[EM] Re: touch screen voting machines - summary

[Dave Ketchum]

On Tue, 11 Nov 2003 22:26:38 -0500 Eron Lloyd wrote:

There were a zillion posts yesterday on this thread - and I offer ONE 
response to all - the above is simply the newest I read.

I also reviewed:  Re: [EM] Securing electronic elections

VALIDATING DRE VOTING MACHINES (MY thoughts and proposal):

A CD (or DVD) will be used for this - one that can record everything of 
interest that occurs for this machine for this election, but does not 
allow for rewriting to change what has been written.  All references to 
"CD" below are to this single disc.  Seems there are different techniques 
for making CDs:
      Manufacture them with fixed, unchangeable, content.
      Permit erasing and rewriting.
      Permit writing ONE time, with no provision in the CD or the "burner" 
that does the writing to change content once written - what I WANT.

Program written on CD - likely by vendor, for this is identical for all in 
state, or even nation.  Program compiled from open source such as Linux, 
such that anyone interested and capable can have done validation.  Here we 
are talking of COMPLETE program, including whatever may be labeled 
"operating system", etc.

Ballot definitions written on CD.  Likely in multiple records such as 
state info and county info.

CD mounted in DRE.  BTW - computer in DRE must be standard, for  closed 
design computer can include gimmicks we are trying to avoid.  At one time 
Sequoia was using Z80s - zillions of those have been made so buying them 
off the shelf should avoid any funny stuff.

Program and ballot definitions loaded from CD.

Test voting permitted at this point?  Anyway nothing recorded.  Also, test 
voting could be done with this CD on any DRE at this point to verify 
whether ballot is correct, as well as on precinct DRE before polls open.

DRE locked to prevent modifications during voting.

DRE adds anything of interest to memory.

Inspectors provide unique identification as part of above.

DRE SHALL NOT be connected or connectable to the internet, for connecting 
makes the internet part of the DRE and there is no way to validate that.

Record complete memory content on CD.  This record can only be produced at 
this time - includes inspector identification and vote totals (which 
better be all zeroes).

Polls open and voting proceeds.

Polls close and vote counts and ballots recorded on CD (permissible to 
record ballots on CD while polls open, but NO record of ballots containing 
less than 100? ballots unless record is ALL votes cast on this DRE - 
purpose of minimum size records is maintaining voter secrecy).

Machine unlocked and CD filed as record.  Content can be validated against 
a master compiled from the official source with this DRE's ballot 
definitions included.

BTW - with the open source validated and actual DRE content recorded, 
there will be little need to actually do the final validation mentioned 
above - few will want to get caught having done something illegal.

BTW - also little need for recounts, but they are doable from the ballots 
recorded on the CD.

VALIDATION RECORD

MUCH LESS need for this than with closed and secret program source.

If it is done, it BETTER maintain voter secrecy:  These printed ballot 
copies may be LOOKED at, but NOT TOUCHED by voter - they go in s ballot 
box and inspectors are directed to shuffle them when polls close (so that 
it is not possible to look at top ballot in box and know this was voted by 
the last voter).

VOTING DETAILS:

Whether the person claiming to be a proper voter, voting the permitted 
once, is valid - is of interest but I see no need for my getting involved 
in this post.

DRE should be prepared to offer help in whatever languages are used 
significantly in the precinct.  Major uses are to describe voting methods 
when you get past Plurality; also to present referenda and other topics 
readably.  To clarify - a welcome page can say "welcome" in every language 
supported, and the DRE can then use whichever the voter chooses.

Also, DRE should be helping verify that voter intent is recorded, 
including that ballot is valid and complete (but I would permit 
incompleteness when that is clearly voter intent).

BTW - DREs BETTER provide better description of referenda (ballot 
questions) than what I just saw on New York ballots this month - they 
abbreviate to what will fit in allotted space on the ballot - sometimes 
shrinking the understandability out.

