Two weeks after the 2000 general elections in the United States, I participated in a discussion of the elections with a group of visiting Italian politicians and businessmen. The discussion put me in an awkward position as an American political scientist. The standard forecasting models, which had predicted a substantial Gore victory, had missed this election by a mile. To make matters worse, the election was still unresolved. Events in Florida had drifted into the uncharted waters of a ballot recount in a presidential election. The Italian visitors had lots of questions: What exactly went wrong in Florida? How would this be resolved? Would the United States face a constitutional crisis? Are contested elections a common problem in America? Why do we have so many election lawyers?

I had no idea how to answer their questions, which mixed constitutional law and technological minutiae. Dimpled chads and butterfly ballots are practical questions of ballot design, issues that election administrators deal with every year in the United States—hardly standard topics for a political scientist.

But the 2000 election—and the Supreme Court's Bush v. Gore decision—made it clear that these "technical matters" are fundamental to the health of democratic institutions. In November 2000, David Baltimore, President of Caltech, and Charles Vest, President of MIT, met to discuss what they saw as the stunning failure of technology in the Florida election. To respond to this failure, they created the Voting Technology Project, a team of computer scientists, mechanical engineers, and social scientists working to assess the troubles with voting systems in the United States and to develop new technology. As co-director of this project, I have had occasion to study the technological, legal, and administrative infrastructure that defines contemporary American elections, and to evaluate its efficiency and democratic value. I am now convinced that America's voting technologies are indeed gravely inefficient and unreliable, but also that solving these problems may be considerably less complicated and less expensive than many politicians and industry leaders have indicated.

Here are some conclusions that the Voting Technology Project team has reached about the current technologies:

• In the 2000 election, the United States lost 1.5 million presidential votes because of the equipment used to cast and count votes. Over the last election cycle, we lost approximately 3.5 million votes for senator and governor because of voting equipment.

• Voting technology in the United States is highly variable: counties use at least five different types of voting technology.

• Paper ballots—either hand-counted or optically-scanned—could cut the incidence of lost votes due to voting equipment in half. In short, of the available technologies, paper ballots remain the best.

Our support for both hand-counted and optically-scanned paper ballots stands in contrast to current proposals for an aggressive, wholesale "modernization" of voting technologies. The voting equipment industry for instance (the firms that build voting machines and the election officials that purchase them) is pushing strongly for electronic and/or Internet voting, using touchscreen computers, that resemble ATMs. Most touchscreen voting equipment is nothing more than an off-the-shelf Windows-based computer with a touchscreen instead of a conventional screen. Existing machines then upload ballots via a modem or the Internet. Arizona has already experimented with Internet voting in the Democratic primary, and the Defense Department has tested an Internet voting pilot program for overseas personnel.

Internet voting is not inherently flawed, though it does raise trickier security issues than other technologies. Rather, the primary technological challenge is to not repeat the mistakes we have made in devising lever machines and punch card ballots. We need a far more deliberate and sensible development of voting technology, and must recognize that new technology may not surpass the virtues of old-fashioned paper ballots.

To see what the sensible development of new technology might look like, we need to begin by articulating some primary principles about voting in a democracy.

Voting and Democracy

Voting is essential to a democracy. For democracy to work, we must be able to count heads—to identify the people's chosen representatives and to tally their expressed preferences. Poor administration of elections prevents democracy from delivering its egalitarian promise: it invites fraud, and weakens popular control and government accountability. The public must also have faith that the voting system works. If citizens are to abide by election outcomes and the laws created by an elected government, they must believe that the voting system reflects their preferences. When the system is tested, as it was in Florida, it must be found to work.

A reliable voting technology for American elections needs to satisfy three main conditions: voter autonomy, equality, and decentralization. The first two—which require that votes reflect voters' independent, uncoerced judgments, and that all votes are weighted equally—are arguably essential to democracy. The norm of decentralization has its roots in American federalism and the particular ways that citizens exercise electoral control over officials here.

