Two weeks after the 2000 general elections in the United States, I
participated in a discussion of the elections with a group of visiting
Italian politicians and businessmen. The discussion put me in an awkward
position as an American political scientist. The standard forecasting
models, which had predicted a substantial Gore victory, had missed this
election by a mile. To make matters worse, the election was still unresolved.
Events in Florida had drifted into the uncharted waters of a ballot
recount in a presidential election. The Italian visitors had lots of
questions: What exactly went wrong in Florida? How would this be resolved?
Would the United States face a constitutional crisis? Are contested
elections a common problem in America? Why do we have so many election
I had no idea how to answer their questions, which mixed constitutional
law and technological minutiae. Dimpled chads and butterfly ballots
are practical questions of ballot design, issues that election administrators
deal with every year in the United States—hardly standard topics
for a political scientist.
But the 2000 election—and the Supreme Court's Bush v. Gore
decision—made it clear that these "technical matters" are fundamental
to the health of democratic institutions. In November 2000, David Baltimore,
President of Caltech, and Charles Vest, President of MIT, met to discuss
what they saw as the stunning failure of technology in the Florida election.
To respond to this failure, they created the Voting Technology Project,
a team of computer scientists, mechanical engineers, and social scientists
working to assess the troubles with voting systems in the United States
and to develop new technology. As co-director of this project, I have
had occasion to study the technological, legal, and administrative infrastructure
that defines contemporary American elections, and to evaluate its efficiency
and democratic value. I am now convinced that America's voting technologies
are indeed gravely inefficient and unreliable, but also that solving
these problems may be considerably less complicated and less expensive
than many politicians and industry leaders have indicated.
Here are some conclusions that the Voting Technology Project team has
reached about the current technologies:
• In the 2000 election, the United States lost 1.5 million presidential
votes because of the equipment used to cast and count votes. Over the
last election cycle, we lost approximately 3.5 million votes for senator
and governor because of voting equipment.
• Voting technology in the United States is highly variable:
counties use at least five different types of voting technology.
• Paper ballots—either hand-counted or optically-scanned—could
cut the incidence of lost votes due to voting equipment in half. In
short, of the available technologies, paper ballots remain the best.
Our support for both hand-counted and optically-scanned paper ballots
stands in contrast to current proposals for an aggressive, wholesale
"modernization" of voting technologies. The voting equipment industry
for instance (the firms that build voting machines and the election
officials that purchase them) is pushing strongly for electronic and/or
Internet voting, using touchscreen computers, that resemble ATMs. Most
touchscreen voting equipment is nothing more than an off-the-shelf Windows-based
computer with a touchscreen instead of a conventional screen. Existing
machines then upload ballots via a modem or the Internet. Arizona has
already experimented with Internet voting in the Democratic primary,
and the Defense Department has tested an Internet voting pilot program
for overseas personnel.
Internet voting is not inherently flawed, though it does raise trickier
security issues than other technologies. Rather, the primary technological
challenge is to not repeat the mistakes we have made in devising lever
machines and punch card ballots. We need a far more deliberate and sensible
development of voting technology, and must recognize that new technology
may not surpass the virtues of old-fashioned paper ballots.
To see what the sensible development of new technology might look like,
we need to begin by articulating some primary principles about voting
in a democracy.
Voting and Democracy
Voting is essential to a democracy. For democracy to work, we must
be able to count heads—to identify the people's chosen representatives
and to tally their expressed preferences. Poor administration of elections
prevents democracy from delivering its egalitarian promise: it invites
fraud, and weakens popular control and government accountability. The
public must also have faith that the voting system works. If citizens
are to abide by election outcomes and the laws created by an elected
government, they must believe that the voting system reflects their
preferences. When the system is tested, as it was in Florida, it must
be found to work.
A reliable voting technology for American elections needs to satisfy
three main conditions: voter autonomy, equality, and decentralization.
The first two—which require that votes reflect voters' independent,
uncoerced judgments, and that all votes are weighted equally—are
arguably essential to democracy. The norm of decentralization has its
roots in American federalism and the particular ways that citizens exercise
electoral control over officials here.
