Re: [EM] Why We Shouldn't Count Votes with Machines
On Oct 5, 2008, at 8:21 PM, Kathy Dopp wrote: Jonathan Not a bad solution at all Jonathan, although there is a lack of transparency to any electronic count for the average citizen That's true enough, though it's also true that the average citizen isn't going to recount (or even observe a recount of) a plurality election. I've participated in one myself, and it requires true dedication. - and IRV/STV counting methods are virtually impossible to audit with anything less than a 100% manual count and are virtually impossible to accurately manually count in some election contests. That's the point of my suggestion, though: it's easy to audit, either 100% or by sampling, the ballot file, and a concerned voter could surely find an independent counter that she trusted, even if she couldn't manage the count on her own. The system could easily provide a set of test files with known results such that a prospective counter could have reasonable assurance that their counting software was counting correctly. Of course, in order to challenge a count, the challenger's counting software would have to be open-source, so it could be independently confirmed that the discrepancy wasn't due to a bug. But I like this solution for any alternative voting method that does not have all the other severe flaws of the IRV/STV method. Well, we disagree on the merits of STV, but my suggestion is really method-independent. Ballot level auditing does have certain challenges as you mention. Kathy On Sun, Oct 5, 2008 at 9:08 PM, Jonathan Lundell [EMAIL PROTECTED] wrote: BTW, it seems to me that there's a relatively straightforward solution in principle to the problem of computerized vote counting, based on the use of separate data-entry and counting processes. Let voters vote on paper, either by hand or with an electronic marking machine, enter the ballot data, perhaps by scanning, in such a way that the resulting ballot data can be verified by hand against the paper ballots, and permit counting by multiple independent counting programs. There are nontrivial details to be resolved, in particular ballot secrecy and the resolution of conflicting results, but it seems to me that it's a fairly contained set of problems. -- Kathy Dopp Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Wed, Oct 8, 2008 at 7:14 PM, Jonathan Lundell [EMAIL PROTECTED] wrote: That's true enough, though it's also true that the average citizen isn't going to recount (or even observe a recount of) a plurality election. I've participated in one myself, and it requires true dedication. True. But citizens should have that option, and having that option is a deterrent to fraud. That's the point of my suggestion, though: it's easy to audit, either 100% or by sampling, the ballot file, and a concerned voter could surely find an independent counter that she trusted, even if she couldn't manage the count on her own. Well, but its virtually impossible for an average citizen to figure out how to count all those votes in time before the election is certified, and also introduces problems with vote buying and loss of ballot privacy if all the choices are publicly published. I personally would not trust any independent counter to get it right if I could not verify it myself - due to the complexity of the count and the likelihood of innocent errors, even if I trusted someone, I would not trust them to correctly write the programs to count IRV. The system could easily provide a set of test files with known results such that a prospective counter could have reasonable assurance that their counting software was counting correctly. Of course, in order to challenge a count, the challenger's counting software would have to be open-source, so it could be independently confirmed that the discrepancy wasn't due to a bug. That method of trying to ensure accurate elections would do nothing whatsoever to ensure accurate election vote counts. That is akin to today's incompetent election officials who insist that simply because the machines can accurately count a set of test ballots before or after the election, that *must* mean that the election day results are accurate. That idea is insane because anyone who has studied computer science knows better. Well, we disagree on the merits of STV, but my suggestion is really method-independent. Your method is not method-independent because the only way to check machine counts is with hand counts and some methods are LOTS easier to accurately and efficiently hand count than other methods, and checking the results of running a small set of test ballots, or even a large set, does zip to check election results accuracy. Cheers, Kathy Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Oct 8, 2008, at 6:26 PM, Kathy Dopp wrote: Your method is not method-independent because the only way to check machine counts is with hand counts and some methods are LOTS easier to accurately and efficiently hand count than other methods, and checking the results of running a small set of test ballots, or even a large set, does zip to check election results accuracy. My suggestion of test data sets is simply a convenience to the authors of counting software, to provide a first-level check of their correctness. The real verification is in the agreement of many independent counters. STV counting software isn't actually all that difficult to read and understand (not for everybody, of course, but for a very large number of people). I'd be willing to rely on a computerized count in which many independent, open-source counting programs (which could certainly included some written by critics of the system) agreed on the result. That's not really necessary for IRV, of course, which is easy, if a little tedious, to count by hand. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Tue, 7 Oct 2008 01:03:47 -0400 Brian Olson wrote: On Oct 6, 2008, at 11:30 AM, AllAbout Voting wrote: So I will ask a pair of constructive questions: 1. Can Condorcet voting be compatible with precinct level optical scan systems? (which many election integrity advocates consider to be pretty good) Yes. 2. Can Condorcet voting be compatible with end-to-end verifiable election integrity systems such as punchscan, 3-ballot, etc...? Aside from the NxNx3 adaption of 3-ballot to condorcet information, I think it was suggested on this list a while ago that 3-ballot can be adapted to 0-100 range voting by scaling up its three ballots of 0-1 voting and requiring sums of 100-200 for a valid vote instead of sums of 1 or 2. If that sort of system was used, rankings for condorcet counting could be extracted from the ratings votes, or a more advanced ratings-aware system could be used. Actually, that sounds pretty messy. NxNx3 is probably better. For Condorcet, N*N*3 for 3-ballot sounds like time for something more affordable space-wise. Since all there is to record for one ballot is Y vs N, N is absence of Y, and positions for the Ys had to be calculated from the ballot, how many positions need recording? Considering that C, the number of candidates voted for, is often one or two, not many. There are LESS THAN NC positions to record (while this N, the number of candidates, can be many). Most of these methods require automatic ballot construction or specially clueful voters. I'd expect 99% of voters to never bother verifying that the election was actually done right if they had the certificates with which to check it. I think probably the best defense against electoral malfeasance is probably through the political and legal processes, and through the vigilance of the citizenry. We'll never make a system so mathematically perfect that we don't still need those other things. Now it becomes MORE important to record for read back what the system thinks the voter voted, rather than some foreign construction such as the 3-ballot array. Not mentioned above is ability for those up to it to analyze the system programming in whatever detail they see as valuable. Brian Olson http://bolson.org/ -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Kathy Dopp wrote: It seems to me that most of the persons on this list would rather have votes fraudulently counted using some alternative voting scheme that requires an unverifiable unauditable electronic voting system, than accurately counted using the plurality election method. Some have that attitude. I'm not one of them. I think that plurality is a lousy voting method *and* that our current voting system is wide-open to fraud. In my view both can and should be addressed. For the most part the means of addressing them are orthogonal. That said, voting methods that are not countable in precincts (eg. IRV) pose a very large challenge to providing for election integrity. This, in addition to other significant faults of IRV, causes me to oppose IRV.. I notice that some supporters of Condorcet voting (Dave Ketchum in particular) directly argue that improving the plurality system should be done even if it sacrifices election integrity. So I will ask a pair of constructive questions: 1. Can Condorcet voting be compatible with precinct level optical scan systems? (which many election integrity advocates consider to be pretty good) 2. Can Condorcet voting be compatible with end-to-end verifiable election integrity systems such as punchscan, 3-ballot, etc...? I suspect that the answers to both questions is 'yes' which would make Ketchum's dangerous arguments that software can be blindly trusted irrelevant. -Greg Wolfe -- I now run an election reform website. Read my rantings here: http://AllAboutVoting.com Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Oct 6, 2008, at 5:42 AM, Terry Bouricius wrote: Jonathan Lundell wrote: BTW, it seems to me that there's a relatively straightforward solution in principle to the problem of computerized vote counting, based on the use of separate data-entry and counting processes. Let voters vote on paper, either by hand or with an electronic marking machine, enter the ballot data, perhaps by scanning, in such a way that the resulting ballot data can be verified by hand against the paper ballots, and permit counting by multiple independent counting programs. That is exactly what Burlington (VT) and San Francisco (CA) do. Optical scan ballots are used, and the voter rankings are tallied by an official open-source program, but can also be tallied (and has been tallied) by other programs, because all of the ballot images are posted on the Internet. A key element, however is a hand-audit of a random sample of machines to assure (to a reasonable degree of confidence) that the computer record for the ballots matches the paper record. This redundant record is what makes these ranked-ballot elections significantly MORE secure than traditional hand-count elections (were some ballots stolen, added, re-marked to spoil, etc.?) and more secure than all electronic elections (was there a bribed programmer who inserted a virus?) California has a pretty good statewide requirement for a random (by precinct IIRC) recount. However, I'm mildly skeptical on the above, both that SF uses open- source counting software and that the ballots are available online. Can you provide URLs for both? I'd love to do some counting myself. Putting hand-marked ballot images online raises vote-buying issues. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Oct 6, 2008, at 11:19 AM, Raph Frank wrote: Condorcet is precinct countable. You just need an N*N grid of numbers from each precinct. OTOH, that degree of compression is hardly necessary. IRV/STV ballots could be captured at the precinct level, cryptographically signed, and transmitted to a central counting facility (or exchanged, to count in multiple locations). Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Oct 6, 2008, at 11:30 AM, AllAbout Voting wrote: So I will ask a pair of constructive questions: 1. Can Condorcet voting be compatible with precinct level optical scan systems? (which many election integrity advocates consider to be pretty good) Yes. 2. Can Condorcet voting be compatible with end-to-end verifiable election integrity systems such as punchscan, 3-ballot, etc...? Aside from the NxNx3 adaption of 3-ballot to condorcet information, I think it was suggested on this list a while ago that 3-ballot can be adapted to 0-100 range voting by scaling up its three ballots of 0-1 voting and requiring sums of 100-200 for a valid vote instead of sums of 1 or 2. If that sort of system was used, rankings for condorcet counting could be extracted from the ratings votes, or a more advanced ratings-aware system could be used. Actually, that sounds pretty messy. NxNx3 is probably better. Most of these methods require automatic ballot construction or specially clueful voters. I'd expect 99% of voters to never bother verifying that the election was actually done right if they had the certificates with which to check it. I think probably the best defense against electoral malfeasance is probably through the political and legal processes, and through the vigilance of the citizenry. We'll never make a system so mathematically perfect that we don't still need those other things. Brian Olson http://bolson.org/ Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Dave Ketchum Sent: Sunday, October 05, 2008 1:16 AM We have to be doing different topics. Yes, we must indeed be doing different topics. If you are electing the City Mayor or the State Governor and there are only two candidates, plurality is as good as it gets. If there are more than two candidates you can do better with a different voting system - some favour a Condorcet approach, some IRV, and some promote a variety of other voting systems. But the context in which my comment was set was much broader, following on from the general suggestion that we should not move from plurality (with single-member districts implied) to more complex voting systems because the possibility of detecting electoral fraud might thereby be reduced. That proposition was not specific to single-office elections, but was relevant to the discussion of more general electoral reform on this list and under this topic (with some non-USA examples), a discussion that is taking place in both the USA and Canada that could see city councils and state legislatures (and perhaps even the US House of Representatives and the Senate!!) elected by voting systems that would give more representative results than the present plurality. My problem with the statement Plurality does fine with two candidates ... is that I have heard it so many times over the years, mainly from those who are opposed to any reform that would make our various assemblies more representative, but sadly also from some who support reform of the voting system but say it would not need any change if there were only two parties. That extrapolation from single-office elections to assembly elections is not valid. In my experience the statement is unhelpful and hinders the cause of reform - hence my reaction to it. James No virus found in this outgoing message. Checked by AVG - http://www.avg.com Version: 8.0.173 / Virus Database: 270.7.5/1708 - Release Date: 04/10/2008 11:35 Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Sat, Oct 4, 2008 at 3:51 PM, Dave Ketchum [EMAIL PROTECTED] wrote: In fact some computer scientists just recently mathematically PROVED that it is impossible to even verify that the certified software is actually running on a voting machine. Tell us more, a bit more convincingly as to fact behind this opinion - assuming proper defenses. Here is the info. I have not read the proof yet myself: In 'An Undetectable Computer Virus,' David Chess and Steven White show that you can always create a vote changing program (called virus there) that no verification software can ever detect. --- It seems to me that most of the persons on this list would rather have votes fraudulently counted using some alternative voting scheme that requires an unverifiable unauditable electronic voting system, than accurately counted using the plurality election method. Curious. Cheers, Kathy Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Kathy Dopp wrote: On Sat, Oct 4, 2008 at 3:51 PM, Dave Ketchum [EMAIL PROTECTED] wrote: In fact some computer scientists just recently mathematically PROVED that it is impossible to even verify that the certified software is actually running on a voting machine. Tell us more, a bit more convincingly as to fact behind this opinion - assuming proper defenses. Here is the info. I have not read the proof yet myself: In 'An Undetectable Computer Virus,' David Chess and Steven White show that you can always create a vote changing program (called virus there) that no verification software can ever detect. Without having read the paper, I suspect this is a reduction to the Halting problem. Of interest regarding my earlier idea of special-purpose machines is that most voting systems don't need full Turing capability to find out who the winner is, so one may be able to make a program (or chip) for counting votes that can be proven not to have modifications (subject to the assumptions of the surrounding, less-than-Turing, framework). It seems to me that most of the persons on this list would rather have votes fraudulently counted using some alternative voting scheme that requires an unverifiable unauditable electronic voting system, than accurately counted using the plurality election method. Curious. Say that the losses due to fraud is p. Also say that the losses due to using Plurality is q. Then, if there is no fraud at all under Plurality, and a lot of fraud under the better method, and p q, then switching to an alternative voting scheme, even if that would lead to fraud, is an improvement. This is a quick and dirty argument (because surely there can be some fraud under Plurality, and no voting method would work if all the ballots have been subject to fraud, i.e the entire input is garbage), but it should get the point across. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Raph Frank Sent: Saturday, October 04, 2008 11:01 PM These disks have to be kept securely for four years - no access to anyone except with a Court Order. What is the basis for granting access? We do not have any precedents for access to the images of ballot papers because there were no challenges after the May 2007 elections. So we have precedents only for access to actual ballot papers, going back many years. An election court would grant an order only if a petitioner (usually a candidate backed by a political party) had good grounds for alleging fraud. So far as I know, we have not had any problems of that kind in the actual counting procedure in UK elections but we have had proven cases of fraud in the handling of postal ballot. A court MIGHT also be grant access (order a recount) if a candidate had good grounds for alleging that the Returning Officer has misinterpreted the regulations in a way that could have changed the outcome (winner) of the election. Some party representatives did challenged the ROs adjudications on some ballot images and these disagreements were recorded in the electronic system. But none of the parties made any challenge after the elections, although in the Scottish Parliament elections (MMP) the numbers of rejected ballot papers considerable exceeded the winner's margin in quite a number of the single-member constituencies. There would probably be consensus on 99% of the ballots and then the returning officer can check the last 1%. A judge might be called in for 0.1%, if there still was a dispute after the RO gave a decision on the disputed ballots. This not how the process works here in the UK. The RO adjudicates on doubtful ballot papers and there are discussions with the candidates an their agents. They may dispute the RO's decision, but if the RO doesn't back down, the election result is announced. Then, after the official announcement, any aggrieved person can petition the court for an investigation which would in effect be a recount. A blank ballot is one that has no writing on it, or one that is not used? Blank ballot paper here means one that came out of a sealed ballot box at the counting centre and had no vote recorded on it. Ahh, it is a check that all ballot papers are accounted for? I wouldn't see an issue with imaging them too. Sorry if I didn't make this completely clear. Every ballot paper that it put into a ballot box by a voter is counted, where that can mean being identified as rejected because it is invalid (informal in Australia) for any one of several reasons, including is blank. The numbers of such rejected ballot papers are reported along with the numbers of valid votes and the candidates' votes. It is the total number of papers in the ballot box (blanks and all, before such blanks have been identified) that is used in the reconciliation against the number of papers issued to the Polling Station, when the unused (unissued) papers and any spoilt (replaced) papers are part of that reconciliation. The numbers of unused ballot papers and the numbers of spoilt ballot papers are not reported and there is no access to that information after the reconciliation at the opening of each ballot box has been completed. NB Rejected ballot papers and Spoilt ballot papers are completely different animals and are both very precisely defined in the Election Regulations though the media (and some officials!!) use the terms interchangeably - which can cause great confusion, as it did in May 2007 when there were unprecedented numbers of rejected ballot papers in the Scottish Parliament MMP elections. James No virus found in this outgoing message. Checked by AVG - http://www.avg.com Version: 8.0.173 / Virus Database: 270.7.6/1709 - Release Date: 05/10/2008 09:20 Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Sun, 5 Oct 2008 12:22:37 +0100 James Gilmour wrote: Dave Ketchum Sent: Sunday, October 05, 2008 1:16 AM We have to be doing different topics. Actually we seem together on topics, but you reacted to what you took as a cue statement without noticing what I was saying. Perhaps the following wording would get my actual thoughts noticed by more: While many methods, including Plurality, have no trouble correctly picking the winner when there are only two candidates, Plurality restricts voters unacceptably when there are more than two candidates and many voters want to show more than one as better than the remainder - which happens often. To clarify, assume this voter wants Tom but, knowing that Tom may not win, wants to show preference for Dick over the remaining lemons. Yes, we must indeed be doing different topics. If you are electing the City Mayor or the State Governor and there are only two candidates, plurality is as good as it gets. If there are more than two candidates you can do better with a different voting system - some favour a Condorcet approach, some IRV, and some promote a variety of other voting systems. But the context in which my comment was set was much broader, following on from the general suggestion that we should not move from plurality (with single-member districts implied) to more complex voting systems because the possibility of detecting electoral fraud might thereby be reduced. That proposition was not specific to single-office elections, but was relevant to the discussion of more general electoral reform on this list and under this topic (with some non-USA examples), a discussion that is taking place in both the USA and Canada that could see city councils and state legislatures (and perhaps even the US House of Representatives and the Senate!!) elected by voting systems that would give more representative results than the present plurality. My problem with the statement Plurality does fine with two candidates ... is that I have heard it so many times over the years, mainly from those who are opposed to any reform that would make our various assemblies more representative, but sadly also from some who support reform of the voting system but say it would not need any change if there were only two parties. That extrapolation from single-office elections to assembly elections is not valid. In my experience the statement is unhelpful and hinders the cause of reform - hence my reaction to it. Given such a statement, might be useful to emphasize that there are often more than two candidates and therefore voters need ability to identify which two or more are best liked - which Plurality cannot support. James -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
To put a different slant on James Gilmour's message bout fraud vs. wasted votes under plurality voting... I'm sure Kathy Dopp (on this list for a few months now) will note that high level fraud is possible without detection on current voting technology, which is why systems should be universally subject to manual audits. On the other hand, current plurality voting doesn't just waste votes, it often elects the wrong candidate even WITHOUT any fraud. Under Plurality voting rules, a candidate can be declared elected who would lose in every possible one-on-one match up with each of the other candidates (the Condorcet Loser). This winner would also be outside the mutual-majority set (those candidates that a solid majority of all voters prefer over this plurality winner). The point is, that even with ZERO FRAUD, the current U.S. voting system regularly elects candidates that the majority of voters believe are the wrong ones. Some election integrity activists have taken the mistaken stance that no improvement in voting methods should be pursued until the fraud issue is perfectly fixed. But in the mean time honest elections, using our defective plurality voting method, regularly elect the wrong candidate. A bit like obsessing on fixing the rotten clapboard on the back of the barn, while ignoring that the barn door is wide open and the cows are leaving. Terry Bouricius - Original Message - From: James Gilmour [EMAIL PROTECTED] To: [EMAIL PROTECTED]; 'Dave Ketchum' [EMAIL PROTECTED] Cc: election-methods@lists.electorama.com Sent: Saturday, October 04, 2008 7:41 AM Subject: Re: [EM] Why We Shouldn't Count Votes with Machines Dave Ketchum wrote: Mixed into this, Plurality is easily done with paper; better systems, such as Condorcet, are difficult with paper, but easily handled with electronics. Kathy Dopp Sent: Saturday, October 04, 2008 1:24 AM Well that is a very good reason to avoid implementing them - because if they can't be easily done with paper ballots, then they cannot be assured to be counted accurately. This raises a very interesting point - how to balance the risk of failing to detect a low level of fraud against the known wasting of very large numbers of votes by the plurality voting system. (I say low level of fraud, because any high level should be readily detectable.) Of course, we don't want any fraud, and we don't want any fraud to go undetected, and we don't want the outcome of any election determined by fraud, no matter how low the level of that fraud may be. But to use the ease of detecting fraud as the sole criterion for selecting a voting system is almost certainly to lose sight of the much larger losses of votes that occur in every plurality election. In the UK, Canada and in most countries using plurality (except USA), the voting system discards the votes of around half of those who vote - sometimes a little more than half, sometimes a little less. In some plurality elections large numbers of the elected members are elected with only a minority of the votes cast in the single-member districts. The evidence on this is abundant and worldwide. The exception is the USA, where, for example, in elections to the House of Representatives, only one-third of the votes are wasted in this way. The reason is probably related to successful incumbent gerrymandering of the district boundaries and to the effects of holding primary elections. But even in the USA, around one-third of the votes are wasted by the plurality voting system. So to look at the overall picture with a voting system like plurality, should we reject any move to a voting system that would give effect to more of the votes actually cast because it might be more difficult to detect a low level of fraud in such a voting system? James No virus found in this outgoing message. Checked by AVG - http://www.avg.com Version: 8.0.173 / Virus Database: 270.7.5/1706 - Release Date: 03/10/2008 18:17 Election-Methods mailing list - see http://electorama.com/em for list info Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Kathy Dopp wrote: In fact there has never been even a theoretical design for an electronic voting system or even electronic paper ballot vote counting system that does not have known security leaks. In my design, whether or not there are security holes in the vote-counting system itself, the certificates that it produces cannot feasibly be forged without first solving mathematical problems that have never yet been solved despite extreme efforts by many very smart people (namely, finding an efficient way to invert one-way functions). So in this way, the possibility of leaks can be rendered irrelevant, in the sense that if the security of the system was compromised, the election outcome could still not be affected substantially, without the forgeries being easily detected by many parties. In fact some computer scientists just recently mathematically PROVED that it is impossible to even verify that the certified software is actually running on a voting machine. Can you give me the reference to that? I'd like to take a look at their assumptions. Although that theorem may be true in some technical sense, it seems to me that voters who are sufficiently paranoid ought still to be able to convince themselves to their satisfaction of the validity of the certificates they receive from the system. They could use several independent computers or services to verify the certificate. They could write the validation software themselves and run it on a computer fresh from the factory that has never been exposed to a possible source of viruses. Or on several computers from independent companies. Or if nothing else, a sufficiently intelligent and determined voter can always carry out the mathematical checks by hand. The fact that there will a few people who are both intelligent enough and paranoid enough to do these checks should give the rest of the voters a high level of confidence that there is not any widespread miscounting going on (else it would have been noticed by these people). The opposite problem, that a few voters could accuse the electronic system of a misreading of their ballot that didn't actually occur, in order to undermine the system's credibility (motivated possibly because these people found it easier to stuff ballot boxes themselves in a paper system) is more difficult to solve. But one approach would be to require that physical evidence be provided to support such claims. For example, organizations concerned about possible miscounting could test the accuracy of the system themselves by sending test voters into public polling places; these voters could carry with them hidden video cameras recording the entire process of entering their vote into the system. Then later, if the certificate generated by the system for that voter did not match the video showing the ballot selections that were actually entered, the organization could produce the certificate and the video, and together that could be considered to be unimpeachable physical evidence that some miscounting really had occurred somewhere in the system. If many organizations try to perform such checks, and are unable to produce any such physical evidence of ballot misreading, and all voters who verify their certificates (using multiple verification tools) find them to be valid, it should be possible to generate a high level of confidence in the overall system. No system is perfectly secure (even paper balloting) and so the goal is just to make fraud and miscounting more difficult than it is presently. I believe this is possible to do electronically, given the right system design. I'll post a white paper describing my system in a later message. -Mike -- Dr. Michael P. Frank, Ph.D. (MIT '99) 820 Hillcrest Ave., Quincy FL 32351-1618 email: [EMAIL PROTECTED] cell: (850) 597-2046, fax/tel: (850) 627-6585 Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Just for the record - Raph Frank Sent: Thursday, October 02, 2008 11:27 PM On Thu, Aug 28, 2008 at 12:00 PM, James Gilmour Here in Scotland there is a somewhat hidden debate that must be had. STV-PR was introduced for local government elections in 2007. The counting rules adopted (Weighted Inclusive Gregory Method for consequential transfers) make electronic counting almost obligatory. (Manual counting to WIGM rules is possible, but long and tedious because so many ballot papers have to be sorted and counted again and again.) So we used scanners, OCR conversion and e-counting. That is similar to Abd's ballot imaging suggestion. I assume that the images used for the OCR aren't made available to the public? Correct - the images were not made available. Those that were subject to adjudication by a Returning Officer were seen, by all who want to look, on a computer screen, large or small, during the count. The images (and the adjudication decisions on them) are stored on the hard drives used at each of the 32 counting centres. These disks have to be kept securely for four years - no access to anyone except with a Court Order. All the ballot papers and all the other paper records from the elections and counts had to be destroyed securely one year after polling day. The Scottish Government is promoting further use of STV-PR for various directly elected bodies. This is raising issues about the long-term provision of the equipment necessary for e-processing of the ballot papers for all these different public elections and about the software that will be used for scanning, OCR and counting. This can be solved by just publishing the ballot images. This way everyone can work out their own result. Yes, BUT adjudication on doubtful images can be critical. So if you had access to the images and ran them through your own OCR software you may well come up with different vote files. Interestingly, in one pre-election validation test of the electronic processing versus manual counting for the STV-PR elections, the results were different - due only to a difference in the adjudication decision the ROs made when they look at the on-screen image and when they looked at the actual ballot paper. Concerns about black box processing have been somewhat muted so far, but there have been calls for all blank ballot papers to be subject to individual adjudication by the Returning Officer under scrutiny of the candidates and their agents. This is an example of the ridiculous double-standards that are being applied to e-processing, because straightforward blank ballot papers would never be subject to Returning Officer adjudication in a manual count. A blank ballot is one that has no writing on it, or one that is not used? Blank ballot paper here means one that came out of a sealed ballot box at the counting centre and had no vote recorded on it. Ballot papers that are not issued to electors at a polling place (= precinct) are sealed up at the polling place by the presiding officer at the close of the poll. When each ballot box is opened, there is a reconciliation of: 1. the numbers of ballot papers in the box; 2. the numbers of ballot papers not used; and 3. the numbers of ballot papers issued and replaced as spoilt - these should add to the total number of ballot papers issued for that polling station within that polling place. (There can be two or more polling stations within one polling place - in Scotland.) Those who want access to real ballot data from real elections (STV-PR) will be interested to know that the full ballot data for each of the 21 wards (= local government electoral districts) within the City of Glasgow were published on the City Council's website at the conclusion of the count on 4 May 2007. No other Returning Officer has published the full ballot data in this way. The file of preference profiles was one of the automatic outputs from the eSTV counting program. It is arguable that in publishing the full ballot data, the Glasgow Returning Officer broke the current law, but no-one has demanded that he remove the data, and the Scottish Government is proposing to make this a requirement for all local government elections. This MAY be applied retrospectively so that we get all the data from the 2007 STV-PR elections. Meanwhile, the Glasgow data are invaluable resources for research, as they show what real voters do in real elections. James No virus found in this outgoing message. Checked by AVG - http://www.avg.com Version: 8.0.173 / Virus Database: 270.7.5/1706 - Release Date: 03/10/2008 18:17 Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