Autonomy

In the nineteenth century, political campaigns often recruited roving voters who would go from polling place to polling place, voting many times and collecting proof that they had voted in the right way. Rovers were paid in cash, food, or alcohol. One (probably apocryphal) story holds that Edgar Allen Poe died of complications from alcohol poisoning after a day of heavy voting.

The secret ballot was introduced to the United States late in the nineteenth century to combat such organized vote buying. While voting may strike some people as an essentially public act, secrecy is essential to ensure voter autonomy: when the ballot is secret, you cannot prove whom you voted for; and in the absence of proof, it is less likely that parties or candidates will try inappropriately to influence your judgment or offer to purchase your vote. But secrecy also complicates voting technology, because it necessitates that any such technology must be receipt-free. If technology provides voters with receipts, then those receipts can become tender. Without a receipt, however, voters have no formal proof that their votes were properly recorded—that they left no hanging chads. When we conduct other transactions, such as banking at an ATM, we receive feedback about that transaction: an immediate receipt and, later, a bank balance. With secret voting, such feedback is a more complicated matter.

Equality

The demand for equality lies behind many of the reforms in voting, including registration reform. Every vote should count the same. To be sure, the idea of "counting the same" is vague and contested (think of all the conflicts over gerrymandering), but whatever it means, it requires that all legitimate votes be counted, and that they not be diluted by fraudulent ballots cast by others. While electoral systems and their technologies must equally protect the rights of all voters, such protection does not require a uniform system, imposed by the federal government. But the equal protection principle articulated in Bush v. Gore threatens to push us in that direction.¹ Depending on how subsequent cases play out, Bush v. Gore may ultimately compel the adoption of uniform voting technology in federal elections—a result that would directly conflict with the decentralization standard. The first test of equal protection under Bush v. Gore is a suit in California (Common Cause v. Jones) to ban punch cards, as an inferior technology.

This idea of electoral equal protection presents a dilemma for the development of future voting technology. Voting machine developers and local administrators now learn what works best through the decentralized system of election administration. Subsequent designs adjust to past problems. Optically-scanned ballots were designed to fix problems with unreliable recordings on punch cards and slow counts on hand-counted paper. That innovation is clearly a success. If the concern for equality leads to uniform equipment, then we lose avenues for innovation—which may be needed to achieve equal protection down the road. We could all end up using inferior technology.

Decentralization

Article II of the Constitution leaves the administration of elections to the states. Most states have further devolved this responsibility to counties and municipalities, which typically register voters, conduct polling place operations, design ballots, select voting equipment, and conduct recounts. As a result of this decentralization, we see enormous variation in the means of voting—including voting equipment—even within individual states.

Though the state and federal governments could exercise greater control over elections without violating Article II, decentralization persists for a practical reason. America has more elected officeholders than any other country, and we tie our elections to geography: the typical ballot includes county commissioners and school board members, as well as senators and representatives. Of course, we could have local, state, and federal elections on different days, as some countries do. But the result would almost certainly be very low turnouts for the non-federal elections. Instead we keep most elections on a single day, which allows us to expand electoral control on both the local and national level, while preventing turnouts from falling through the floor. In some locales, voters may choose as many as twenty offices and vote on large numbers of ballot questions. And what's on the ballot varies within locales, depending on boundaries of political districts.

Decentralization has also served as a way to test innovations in voting technology. We use a wide range of technologies in the United States in part because decentralization provides opportunities to experiment and to learn from past experience.

For better and for worse, decentralization also places financial constraints on our electoral system, because the costs of elections are paid by counties and municipalities with limited resources. Counties spent approximately $1 billion on federal, state, and local elections in 2000—roughly $10 per voter and less than one-fifteenth of one percent of the 2001 federal budget. These limited resources have also produced some remarkably efficient community-based elections operations, which often rely on large networks of dedicated volunteers. Roughly one-third of county elections funds goes to voter registration, one-third supports election day operations, and another third pays for election administration and overhead. Unfortunately, the local funding of elections leaves little money to purchase state-of-the-art voting technology. The cost of a complete upgrade to new technology is in the range of $700 million (for scanners) to $1.8 billion for electronic voting.