In the nineteenth century, political campaigns often recruited roving
voters who would go from polling place to polling place, voting many
times and collecting proof that they had voted in the right way. Rovers
were paid in cash, food, or alcohol. One (probably apocryphal) story
holds that Edgar Allen Poe died of complications from alcohol poisoning
after a day of heavy voting.
The secret ballot was introduced to the United States late in the nineteenth
century to combat such organized vote buying. While voting may strike
some people as an essentially public act, secrecy is essential to ensure
voter autonomy: when the ballot is secret, you cannot prove whom you
voted for; and in the absence of proof, it is less likely that parties
or candidates will try inappropriately to influence your judgment or
offer to purchase your vote. But secrecy also complicates voting technology,
because it necessitates that any such technology must be receipt-free.
If technology provides voters with receipts, then those receipts can
become tender. Without a receipt, however, voters have no formal proof
that their votes were properly recorded—that they left no hanging
chads. When we conduct other transactions, such as banking at an ATM,
we receive feedback about that transaction: an immediate receipt and,
later, a bank balance. With secret voting, such feedback is a more complicated
The demand for equality lies behind many of the reforms in voting,
including registration reform. Every vote should count the same. To
be sure, the idea of "counting the same" is vague and contested (think
of all the conflicts over gerrymandering), but whatever it means, it
requires that all legitimate votes be counted, and that they not be
diluted by fraudulent ballots cast by others. While electoral systems
and their technologies must equally protect the rights of all voters,
such protection does not require a uniform system, imposed by the federal
government. But the equal protection principle articulated in Bush
v. Gore threatens to push us in that direction.1
Depending on how subsequent cases play out, Bush v. Gore may
ultimately compel the adoption of uniform voting technology in federal
elections—a result that would directly conflict with the decentralization
standard. The first test of equal protection under Bush v. Gore
is a suit in California (Common Cause v. Jones) to ban punch
cards, as an inferior technology.
This idea of electoral equal protection presents a dilemma for the
development of future voting technology. Voting machine developers and
local administrators now learn what works best through the decentralized
system of election administration. Subsequent designs adjust to past
problems. Optically-scanned ballots were designed to fix problems with
unreliable recordings on punch cards and slow counts on hand-counted
paper. That innovation is clearly a success. If the concern for equality
leads to uniform equipment, then we lose avenues for innovation—which
may be needed to achieve equal protection down the road. We could all
end up using inferior technology.
Article II of the Constitution leaves the administration of elections
to the states. Most states have further devolved this responsibility
to counties and municipalities, which typically register voters, conduct
polling place operations, design ballots, select voting equipment, and
conduct recounts. As a result of this decentralization, we see enormous
variation in the means of voting—including voting equipment—even
within individual states.
Though the state and federal governments could exercise greater control
over elections without violating Article II, decentralization persists
for a practical reason. America has more elected officeholders than
any other country, and we tie our elections to geography: the typical
ballot includes county commissioners and school board members, as well
as senators and representatives. Of course, we could have local, state,
and federal elections on different days, as some countries do. But the
result would almost certainly be very low turnouts for the non-federal
elections. Instead we keep most elections on a single day, which allows
us to expand electoral control on both the local and national level,
while preventing turnouts from falling through the floor. In some locales,
voters may choose as many as twenty offices and vote on large numbers
of ballot questions. And what's on the ballot varies within locales,
depending on boundaries of political districts.
Decentralization has also served as a way to test innovations in voting
technology. We use a wide range of technologies in the United States
in part because decentralization provides opportunities to experiment
and to learn from past experience.
For better and for worse, decentralization also places financial constraints
on our electoral system, because the costs of elections are paid by
counties and municipalities with limited resources. Counties spent approximately
$1 billion on federal, state, and local elections in 2000—roughly
$10 per voter and less than one-fifteenth of one percent of the 2001
federal budget. These limited resources have also produced some remarkably
efficient community-based elections operations, which often rely on
large networks of dedicated volunteers. Roughly one-third of county
elections funds goes to voter registration, one-third supports election
day operations, and another third pays for election administration and
overhead. Unfortunately, the local funding of elections leaves little
money to purchase state-of-the-art voting technology. The cost of a
complete upgrade to new technology is in the range of $700 million (for
scanners) to $1.8 billion for electronic voting.