THANK YOU, Terry James. Plurality does fine with two candidates, or with one obvious winner over others. It is unable, even with top-two Runoffs, to satisfy voter needs to identify: Best - hoped for winner. Next - hoped for if best loses. Remainder - not as good as above. French voters, a few years ago, talked of rioting when they saw what Plurality offered to Runoff. Look at the this year's competition between Obama and Clinton - something more practically attended to in November, given a capable election method. DWK On Sat, 4 Oct 2008 09:29:54 -0400 Terry Bouricius wrote: To put a different slant on James Gilmour's message bout fraud vs. wasted votes under plurality voting... I'm sure Kathy Dopp (on this list for a few months now) will note that high level fraud is possible without detection on current voting technology, which is why systems should be universally subject to manual audits. On the other hand, current plurality voting doesn't just waste votes, it often elects the wrong candidate even WITHOUT any fraud. Under Plurality voting rules, a candidate can be declared elected who would lose in every possible one-on-one match up with each of the other candidates (the Condorcet Loser). This winner would also be outside the mutual-majority set (those candidates that a solid majority of all voters prefer over this plurality winner). The point is, that even with ZERO FRAUD, the current U.S. voting system regularly elects candidates that the majority of voters believe are the wrong ones. Some election integrity activists have taken the mistaken stance that no improvement in voting methods should be pursued until the fraud issue is perfectly fixed. But in the mean time honest elections, using our defective plurality voting method, regularly elect the wrong candidate. A bit like obsessing on fixing the rotten clapboard on the back of the barn, while ignoring that the barn door is wide open and the cows are leaving. Terry Bouricius - Original Message - From: James Gilmour [EMAIL PROTECTED] To: [EMAIL PROTECTED]; 'Dave Ketchum' [EMAIL PROTECTED] Cc: election-methods@lists.electorama.com Sent: Saturday, October 04, 2008 7:41 AM Subject: Re: [EM] Why We Shouldn't Count Votes with Machines Dave Ketchum wrote: Mixed into this, Plurality is easily done with paper; better systems, such as Condorcet, are difficult with paper, but easily handled with electronics. Kathy Dopp Sent: Saturday, October 04, 2008 1:24 AM Well that is a very good reason to avoid implementing them - because if they can't be easily done with paper ballots, then they cannot be assured to be counted accurately. This raises a very interesting point - how to balance the risk of failing to detect a low level of fraud against the known wasting of very large numbers of votes by the plurality voting system. (I say low level of fraud, because any high level should be readily detectable.) Of course, we don't want any fraud, and we don't want any fraud to go undetected, and we don't want the outcome of any election determined by fraud, no matter how low the level of that fraud may be. But to use the ease of detecting fraud as the sole criterion for selecting a voting system is almost certainly to lose sight of the much larger losses of votes that occur in every plurality election. In the UK, Canada and in most countries using plurality (except USA), the voting system discards the votes of around half of those who vote - sometimes a little more than half, sometimes a little less. In some plurality elections large numbers of the elected members are elected with only a minority of the votes cast in the single-member districts. The evidence on this is abundant and worldwide. The exception is the USA, where, for example, in elections to the House of Representatives, only one-third of the votes are wasted in this way. The reason is probably related to successful incumbent gerrymandering of the district boundaries and to the effects of holding primary elections. But even in the USA, around one-third of the votes are wasted by the plurality voting system. So to look at the overall picture with a voting system like plurality, should we reject any move to a voting system that would give effect to more of the votes actually cast because it might be more difficult to detect a low level of fraud in such a voting system? James -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Fri, 3 Oct 2008 18:24:09 -0600 Kathy Dopp wrote: On Fri, Oct 3, 2008 at 1:23 PM, Dave Ketchum [EMAIL PROTECTED] wrote: More complete defenses are possible with electronics. Totally FALSE statement. Sad that we cannot look at the same reality! Conceded that rogue programmers can do all kinds of destruction if permitted, we need to evict the rogues and proceed carefully. In fact there has never been even a theoretical design for an electronic voting system or even electronic paper ballot vote counting system that does not have known security leaks. This is not proof that quality is impossible. In fact some computer scientists just recently mathematically PROVED that it is impossible to even verify that the certified software is actually running on a voting machine. Tell us more, a bit more convincingly as to fact behind this opinion - assuming proper defenses. You are showing a lack of knowledge in the field of computer science by making such an obviously false, already disproven statement. Luckily most people disagree with your incorrect opinion and another state, KY just joined the list of states planning to scrap unauditable e-ballot voting systems, joining, TN, IA, FL, CA, MD, and a few other states and a lot of other counties that don't immediately come to mind now. Sad that we have been afflicted with such a surplus of failures, complicated by fact that many of them could and should have been recognized as such, and disposed of earlier in their life. Mixed into this, Plurality is easily done with paper; better systems, such as Condorcet, are difficult with paper, but easily handled with electronics. Well that is a very good reason to avoid implementing them - because if they can't be easily done with paper ballots, then they cannot be assured to be counted accurately. Mixed in with this is Plurality's inability to accurately measure and count voters' true desires - a reason for looking for a more accurate method, even if it may be more difficult to perform. Watch this film for an education. It's great. http://www.cs.ucsb.edu/~seclab/projects/voting/ They truly did look for, and found, bunches of flaws. Cheers, Kathy -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Fri, Oct 3, 2008 at 11:26 AM, Dave Ketchum [EMAIL PROTECTED] wrote: ANYTHING cam get tampered with if enough doors are left ajar, including paper ballots (such as discarding, editing, or replacing some). True, but paper ballots must be tampered with one at a time and it takes many many more persons to affect any election by tampering with paper ballots. Whereas electronic ballots can be tampered with en masse by one rogue programmer who can fraudulently alter an entire county's or an entire state's election outcomes. The risk is far greater for electronic fraud which is also much more difficult to detect and secure against. Paper ballots are much easier to secure in a way that is understandable and transparent to citizens and far more difficult (would take a far larger conspiracy) to tamper with. Watch this film for an education. It's great. http://www.cs.ucsb.edu/~seclab/projects/voting/ Cheers, Kathy Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Fri, 3 Oct 2008 11:45:16 -0600 Kathy Dopp wrote: On Fri, Oct 3, 2008 at 11:26 AM, Dave Ketchum [EMAIL PROTECTED] wrote: ANYTHING cam get tampered with if enough doors are left ajar, including paper ballots (such as discarding, editing, or replacing some). True, but paper ballots must be tampered with one at a time and it takes many many more persons to affect any election by tampering with paper ballots. Whereas electronic ballots can be tampered with en masse by one rogue programmer who can fraudulently alter an entire county's or an entire state's election outcomes. Paper ballots can be discarded a handful or a boxful at a time. Rogue programmers SHOULD NOT be invited in, and the real programmers should provide for noticing if such sneak in. The risk is far greater for electronic fraud which is also much more difficult to detect and secure against. Paper ballots are much easier to secure in a way that is understandable and transparent to citizens and far more difficult (would take a far larger conspiracy) to tamper with. Agreed that unprotected electronic ballots can suffer major theft beyond what can happen to paper ballots. More complete defenses are possible with electronics. Mixed into this, Plurality is easily done with paper; better systems, such as Condorcet, are difficult with paper, but easily handled with electronics. Watch this film for an education. It's great. http://www.cs.ucsb.edu/~seclab/projects/voting/ Cheers, Kathy -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Fri, Oct 3, 2008 at 1:23 PM, Dave Ketchum [EMAIL PROTECTED] wrote: More complete defenses are possible with electronics. Totally FALSE statement. In fact there has never been even a theoretical design for an electronic voting system or even electronic paper ballot vote counting system that does not have known security leaks. In fact some computer scientists just recently mathematically PROVED that it is impossible to even verify that the certified software is actually running on a voting machine. You are showing a lack of knowledge in the field of computer science by making such an obviously false, already disproven statement. Luckily most people disagree with your incorrect opinion and another state, KY just joined the list of states planning to scrap unauditable e-ballot voting systems, joining, TN, IA, FL, CA, MD, and a few other states and a lot of other counties that don't immediately come to mind now. Mixed into this, Plurality is easily done with paper; better systems, such as Condorcet, are difficult with paper, but easily handled with electronics. Well that is a very good reason to avoid implementing them - because if they can't be easily done with paper ballots, then they cannot be assured to be counted accurately. Watch this film for an education. It's great. http://www.cs.ucsb.edu/~seclab/projects/voting/ Cheers, Kathy Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Thu, Aug 28, 2008 at 12:00 PM, James Gilmour [EMAIL PROTECTED] wrote: Here in Scotland there is a somewhat hidden debate that must be had. STV-PR was introduced for local government elections in 2007. The counting rules adopted (Weighted Inclusive Gregory Method for consequential transfers) make electronic counting almost obligatory. (Manual counting to WIGM rules is possible, but long and tedious because so many ballot papers have to be sorted and counted again and again.) So we used scanners, OCR conversion and e-counting. That is similar to Abd's ballot imaging suggestion. I assume that the images used for the OCR aren't made available to the public? The Scottish Government is promoting further use of STV-PR for various directly elected bodies. This is raising issues about the long-term provision of the equipment necessary for e-processing of the ballot papers for all these different public elections and about the software that will be used for scanning, OCR and counting. This can be solved by just publishing the ballot images. This way everyone can work out their own result. Concerns about black box processing have been somewhat muted so far, but there have been calls for all blank ballot papers to be subject to individual adjudication by the Returning Officer under scrutiny of the candidates and their agents. This is an example of the ridiculous double-standards that are being applied to e-processing, because straightforward blank ballot papers would never be subject to Returning Officer adjudication in a manual count. A blank ballot is one that has no writing on it, or one that is not used? Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Ralph wrote: This can be solved by just publishing the ballot images. This way everyone can work out their own result. Note that in Burlington (Vermont, USA), all of the ranked ballot images (text file, not graphical images, unfortunately) are posted on the Internet after the election, along with tallying software and instructions on how to conduct your own IRV tally using any spread sheet software. You can see the actual city web site here: http://www.burlingtonvotes.org/20060307/ Terry Bouricius - Original Message - From: Raph Frank [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: Dave Ketchum [EMAIL PROTECTED]; election-methods@lists.electorama.com Sent: Thursday, October 02, 2008 6:26 PM Subject: Re: [EM] Why We Shouldn't Count Votes with Machines On Thu, Aug 28, 2008 at 12:00 PM, James Gilmour [EMAIL PROTECTED] wrote: Here in Scotland there is a somewhat hidden debate that must be had. STV-PR was introduced for local government elections in 2007. The counting rules adopted (Weighted Inclusive Gregory Method for consequential transfers) make electronic counting almost obligatory. (Manual counting to WIGM rules is possible, but long and tedious because so many ballot papers have to be sorted and counted again and again.) So we used scanners, OCR conversion and e-counting. That is similar to Abd's ballot imaging suggestion. I assume that the images used for the OCR aren't made available to the public? The Scottish Government is promoting further use of STV-PR for various directly elected bodies. This is raising issues about the long-term provision of the equipment necessary for e-processing of the ballot papers for all these different public elections and about the software that will be used for scanning, OCR and counting. This can be solved by just publishing the ballot images. This way everyone can work out their own result. Concerns about black box processing have been somewhat muted so far, but there have been calls for all blank ballot papers to be subject to individual adjudication by the Returning Officer under scrutiny of the candidates and their agents. This is an example of the ridiculous double-standards that are being applied to e-processing, because straightforward blank ballot papers would never be subject to Returning Officer adjudication in a manual count. A blank ballot is one that has no writing on it, or one that is not used? Election-Methods mailing list - see http://electorama.com/em for list info Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
James, Nice sales piece for electronic ballot rigging machines that fails to mention that it is impossible to ensure that e-votes are not tampered with. Here is a great film done by graduate students at the University of California, Santa Barbara in their Computer Security Group who show how easy it is to rig elections with any e-ballot voting machines - in four different ways that would subvert any post-election audits - because even the voter verifiable paper ballot records are easily rigged to match fraudulent vote totals: http://www.cs.ucsb.edu/~seclab/projects/voting/ The graduate students' film is easy for any lay person to understand. It requires no computer expertise to follow. It is amazing the utter cr-- that voting machine vendors and election officials continue to put out to the press that is contrary to all fact and common sense. Cheers, Kathy Date: Thu, 2 Oct 2008 21:58:39 +0100 From: James Gilmour [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines I thought this might be of interest: BBC Digital Planet takes a look at Brazil's e-voting system http://news.bbc.co.uk/1/low/technology/7644751.stm James Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Dave Ketchum Sent: Thursday, August 28, 2008 4:54 AM Regrettably James is making an incorrect analysis of the problem. Oh dear! I never thought for one moment that posting a link to a relevant news item for information would be taken as necessarily signifying my agreement with its content. If you look at my message, you will see there is no comment at all from me. But just to make sure, beyond all peradventure of a doubt, Inclusion of a news item should not be taken to imply endorsement by this sender. This debate is fascinating, especially as there are such divergent and polarised views. It has surfaced in various other web groups concerned with e-participation and e-democracy. On the one hand there are some, and some countries, completely opposed to any electronic processing of ballot papers in public elections, never mind the use of electronic voting machines of any kind. At the other extreme, we have countries like Estonia where e-voting for public elections has been fully embraced, apparently with few reservations: registered electors can vote from their own laptops wherever they might be. Here in Scotland there is a somewhat hidden debate that must be had. STV-PR was introduced for local government elections in 2007. The counting rules adopted (Weighted Inclusive Gregory Method for consequential transfers) make electronic counting almost obligatory. (Manual counting to WIGM rules is possible, but long and tedious because so many ballot papers have to be sorted and counted again and again.) So we used scanners, OCR conversion and e-counting. The Scottish Government is promoting further use of STV-PR for various directly elected bodies. This is raising issues about the long-term provision of the equipment necessary for e-processing of the ballot papers for all these different public elections and about the software that will be used for scanning, OCR and counting. Concerns about black box processing have been somewhat muted so far, but there have been calls for all blank ballot papers to be subject to individual adjudication by the Returning Officer under scrutiny of the candidates and their agents. This is an example of the ridiculous double-standards that are being applied to e-processing, because straightforward blank ballot papers would never be subject to Returning Officer adjudication in a manual count. James No virus found in this outgoing message. Checked by AVG. Version: 7.5.526 / Virus Database: 270.6.10/1638 - Release Date: 27/08/2008 19:06 Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Here's an alternative view from the ones I highlighted yesterday, and from the same source: Resurrecting E-voting http://blogs.zdnet.com/Murphy/?p=1228tag=nl.e019 As before, with no endorsement intended, and I would not presume to comment on the technical content. JG No virus found in this outgoing message. Checked by AVG. Version: 7.5.526 / Virus Database: 270.6.10/1638 - Release Date: 27/08/2008 19:06 Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Wed, 27 Aug 2008 22:16:53 -0600 Kathy Dopp wrote: From: Dave Ketchum [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines Regrettably James is making an incorrect analysis of the problem. I believe that is a mischaracterization because James' prior email simply cited some recent articles. And James says so now. Still, it was easy to assume his references implied agreement with their obvious position. The references that you provided below seemed to have the same slant as his. BETTER to accept that computers are truly as dependable as their successful use elsewhere demonstrates, So since computers work well for problems like banking where errors are easily detected and corrected due to a lack of anonymity and paper receipts and banking statements, then we should use computers for anonymously deposited e-ballots where errors can be virtually impossible to detect and even more impossible (if that were possible) to correct? Not good logic unless you think that we should anonymously deposit our money into banks without any receipts or bank statements and *trust* bankers blindly too. Except for the anonymity that we properly provide for voters, you have it backwards: That anonymity is not a license to produce election equipment: Without attention to getting the details right, including minimizing likelihood of trouble from human errors. Including deliberate falsification of results. Nor is it a license to purchase such without attention to the quality being supplied. Here are some recent articles on this topic (all these articles were I believe published in August 2008): ... Kathy -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Dancing on E-voting’s grave http://blogs.zdnet.com/Murphy/?p=1227tag=nl.e019 Election loser: touch-screen voting http://www.newsobserver.com/politics/story/1185482.html JG No virus found in this outgoing message. Checked by AVG. Version: 7.5.526 / Virus Database: 270.6.9/1636 - Release Date: 26/08/2008 19:09 Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Regrettably James is making an incorrect analysis of the problem. Agreed that there have been some expensive disasters associated with computers and voting. ASSUMING computers were as unreliable as James' sources imply, we had best retreat from our computer-based civilization, much of which depends on computers reliably doing their part. BETTER to accept that computers are truly as dependable as their successful use elsewhere demonstrates, study how we stumbled into our election disasters, and plan to do better in the future. DWK On Wed, 27 Aug 2008 14:57:39 +0100 James Gilmour wrote: Dancing on E-voting’s grave http://blogs.zdnet.com/Murphy/?p=1227tag=nl.e019 Election loser: touch-screen voting http://www.newsobserver.com/politics/story/1185482.html JG -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