The small budget of election administrators also limits the capacity of the industry to develop new equipment or to take the care with design that large software manufacturers do. In a good year, the voting equipment industry has $150 million in revenue, which makes it a small industry. Large firms, such as IBM and Unisys, have made forays into the voting machine business and produced innovations (punch cards and scanners), but they quickly left. In the absence of sustained private or federal investment, it is thus essential that new voting technology be compatible with the small-scale, low-budget requirements of our decentralized system.

Suppose, then, that we want to ensure autonomy by requiring secrecy, prevent vote dilution to ensure equal treatment, and achieve broad electoral control and technological innovation by maintaining decentralization. How can we best achieve all these aims? Can improved technology help?

How We Vote

Americans currently vote with five different types of technologies: hand-counted paper ballots, mechanical lever machines, punch card ballots, optically-scanned paper ballots, and electronic voting machines (called direct recording electronic devices, or DREs).

Available Technologies

The oldest technology is the hand-counted paper ballot. To cast a vote, a person makes a mark next to the name of the preferred candidates or referendum options and puts the marked ballot in a box. The ballots are counted manually. Hand-counted paper ballots enjoyed nearly universal application in the United States in the nineteenth century. They are still widely used in rural areas, and also in national elections in other democracies, including Canada and France.

At the end of the nineteenth century, New York State introduced mechanical lever machines, and by 1930 almost all major metropolitan areas had adopted lever machinery. Here the voter steps into a steel booth, and views a series of candidate, party, and referenda options, each of which corresponds to a mechanical switch. The voter flips the switches that indicate his or her preferences for each office or referendum. When the voter wishes to make no further changes, he or she pulls a large lever, which registers the votes on a counter located at the back of the machine. When the polls close, the election precinct workers record the tallies from each of the machines.

Punch card machines automated the counting process for paper ballots using 1960s computer technology. Upon entering the polling place, the voter is given a ballot in the form of a long piece of heavy stock paper. The paper has columns of small, perforated rectangles (or chads). Punch cards come in two varieties: the DataVote lists the names of the candidates on the card; the VotoMatic does not. The VotoMatic is by far the more common. In the VotoMatic booth, the voter inserts the card into a slot and opens a booklet that lists the candidates for a given office. The voter uses a metal stylus to punch out the rectangle beside the candidate of choice. The voter then turns the page, which lists the options for the next office and shifts the card to the next column of rectangles. When finished, the voter removes the card and puts it in the ballot box. At the end of the day, the election workers put the cards into a sorter that counts the number of perforations for each candidate.

Optically-scanned ballots, also known as "marksense" ballots, offer another method for automating the counting of paper ballots. The format of the optically-scanned ballot is familiar to anyone who has taken a standardized test. The voter is given a paper ballot that lists the names of the candidates and the options for referenda, and next to each choice is a bubble or an arrow with a gap between the fletching and the point. The voter shades in the bubble next to the preferred option for each office or referendum, or draws a straight line connecting the two parts of the arrow. The ballot is placed in a box, and, at the end of the day, counted using an optical scanner. Some versions of this technology allow voters to scan their ballots at the polling place to make sure that they have voted as intended. This is called precinct optical scanning. Otherwise the scanning is performed at the election office, and is called central optical scanning.