The small budget of election administrators also limits the capacity
of the industry to develop new equipment or to take the care with design
that large software manufacturers do. In a good year, the voting equipment
industry has $150 million in revenue, which makes it a small industry.
Large firms, such as IBM and Unisys, have made forays into the voting
machine business and produced innovations (punch cards and scanners),
but they quickly left. In the absence of sustained private or federal
investment, it is thus essential that new voting technology be compatible
with the small-scale, low-budget requirements of our decentralized system.
Suppose, then, that we want to ensure autonomy by requiring secrecy,
prevent vote dilution to ensure equal treatment, and achieve broad electoral
control and technological innovation by maintaining decentralization.
How can we best achieve all these aims? Can improved technology help?
How We Vote
Americans currently vote with five different types of technologies:
hand-counted paper ballots, mechanical lever machines, punch card ballots,
optically-scanned paper ballots, and electronic voting machines (called
direct recording electronic devices, or DREs).
The oldest technology is the hand-counted paper ballot. To
cast a vote, a person makes a mark next to the name of the preferred
candidates or referendum options and puts the marked ballot in a box.
The ballots are counted manually. Hand-counted paper ballots enjoyed
nearly universal application in the United States in the nineteenth
century. They are still widely used in rural areas, and also in national
elections in other democracies, including Canada and France.
At the end of the nineteenth century, New York State introduced mechanical
lever machines, and by 1930 almost all major metropolitan areas
had adopted lever machinery. Here the voter steps into a steel booth,
and views a series of candidate, party, and referenda options, each
of which corresponds to a mechanical switch. The voter flips the switches
that indicate his or her preferences for each office or referendum.
When the voter wishes to make no further changes, he or she pulls a
large lever, which registers the votes on a counter located at the back
of the machine. When the polls close, the election precinct workers
record the tallies from each of the machines.
Punch card machines automated the counting process for paper
ballots using 1960s computer technology. Upon entering the polling place,
the voter is given a ballot in the form of a long piece of heavy stock
paper. The paper has columns of small, perforated rectangles (or chads).
Punch cards come in two varieties: the DataVote lists the names of the
candidates on the card; the VotoMatic does not. The VotoMatic is by
far the more common. In the VotoMatic booth, the voter inserts the card
into a slot and opens a booklet that lists the candidates for a given
office. The voter uses a metal stylus to punch out the rectangle beside
the candidate of choice. The voter then turns the page, which lists
the options for the next office and shifts the card to the next column
of rectangles. When finished, the voter removes the card and puts it
in the ballot box. At the end of the day, the election workers put the
cards into a sorter that counts the number of perforations for each
Optically-scanned ballots, also known as "marksense"
ballots, offer another method for automating the counting of paper ballots.
The format of the optically-scanned ballot is familiar to anyone who
has taken a standardized test. The voter is given a paper ballot that
lists the names of the candidates and the options for referenda, and
next to each choice is a bubble or an arrow with a gap between the fletching
and the point. The voter shades in the bubble next to the preferred
option for each office or referendum, or draws a straight line connecting
the two parts of the arrow. The ballot is placed in a box, and, at the
end of the day, counted using an optical scanner. Some versions of this
technology allow voters to scan their ballots at the polling place to
make sure that they have voted as intended. This is called precinct
optical scanning. Otherwise the scanning is performed at the election
office, and is called central optical scanning.