From: Dave Ketchum [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines Regrettably James is making an incorrect analysis of the problem. I believe that is a mischaracterization because James' prior email simply cited some recent articles. BETTER to accept that computers are truly as dependable as their successful use elsewhere demonstrates, So since computers work well for problems like banking where errors are easily detected and corrected due to a lack of anonymity and paper receipts and banking statements, then we should use computers for anonymously deposited e-ballots where errors can be virtually impossible to detect and even more impossible (if that were possible) to correct? Not good logic unless you think that we should anonymously deposit our money into banks without any receipts or bank statements and *trust* bankers blindly too. Here are some recent articles on this topic (all these articles were I believe published in August 2008): AP USA Today: States throw out costly electronic voting machines Aug. 19, 2008 http://ap.google.com/article/ALeqM5jej6XIWrQn6-gw5O5bJa1ELx78DgD92LK3E00 http://ap.google.com/article/ALeqM5jej6XIWrQn6-gw5O5bJa1ELx78DgD92LLDO00 http://www.usatoday.com/news/politics/election2008/2008-08-19-electronic-voting_N.htm Scientific American: Planning to E-Vote? Read This First, Aug. 18, 2008 http://www.sciam.com/article.cfm?id=electronic-election-day CBS News: Voting Machine Doubts Linger, Aug. 16, 2008 Concerns Over Vulnerability Of Electronic Machines Sending Many States Back To Paper Ballots http://www.cbsnews.com/stories/2008/08/16/eveningnews/main4355733.shtml NY Times: Officials Say Flaws at Polls Will Remain in November, Aug. 16, 2008 [NOTE: Officials in two states admit that their voting machines are not accurately casting or counting votes] http://www.nytimes.com/2008/08/16/us/politics/16vote.html http://www.nytimes.com/2008/08/16/us/politics/16vote.html Washington Post: Ohio Voting Machines Contained Programming Error That Dropped Votes, Aug. 21, 2008 [Note: States like MD with paperless voting cannot detect the errors in the vote counts via valid audits. States like OH and UT can detect the dropped votes *if* they do valid audits (Utah does not.)] http://voices.washingtonpost.com/the-trail/2008/08/21/ohio_voting_machines_contained.html Company acknowledges voting machine error, Aug. 21, 2008 http://www.ohio.com/news/ap?articleID=688274c=y Ohio's voting machine glitch exposed - Touch-screens can't be fixed before election, Brunner says Thursday, August 21, 2008 8:34 PM http://dispatch.com/live/content/local_news/stories/2008/08/21/voting_machines.html?sid=101 Did Washington waste millions on faulty voting machines? Aug 15, 2008 http://www.mcclatchydc.com/election2008/story/48508.html Voting System Standards: All Form and No Substance, June 12, 2008 http://washburnsworld.blogspot.com/2008/06/voting-system-standards-all-form-and-no.html States seek workarounds for e-voting systems http://www.securityfocus.com/brief/803 How do you compare security across voting systems? http://www.freedom-to-tinker.com/?p=1367 http://accurate-voting.org/wp-content/uploads/2008/08/risk-eval-final.pdf http://www.josephhall.org/nqb2/index.php/2008/08/16/nakedeval States rush to dump touch-screen voting systems, Aug. 21, 2008 http://arstechnica.com/news.ars/post/20080820-states-rush-to-dump-touchscreen-voting-systems.html Vote fraud, crumbling democracy's bedrock, Aug. 21, 2008 http://www.philly.com/philly/entertainment/20080822_Vote_fraud__crumbling_democracy_s_bedrock.html Voting Machines Can Never Be Trusted Says GOP Computer Security Expert http://freeinternetpress.com/story.php?sid=18097 VIDEOS: Republican computer expert re need to have audited paper ballots http://realhistoryarchives.blogspot.com/2008/08/republican-computer-expert-re-need-to.html U-Tube UNCOUNTED CLIPS: WEEK 7: The Electronic Voting Machine Hokey Pokey (You Put Your Right Vote In. It Spits Your Wrong Vote Out http://www.youtube.com/watch?v=yqsL-KNiYJ8 DIEBOLD[/Premier] ADMITS TO MAJOR ACCURACY FLAWS, Aug. 2008 http://www.youtube.com/watch?v=Ey2TrJvtGN8 and Lou Dobbs: CNN - Democracy at Risk - A voting machine company admits to software flaws in Ohio elections. Kitty Pilgrim reports. http://www.cnn.com/video/#/video/bestoftv/2008/08/21/ldt.pilgrim.democracy.at.risk.cnn Diebold/Premier Actually Admits Its Machines Are Faulty! And That It Lied About Antivirus Software... from the wonders-never-cease dept http://www.techdirt.com/articles/20080822/0352532064.shtml E-voting vendor: Programming errors caused dropped votes http://www.networkworld.com/news/2008/082208-e-voting-vendor-programming-errors-caused.html Vote-Dropping Software Bug Could Gum Up Elections http://www.linuxinsider.com/story/Vote-Dropping-Software-Bug-Could-Gum-Up-Elections-64259.html Company admits voting machine error http://www.usatoday.com/news/politics/election2008/2008-08-21-voting
Re: [EM] Why We Shouldn't Count Votes with Machines
Date: Sat, 23 Aug 2008 01:02:44 -0400 From: Dave Ketchum [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines Federal certification? The many horror stories tell us either: Equipment is failing that has never been certified or The certifiers are signing off without bothering to look seriously for the many defects in the offered systems, The second scenario is true, and there are loopholes in the standards which allow systems to be certified despite not meeting the standards. Thus the certification process needs overhauling. Yes, but certifying voting systems is a fundamentally flawed concept anyway, because if the software is changed at all, then it is not certified any longer and many states require that only certified software is used. This makes it legally impossible to do security and bug fixes because it can take a year (or perhaps more, but a really long time) to get a new voting system software federally certified. Smart State Election Officials are beginning to see that federal certification is not a good idea, but many states would have to get the legislatures to change state statutes to no longer require federal certification of their voting machines. The state with one of the best, most economical voting system is Oklahoma who programmed their own paper ballot voting system rather than buying one from a vendor so OK uses standard optical scanners to count their paper ballots. I would think that this means that OK could possibly have an open source voting system. I heard that OK decided to forgo taking Help America Vote Act funds for a new voting system. Cheers, Kathy Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Dave Ketchum wrote: You claim that many fragments can be done by specialized machines. AGREED, though I do not agree that they can do it any better than a normal computer - which has equivalent capability. In a technical capacity, of course not. Since a computer is Turing-complete, it can do anything the specialized machines can. However, and this is the point I've been trying to make, the specialized machines are simple enough that it's possible to formally prove that they do only what they're intended to do, and perhaps also to convince the voters that this is the case. It's kind of like the difference between physics and mathematics. Doing tests is analogous to the hypothesis testing of physics: you can say that this particular machine does not exhibit any flaws that would compromise security, within some margin of error. However, if the machines are sufficiently simple, then one can use formal proving to show, mathematically, that there are no bugs; that the Condorcet counter will turn ballot records into Condorcet matrices and no more - that the machine with buttons on it will register votes, register them to the candidate shown on the display, and no more, and so on. Now, the analogy is not total. Even a correct hardware system could be compromised by vendors adding backdoors to their fabrication (going outside of the spec) and so on, but those errors are much harder to conceal than simple software tinkering. Even if the software is open source (as you've stated that you want), knowing the full limits of the hardware keeps hackers out. The more complex the OS, the greater the chance that there's a bug: even Linux has had privilege escalation bugs, although they appear much less frequently than in closed-source software. What I'm saying here is that if you have to have machines, have a way of saying to, first, the experts that there is no way there can be an error, and second (if possible), the same to the ordinary voters as well. However, the whole task involves connecting the fragments: One way is via computer capability. You seem to be doing without such, so What do you have other than humans HOPEFULLY correctly following a HOPEFULLY correct and complete script? That's right - the links are the weak spots. The script can be devised just as any programming can be, and it would be quite simple, and ideally reminiscent of what one does when having a manual count regime. The PROMs or CDs are the ballot boxes, and they're transported from one location to another as one would ballot boxes. That leaves the humans. The humans may do weird things, and the ensured limits that the specialized hardware would have would obviously not apply to them. But since the script is simple, various parties can monitor each other. In the worst case, the transportation and aggregation parts of the process are as insecure as they would be for manual ballots. If that is still too risky, the ballot boxes could be numbered and digitally signed prior to being distributed to the machines for writing, so that if any are lost or replaced, it would immediately show up as an error. Such a process would add steps to the script, but I think it'd be managable. Consider a general computer. Even for general computers, it makes little sense to have the district joining software - that counts the results from various districts and sum them up in the case of a summable method - on the individual units. As such, the general-purpose computers are already specialized, only in software instead of hardware. ??? That was simply intended to show that you don't need the full powers of a computer. It's convenient, but that convenience can tilt in the favor of manipulators or hackers as well. That's true. Maybe a compromise could be using cheap computer hardware with read-only software, standardized components, and have the software not be a full OS, but instead just enough to get the job done and be provable. You'd have to rely on that there are no hardware backdoors, but the existence of such would be very unlikely, and the entire thing would have to be put inside some sort of tamper-resistant enclosure so hackers can't attach keyloggers or do similar things. Hardware backdoors can be hard to find. Still, if and when one is found, can there not be an appropriate punishment to discourage such crimes in the future? Agreed defense against such as keyloggers is essential. I still say OPEN SOURCE! I was thinking more of hardware keyloggers, such as those that look like keyboard extension cords. Thus the computer should be tamper resistant so you can't just do these things. Ideally, for the cheap computer compromise, you'd use a cryptoprocessor (like banks use to keep their keys, but more general purpose) to run the actual software - perhaps an IBM 4758, though since I'm not a hardware expert I don't know if that one is sufficiently powerful to do what
Re: [EM] Why We Shouldn't Count Votes with Machines
Kathy Dopp wrote: On Thu, Aug 21, 2008 at 10:00 PM, Dave Ketchum [EMAIL PROTECTED] wrote: First, this is not intended to be used in a zillion precincts - just to validate the programs. OK. Well if you don't care about validating the election outcome accuracy, and just want to verify the small amount of programs on voting machines that pertain to voting, then you could do parallel (Election Day) sampling of memory cards (memory cards unbelievably have today interpreted code on them on most voting systems) like the University of CT engineering dept. has designed for checking the voting code on CT's voting systems. That's bad design. The election machine shouldn't have code that can be simply replaced by switching memory cards. The code should be loaded at some time prior to the election and then locked in, and the machine should verify that it's the right code, perhaps by checking a digital signature. Anything less is, well, just bad. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Federal certification? The many horror stories tell us either: Equipment is failing that has never been certified or The certifiers are signing off without bothering to look seriously for the many defects in the offered systems, Thus the certification process needs overhauling. I said nothing of such as central tabulators. Certainly quality needs attending to here, but voter anonymity should not be a problem here. On Thu, 21 Aug 2008 22:22:41 -0600 Kathy Dopp wrote: On Thu, Aug 21, 2008 at 10:00 PM, Dave Ketchum [EMAIL PROTECTED] wrote: First, this is not intended to be used in a zillion precincts - just to validate the programs. OK. Well if you don't care about validating the election outcome accuracy, and just want to verify the small amount of programs on voting machines that pertain to voting, then you could do parallel (Election Day) sampling of memory cards (memory cards unbelievably have today interpreted code on them on most voting systems) like the University of CT engineering dept. has designed for checking the voting code on CT's voting systems. My own focus is on ensuring that voters decide who governs them by checking the accuracy of the election outcomes instead. I assume properly certified systems, only demonstrating to voters that they truly behave as such. I am not interested in memory cards, as such - if such are used, the certifiers should have considered proper installation and use. But part of the requirement on the program installation is that it be impractical to alter it undetectably. OK. So how many billions of dollars do you want to allocate to your new voting system and voting program design? And you do understand that it will not ensure that the election outcomes are accurate right? Certainly want correct outcomes. Major requirement is developers with the right mindset, plus reasonable skill. Do not see this costing billions - more than many present efforts, but usable by many precincts. 1. potentially violates voter privacy That is the reason for letting voters CHOOSE whether to volunteer for this. Oh. I see, so you want voters to choose to give up their ballot privacy. Hmmm. You do realize that could/would enable vote buying not just for mail-in voting like today, but also for precinct voting? Needs thought. Look for needed use of the tapes while making vote buying as impractical as possible. 2. video can be digitally altered, segments deleted (is more volatile than paper ballots) So there needs to be extra effort to avoid such. Extra effort and expense and complexity and you are going to first convince the public to double their budget for elections so that you can remove the voter from voter-verification so that we can have video verification? Not something to do at many precincts. Do not see it as being as expensive as you imply. 3. another expensive toy (video cameras) that would have to be kept running during elections, maintained between elections, tested, certified, etc. Sounds like overkill. What more is needed than cameras that can be borrowed for use as needed? OK. So now you plan to change the election statutes in almost all states too, so that federal certification and testing are no longer required for voting systems? As I say above, what has been called federal certification apparently needs to be replaced by testing whether the equipment offered can really do the job. Gee, does anyone on this list ever consider practical real life situations when you devise your solutions? I do consider. Do not know what proper equipment would cost, but believe we could get closer than where we are now. 4. auditing video tapes would be much slower (more administratively burdensome) than auditing paper ballots Auditing is not clear to me - must read all the ballots off the tape - part of deciding how many voting machines to do this on. I thought you already said that only some machines are selected prior to the election for videoing, so that all the unselected machine counts can be undetectably altered to match erroneous election results? They are all supposed to be using the same programs - which are supposed to defend against what you suggest. Since your aim is not to ensure accurate election outcomes and only to check some of the vote counting software on the individual machines, and not on the central tabulator and not check the accuracy of the election outcomes, I'm not sure how you plan to calculate the amount of voting machines to do this on? There are supposed to be proper programs everywhere. Topic here is enough verification to satisfy voters that we are saying goodby to the horror stories. When calculating audit amounts with the goal of assuring correct election outcomes, the mathematics depend on the reported election results and the total number of reported auditable vote counts. I am not talking of auditing. 5. selecting the
Re: [EM] Why We Shouldn't Count Votes with Machines