Direct recording electronic devices (DREs) are electronic versions of lever machines. The first widely used DRE—the Shouptronic 1242—was modeled on the lever machine and developed by Shoup, one of the main lever machine manufacturers. The distinguishing feature of a DRE is that it records the voter's intentions electronically, rather than on a piece of paper or mechanical device. Older DREs present the voter with a large panel displaying all the choices and push buttons next to each choice. Newer DREs use touchscreen computer technology. Each screen of the computer displays a "page" of options—sometimes one office at a time, sometimes a couple of offices at a time. Voters make selections by touching the screen at the appropriate place and paging through all of the offices. Typically, the voter may review the entire session (or ballot) to check his or her votes. Like lever machines, DREs make it impossible to overvote—that is, to vote twice for the same office. As with the lever machine, each DRE tallies the votes locally and the tallies, usually on a disc, are sent to a central location.

Each type of technology involves many variations based on specifications of manufacturers, ballot formats, and polling place administration. When election administrators set up a local voting operation however, they begin by choosing a type of voting technology, and that is the level of focus here. Those choices are usually made by county election officials. Some counties do not have uniform voting technologies though, and as a result municipalities and sometimes individual precincts will use different methods. These so-called mixed systems are found most often in Massachusetts, Michigan, Maine, New Hampshire, and Vermont, where town governments usually administer elections.

Who Uses What?

The pattern of voting equipment usage across the United States is a demographic crazy quilt. In the most recent election, one in five voters used the "old" technologies of paper and levers—1.3 percent paper and 17.8 percent levers. One in three voters used punch cards—31 percent used the VotoMatic variety and 3.5 percent used the DataVote variety. Over one in four used optically-scanned ballots. One in ten used electronic devices. The remaining 8 percent used a variety of technologies in mixed system districts.

Variation within states is nearly as great as variation between states. In some states, such as Arkansas, Indiana, Michigan, Pennsylvania, and Virginia, at least one county uses each type of technology available. The states with complete or near uniformity are New York and Connecticut with lever machines; Alaska, Hawaii, Rhode Island, and Oklahoma with scanners; Illinois with punch cards; Delaware and Kentucky with electronics.

Changes in technology over time are equally dramatic. Optically-scanned ballots and DREs, once available to only 3.2 percent of the voting-age population are now available to 38.2 percent. Hand-counted paper ballots, which were the only available technology for 9.7 percent of the voting-age population in 1980, served just 1.3 percent in 2000. Lever machines, by far the dominant mode of voting in 1980, then served 43.9 percent of potential voters. Today, only 17.8 percent of potential voters reside in counties using lever machines. There has been little change in the mixed and punch card systems.

Three comments are in order about the change in equipment.

First, the industry is in flux. Between 1988 and 2000, nearly half of all counties adopted new technologies (1476 out of a total 3155), and between 1980 and 2000, three out of five counties did so. But some places have not changed at all; most notably, the state of New York continues to use lever machines.

Second, voting equipment usage has a strongly regional flavor. The Eastern and Southeastern United States rely on lever machines. Midwestern states have a penchant for paper. And the West and Southwest largely depend on punch cards. As counties have adopted newer technologies over the last twenty years, they have followed that same pattern. Counties tend to adopt newer technologies that are analogous to the technology they move away from. Optical scanning has been most readily adopted in areas that previously used paper, especially in the Midwest. Where counties have moved away from lever machines, they have tended to adopt electronic machines—for example, New Jersey, Kentucky, central Indiana and New Mexico.

Third, there is a clear trend toward electronic equipment, primarily scanners but also electronic voting machines. This trend, and the adoption of punch cards in the 1950s and 1960s, reflects the growing automation of vote counting. Punch cards, optical scanners, and DREs use computer technology to produce a speedy and (hopefully) more reliable count.

The trends today, then, are toward two competing technologies: optically-scanned paper and direct recording electronics. These changes are motivated by a strong desire to speed up the count. These trends will continue into the 2002 and 2004 elections, as many states and counties have already adopted or are considering scanners or electronics.

What's The Problem?