Direct recording electronic devices (DREs) are electronic versions
of lever machines. The first widely used DRE—the Shouptronic 1242—was
modeled on the lever machine and developed by Shoup, one of the main
lever machine manufacturers. The distinguishing feature of a DRE is
that it records the voter's intentions electronically, rather than on
a piece of paper or mechanical device. Older DREs present the voter
with a large panel displaying all the choices and push buttons next
to each choice. Newer DREs use touchscreen computer technology. Each
screen of the computer displays a "page" of options—sometimes
one office at a time, sometimes a couple of offices at a time. Voters
make selections by touching the screen at the appropriate place and
paging through all of the offices. Typically, the voter may review the
entire session (or ballot) to check his or her votes. Like lever machines,
DREs make it impossible to overvote—that is, to vote twice for
the same office. As with the lever machine, each DRE tallies the votes
locally and the tallies, usually on a disc, are sent to a central location.
Each type of technology involves many variations based on specifications
of manufacturers, ballot formats, and polling place administration.
When election administrators set up a local voting operation however,
they begin by choosing a type of voting technology, and that is the
level of focus here. Those choices are usually made by county election
officials. Some counties do not have uniform voting technologies though,
and as a result municipalities and sometimes individual precincts will
use different methods. These so-called mixed systems are found
most often in Massachusetts, Michigan, Maine, New Hampshire, and Vermont,
where town governments usually administer elections.
Who Uses What?
The pattern of voting equipment usage across the United States is
a demographic crazy quilt. In the most recent election, one in five
voters used the "old" technologies of paper and levers—1.3 percent
paper and 17.8 percent levers. One in three voters used punch cards—31
percent used the VotoMatic variety and 3.5 percent used the DataVote
variety. Over one in four used optically-scanned ballots. One in ten
used electronic devices. The remaining 8 percent used a variety of technologies
in mixed system districts.
Variation within states is nearly as great as variation between states.
In some states, such as Arkansas, Indiana, Michigan, Pennsylvania, and
Virginia, at least one county uses each type of technology available.
The states with complete or near uniformity are New York and Connecticut
with lever machines; Alaska, Hawaii, Rhode Island, and Oklahoma with
scanners; Illinois with punch cards; Delaware and Kentucky with electronics.
Changes in technology over time are equally dramatic. Optically-scanned
ballots and DREs, once available to only 3.2 percent of the voting-age
population are now available to 38.2 percent. Hand-counted paper ballots,
which were the only available technology for 9.7 percent of the voting-age
population in 1980, served just 1.3 percent in 2000. Lever machines,
by far the dominant mode of voting in 1980, then served 43.9 percent
of potential voters. Today, only 17.8 percent of potential voters reside
in counties using lever machines. There has been little change in the
mixed and punch card systems.
Three comments are in order about the change in equipment.
First, the industry is in flux. Between 1988 and 2000, nearly half
of all counties adopted new technologies (1476 out of a total 3155),
and between 1980 and 2000, three out of five counties did so. But some
places have not changed at all; most notably, the state of New York
continues to use lever machines.
Second, voting equipment usage has a strongly regional flavor. The
Eastern and Southeastern United States rely on lever machines. Midwestern
states have a penchant for paper. And the West and Southwest largely
depend on punch cards. As counties have adopted newer technologies over
the last twenty years, they have followed that same pattern. Counties
tend to adopt newer technologies that are analogous to the technology
they move away from. Optical scanning has been most readily adopted
in areas that previously used paper, especially in the Midwest. Where
counties have moved away from lever machines, they have tended to adopt
electronic machines—for example, New Jersey, Kentucky, central
Indiana and New Mexico.
Third, there is a clear trend toward electronic equipment, primarily
scanners but also electronic voting machines. This trend, and the adoption
of punch cards in the 1950s and 1960s, reflects the growing automation
of vote counting. Punch cards, optical scanners, and DREs use computer
technology to produce a speedy and (hopefully) more reliable count.
The trends today, then, are toward two competing technologies: optically-scanned
paper and direct recording electronics. These changes are motivated
by a strong desire to speed up the count. These trends will continue
into the 2002 and 2004 elections, as many states and counties have already
adopted or are considering scanners or electronics.
What's The Problem?
After Florida, we all understood the troubles with punch card ballots—ominous
possibilities like confusing ballot designs and hanging or dimpled chads.
But other technologies have troubles, too, so in evaluating alternatives
we need a common standard. The best such standard is the count of residual
votes—the combined total of uncounted, unmarked, and spoiled ballots.