New York demands a full face ballot - not acceptable, for the full face 
gets cramped when there are many candidates.

One problem Florida got into in 2000 was bad choice as to arrangement when 
number of candidates made a ballot too crowded.  That was paper, but the 
same thing could happen with full face DREs.

Perhaps should demand that voter look at each face at least once.

If there are validation records, they need printing AFTER voter has 
completed selection - voter is looking at them only to verify between:
      They look right, as expected.
      The DRE has failed, for they do not match the voters selections.

Another post wants these validation records to be the actual ballots to be 
counted, rather than the machine being a complete DRE.  I would still want 
the machine to obey everything else I state, for too many voters are NOT 
going to inspect these records carefully.  Another thought would be for 
DRE to be complete but these validation records be the official count.

I have the ballots being recorded in memory and copied to the CD for 
recount purposes.  Even the recording in memory step requires random 
ordering to preserve secrecy.

DREs must permit write-ins.

While voters should have less need for assistance with DREs, voter should 
control who does any needed helping (except if election personnel get 
involved, it should be personnel from more than one party - NEEDED, for a 
single person can be corruptly partisan even if an election worker).

BTW - many with disabilities HATE to have to ask for assistance - it is 
REASONABLE for DRE construction and ballot design and content to let as 
many of these as practical vote without assistance.

A post mentioned voters being afraid to use a DRE.  In New York we permit 
what we call an affidavit ballot - a paper ballot for someone who CLAIMS 
to be a proper voter but for whom there is no record.  We let them vote 
with paper ballots and validate these for proper voter identity afterwards 
(these paper ballots go in envelopes like absentee ballots to preserve 
secrecy).  Someone afraid to use the DRE could be allowed to use this form 
of paper ballot, marked to be counted without requiring later voter 
validation.




> On Tuesday 11 November 2003 8:00 pm, David GLAUDE wrote:
> 
>>This list is about "advance voting technique"...
>>
>>My question to this list is wich of those technique can be used in large
>>scale election using only manual counting and computing of the result.
>>
> 
> A very good question. For the most part any advanced voting method can be 
> captured on paper, but how it *scales* is indeed something to look into.
> 

EM is into BOTH methods that could be implemented with manual counting, 
and methods worth discussing for theory, but very unlikely to suit Glaube 
or myself for public elections.

Plurality is countable manually, but has problems we should DEMAND escape 
from.

Condorcet, which is the method of counting ranked choice ballots that 
I see as better than IRV, is a bit more complex for manual counting, yet 
is simple enough that people should have little trouble understanding it.

> 
>>I see too many peaple that push e-voting in order to introduce "complex"
>>counting system. Where I think for election complexity is the opponent
>>of transparency, security and clear understanding on the effect of my
>>vote on the potential result.

>>
Eron Lloyd complained that, while he could express unhappiness by marking 

up a paper ballot, e-voting would not tolerate anything similar.


He could vote blanc (blank), but is not satisfied by that.

Paper or e-vote CAN permit none-of-the-above (NOTA).  This is a COUNTABLE 
expression of unhappiness with choices offered:
      Can simply embarrass the candidates if they are disliked enough.
      Or, NOTA can get elected if there is enough unhappiness (unable to 
serve, but that doe not require special substitution provisions in law, 
for it can happen to live candidates).


Of course, if he is required to vote (as Belgium seems to demand) and 
objects to e-voting, the most I would agree to is whatever could easily be 
provided for (to just not vote for any candidate is not enough, for voters 
can do that in error and the DRE should warn that it is a possible error).

BTW - on 11/10 I mentioned to EM about DRE: having source for a DRE voting 
system, on MY disk, in Linux and in use in Canberra (Australian Capital 
Territory),
-- 
  davek at clarityconnect.com    people.clarityconnect.com/webpages3/davek
  Dave Ketchum   108 Halstead Ave, Owego, NY  13827-1708   607-687-5026
            Do to no one what you would not want done to you.
                  If you want peace, work for justice.