After Florida, we all understood the troubles with punch card ballots—ominous possibilities like confusing ballot designs and hanging or dimpled chads. But other technologies have troubles, too, so in evaluating alternatives we need a common standard. The best such standard is the count of residual votes—the combined total of uncounted, unmarked, and spoiled ballots. If voting equipment had no effect on the ability of voters to express their preferences, then the residual vote would be unrelated to machine types. To measure the effects of equipment, we estimate the average residual vote associated with each machine type, and then see whether these averages differ significantly.

Over the last sixteen years, the rate of residual votes in presidential elections was slightly over 2 percent. This means that in a typical presidential election over 2 million voters did not successfully record a vote for president. But remember that the presidential race is the "top of the ticket," and thus generates relatively few residual votes. Other contests further down the ballot produce an even higher rate of residual votes—5 percent for senatorial and gubernatorial elections.

To be sure, the residual vote is not a pure measure of machine error or voter mistakes. A ballot may show no vote because the machine failed to record the voter's selections, because the voter made a mistake or was confused, or because the voter did not wish to vote at all in that contest. Whereas the first two scenarios would produce lost votes, the third would produce an accurate record of the voter's preferences. It is difficult to quantify voter intentions, but exit polls suggest approximately 25 percent of residual votes are intentional. This leaves 1.5 million presidential votes that are actually lost each election, and 3.5 million votes for governor and senator that are lost each cycle.²

Still, the residual vote provides an appropriate yardstick for the comparison of machine types: whatever the cause and however strong voters' intentions, the residual vote rate should not depend on what equipment is used. But it does. Table 1 presents the residual votes in presidential elections and in senate and gubernatorial elections as a percentage of all ballots cast over the last decade.³

Some technologies consistently perform well on average, and some technologies have excessively high rates of residual votes. Optically-scanned paper and hand-counted paper ballots have consistently shown the best average performance. Scanners have the lowest rate of uncounted, unmarked, and spoiled ballots in presidential, senatorial, and gubernatorial races. Counties using optical scanning have averaged a residual vote rate of 1.5 percent in presidential elections and 3.5 percent in elections for senators and governors over the last twelve years. Hand-counted paper has shown similarly low rates of vote loss.

Punch cards, the other paper-based system, loses at least 50 percent more votes than optically-scanned paper ballots. Punch cards have averaged a residual vote rate of 2.5 percent in presidential elections and 4.7 percent down the ballot. Both rates of vote loss are more than 50 percent higher than those of the other two paper systems—hand-counted and scanned. Punch cards had the highest average rate of vote loss of all systems used in presidential elections. Over 30 million voters used punch cards in the 2000 election. Had those voters used optical scanning there would have been 300,000 more votes recorded in the 2000 presidential election nationwide and 360,000 more votes in the senatorial and gubernatorial elections.

Voting with any kind of machine, on the whole, has performed significantly worse. Certainly, lever machines lost relatively few votes over the last four presidential elections, averaging a residual vote rate of 1.5 percent. But electronic machines lost nearly as many votes as punch cards, averaging 2.3 percent over the last four elections. The even more severe problems with these technologies appear down the ballot, and here we find reason for serious concern about the continued use of lever machines. In recent senatorial and gubernatorial elections, 7.6 percent of all ballots cast recorded no vote in counties using lever machines—the highest vote loss of all systems. In counties using electronic machines, the residual vote in senatorial and gubernatorial elections equaled 5.9 percent of all ballots cast. Optically-scanned ballots average substantially lower rates of lost votes than the machine voting technologies. Had the counties using lever machines used optical scanning, we estimate that there would have been little difference in the presidential vote, but 830,000 more votes recorded in the elections for senators and governors.

These figures imply that the United States can immediately lower the rate of lost votes, just by using existing technologies: we need to replace punch cards and lever machines with optical scanning. Based on its track record, optical scanning would cut the rate of lost votes in half in the counties currently using levers and punch cards.

Optical scanning itself has plenty of problems. Many of the current systems do not allow voters to check whether their ballot is valid, though in-precinct scanning can. Election officials complain of paper jams, maintenance problems at the polling places, and high costs of printing and ballot management. In the end, this system also loses significant numbers of votes. It is imperfect, but it is the best of the available technologies.