If voting equipment had no effect on the ability of voters to express
their preferences, then the residual vote would be unrelated to machine
types. To measure the effects of equipment, we estimate the average
residual vote associated with each machine type, and then see whether
these averages differ significantly.
Over the last sixteen years, the rate of residual votes in presidential
elections was slightly over 2 percent. This means that in a typical
presidential election over 2 million voters did not successfully record
a vote for president. But remember that the presidential race is the
"top of the ticket," and thus generates relatively few residual votes.
Other contests further down the ballot produce an even higher rate of
residual votes—5 percent for senatorial and gubernatorial elections.
To be sure, the residual vote is not a pure measure of machine error
or voter mistakes. A ballot may show no vote because the machine failed
to record the voter's selections, because the voter made a mistake or
was confused, or because the voter did not wish to vote at all in that
contest. Whereas the first two scenarios would produce lost votes, the
third would produce an accurate record of the voter's preferences. It
is difficult to quantify voter intentions, but exit polls suggest approximately
25 percent of residual votes are intentional. This leaves 1.5 million
presidential votes that are actually lost each election, and 3.5 million
votes for governor and senator that are lost each cycle.2
Still, the residual vote provides an appropriate yardstick for the
comparison of machine types: whatever the cause and however strong voters'
intentions, the residual vote rate should not depend on what equipment
is used. But it does. Table
1 presents the residual votes in presidential elections and
in senate and gubernatorial elections as a percentage of all ballots
cast over the last decade.3
Some technologies consistently perform well on average, and some technologies
have excessively high rates of residual votes. Optically-scanned paper
and hand-counted paper ballots have consistently shown the best average
performance. Scanners have the lowest rate of uncounted, unmarked, and
spoiled ballots in presidential, senatorial, and gubernatorial races.
Counties using optical scanning have averaged a residual vote rate of
1.5 percent in presidential elections and 3.5 percent in elections for
senators and governors over the last twelve years. Hand-counted paper
has shown similarly low rates of vote loss.
Punch cards, the other paper-based system, loses at least 50 percent
more votes than optically-scanned paper ballots. Punch cards have averaged
a residual vote rate of 2.5 percent in presidential elections and 4.7
percent down the ballot. Both rates of vote loss are more than 50 percent
higher than those of the other two paper systems—hand-counted
and scanned. Punch cards had the highest average rate of vote loss of
all systems used in presidential elections. Over 30 million voters used
punch cards in the 2000 election. Had those voters used optical scanning
there would have been 300,000 more votes recorded in the 2000 presidential
election nationwide and 360,000 more votes in the senatorial and gubernatorial
Voting with any kind of machine, on the whole, has performed significantly
worse. Certainly, lever machines lost relatively few votes over the
last four presidential elections, averaging a residual vote rate of
1.5 percent. But electronic machines lost nearly as many votes as punch
cards, averaging 2.3 percent over the last four elections. The even
more severe problems with these technologies appear down the ballot,
and here we find reason for serious concern about the continued use
of lever machines. In recent senatorial and gubernatorial elections,
7.6 percent of all ballots cast recorded no vote in counties using lever
machines—the highest vote loss of all systems. In counties using
electronic machines, the residual vote in senatorial and gubernatorial
elections equaled 5.9 percent of all ballots cast. Optically-scanned
ballots average substantially lower rates of lost votes than the machine
voting technologies. Had the counties using lever machines used optical
scanning, we estimate that there would have been little difference in
the presidential vote, but 830,000 more votes recorded in the elections
for senators and governors.
These figures imply that the United States can immediately lower the
rate of lost votes, just by using existing technologies: we need to
replace punch cards and lever machines with optical scanning. Based
on its track record, optical scanning would cut the rate of lost votes
in half in the counties currently using levers and punch cards.