4. Re: Why We Shouldn't Count Votes with Machines (Dave Ketchum) On Sun, 17 Aug 2008 11:14:34 +0200 Kristofer Munsterhjelm wrote: Dave Ketchum wrote: I DO NOT like printout-based machines. To start some thinking, how about: All machines have identical valid code, Some have video cameras recording the ballot as the voter submits it. Voters choose which machines to vote on. Audit that tapes prove 100% correctness of those machines taped - BETTER be. Just a few objections come to mind for that solution David: 1. potentially violates voter privacy 2. video can be digitally altered, segments deleted (is more volatile than paper ballots) 3. another expensive toy (video cameras) that would have to be kept running during elections, maintained between elections, tested, certified, etc. 4. auditing video tapes would be much slower (more administratively burdensome) than auditing paper ballots 5. selecting the machines to be videotaped prior to the election tells any inside fraudsters which machines can be undetectably tampered with or have their votes altered during or after the election (valid auditing requires only selecting the random audit units AFTER all the auditable vote counts have been publicly posted after the polls close (as in any field, the data must be committed prior to auditing it) A response giving more details of why election integrity advocates oppose such video systems is included in this post that I wrote upon request of the Election Defense Alliance: http://electionarchive.org/ucvInfo/US/legislation/S3212BennettFeinsteinBill2008.pdf Cheers, Kathy Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Thu, 21 Aug 2008 16:37:32 -0600 Kathy Dopp wrote: 4. Re: Why We Shouldn't Count Votes with Machines (Dave Ketchum) On Sun, 17 Aug 2008 11:14:34 +0200 Kristofer Munsterhjelm wrote: Dave Ketchum wrote: I DO NOT like printout-based machines. To start some thinking, how about: All machines have identical valid code, Some have video cameras recording the ballot as the voter submits it. Voters choose which machines to vote on. Audit that tapes prove 100% correctness of those machines taped - BETTER be. Just a few objections come to mind for that solution David: First, this is not intended to be used in a zillion precincts - just to validate the programs. But part of the requirement on the program installation is that it be impractical to alter it undetectably. 1. potentially violates voter privacy That is the reason for letting voters CHOOSE whether to volunteer for this. 2. video can be digitally altered, segments deleted (is more volatile than paper ballots) So there needs to be extra effort to avoid such. 3. another expensive toy (video cameras) that would have to be kept running during elections, maintained between elections, tested, certified, etc. Sounds like overkill. What more is needed than cameras that can be borrowed for use as needed? 4. auditing video tapes would be much slower (more administratively burdensome) than auditing paper ballots Auditing is not clear to me - must read all the ballots off the tape - part of deciding how many voting machines to do this on. 5. selecting the machines to be videotaped prior to the election tells any inside fraudsters which machines can be undetectably tampered with or have their votes altered during or after the election (valid auditing requires only selecting the random audit units AFTER all the auditable vote counts have been publicly posted after the polls close (as in any field, the data must be committed prior to auditing it) Then I am not proposing auditing as such. The programs used need to make fraud difficult, and undetectable fraud VERY difficult, wherever used, whether or not a particular machine is taped. Again, my purpose is validating a program, rather than a particular election. A response giving more details of why election integrity advocates oppose such video systems is included in this post that I wrote upon request of the Election Defense Alliance: http://electionarchive.org/ucvInfo/US/legislation/S3212BennettFeinsteinBill2008.pdf Cheers, Kathy -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Thu, Aug 21, 2008 at 10:00 PM, Dave Ketchum [EMAIL PROTECTED] wrote: First, this is not intended to be used in a zillion precincts - just to validate the programs. OK. Well if you don't care about validating the election outcome accuracy, and just want to verify the small amount of programs on voting machines that pertain to voting, then you could do parallel (Election Day) sampling of memory cards (memory cards unbelievably have today interpreted code on them on most voting systems) like the University of CT engineering dept. has designed for checking the voting code on CT's voting systems. My own focus is on ensuring that voters decide who governs them by checking the accuracy of the election outcomes instead. But part of the requirement on the program installation is that it be impractical to alter it undetectably. OK. So how many billions of dollars do you want to allocate to your new voting system and voting program design? And you do understand that it will not ensure that the election outcomes are accurate right? 1. potentially violates voter privacy That is the reason for letting voters CHOOSE whether to volunteer for this. Oh. I see, so you want voters to choose to give up their ballot privacy. Hmmm. You do realize that could/would enable vote buying not just for mail-in voting like today, but also for precinct voting? 2. video can be digitally altered, segments deleted (is more volatile than paper ballots) So there needs to be extra effort to avoid such. Extra effort and expense and complexity and you are going to first convince the public to double their budget for elections so that you can remove the voter from voter-verification so that we can have video verification? 3. another expensive toy (video cameras) that would have to be kept running during elections, maintained between elections, tested, certified, etc. Sounds like overkill. What more is needed than cameras that can be borrowed for use as needed? OK. So now you plan to change the election statutes in almost all states too, so that federal certification and testing are no longer required for voting systems? Gee, does anyone on this list ever consider practical real life situations when you devise your solutions? 4. auditing video tapes would be much slower (more administratively burdensome) than auditing paper ballots Auditing is not clear to me - must read all the ballots off the tape - part of deciding how many voting machines to do this on. I thought you already said that only some machines are selected prior to the election for videoing, so that all the unselected machine counts can be undetectably altered to match erroneous election results? Since your aim is not to ensure accurate election outcomes and only to check some of the vote counting software on the individual machines, and not on the central tabulator and not check the accuracy of the election outcomes, I'm not sure how you plan to calculate the amount of voting machines to do this on? When calculating audit amounts with the goal of assuring correct election outcomes, the mathematics depend on the reported election results and the total number of reported auditable vote counts. 5. selecting the machines to be videotaped prior to the election tells any inside fraudsters which machines can be undetectably tampered with or have their votes altered during or after the election (valid auditing requires only selecting the random audit units AFTER all the auditable vote counts have been publicly posted after the polls close (as in any field, the data must be committed prior to auditing it) Then I am not proposing auditing as such. Yes. I understand that your goal is obviously not to ensure that the election outcomes are correct, but only to test the voting software on some machines selected at the beginning of the election. Obviously there are a lot of ways to fraudulently manipulate election outcomes with using your costly administratively burdensome procedure of adding video machines that film voters' screens while voting. The programs used need to make fraud difficult, and undetectable fraud VERY difficult, wherever used, whether or not a particular machine is taped. Again, my purpose is validating a program, rather than a particular election. Yes. Thanks for explaining that. I am more concerned about whether or not voters are the decision-makers in who governs them and really am not interested in spending gobs of money and complicating elections just to video some individual voting machines during the election. Cheers, Kathy Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Sun, 17 Aug 2008 11:14:34 +0200 Kristofer Munsterhjelm wrote:
Dave Ketchum wrote:
So you're saying that computers are better than specialized machines?
I'm not sure that's what you say (rather than that machines are
better than paper ballots), but I'll assume that.
Your specialized machines can each do a fragment of the task. However,
dependably composing a capable whole from them requires big efforts
from humans.
Composing the same capability whole from a computer and adequate
programming can be easier.
Each does a fragment of the task, yes; that's the point of modular
design, so that you can treat the local units differently from the
central units and don't have to prove everything everywhere.
You claim that many fragments can be done by specialized machines.
AGREED, though I do not agree that they can do it any better than a
normal computer - which has equivalent capability.
However, the whole task involves connecting the fragments:
One way is via computer capability.
You seem to be doing without such, so What do you have other
than humans HOPEFULLY correctly following a HOPEFULLY correct and
complete script?
Consider a general computer. Even for general computers, it makes little
sense to have the district joining software - that counts the results
from various districts and sum them up in the case of a summable method
- on the individual units. As such, the general-purpose computers are
already specialized, only in software instead of hardware.
???
Because the specialized machines are simpler than computers, once
mass production gets into action, they should be cheaper. The best
here would probably be to have some sort of independent organization
or open-source analog draw up the plans, and then have various
companies produce the components to spec.
They can be cheaper by not doing the complete task - make the task an
election system and the cost goes up and dependability becomes expensive.
By extension, they can be cheaper by, in concert, doing just enough and
no more. One doesn't need Turing-completeness to count an election.
(Perhaps unless it's Kemeny.)
Se my above note.
The simplicity of voting could also count against general-purpose
computers as far as manual labor is concerned. If the machine has
been proved to work, you don't need to know what Access (yes, Diebold
used Access) is to count the votes, and you don't need a sysadmin
present in case the system goes to a blue screen.
You need equivalent of a sysadmin to sort out getting a whole composed
of your specialized machines.
The way I would set up the system, there would be different counting
units. The group of units would need a person to unlock them each time
a new voter wants to vote; that could be included in the design so that
you don't need a system administrator for it. Then, once the election
day is over, gather the read-only media (CD or programmable ROM), and
either send them or the summable result (given by a second machine) to
the central. Count and announce as you get higher up in the hierarchy.
If the components are constructed correctly, and proved to be so (which
can be done because of the units' relative simplicity), then there won't
be any bluescreens and little need for maintenance - except for cases
where the machines simply break.
In this manner, the setup is more like paper balloting than it is to
ordinary computer systems. The read-only media take the place of the
ballot box, and the aggregating machines the place of the election count
workers.
Computers get cheaper and cheaper - think of what is hidden inside a
cell phone.
That's true. Maybe a compromise could be using cheap computer hardware
with read-only software, standardized components, and have the software
not be a full OS, but instead just enough to get the job done and be
provable. You'd have to rely on that there are no hardware backdoors,
but the existence of such would be very unlikely, and the entire thing
would have to be put inside some sort of tamper-resistant enclosure so
hackers can't attach keyloggers or do similar things.
Hardware backdoors can be hard to find. Still, if and when one is
found, can there not be an appropriate punishment to discourage such
crimes in the future?
Agreed defense against such as keyloggers is essential.
I still say OPEN SOURCE!
That's true, but it's still fairly simple. Assume the ranked ballot
is in the form of rank[candidate] = position, so that if candidate X
was ranked first, rank[X] = 0. (Or 1 for that matter, I just count
from zero because I know programming)
Then the simple nested loop goes like this:
for (outer = 0; outer num_candidates; ++outer) {
for (inner = 0; inner num_candidates; ++inner) {
if (rank[outer] rank[inner]) { // if outer has higher rank
condorcet_matrix[outer][inner] += 1; // increment
}
}
}
What ran this loop outside a computer?
A chip with just
Re: [EM] Why We Shouldn't Count Votes with Machines
Rob, As I said, I am not responding to any more of your unsupported internal chatter/attacks. Instead here is interesting news coverage today by CBS news: Voting Machine Doubts Linger - Concerns Over Vulnerability Of Electronic Machines Sending Many States Back To Paper Ballots http://www.cbsnews.com/stories/2008/08/16/eveningnews/main4355733.shtml Most of the country, thankfully *is* beginning to get the concepts that I've been trying to explain for why only voter marked paper ballots and routine scientific post-election audits provide a way to publicly verify the accuracy of election outcomes in a way that the public can comprehend and support. This CBS article *gets it*. For the best election auditing legislative proposal, reviewed by election officials, and statisticians and mathematicians who are experts in election auditing mathematics, please review this and see how it would work for your pet voting method: http://electionarchive.org/ucvAnalysis/US/paper-audits/VoteCountAuditBillRequest.pdf You will not be able to provide information or data to support the assertion that US election outcomes are mostly accurate today due to the lack of any scientific independent post-election auditing in all US states and lack of public access to election records, lack of ballot security, lack of any public oversight over ballot security, lack of timely public access to election records, and lack of post-election ballot reconciliation. I know of NO state, not even one, which employs all the fundamentals which would demonstrate the accuracy of its election outcomes. The U.S. currently has a voting system that is wide-open to outcome-altering vote fraud in almost all states. It is naive to imagine that no insiders take advantage of this susceptibility and unaccountability. Rigging an election is much easier to do and to get away with than robbing a bank, and the financial rewards and power obtained from election rigging are far greater. And all the available data is highly consistent with ubiquitous vote miscount - not surprising without any measures to detect or correct vote miscount in most states. Why would you imagine that any election outcomes are accurate? Why would you imagine that state legislative election outcomes are accurate? Why would you imagine that any US congressional election outcomes are accurate? There is no evidence to support any claim of accurate election outcomes in most states. Cheers, Kathy Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Jonathan Lundell wrote: On Aug 16, 2008, at 12:54 AM, Kristofer Munsterhjelm wrote: I am for a record on disk of each ballot, but done in a maner to not destroy secrecy. You have to be very careful when doing so, because there are many channels to secure. A vote-buyer might tell you to vote exactly at noon so that the disk record timestamp identifies you, or he might, in the case of Approval and ranked ballots, tell you to vote for not just his preferred candidate, but both the low-support communist and the low-support right extremist as well, so that he can tell which ballot was yours and that you voted correctly. In the US, at least, voting by mail has become so prevalent that I wonder whether it's worthwhile making voting machinery absolutely impregnable to vote-buying. All else being equal, sure, why not, but if we trade off other desirable properties to preserve secrecy, and leave the vote-by-mail door unlocked I think it'd be better to lock the vote-by-mail door. One simple way of doing that has already been given, with the two envelopes under a verified setting. If you like technology, you can achieve the same effect, without the need for the physical verified setting, by using blind signatures. However, that runs into the same problem where the voters may not know what's going on. The fingerprinting vulnerability of ranked ballots is annoying, because I like ranked methods (rated ones would have even greater a vulnerability). I can think of a crypto solution where the recording is done under k of n secret sharing, and the secret-holders don't disclose their key parts unless it becomes necessary to do a recount. But yet again, how could the voters know that'll actually work? Even if they don't, it may still be better than nothing, though. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Dave Ketchum wrote:
So you're saying that computers are better than specialized machines?
I'm not sure that's what you say (rather than that machines are better
than paper ballots), but I'll assume that.
Your specialized machines can each do a fragment of the task. However,
dependably composing a capable whole from them requires big efforts from
humans.
Composing the same capability whole from a computer and adequate
programming can be easier.
Each does a fragment of the task, yes; that's the point of modular
design, so that you can treat the local units differently from the
central units and don't have to prove everything everywhere.
Consider a general computer. Even for general computers, it makes little
sense to have the district joining software - that counts the results
from various districts and sum them up in the case of a summable method
- on the individual units. As such, the general-purpose computers are
already specialized, only in software instead of hardware.
Because the specialized machines are simpler than computers, once mass
production gets into action, they should be cheaper. The best here
would probably be to have some sort of independent organization or
open-source analog draw up the plans, and then have various companies
produce the components to spec.
They can be cheaper by not doing the complete task - make the task an
election system and the cost goes up and dependability becomes expensive.
By extension, they can be cheaper by, in concert, doing just enough and
no more. One doesn't need Turing-completeness to count an election.
(Perhaps unless it's Kemeny.)
The simplicity of voting could also count against general-purpose
computers as far as manual labor is concerned. If the machine has been
proved to work, you don't need to know what Access (yes, Diebold used
Access) is to count the votes, and you don't need a sysadmin present
in case the system goes to a blue screen.
You need equivalent of a sysadmin to sort out getting a whole composed
of your specialized machines.
The way I would set up the system, there would be different counting
units. The group of units would need a person to unlock them each time
a new voter wants to vote; that could be included in the design so that
you don't need a system administrator for it. Then, once the election
day is over, gather the read-only media (CD or programmable ROM), and
either send them or the summable result (given by a second machine) to
the central. Count and announce as you get higher up in the hierarchy.
If the components are constructed correctly, and proved to be so (which
can be done because of the units' relative simplicity), then there won't
be any bluescreens and little need for maintenance - except for cases
where the machines simply break.
In this manner, the setup is more like paper balloting than it is to
ordinary computer systems. The read-only media take the place of the
ballot box, and the aggregating machines the place of the election count
workers.
Computers get cheaper and cheaper - think of what is hidden inside a
cell phone.
That's true. Maybe a compromise could be using cheap computer hardware
with read-only software, standardized components, and have the software
not be a full OS, but instead just enough to get the job done and be
provable. You'd have to rely on that there are no hardware backdoors,
but the existence of such would be very unlikely, and the entire thing
would have to be put inside some sort of tamper-resistant enclosure so
hackers can't attach keyloggers or do similar things.
That's true, but it's still fairly simple. Assume the ranked ballot is
in the form of rank[candidate] = position, so that if candidate X was
ranked first, rank[X] = 0. (Or 1 for that matter, I just count from
zero because I know programming)
Then the simple nested loop goes like this:
for (outer = 0; outer num_candidates; ++outer) {
for (inner = 0; inner num_candidates; ++inner) {
if (rank[outer] rank[inner]) { // if outer has higher rank
condorcet_matrix[outer][inner] += 1; // increment
}
}
}
What ran this loop outside a computer?
A chip with just enough transistors to do this task. I'm not a hardware
expert, but I think it could be done by the use of a HDL like Verilog.
It's less than instead of greater than because lower rank number means
the rank is closer to the top.