One interesting question is why lever machines perform well at the top of the ballot but badly down the ballot. The answer has to do with both the tabulation process and the user interface. The tabulation process involves transcribing the tallies at the back of the lever machine onto a paper record of the total votes for each candidate and referendum. There is little information on the back of the lever machine to distinguish where the tallies for each item begin and end. It is easy to record the wrong numbers (including 0) as the total votes for a particular item. For example, in the 2000 election, the count for one ballot question in Boston missed 30,000 out of 100,000 votes.

Moreover, the user interface with lever machines presents similar problems for the voters. The printing on the front of the machines does not distinguish offices clearly. Voters can easily find the choices for president, but moving down the ballot, it becomes harder to distinguish which choices correspond to which offices and easier to miss an office or ballot question entirely.

Perhaps the most surprising result is the poor performance of electronic voting machines. It should be stressed that the most widely-used DREs feature old push-button technologies, such as the "Shouptronic." These machines share many of the same interface design problems as lever machines.

Newer touchscreen machines have not been extensively used. Some counties have had excellent experiences, such as Riverside County, California, with a residual vote rate of less than one percent. But other counties have had unhappy experiences with such technology, such as Beaver County, Pennsylvania, with a residual vote rate over 6 percent.

Even the newer equipment presents difficult problems of ballot design. Ted Selker of the MIT Media Lab has evaluated the designs of all of the major DRE models on the market. He has found that user interfaces are typically not designed to ensure ease-of-use and familiarity for the voter. And there are strong incentives not to fix these problems, even when they are conspicuous. Once a machine is on the market, it is difficult to change the user interface: the machine will most likely have to go through the existing certification process for computer code, which can take up to a year.

The Future of Voting Technology

The lesson of the last two decades is that the small, static market for voting technology will not necessarily produce easy-to-use and secure systems for American elections. Despite a century of innovation, many voters today are using equipment which does not easily and reliably record their political preferences. Moreover, the future will introduce even greater variety in voting technologies.

The United States is in the midst of an ongoing technological revolution in computing and communication and that will soon change the way we vote. The technologies competing today—optical scanners and DREs—are some of the earliest products to come out of that revolution. Internet voting is the next step. The question remains however, will we be able to capitalize on this revolution and develop a truly reliable and effective voting system?

The United States has no shortage of people and firms interested in electronic and Internet voting. According to the Federal Election Commission, over half of the twenty-five companies that sell voting equipment in the United States today offer electronics. A few are devoted exclusively to Internet voting. But electronic—and in particular Internet—voting presents three substantial challenges.

First, the voting industry will have to change the way it does business. The current voting machine industry sells boxes —lever machines, scanner devices, punch-card booths and readers, full-faced DREs. But such highly specific, dedicated voting machines are unnecessary and impracticable for the future of electronic voting. Most of the new touchscreen DREs are standard computers, running Windows. Internet voting could use any computer. In the future, the primary technology for electronic voting will thus be software for recording, validating, and counting votes. Secure, reliable voting technology will increasingly depend on secure, reliable software development. This will push the industry away from selling boxes and toward selling software and services.

Second, monolithic electronic platforms such as the Internet are inherently more vulnerable to fraud and disruption on a statewide or even national scale. To make the voting system accurate and reliable, we must minimize lost votes and fraud. With regard to lost votes, the aim is to make equipment as dependable and easy-to-use as possible, so as to minimize the observed "failure rate." Fraud is a different beast. Fraud involves malicious attack on the voting system. There are strong incentives to defraud or disrupt elections. American history is littered with incidents of stolen ballots, stuffed ballot boxes, and rigged machines.