Optical scanning itself has plenty of problems. Many of the current
systems do not allow voters to check whether their ballot is valid,
though in-precinct scanning can. Election officials complain of paper
jams, maintenance problems at the polling places, and high costs of
printing and ballot management. In the end, this system also loses significant
numbers of votes. It is imperfect, but it is the best of the available
One interesting question is why lever machines perform well at the
top of the ballot but badly down the ballot. The answer has to do with
both the tabulation process and the user interface. The tabulation process
involves transcribing the tallies at the back of the lever machine onto
a paper record of the total votes for each candidate and referendum.
There is little information on the back of the lever machine to distinguish
where the tallies for each item begin and end. It is easy to record
the wrong numbers (including 0) as the total votes for a particular
item. For example, in the 2000 election, the count for one ballot question
in Boston missed 30,000 out of 100,000 votes.
Moreover, the user interface with lever machines presents similar problems
for the voters. The printing on the front of the machines does not distinguish
offices clearly. Voters can easily find the choices for president, but
moving down the ballot, it becomes harder to distinguish which choices
correspond to which offices and easier to miss an office or ballot question
Perhaps the most surprising result is the poor performance of electronic
voting machines. It should be stressed that the most widely-used DREs
feature old push-button technologies, such as the "Shouptronic." These
machines share many of the same interface design problems as lever machines.
Newer touchscreen machines have not been extensively used. Some counties
have had excellent experiences, such as Riverside County, California,
with a residual vote rate of less than one percent. But other counties
have had unhappy experiences with such technology, such as Beaver County,
Pennsylvania, with a residual vote rate over 6 percent.
Even the newer equipment presents difficult problems of ballot design.
Ted Selker of the MIT Media Lab has evaluated the designs of all of
the major DRE models on the market. He has found that user interfaces
are typically not designed to ensure ease-of-use and familiarity for
the voter. And there are strong incentives not to fix these problems,
even when they are conspicuous. Once a machine is on the market, it
is difficult to change the user interface: the machine will most likely
have to go through the existing certification process for computer code,
which can take up to a year.
The Future of Voting Technology
The lesson of the last two decades is that the small, static market
for voting technology will not necessarily produce easy-to-use and secure
systems for American elections. Despite a century of innovation, many
voters today are using equipment which does not easily and reliably
record their political preferences. Moreover, the future will introduce
even greater variety in voting technologies.
The United States is in the midst of an ongoing technological revolution
in computing and communication and that will soon change the way we
vote. The technologies competing today—optical scanners and DREs—are
some of the earliest products to come out of that revolution. Internet
voting is the next step. The question remains however, will we be able
to capitalize on this revolution and develop a truly reliable and effective
The United States has no shortage of people and firms interested in
electronic and Internet voting. According to the Federal Election Commission,
over half of the twenty-five companies that sell voting equipment in
the United States today offer electronics. A few are devoted exclusively
to Internet voting. But electronic—and in particular Internet—voting
presents three substantial challenges.
First, the voting industry will have to change the way it does business.
The current voting machine industry sells boxes —lever machines,
scanner devices, punch-card booths and readers, full-faced DREs. But
such highly specific, dedicated voting machines are unnecessary and
impracticable for the future of electronic voting. Most of the new touchscreen
DREs are standard computers, running Windows. Internet voting could
use any computer. In the future, the primary technology for electronic
voting will thus be software for recording, validating, and counting
votes. Secure, reliable voting technology will increasingly depend on
secure, reliable software development. This will push the industry away
from selling boxes and toward selling software and services.
Second, monolithic electronic platforms such as the Internet are inherently
more vulnerable to fraud and disruption on a statewide or even national
scale. To make the voting system accurate and reliable, we must minimize
lost votes and fraud. With regard to lost votes, the aim is to make
equipment as dependable and easy-to-use as possible, so as to minimize
the observed "failure rate." Fraud is a different beast. Fraud involves
malicious attack on the voting system. There are strong incentives to
defraud or disrupt elections. American history is littered with incidents
of stolen ballots, stuffed ballot boxes, and rigged machines.
Security is thus a continual challenge. Fortunately, most traditional
voting technologies have offered two important checks on fraud: the
scale of the election and the observability of the process. Large-scale
fraud is, obviously, of greater concern than small-scale fraud. With
many separate voting machines and polling places it is difficult to
conduct large-scale fraud, because a very large number of people must
be involved to carry it out. Also, with paper ballots and lever machines
the counting process is open—there are many eyes on the process.
