[EM] Electronic Voting Bill of Rights?

[Ken Johnson]

This is a follow-up to EM Vol 1, #355, Message 1, Re: touch screen 
voting machines

Dave Ketchum wrote:

> ... 
> I think of a voting machine as a unit that supports a single voter at 
> a time, doing NO communication outside the room that contains it. 
> After polls close and it completes recording the day's activity on its 
> CD, it reports totals for publication and for summing for larger 
> districts.
> ...
> As to voter secrecy, it has been mentioned that there is little when 
> there are only a few voters.  In fact it disappears when there is a 
> single voter in a count.  We only demand that administration not 
> aggravate this problem. 

The summing and publication of vote subtotals for specific geographic 
regions (e.g. precincts or districts) is, in my view, a violation of 
voter secrecy.  For example, someone might say "Oh - you live in that 
district that voted 80% Nazi, so you're most probably a Nazi." What's 
worse - having someone see my ballot, showing that I voted "Peace and 
Freedom", or having someone conclude that I voted Nazi and my not having 
any way to prove otherwise? Or maybe an elected governor might think 
"that's the district that always votes overwhelmingly against my party, 
so I'm not going to fund their much-needed road improvement project - 
why bother?" In a sense, reporting district-level election tallies might 
be considered a greater violation of privacy than revealing my 
individual vote, because no one's going to care much how a particular 
individual voted, whereas knowledge of district-level results might 
significantly influence governmental decisions. (Granted, such 
information can be obtained from independent polls, but polling 
information is obtained voluntarily, and there's nothing to prevent me 
from lying to pollsters.) Nobody keeps track of my religion, race, 
gender, etc. as part of the vote tallying process, and in my view they 
shouldn't track my voting locale either.

I would propose the following refinement of the Voter Secrecy provision 
of the "Electronic Voting Bill of Rights":

SECRECY:
(1) INDIVIDUAL BALLOTS SHOULD NOT BE TRACEABLE TO SPECIFIC VOTERS.
(2) ELECTION RESULT SUBTOTALS SHOULD NOT BE PUBLISHED OR GENERATED FOR 
SPECIFIC KNOWN GROUPS OF VOTERS (SUCH AS GEOGRAPHIC OR SOCIO-ECONOMIC 
CLASSES).

To ensure #2 I think it would make sense to send a record of every 
ballot (perhaps encrypted) to a central computer, which combines ALL the 
ballot records into a SINGLE randomly-indexed database before any vote 
tallying is done. If the counting is done manually, or if a manual 
recount is required, the process should ensure that the counters do not 
know where the votes they are counting come from and that the 
intermediate subtotals are not associated with identifiable voter 
subgroups. It may be necessary to store original (paper or possibly 
CD-recorded) ballots separately for each precinct so that any 
discrepancy between the number of voters and the total ballot count can 
be traced to the precinct level. However, the original ballots, which 
constitute the official, legal record of the vote, could not be viewed 
except by appointed election officials or judges under specific 
conditions: (1) To corroborate the number of voters to the number of 
ballots for a particular precinct, the ballots would be taken out of 
storage and counted face down (so that no information about the 
precinct's voting preference is viewable). (2) To correlate the official 
ballots to the ballot database, or to perform a manual recount, some or 
all of the ballots may be viewed by a process in which the people 
viewing the ballots do not know where the ballots come from.

In a well-designed process it should rarely, if ever, be necessary to 
inspect more than a small statistical sampling of the official ballots 
to validate an election result. Regarding Validation, I would also 
propose the following Voting Rights provision:

VALIDATION:
(1) IT SHOULD BE POSSIBLE TO PERFORM A FULL RECOUNT BASED ON THE 
OFFICIAL BALLOTS, IF NECESSARY.
(2) IT SHOULD BE POSSIBLE TO ROUTINELY AND INDEPENDENTLY VALIDADATE THE 
ELECTION (AT LEAST WITHIN SOME REASONABLE STATISTICAL UNCERTAINTY LEVEL) 
WITHOUT DOING A FULL RECOUNT.

The validation process #2 should be simple, transparent, and preferably 
not require a great deal of technical expertise (e.g. in computers or 
statistics) to understand or implement, and the validation should be 
applied  routinely as part of election certification. Furthermore, 
ANYONE should have the right to challenge the election and apply the 
validation test independently.  As a practical matter, the challenging 
party may need to pay a nominal fee to cover inspection-related 
expenses, and if multiple validation requests are made then election 
officials would have the option of combining them into a single 
inspection. Provided that the size of the statistical sampling required 
to validate the election is quite small, the validation process would be 
fairly simple and inexpensive.

Ken Johnson