Security is thus a continual challenge. Fortunately, most traditional voting technologies have offered two important checks on fraud: the scale of the election and the observability of the process. Large-scale fraud is, obviously, of greater concern than small-scale fraud. With many separate voting machines and polling places it is difficult to conduct large-scale fraud, because a very large number of people must be involved to carry it out. Also, with paper ballots and lever machines the counting process is open—there are many eyes on the process. But Internet voting lacks both properties. With any monolithic voting system on a common platform it is possible for one person to disrupt or defraud an entire election. Because software in the voting industry is proprietary and because procedures and counts are often only accessible to a few experts, it is difficult for the public to adequately monitor electronic voting systems.

Third, electronic voting and Internet voting rely on technologies that are unfamiliar to large segments of the population. Somewhere around 70 percent of Americans have used computer equipment at work or home. For the other 30 percent, computers are foreign and may be intimidating. This is especially true of older Americans and those with fewer years of formal education. Over time the "digital divide" will vanish as Americans come to use computers in banking, shopping, and other daily activities. In the near-term, however, electronic voting may become a barrier to voting for people unfamiliar with computers. Nonetheless, electronic voting holds considerable promise: the potential for full accessibility, greater convenience, and no paper to manage.

A Role for the Federal Government

Voting involves a simple act. Yet, with our small-scale, low-budget system, it has proved very hard to find the right instrument—to develop a technology that sustains voter autonomy, equality, and decentralization.

Sensible and secure electronic and Internet voting may be within our grasp, but we must recognize that electronic voting demands higher standards of security and usability, and that the decentralized American system lacks any legal mechanism to guarantee that voting systems are easy-to-use and tamper-proof before they are deployed. Counties make decisions, usually with little more information than what voting technology vendors have provided. There is also an incentive problem in the private market for voting machines. Election administrators are the consumers, not the voters. As a result, ease-of-use receives less emphasis in purchasing decisions than it should.

Many election administrators appreciate these problems. Working through the Federal Election Commission and the National Institute of Standards and Technology, state elections directors helped develop voluntary voting system standards, introduced in 1990. The standards establish minimum criteria for equipment durability. In addition, tabulators must reach a high level of accuracy using machine-generated sample ballots. Software is also now tested for a minimum level of integrity.

This is a beginning. It reflects a resolve to improve voting systems, but existing standards still embody two key weaknesses.

First, the standards do not cover the technology as it is used by people. The tabulator tests are run on mechanically-generated ballots, not ballots generated by actual voters. Machines do not create improper marks or hanging chads, or incorrectly use a touchscreen. There are also no guidelines for ballot design, which could have prevented the introduction of the butterfly ballot in Florida. The absence of human testing is especially perplexing when it comes to questions of security. The way to expose security failures is to attempt to hack the system. No such process of deliberate and controlled testing is currently in place.

Second, the process is static. Once a machine is certified it is "fixed": any changes in the machine require additional certification, which can take up to a year. As a result, vendors are reluctant to make changes, even in the face of chronic malfunctions.

Brazil offers a provocative contrast with the United States in the development of national standards for voting technology. Election administration in Brazil was notoriously flawed for decades. Fraud was rampant, and counts were highly unreliable. The country also has a large illiterate population that effectively cannot vote using many of the available technologies. In the 1980s, the Brazilian government established a consortium of engineering labs to develop new voting equipment that would be inexpensive and accessible to all people (regardless of literacy), and that could provide a quick, reliable count. They set up a separate agency to evaluate equipment in laboratory tests and to select a uniform system for each election. Though not without flaws, this process has produced an enormous improvement in the reliability of voting in Brazil and in public confidence in its elections.

New Standards

The United States must create a similar system of research and evaluation to guarantee development of secure and reliable voting technologies. Those evaluating new equipment must try to attack it to find weaknesses in security and assess its ease-of-use for a range of real voters. Information from tests must be relayed back to industry so that firms can correct problems before equipment is adopted.