But Internet voting lacks both properties. With any monolithic voting
system on a common platform it is possible for one person to disrupt
or defraud an entire election. Because software in the voting industry
is proprietary and because procedures and counts are often only accessible
to a few experts, it is difficult for the public to adequately monitor
electronic voting systems.
Third, electronic voting and Internet voting rely on technologies that
are unfamiliar to large segments of the population. Somewhere around
70 percent of Americans have used computer equipment at work or home.
For the other 30 percent, computers are foreign and may be intimidating.
This is especially true of older Americans and those with fewer years
of formal education. Over time the "digital divide" will vanish as Americans
come to use computers in banking, shopping, and other daily activities.
In the near-term, however, electronic voting may become a barrier to
voting for people unfamiliar with computers. Nonetheless, electronic
voting holds considerable promise: the potential for full accessibility,
greater convenience, and no paper to manage.
A Role for the Federal Government
Voting involves a simple act. Yet, with our small-scale, low-budget
system, it has proved very hard to find the right instrument—to
develop a technology that sustains voter autonomy, equality, and decentralization.
Sensible and secure electronic and Internet voting may be within our
grasp, but we must recognize that electronic voting demands higher standards
of security and usability, and that the decentralized American system
lacks any legal mechanism to guarantee that voting systems are easy-to-use
and tamper-proof before they are deployed. Counties make decisions,
usually with little more information than what voting technology vendors
have provided. There is also an incentive problem in the private market
for voting machines. Election administrators are the consumers, not
the voters. As a result, ease-of-use receives less emphasis in purchasing
decisions than it should.
Many election administrators appreciate these problems. Working through
the Federal Election Commission and the National Institute of Standards
and Technology, state elections directors helped develop voluntary voting
system standards, introduced in 1990. The standards establish minimum
criteria for equipment durability. In addition, tabulators must reach
a high level of accuracy using machine-generated sample ballots. Software
is also now tested for a minimum level of integrity.
This is a beginning. It reflects a resolve to improve voting systems,
but existing standards still embody two key weaknesses.
First, the standards do not cover the technology as it is used by people.
The tabulator tests are run on mechanically-generated ballots, not ballots
generated by actual voters. Machines do not create improper marks or
hanging chads, or incorrectly use a touchscreen. There are also no guidelines
for ballot design, which could have prevented the introduction of the
butterfly ballot in Florida. The absence of human testing is especially
perplexing when it comes to questions of security. The way to expose
security failures is to attempt to hack the system. No such process
of deliberate and controlled testing is currently in place.
Second, the process is static. Once a machine is certified it is "fixed":
any changes in the machine require additional certification, which can
take up to a year. As a result, vendors are reluctant to make changes,
even in the face of chronic malfunctions.
Brazil offers a provocative contrast with the United States in the
development of national standards for voting technology. Election administration
in Brazil was notoriously flawed for decades. Fraud was rampant, and
counts were highly unreliable. The country also has a large illiterate
population that effectively cannot vote using many of the available
technologies. In the 1980s, the Brazilian government established a consortium
of engineering labs to develop new voting equipment that would be inexpensive
and accessible to all people (regardless of literacy), and that could
provide a quick, reliable count. They set up a separate agency to evaluate
equipment in laboratory tests and to select a uniform system for each
election. Though not without flaws, this process has produced an enormous
improvement in the reliability of voting in Brazil and in public confidence
in its elections.
The United States must create a similar system of research and evaluation
to guarantee development of secure and reliable voting technologies.
Those evaluating new equipment must try to attack it to find weaknesses
in security and assess its ease-of-use for a range of real voters. Information
from tests must be relayed back to industry so that firms can correct
problems before equipment is adopted.
This effort is most appropriately funded and overseen by the federal
government, but it need not (and cannot constitutionally) impose such
a system on local elections officials. To entice counties and states
into participating in such a program, the federal government should
offer to share the costs of election administration for any county or
state willing to adopt equipment developed and evaluated through the
program. Within this process we must require more than minimum durability
and software integrity standards. What are the specifications that the
industry must build to?