Write-ins could be a problem with the scheme I mentioned, and with
transmitting Condorcet matrices. One possible option would be to
prepend the transmission with a lookup list, something similar to:
Candidate 0 is Bush
Candidate 1 is Gore
Candidate 2 is Nader
Candidate 3 is Joe Write-In
Candidate 4 is Robert Write-In, etc
and if the central gets two condorcet matrices that have the same
candidates in different order (or share some candidates), it flips the
rows and columns to make the numbers the same before adding up.
Do you concede central
Re: [EM] Why We Shouldn't Count Votes with Machines
But murderers get away with murder, police are being bought off by criminals, government employees steal office supplies. No one knows exactly how much any of things happen. We try to limit them (balancing the degree of the problem and the cost of addressing it), and we go on with our lives. OH. So you see it as no big problem to pretend to live in a democracy (where you can pretend to yourself that most election outcomes are accurate) and continuing to let elections be the only major industry where insiders have complete freedom to tamper because 49 US states never subjected their election results to any independent checks, except the wholly unscientific ones in NM. Even when Utah used to use paper punch card ballots, one person did all the programming to count all the punch cards for the entire state of Utah, and no one ever checked after the election to make sure that any of the machine counts were accurate. You sure must believe in the 100% infallibility and honesty of this one person, and all the other persons who have trivially easy access to rig elections. Apparently none of the plethora of evidence that election rigging has been occurring ubiquitously in the US is of any interest or concern to you. I'm not Rob, so excuse the interruption, but some questions and ideas here: Won't the people, as a last stop, keep fraud from being too blatant? You don't need scientific methods to know that something's up if a state was 80-20 Democratic one cycle and then suddenly becomes 80-20 Republican (or vice versa) the next. Fraudsters could swing 45-55 results, but it doesn't completely demolish democracy, since the 60% (or whatever margin) results would presumably be left alone. Fraud corrupts results, but it seems to me that fortunately we have some room to implement improvements that get us closer to verifiability without having the fraud that exists plunge the society directly into dictatorship. New voting methods and improved fraud detection could also strengthen the prospects of each other. If you have an election method that supports multiple parties (since the dominant parties can't rig all the elections everywhere), then instead of only one other party, you have n-1 parties actively interested in keeping an eye on what rigging attempts do occur, and a lesser chance of entrenched forces colluding to ignore each other's attempts, since collusion among multiple entities become much harder as the number of entities grow. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Sun, Aug 17, 2008 at 10:09 AM, Kristofer Munsterhjelm Won't the people, as a last stop, keep fraud from being too blatant? You don't need scientific methods to know that something's up if a state was 80-20 Democratic one cycle and then suddenly becomes 80-20 Republican (or vice versa) the next. Fraudsters could swing 45-55 results, but it doesn't completely demolish democracy, since the 60% (or whatever margin) results would presumably be left alone. Excellent point Kristofer. Absolutely you are correct. It would be immediately obvious if a fraudster stole 100% of the available target votes or even 50%, so all our calculations for determining the sample size for post-election audits assume that a vote fraudster would steal at most, say 20% of available target votes, and then allow the candidate to add atleast one auditable vote count to the audit that may appear to look suspicious, or provides for calculations to determine any suspicious-looking auditable vote counts. In practice, when we analyze the available exit poll data that we can obtain (in Ohio 2004 presidential election some data was made available and state-wide data in the recent 2008 primary elections), it looks like the exit poll discrepancies can be explained by vote shifts from one candidate to another of under about 15% of the margin amounts. Audit amounts need to be based on the reported unofficial margins and the error bounds in the auditable vote counts and the total number of auditable vote counts. The concepts are explained in the first few pages of this doc in lay person's terms as much as possible: http://electionarchive.org/ucvAnalysis/US/paper-audits/VoteCountAudits-PPMEB.pdf Fraud corrupts results, but it seems to me that fortunately we have some room to implement improvements that get us closer to verifiability without having the fraud that exists plunge the society directly into dictatorship. That is the hope, IF we can get our elected officials to agree to implement the improvements. However, it appears that most officials who get elected see nothing wrong with a system that elected themselves (It must not be broken, it elected ME.) New voting methods and improved fraud detection could also strengthen the prospects of each other. If you have an election method that supports multiple parties (since the dominant parties can't rig all the elections everywhere), then instead of only one other party, you have n-1 parties actively interested in keeping an eye on what rigging attempts do occur, and a lesser chance of entrenched forces colluding to ignore each other's attempts, since collusion among multiple entities become much harder as the number of entities grow. I do not believe that the number of parties in power has any effect on whether or not publicly verifiable routine measures are in place to detect and correct vote miscount are effective or not. However, the voting method could effect how difficult or easy costly or not it is to implement routine measures that detect or correct vote miscount. For instance, the IRV counting method could make it much more difficult and costly to implement measures to routinely detect and correct errors, whereas other voting methods may not make routine error detection and correction more difficult and so may make publicly verifiable election outcome accuracy much easier to achieve. The practical effects of the various voting methods on election administration and in particular on as yet unimplemented but necessary routine measures to detect and correct vote miscount, must be considered when deciding on which voting method to promote. Cheers, Kathy Dopp The material expressed herein is the informed product of the author Kathy Dopp's fact-finding and investigative efforts. Dopp is a Mathematician, Expert in election audit mathematics and procedures; in exit poll discrepancy analysis; and can be reached at P.O. Box 680192 Park City, UT 84068 phone 435-658-4657 http://utahcountvotes.org http://electionmathematics.org http://electionarchive.org How to Audit Election Outcome Accuracy http://electionarchive.org/ucvAnalysis/US/paper-audits/legislative/VoteCountAuditBillRequest.pdf History of Confidence Election Auditing Development Overview of Election Auditing Fundamentals http://electionarchive.org/ucvAnalysis/US/paper-audits/History-of-Election-Auditing-Development.pdf Voters Have Reason to Worry http://utahcountvotes.org/UT/UtahCountVotes-ThadHall-Response.pdf Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Date: Fri, 15 Aug 2008 02:01:45 -0400 From: Dave Ketchum [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines Well here is where you and I differ. I think if electoral fraud in the US were eliminated, it would be a good thing, but not dramatically change things, any more than eliminating shoplifting would dramatically change our economy. I do not believe that such fraud changes the outcome of a large percentage of elections, and in those it does, it was pretty close anyway. And how do you know this since elections are not subjected to independent audits except in one state (beginning in 2006 - NM)? Do you believe that you are psychic and *know* which elections are being subjected to fraud in the last couple of decades since ballots have been primarily secretly counted by private companies with easily hackable, unaccountable voting equipment. Most elections do not inspire the fraudsters. The few they care about may be near ties, responding to minimum fraudulent effort. What basis in fact could you possibly have to support such a belief? If plurality voting were replaced with a ranked system such as a condorcet method, I beleive it WOULD dramatically change the entire dynamic of politics, in a very, very good way, by nearly eliminating the polarized nature of government due to partisanship. Really? Even if it is counted inaccurately and the new condorcet method does not accurately determine who wins, because anyone who has inside access can manipulate the system to put anyone in office they want to? So we do not care about having accurately counted elections on this list, as long as we have the appearance that a new voting method is being used to select the winners? So my priorities are different. Yes. Apparently. Giving up on fixing a huge problem because it makes it more difficult to fix a much smaller problem is not something I can support. Ah. So you consider it a small problem that the public has virtually no reason to believe that election results are accurate in 49 out of 50 states and that even the one state that subjects their election results to independent scrutiny, does so in a wholly unscientific manner that is insufficient to detect vote fraud in close election contests? And just why, pray tell, do you believe that the fact that elections is the only major industry (I am aware of) that is not subjected to any independent auditing, yet election winners decide who controls budgets in the millions to trillions of dollars and make decisions on awarding contracts worth millions to billions of dollars, is such a small problem? (and btw, I believe this list is about reforming the voting methods, not so much about fixing security problems.so if you are willing to abandon all attempts at reform because you don't think you can solve your particular problem as easily on a reformed system, it seems unlikely to fly here) Oh. So it is *not* reform to subject elections to independent routine scrutiny to ensure accurate election outcomes for the first time in US history? You certainly do have a very narrow definition of reform. In your dictionary, what exactly does the word reform apply to? (I am certainly down the rabbit hole again judging from this conversation where you claim to know which election outcomes were and were not fraudulently altered when you can have no possible data to make such a claim.) The whole point of open source is that if the officials don't verify it satisfactorily, someone will. A security researcher could make themselves famous for discovering something malicious in voting software. Really and how pray tell would they do this - especially when today's voting systems have so many back doors to simply change the votes in 30 secs to a minute without altering any software and without even touching the writable log files which could be altered with the votes anyway? Are you counting on the same kind of miracles that let you know how many prior election contests were rigged without any access to the data to know that? The only thing that is immune to checking would be the compiler itself, since the compiler needs a compiler to compile itselfbut someone would have had to have done something evil (and very, very brilliant) a long time ago to pull that offgood for a sci fi novel anyway, but not so much in the real world. Really? So not the proprietary compiled video drivers or any of the other proprietary hardware or software and of course I see you ruled out all the back doors that simply allow persons to change the reported vote counts on the central tabulators? I wonder why your opinion differs so wildly from all the computer scientists who are known to have studied voting systems for almost a decade now and why you think you know so much more than they do? Are you an all-seeing being? And of course since you consider yourself to be such an expert, you must already know
Re: [EM] Why We Shouldn't Count Votes with Machines
On Aug 16, 2008, at 12:54 AM, Kristofer Munsterhjelm wrote: I am for a record on disk of each ballot, but done in a maner to not destroy secrecy. You have to be very careful when doing so, because there are many channels to secure. A vote-buyer might tell you to vote exactly at noon so that the disk record timestamp identifies you, or he might, in the case of Approval and ranked ballots, tell you to vote for not just his preferred candidate, but both the low-support communist and the low-support right extremist as well, so that he can tell which ballot was yours and that you voted correctly. In the US, at least, voting by mail has become so prevalent that I wonder whether it's worthwhile making voting machinery absolutely impregnable to vote-buying. All else being equal, sure, why not, but if we trade off other desirable properties to preserve secrecy, and leave the vote-by-mail door unlocked Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Sat, 16 Aug 2008 07:27:10 -0700 Jonathan Lundell wrote: On Aug 16, 2008, at 12:54 AM, Kristofer Munsterhjelm wrote: I am for a record on disk of each ballot, but done in a maner to not destroy secrecy. You have to be very careful when doing so, because there are many channels to secure. A vote-buyer might tell you to vote exactly at noon so that the disk record timestamp identifies you, or he might, in the case of Approval and ranked ballots, tell you to vote for not just his preferred candidate, but both the low-support communist and the low-support right extremist as well, so that he can tell which ballot was yours and that you voted correctly. In the US, at least, voting by mail has become so prevalent that I wonder whether it's worthwhile making voting machinery absolutely impregnable to vote-buying. All else being equal, sure, why not, but if we trade off other desirable properties to preserve secrecy, and leave the vote-by-mail door unlocked There are two topics here: I LIKE the secret ballot, have had it most of my life, and know many others have similar desires for good reason. That thought inspired my words at the top. Vote buying needs discouraging, but I concede perfection is less essential here. Voting by mail requires humans obeying rules. I believe the rules in NY still require placing the ballots in an anonymous stack without humans reading their content while having the voter's identity associated. -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Fri, Aug 15, 2008 at 11:07 PM, Kathy Dopp [EMAIL PROTECTED] wrote: Date: Fri, 15 Aug 2008 02:01:45 -0400 From: Dave Ketchum [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines Well here is where you and I differ. I think if electoral fraud in the US were eliminated, it would be a good thing, but not dramatically change things, any more than eliminating shoplifting would dramatically change our economy. I do not believe that such fraud changes the outcome of a large percentage of elections, and in those it does, it was pretty close anyway. And how do you know this since elections are not subjected to independent audits except in one state (beginning in 2006 - NM)? Do you believe that you are psychic and *know* which elections are being subjected to fraud in the last couple of decades since ballots have been primarily secretly counted by private companies with easily hackable, unaccountable voting equipment. I did not say I *know*, I said I *think*. Your argument could be made to support any crazy conspiracy theory out there. How do you know aliens aren't controlling our thoughts? You don't. Or for that matter, how do you know your spouse isn't cheating on you without proof? You take a reasonable, balanced perspective on things. Which you seem unable to do on this issue. I'm sure a degree of electoral fraud happens in the US (but much moreso in other places). But murderers get away with murder, police are being bought off by criminals, government employees steal office supplies. No one knows exactly how much any of things happen. We try to limit them (balancing the degree of the problem and the cost of addressing it), and we go on with our lives. I do not object to the fact that you consider it an issue of more importance than various other issues (street crime/violence, cancer, plurality voting, bacterial resistance to antibiotics, middle east conflict, poverty, whatever...). I do object to your expectation that others on this list consider it so, since that is not the core issue of the list. What I care about, and my understanding of what this list is about, is the problems due to plurality voting and how to fix them. Basically the math of voting and reforming that side of it. And since you are distracting from that, I take issue. So my priorities are different. Yes. Apparently. Due to the nature of the list, isn't that expected? This isn't an election security list. See http://wiki.electorama.com/wiki/Election-methods_mailing_list and http://wiki.electorama.com/wiki/Main_Index if you are confused as to what is meant by methods. Security and fraud prevention is at best a peripheral topic. I'm not saying you can't discuss this stuff here, but if you come in expecting us to care about your pet issue as much as you do, you are being unrealistic. Giving up on fixing a huge problem because it makes it more difficult to fix a much smaller problem is not something I can support. Ah. So you consider it a small problem that the public has virtually no reason to believe that election results are accurate in 49 out of 50 states and that even the one state that subjects their election results to independent scrutiny, does so in a wholly unscientific manner that is insufficient to detect vote fraud in close election contests? Well, first off, I did not say small. I said smaller. Big difference. I consider the problem with plurality huge, strongly affecting the shape of our government (i.e. it has become polarized into two main parties that spend most of their time battling each other rather than solving real problems). Your issue is with crime.a fundamentally different thing. And just why, pray tell, do you believe that the fact that elections is the only major industry (I am aware of) that is not subjected to any independent auditing, yet election winners decide who controls budgets in the millions to trillions of dollars and make decisions on awarding contracts worth millions to billions of dollars, is such a small problem? Why do you not consider the issues with plurality a larger problem than you do? Maybe because that is your pet issue, this is mine. I won't address the rest of your email because it is basically just more of the same...you typing in all caps and labeling things insane and calling this list a rabbit hole because others aren't as convinced as you there is a massive conspiracy going on. -rob Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
To clarify:
Kristofer
Me
Kristofer
On Sat, 16 Aug 2008 09:54:28 +0200 Kristofer Munsterhjelm wrote:
As I say above, we are in trouble. Until we both fix the machines and
demonstrate success of the repairs, such use of paper backups makes sense.
Complicating all this, paper ballots have their own problems.
Hopefully the paper ballot problems won't be the same as the machine
problems, so that fraud is complicated rather than made easier.
Let's look at this again. What does a voting machine do? It registers
votes. Surely, that can't be a difficult task, so why use a computer?
Why not (for Approval or Plurality) just have a simple chip connected
to a PROM, with the chip in turn connected to a bunch of switches,
one for each candidate, with a matrix display next to each switch,
and a final switch to commit the ballot? Such a machine would be
provably correct: as long as you have a PROM that hasn't been
preprogrammed (this can be checked at the beginning), and the machine
hasn't been compromised (rewired switches, backdoor chips), then
it'll work as promised.