This effort is most appropriately funded and overseen by the federal government, but it need not (and cannot constitutionally) impose such a system on local elections officials. To entice counties and states into participating in such a program, the federal government should offer to share the costs of election administration for any county or state willing to adopt equipment developed and evaluated through the program. Within this process we must require more than minimum durability and software integrity standards. What are the specifications that the industry must build to?

First, all equipment must be fully auditable. A separate physical record of each vote should be stored in the event of a challenged election and recount. Setting such a standard will allow for more accurate and objective counts and recounts.

Second, votes must be verifiable. Voters should be able to check that their ballots are properly marked and will be counted as they intend—though they cannot be given voting receipts.

Third, equipment for casting and counting votes must reach a very high level of accuracy when tested using votes cast by a broad spectrum of actual voters. We recommend error rates of no more than one-quarter of one percent.

Fourth, equipment generating votes and ballot designs should be evaluated for ease-of-use. Straightforward, accessible voting technology must be designed to permit voting by people with handicaps and low literacy levels. Voting should not be a test.

Fifth, equipment for casting and counting votes must be highly secure. Large-scale fraud or attack must be exceedingly difficult.

Certifying a single machine that fits all of these standards might prove exceptionally difficult. There must also be some way of streamlining the certification process. The solution is to break the equipment into modules, a move consistent with current technological trends. There should be separate certification for the equipment that generates votes, emphasizing usability, and for the equipment that captures and counts votes, emphasizing security.

A New System?

The Voting Technology Project has developed a modular architecture that could serve as a suitable framework for meeting these standards in many different ways. The architecture was developed independently by Ron Rivest and David Jefferson, and by Shuki Bruck.

The architecture divides the voting process into four discrete stages. The voter first obtains a valid "vehicle" for his or her vote. The vehicle can be many things including a piece of paper or an electronic memory card. This vehicle is not a ballot, as it contains other information, such as the precinct number and the administrator's name. Next, the voter records his or her votes on the vehicle. The voter then inserts the vehicle into a standard input device and verifies that the choices recorded on the vehicle are those intended. If the votes are not what the voter intended, then the voter can go back to the second stage and make changes. And finally, the voter submits his or her votes. The votes are sent to the tabulator (electronically). At this point the votes recorded on the vehicle are "locked" in place. The locked vehicle is put in a box and kept as an audit trail.

The central insight behind this architecture is to separate the second stage from the third and fourth, which divides user interface from actual vote casting. The standard input device that records the vote should be a highly secure device built to specified standards. The user interface can be developed, refined, and certified separately. This would likely lead to improved user interface and ballot designs. With a standard input device ("vote reader"), the industry would be free to focus on the "front end." These devices could even be developed and sold by separate companies.

A further strength of this architecture is that it belies the myth that only paper systems can have separate, physical audit trails that are created by the voter—since the "vehicle" could be an electronic memory card or some other device.

Finally, this is an ideal architecture for precinct-based or kiosk electronic voting, either for absentee or election day voting. Voters could prepare a paper ballot at home on their own computers and bring that to a kiosk or precinct. They could then insert that ballot in a standard input device to verify and submit their votes. Kiosks, of course, could be equipped to generate valid ballots as well.

Importantly, the process proposed by the Voting Technology Project respects decentralization and diversity, while promoting equality and ensuring secrecy; it would not lead to uniform voting technology. Within a common architecture, many different kinds of machines can offer highly secure and reliable means of expressing preferences and capturing and tallying votes. The process of continual innovation around a shared framework is also designed to minimize the sorts of problems that produce lost and fraudulent votes. If all equipment reaches a high level of usability and security, we can then tolerate technological diversity and innovation among and within counties and states.

Technology cannot save our democracy from all its ills. But wise investment in more sensible equipment can help forestall disasters that undermine the confidence of citizens in their institutions.

Stephen Ansolabehere is co-director of the Caltech/MIT Voting Technology Project, and professor of political science at MIT.

Return to the forum on machine politics, with Stephen Ansolabehere and respondents.