First, all equipment must be fully auditable. A separate physical record
of each vote should be stored in the event of a challenged election
and recount. Setting such a standard will allow for more accurate and
objective counts and recounts.
Second, votes must be verifiable. Voters should be able to check that
their ballots are properly marked and will be counted as they intend—though
they cannot be given voting receipts.
Third, equipment for casting and counting votes must reach a very high
level of accuracy when tested using votes cast by a broad spectrum of
actual voters. We recommend error rates of no more than one-quarter
of one percent.
Fourth, equipment generating votes and ballot designs should be evaluated
for ease-of-use. Straightforward, accessible voting technology must
be designed to permit voting by people with handicaps and low literacy
levels. Voting should not be a test.
Fifth, equipment for casting and counting votes must be highly secure.
Large-scale fraud or attack must be exceedingly difficult.
Certifying a single machine that fits all of these standards might
prove exceptionally difficult. There must also be some way of streamlining
the certification process. The solution is to break the equipment into
modules, a move consistent with current technological trends. There
should be separate certification for the equipment that generates votes,
emphasizing usability, and for the equipment that captures and counts
votes, emphasizing security.
A New System?
The Voting Technology Project has developed a modular architecture
that could serve as a suitable framework for meeting these standards
in many different ways. The architecture was developed independently
by Ron Rivest and David Jefferson, and by Shuki Bruck.
The architecture divides the voting process into four discrete stages.
The voter first obtains a valid "vehicle" for his or her vote. The vehicle
can be many things including a piece of paper or an electronic memory
card. This vehicle is not a ballot, as it contains other information,
such as the precinct number and the administrator's name. Next, the
voter records his or her votes on the vehicle. The voter then inserts
the vehicle into a standard input device and verifies that the choices
recorded on the vehicle are those intended. If the votes are not what
the voter intended, then the voter can go back to the second stage and
make changes. And finally, the voter submits his or her votes. The votes
are sent to the tabulator (electronically). At this point the votes
recorded on the vehicle are "locked" in place. The locked vehicle is
put in a box and kept as an audit trail.
The central insight behind this architecture is to separate the second
stage from the third and fourth, which divides user interface from actual
vote casting. The standard input device that records the vote should
be a highly secure device built to specified standards. The user interface
can be developed, refined, and certified separately. This would likely
lead to improved user interface and ballot designs. With a standard
input device ("vote reader"), the industry would be free to focus on
the "front end." These devices could even be developed and sold by separate
A further strength of this architecture is that it belies the myth
that only paper systems can have separate, physical audit trails that
are created by the voter—since the "vehicle" could be an electronic
memory card or some other device.
Finally, this is an ideal architecture for precinct-based or kiosk
electronic voting, either for absentee or election day voting. Voters
could prepare a paper ballot at home on their own computers and bring
that to a kiosk or precinct. They could then insert that ballot in a
standard input device to verify and submit their votes. Kiosks, of course,
could be equipped to generate valid ballots as well.
Importantly, the process proposed by the Voting Technology Project
respects decentralization and diversity, while promoting equality and
ensuring secrecy; it would not lead to uniform voting technology. Within
a common architecture, many different kinds of machines can offer highly
secure and reliable means of expressing preferences and capturing and
tallying votes. The process of continual innovation around a shared
framework is also designed to minimize the sorts of problems that produce
lost and fraudulent votes. If all equipment reaches a high level of
usability and security, we can then tolerate technological diversity
and innovation among and within counties and states.
Technology cannot save our democracy from all its ills. But wise investment
in more sensible equipment can help forestall disasters that undermine
the confidence of citizens in their institutions.
Stephen Ansolabehere is co-director of the Caltech/MIT Voting
Technology Project, and professor of political science at MIT.
Return to the forum on machine
politics, with Stephen Ansolabehere and respondents.
1 For discussion of voting technologies and the equal
protection principle in Bush v. Gore, see Richard Posner,