I will use zillion, a stretchable value, below:
A zillion precincts each set up for a few of the zillion races voted
on in the US.
A zillion personnel who must do all the manual labor and guidance of
voters. This is a sideline, thus hard to justify learning complex
skills, rather than a full-time career for these.
A zillion voters, who BETTER be provided a simple interface for voting.
At end of election the counts for the zillion races better get
attended to.
I really see it easier to do well effectively if you take advantage of
what computers can do (and have them do better than the failures we
have experienced).
So you're saying that computers are better than specialized machines?
I'm not sure that's what you say (rather than that machines are better
than paper ballots), but I'll assume that.
Your specialized machines can each do a fragment of the task.
However, dependably composing a capable whole from them requires big
efforts from humans.
Composing the same capability whole from a computer and adequate
programming can be easier.
Because the specialized machines are simpler than computers, once mass
production gets into action, they should be cheaper. The best here would
probably be to have some sort of independent organization or open-source
analog draw up the plans, and then have various companies produce the
components to spec.
They can be cheaper by not doing the complete task - make the task an
election system and the cost goes up and dependability becomes expensive.
The simplicity of voting could also count against general-purpose
computers as far as manual labor is concerned. If the machine has been
proved to work, you don't need to know what Access (yes, Diebold used
Access) is to count the votes, and you don't need a sysadmin present in
case the system goes to a blue screen.
You need equivalent of a sysadmin to sort out getting a whole composed
of your specialized machines.
Computers get cheaper and cheaper - think of what is hidden inside a
cell phone.
You could also do these kind of proofs on general purpose computers, but
then you'd have to design the complete software system from the bottom
up, which includes what one'd traditionally consider the OS; and if it's
general purpose, you also have to ensure that the vendors don't patch
the systems after they've been deployed.
Having the kind of programmable ROM infrastructure with a limiter on
per-voter might be good in the general-purpose computer case as well, in
which case the computer just act as a GUI. Then it can't mass vote - the
worst (which is pretty bad) it can do is alter the ballot as the voter
votes.
I do say general purpose computers, with no funny stuff buried inside.
And all the contents open source.
And recording - CD-R sounds right.
For Condorcet you must recognize, for A vs B, how many ranked AB and
how many BA. Must do this for every pair of candidates. If
write-ins are permitted (better be), they are more candidates to
attend to.
That's true, but it's still fairly simple. Assume the ranked ballot is
in the form of rank[candidate] = position, so that if candidate X was
ranked first, rank[X] = 0. (Or 1 for that matter, I just count from zero
because I know programming)
Then the simple nested loop goes like this:
for (outer = 0; outer num_candidates; ++outer) {
for (inner = 0; inner num_candidates; ++inner) {
if (rank[outer] rank[inner]) { // if outer has higher rank
condorcet_matrix[outer][inner] += 1; // increment
}
}
}
What ran this loop outside a computer?
It's less than instead of greater than because lower rank number means
the rank is closer to the top.
Write-ins could be a problem with the scheme I mentioned, and with
transmitting Condorcet matrices. One possible option would be to prepend
the transmission with a lookup
Re: [EM] Why We Shouldn't Count Votes with Machines
On Sat, Aug 16, 2008 at 7:48 PM, rob brown [EMAIL PROTECTED] wrote: I do not believe that such fraud changes the outcome of a large percentage of elections, and in those it does, it was pretty close anyway. And how do you know this since elections are not subjected to independent audits except in one state (beginning in 2006 - NM)? Your argument could be made to support any crazy conspiracy theory out there. How do you know aliens aren't controlling our thoughts? You don't. Or for that matter, how do you know your spouse isn't cheating on you without proof? You take a reasonable, balanced perspective on things. Which you seem unable to do on this issue. Rob, You can tell when someone has absolutely no facts to back them up when they attack and disparage the person rather than the issue that is under discussion. So anyone who has done actual research on the issue that clearly mathematically shows that the available data is consistent with vote fraud must be a crazy conspiracy theorist or lack a balanced perspective if they disagree with your imagined beliefs about U.S. elections? I'm sure a degree of electoral fraud happens in the US (but much moreso in other places). Are you saying that if everyone is doing electoral fraud, that makes it OK? But murderers get away with murder, police are being bought off by criminals, government employees steal office supplies. No one knows exactly how much any of things happen. We try to limit them (balancing the degree of the problem and the cost of addressing it), and we go on with our lives. OH. So you see it as no big problem to pretend to live in a democracy (where you can pretend to yourself that most election outcomes are accurate) and continuing to let elections be the only major industry where insiders have complete freedom to tamper because 49 US states never subjected their election results to any independent checks, except the wholly unscientific ones in NM. Even when Utah used to use paper punch card ballots, one person did all the programming to count all the punch cards for the entire state of Utah, and no one ever checked after the election to make sure that any of the machine counts were accurate. You sure must believe in the 100% infallibility and honesty of this one person, and all the other persons who have trivially easy access to rig elections. Apparently none of the plethora of evidence that election rigging has been occurring ubiquitously in the US is of any interest or concern to you. I do not object to the fact that you consider it an issue of more importance than various other issues (street crime/violence, cancer, plurality voting, bacterial resistance to antibiotics, middle east conflict, poverty, whatever...). Voting is the one right that protect ALL OTHER RIGHTS. Tell me, just how do you think that people can solve all the other problems if they do not have the ability to select the decision-makers who spend all our tax dollars, decide how many taxes we pay and what to spend it on, whether or not to wage war, how many police to hire, what youth programs to implement, and make all the laws, and so on? I do object to your expectation that others on this list consider it so, since that is not the core issue of the list. I was *not* the person who began this thread. Are you claiming that my expertise and knowledge about the issues of vote fraud which is extensive since I have studied this issue and read widely on it and written dozens of papers with PhD statisticians and mathematicians on it - using actual election data - are not welcome on this list if a thread that someone else introduces touches on a topic on which I have considerable knowledge? What I care about, and my understanding of what this list is about, is the problems due to plurality voting and how to fix them. So when the facts are not on your side then: 1. make personal attacks and 2. say that the topic should not to be discussed on this list? So my priorities are different. Yes. Apparently. Due to the nature of the list, isn't that expected? So are you claiming that an interest in seeing that votes are counted accurately as voters intended is incompatible with discussing new voting methods? Really? Well that may not be true for everyone on this list Rob. Perhaps some people on this list *may* want to consider the effects of particular voting methods on the ability to effect transparently verifiably accurate election outcomes. I mean let's climb out of the rabbit hole for a few minutes and consider the REAL world effects of some of these voting methods on the effort to make sure that voters actually have the right to throw the bums out rather than just the pretense of democracy while private companies secretly count (and often cast) our votes for us without any independent checks. Giving up on fixing a huge problem because it makes it more difficult to fix a much smaller problem is not something I can
Re: [EM] Why We Shouldn't Count Votes with Machines
On Aug 17, 2008, at 3:49 , Jonathan Lundell wrote: On Aug 16, 2008, at 5:24 PM, Dave Ketchum wrote: On Sat, 16 Aug 2008 07:27:10 -0700 Jonathan Lundell wrote: On Aug 16, 2008, at 12:54 AM, Kristofer Munsterhjelm wrote: I am for a record on disk of each ballot, but done in a maner to not destroy secrecy. You have to be very careful when doing so, because there are many channels to secure. A vote-buyer might tell you to vote exactly at noon so that the disk record timestamp identifies you, or he might, in the case of Approval and ranked ballots, tell you to vote for not just his preferred candidate, but both the low-support communist and the low-support right extremist as well, so that he can tell which ballot was yours and that you voted correctly. In the US, at least, voting by mail has become so prevalent that I wonder whether it's worthwhile making voting machinery absolutely impregnable to vote-buying. All else being equal, sure, why not, but if we trade off other desirable properties to preserve secrecy, and leave the vote-by-mail door unlocked There are two topics here: I LIKE the secret ballot, have had it most of my life, and know many others have similar desires for good reason. That thought inspired my words at the top. Vote buying needs discouraging, but I concede perfection is less essential here. Voting by mail requires humans obeying rules. I believe the rules in NY still require placing the ballots in an anonymous stack without humans reading their content while having the voter's identity associated. California, too, or a method to that effect. It's vote-buying (or coercion) that vote-by-mail enables. I wonder what kind of a vote-by-mail system is in use there. If it is just based on ordinary mail that one can send from one's home or anywhere (and doesn't offer any way to cancel and replace the vote) then that seems to offer opportunities for coercion and vote buying. The early voting system that I'm used to (and that is very popular) is however one where you vote under the observation of an election official (that can be e.g. a post office worker that takes care of early voting) that then puts your secret vote that you have put in one envelope into another envelope (under your eyes) that he will send to your local election authorities. This method offers the election officials some more chances to violate your privacy if they so wish (since your name will appear in the papers inside the outer envelope) (not probable though) but coercion and vote buying (without the involvement of the election officials) is about as difficult as with traditional voting at the official voting site on the election day. Juho The Civitas system has something to say about that, but it requires quite a few other conditions to make it work. Election-Methods mailing list - see http://electorama.com/em for list info ___ Now you can scan emails quickly with a reading pane. Get the new Yahoo! Mail. http://uk.docs.yahoo.com/nowyoucan.html Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
On Sat, Aug 16, 2008 at 9:40 PM, Kathy Dopp [EMAIL PROTECTED] wrote: Rob, You can tell when someone has absolutely no facts to back them up when they attack and disparage the person rather than the issue that is under discussion. So anyone who has done actual research on the issue that clearly mathematically shows that the available data is consistent with vote fraud must be a crazy conspiracy theorist or lack a balanced perspective if they disagree with your imagined beliefs about U.S. elections? You came in swinging, Kathy. Your constant references to rabbit holes etc. Your constant implications that everyone who doesn't consider your issues all-important is insane. I did not call you a crazy conspiracy theorist, either, I simply said that your logic could be applied to justify any crazy conspiracy theory. And I don't think that saying you are blowing things out of proportion or that you don't have a balanced perspective is a personal attack. I'm sure a degree of electoral fraud happens in the US (but much moreso in other places). Are you saying that if everyone is doing electoral fraud, that makes it OK? No. How on earth did you get that? I said that it is a problem like other problems, but I happen to not elevate the problem to the level you do. Maybe you can give me your estimate of what percentage of US elections would have different outcomes if it were not for fraud. I would expect the number to be very low. Doesn't make it ok when it happens, obviously. Your logic is ridiculously black and white on this. And completely full of straw men. But murderers get away with murder, police are being bought off by criminals, government employees steal office supplies. No one knows exactly how much any of things happen. We try to limit them (balancing the degree of the problem and the cost of addressing it), and we go on with our lives. OH. So you see it as no big problem to pretend to live in a democracy (where you can pretend to yourself that most election outcomes are accurate) and continuing to let elections be the only major industry where insiders have complete freedom to tamper because 49 US states never subjected their election results to any independent checks, except the wholly unscientific ones in NM. Your words pretend top live in a democracy pretty much show where you are coming from. That is the kind of thing that actual tempts me to actually call you a crazy conspiracy theorist now (but I'm not, of course...). Or at least I feel justified in saying you are blowing things out of proportion. Voting is the one right that protect ALL OTHER RIGHTS. Tell me, just how do you think that people can solve all the other problems if they do not have the ability to select the decision-makers who spend all our tax dollars, decide how many taxes we pay and what to spend it on, whether or not to wage war, how many police to hire, what youth programs to implement, and make all the laws, and so on? Yes, and are you saying that if one person cheats the system by, say, adding a single fake vote, that the whole system falls apart? (that would be black and white thinking) Either that, or you think that this is happening on a much grander scale than most mainstream people do. Either way, it still appears to me that you are blowing things way out of proportion. And I stand by that, whether you think it is a personal attack or not. I do object to your expectation that others on this list consider it so, since that is not the core issue of the list. I was *not* the person who began this thread. It sure appears to me that you were. Maybe not, but your name shows up first on it for me. Are you claiming that my expertise and knowledge about the issues of vote fraud which is extensive since I have studied this issue and read widely on it and written dozens of papers with PhD statisticians and mathematicians on it - using actual election data - are not welcome on this list if a thread that someone else introduces touches on a topic on which I have considerable knowledge? I am impressed with logic and a coherent argument, not with claims of authority. What I care about, and my understanding of what this list is about, is the problems due to plurality voting and how to fix them. So when the facts are not on your side then: 1. make personal attacks and Would you like me to paste in each and every attack you have made? You are pretty thin-skinned for someone who likes to hurl ridicule around like you do. 2. say that the topic should not to be discussed on this list? I did not say that. I said that if you come in here expecting us all to care so much about your pet issue, that is not the core topic of the list, you are being unrealistic. Really? Well that may not be true for everyone on this list Rob. Perhaps some people on this list *may* want to consider the effects of particular voting methods on the ability to
Re: [EM] Why We Shouldn't Count Votes with Machines
On Aug 16, 2008, at 10:08 PM, Juho wrote: I wonder what kind of a vote-by-mail system is in use there. If it is just based on ordinary mail that one can send from one's home or anywhere (and doesn't offer any way to cancel and replace the vote) then that seems to offer opportunities for coercion and vote buying. The early voting system that I'm used to (and that is very popular) is however one where you vote under the observation of an election official (that can be e.g. a post office worker that takes care of early voting) that then puts your secret vote that you have put in one envelope into another envelope (under your eyes) that he will send to your local election authorities. This method offers the election officials some more chances to violate your privacy if they so wish (since your name will appear in the papers inside the outer envelope) (not probable though) but coercion and vote buying (without the involvement of the election officials) is about as difficult as with traditional voting at the official voting site on the election day. In California, something like 35-40% of voters vote by mail (the percentage is increasing), and it's just like mailing a letter. One's ballot comes in the mail, you mark it at home, and drop it in a mailbox to return it. I assume that Oregon has a similar method, but I'm not personally familiar with it. Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Rob, I noticed that you did not try to answer one of my sincere questions to you (I am a highly skilled teacher whose college classes always had the highest score of all the classes taught by all the professors and other TA's on any department-wide final mathematics exams. I did this by questioning my classes and making them think, although some students reacted antagonistically by being forced to learn to think rather than being able to simply memorize.) Your entire email (below) disparaged me personally and mischaracterized me rather than trying to honestly communicate on the issue, so I will waste no more time or effort trying to teach you how to think logically about the issues concerning how to or why to assure the accuracy of election outcomes. I am sorry that my teaching style of asking questions to get people to think about the topic offends you so much. Cheers, Kathy On Sat, Aug 16, 2008 at 11:25 PM, Message: 4 Date: Sat, 16 Aug 2008 22:25:45 -0700 From: rob brown [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines To: [EMAIL PROTECTED] Cc: election-methods@lists.electorama.com Message-ID: [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 On Sat, Aug 16, 2008 at 9:40 PM, Kathy Dopp [EMAIL PROTECTED] wrote: Rob, You can tell when someone has absolutely no facts to back them up when they attack and disparage the person rather than the issue that is under discussion. So anyone who has done actual research on the issue that clearly mathematically shows that the available data is consistent with vote fraud must be a crazy conspiracy theorist or lack a balanced perspective if they disagree with your imagined beliefs about U.S. elections? You came in swinging, Kathy. Your constant references to rabbit holes etc. Your constant implications that everyone who doesn't consider your issues all-important is insane. I did not call you a crazy conspiracy theorist, either, I simply said that your logic could be applied to justify any crazy conspiracy theory. And I don't think that saying you are blowing things out of proportion or that you don't have a balanced perspective is a personal attack. I'm sure a degree of electoral fraud happens in the US (but much moreso in other places). Are you saying that if everyone is doing electoral fraud, that makes it OK? No. How on earth did you get that? I said that it is a problem like other problems, but I happen to not elevate the problem to the level you do. Maybe you can give me your estimate of what percentage of US elections would have different outcomes if it were not for fraud. I would expect the number to be very low. Doesn't make it ok when it happens, obviously. Your logic is ridiculously black and white on this. And completely full of straw men. But murderers get away with murder, police are being bought off by criminals, government employees steal office supplies. No one knows exactly how much any of things happen. We try to limit them (balancing the degree of the problem and the cost of addressing it), and we go on with our lives. OH. So you see it as no big problem to pretend to live in a democracy (where you can pretend to yourself that most election outcomes are accurate) and continuing to let elections be the only major industry where insiders have complete freedom to tamper because 49 US states never subjected their election results to any independent checks, except the wholly unscientific ones in NM. Your words pretend top live in a democracy pretty much show where you are coming from. That is the kind of thing that actual tempts me to actually call you a crazy conspiracy theorist now (but I'm not, of course...). Or at least I feel justified in saying you are blowing things out of proportion. Voting is the one right that protect ALL OTHER RIGHTS. Tell me, just how do you think that people can solve all the other problems if they do not have the ability to select the decision-makers who spend all our tax dollars, decide how many taxes we pay and what to spend it on, whether or not to wage war, how many police to hire, what youth programs to implement, and make all the laws, and so on? Yes, and are you saying that if one person cheats the system by, say, adding a single fake vote, that the whole system falls apart? (that would be black and white thinking) Either that, or you think that this is happening on a much grander scale than most mainstream people do. Either way, it still appears to me that you are blowing things way out of proportion. And I stand by that, whether you think it is a personal attack or not. I do object to your expectation that others on this list consider it so, since that is not the core issue of the list. I was *not* the person who began this thread. It sure appears to me that you were. Maybe not, but your name shows up first on it for me. Are you claiming
Re: [EM] Why We Shouldn't Count Votes with Machines
On Wed, 13 Aug 2008 22:00:06 -0700 rob brown wrote: On Wed, Aug 13, 2008 at 9:16 AM, Kathy Dopp [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: On Tue, Aug 12, 2008 at 11:28 PM, rob brown [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: How? Do we want an infinite loop of a voter running paper through a cheap printer trying to obtain an accurate ballot record and the machine refusing to print one while it switches a vote wrongly? Or do we want the voter to be able to cancel the ballot and let the poll workers know that he needs a paper ballot instead that he can mark himself? I'm fine with the latter. Actually that seems like a reasonable thing to do. I agree, but that is not happening on all of todays' voting systems. Election officials seem to be hopelessly slow to grasp the problem or the solution. This is a possible place for some new, clear, thinking - the Election officials likely couldn't fix this by themselves. We are in trouble - failures have been proved too often, and there is good reason to believe most failures do not even get proved. Even working correctly, Plurality voting is not adequate. While there are many competing methods, Condorcet is discussed here: Ballot is ranked, as is IRV's. Plurality voting is permitted, and can satisfy most voters most of the time - letting them satisfy their desires with no extra pain while getting their votes fully credited. Approval voting is likewise accepted, satisfying a few extra voters. Fully ranked voting is Condorcet's promise, giving full response to those desiring such when desired. Open source is ESSENTIAL: While it encourages quality programming by those who do not want to get caught doing otherwise, it also encourages thorough testing by the community. But, there is a temptation for copying such without paying: Perhaps the law should provide a punishment for such. Perhaps customers should pay for such code before it becomes open - and get refunds of such payments if the code, once open, proves to be unreasonably defective. The community should be demanding of Congress such support as may help. While open source could be thought of as just the voting program, proper thinking includes the hardware, protecting the program against whatever destructive forces may exist, and verifying what happens. Secret ballot is essential. While voter should be able to verify the vote before submitting such, this is only to verify - goal above is election programs that REALLY DO what they promise. If so, why not let the voters vote on a paper ballot to begin with? Any ideas? Cost? Wrong answer. Paper ballot optical scan systems are so much more economical than e-ballot systems that if you purchase all-new optical scan systems, the on-going cost savings totally pay for the initial purchase within four years and then begin saving taxpayers lots of monies. See http://electionmathematics.org and click on Voting Systems for links to cost comparison studies. But honestly, the big problem I have with paper ballots filled out by hand is that they make the transition to a ranked system a lot harder, both in terms of difficulty filling in the ballot and difficulty counting them. As That is a good argument against using any ranked ballot systems then since the integrity of e-ballot systems cannot be adequately ensured, given the secret ballot and the difficulty of implementing systems to detect and correct errors with a secret ballot. Well here is where you and I differ. I think if electoral fraud in the US were eliminated, it would be a good thing, but not dramatically change things, any more than eliminating shoplifting would dramatically change our economy. I do not believe that such fraud changes the outcome of a large percentage of elections, and in those it does, it was pretty close anyway. Most elections do not inspire the fraudsters. The few they care about may be near ties, responding to minimum fraudulent effort. Thus, a few false wins can be big trouble. If plurality voting were replaced with a ranked system such as a condorcet method, I beleive it WOULD dramatically change the entire dynamic of politics, in a very, very good way, by nearly eliminating the polarized nature of government due to partisanship. That is huge, comparitively. Could be BIG - Plurality NEEDS primaries. Condorcet does not need such, but could not object if parties chose to do them anyway for other reasons. So my priorities are different. Giving up on fixing a huge problem because it makes it more difficult to fix a much smaller problem is not something I can support. (and btw, I believe this list is about reforming the voting methods, not so much about
Re: [EM] Why We Shouldn't Count Votes with Machines
On Thu, Aug 14, 2008 at 11:01 PM, Dave Ketchum [EMAIL PROTECTED]wrote: (most of Dave's comments snipped out, I responded to only a few) Open source is ESSENTIAL: While it encourages quality programming by those who do not want to get caught doing otherwise, it also encourages thorough testing by the community. But, there is a temptation for copying such without paying: Perhaps the law should provide a punishment for such. The law already does. http://ap.google.com/article/ALeqM5iR9T2USlbjJbHOl7sIgiE9RCx33gD92IB4900 Well here is where you and I differ. I think if electoral fraud in the US were eliminated, it would be a good thing, but not dramatically change things, any more than eliminating shoplifting would dramatically change our economy. I do not believe that such fraud changes the outcome of a large percentage of elections, and in those it does, it was pretty close anyway. Most elections do not inspire the fraudsters. The few they care about may be near ties, responding to minimum fraudulent effort. Thus, a few false wins can be big trouble. However, if they are near ties, that isn't quite so big trouble because both candidates are pretty popular anyway. While it may offend our notion of democracy to have someone win (a two person election) who had only 49.99 percent of the voteits really not that huge a dealnot nearly the same scale of a problem as one where a truly unpopular candidate could get himself elected by fraud. Like with everything else in the world, we want to minimize the ability of criminals to profit from their crimes, but how much are we willing to give up to reduce the chance to zero? If plurality voting were replaced with a ranked system such as a condorcet method, I beleive it WOULD dramatically change the entire dynamic of politics, in a very, very good way, by nearly eliminating the polarized nature of government due to partisanship. That is huge, comparitively. Could be BIG - Plurality NEEDS primaries. Condorcet does not need such, but could not object if parties chose to do them anyway for other reasons. Yes, although maybe it would be more accurate to say that candidates that want to win need primaries under plurality. The only thing that is immune to checking would be the compiler itself, since the compiler needs a compiler to compile itselfbut someone would have had to have done something evil (and very, very brilliant) a long time ago to pull that offgood for a sci fi novel anyway, but not so much in the real world. Compilers do not have to be that complex - since voting programs need not be that complex, such as would need a high powered compiler. Well, even a basic C compiler has this issue, since the compiler itself is written in C, so there is a chicken egg problem. But this is really not a real world concern (and if it was, someone would have been using it to steal money from banks, etc). It's an amusing theoretical concept, but not much more. Perhaps my 2-cents will inspire a response. I agree, in general, with Rob that we have a fixable problem that NEEDS fixing. Cool. :) Indeed, while I think that voting security is important, lets not throw the baby (fixing the problems with plurality) out with the bathwater (fraud). -r Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
Dave Ketchum wrote: Or do we want the voter to be able to cancel the ballot and let the poll workers know that he needs a paper ballot instead that he can mark himself? I'm fine with the latter. Actually that seems like a reasonable thing to do. I agree, but that is not happening on all of todays' voting systems. Election officials seem to be hopelessly slow to grasp the problem or the solution. This is a possible place for some new, clear, thinking - the Election officials likely couldn't fix this by themselves. We are in trouble - failures have been proved too often, and there is good reason to believe most failures do not even get proved. Even if the voting machine would be perfect - have no flaws at all - having a backup paper balloting option would be a good idea, I think. To the extent that democracy is not only about who won, but also about the losers (and their voters) being confident that they lost in a fair manner, any voter who doesn't trust the machine can request a paper ballot instead; and candidates that distrust the machinery can tell their voters to use the paper ballot backup. If the machine works correctly, and candidates and voters know that, the load on the backup system will be minimal. However, if the machines are untrusted or haven't earned the reputation for being fair, the backup will at least limit fraud somewhat. A possible problem with the solution may occur if many more voters use backup ballots than was predicted, and the infrastructure (parties' counters, and so on) can't keep up with the load. This weakness is the consequence of that the load is going to be dynamic (depending on voters' trust in the machines), and in the worst case, the backup might be neglected completely. Even working correctly, Plurality voting is not adequate. While there are many competing methods, Condorcet is discussed here: Ballot is ranked, as is IRV's. Plurality voting is permitted, and can satisfy most voters most of the time - letting them satisfy their desires with no extra pain while getting their votes fully credited. Approval voting is likewise accepted, satisfying a few extra voters. Fully ranked voting is Condorcet's promise, giving full response to those desiring such when desired. From a purely technical point of view, I agree. I think the good (at least cloneproof) Condorcet methods to focus on here would be either Ranked Pairs (easy to explain) or Schulze (seems to be gaining momentum for non-governmental purposes, e.g MTV and Debian), both wv as their definitions state. That shouldn't keep us from trying to find things like good burial-resistant Condorcet methods, though. Open source is ESSENTIAL: While it encourages quality programming by those who do not want to get caught doing otherwise, it also encourages thorough testing by the community. But, there is a temptation for copying such without paying: Perhaps the law should provide a punishment for such. Perhaps customers should pay for such code before it becomes open - and get refunds of such payments if the code, once open, proves to be unreasonably defective. The community should be demanding of Congress such support as may help. While open source could be thought of as just the voting program, proper thinking includes the hardware, protecting the program against whatever destructive forces may exist, and verifying what happens. Secret ballot is essential. While voter should be able to verify the vote before submitting such, this is only to verify - goal above is election programs that REALLY DO what they promise. Let's look at this again. What does a voting machine do? It registers votes. Surely, that can't be a difficult task, so why use a computer? Why not (for Approval or Plurality) just have a simple chip connected to a PROM, with the chip in turn connected to a bunch of switches, one for each candidate, with a matrix display next to each switch, and a final switch to commit the ballot? Such a machine would be provably correct: as long as you have a PROM that hasn't been preprogrammed (this can be checked at the beginning), and the machine hasn't been compromised (rewired switches, backdoor chips), then it'll work as promised. Reading off the PROMs would require more complex machinery, but it's really just an adder. In a Condorcet election, it's a two-loop adder (for each candidate, for each ranked below, increment vote_for[a][b]). That, too, is not too difficult a task and it should be possible to prove that it'll work in all cases. One might also have to take TEMPEST sniffing and similar things into account, but the point is that both actually registering ballots and counting the votes is a simple task, and therefore one can inspect the device or program to see that it works properly, and more than that, that it'll always work properly within
Re: [EM] Why We Shouldn't Count Votes with Machines
On Fri, 15 Aug 2008 16:01:10 +0200 Kristofer Munsterhjelm wrote: Dave Ketchum wrote: Or do we want the voter to be able to cancel the ballot and let the poll workers know that he needs a paper ballot instead that he can mark himself? I'm fine with the latter. Actually that seems like a reasonable thing to do. I agree, but that is not happening on all of todays' voting systems. Election officials seem to be hopelessly slow to grasp the problem or the solution. This is a possible place for some new, clear, thinking - the Election officials likely couldn't fix this by themselves. We are in trouble - failures have been proved too often, and there is good reason to believe most failures do not even get proved. Even if the voting machine would be perfect - have no flaws at all - having a backup paper balloting option would be a good idea, I think. To the extent that democracy is not only about who won, but also about the losers (and their voters) being confident that they lost in a fair manner, any voter who doesn't trust the machine can request a paper ballot instead; and candidates that distrust the machinery can tell their voters to use the paper ballot backup. As I say above, we are in trouble. Until we both fix the machines and demonstrate success of the repairs, such use of paper backups makes sense. Complicating all this, paper ballots have their own problems. If the machine works correctly, and candidates and voters know that, the load on the backup system will be minimal. However, if the machines are untrusted or haven't earned the reputation for being fair, the backup will at least limit fraud somewhat. A possible problem with the solution may occur if many more voters use backup ballots than was predicted, and the infrastructure (parties' counters, and so on) can't keep up with the load. This weakness is the consequence of that the load is going to be dynamic (depending on voters' trust in the machines), and in the worst case, the backup might be neglected completely. Even working correctly, Plurality voting is not adequate. While there are many competing methods, Condorcet is discussed here: Ballot is ranked, as is IRV's. Plurality voting is permitted, and can satisfy most voters most of the time - letting them satisfy their desires with no extra pain while getting their votes fully credited. Approval voting is likewise accepted, satisfying a few extra voters. Fully ranked voting is Condorcet's promise, giving full response to those desiring such when desired. From a purely technical point of view, I agree. I think the good (at least cloneproof) Condorcet methods to focus on here would be either Ranked Pairs (easy to explain) or Schulze (seems to be gaining momentum for non-governmental purposes, e.g MTV and Debian), both wv as their definitions state. That shouldn't keep us from trying to find things like good burial-resistant Condorcet methods, though. Open source is ESSENTIAL: While it encourages quality programming by those who do not want to get caught doing otherwise, it also encourages thorough testing by the community. But, there is a temptation for copying such without paying: Perhaps the law should provide a punishment for such. Perhaps customers should pay for such code before it becomes open - and get refunds of such payments if the code, once open, proves to be unreasonably defective. The community should be demanding of Congress such support as may help. While open source could be thought of as just the voting program, proper thinking includes the hardware, protecting the program against whatever destructive forces may exist, and verifying what happens. Secret ballot is essential. While voter should be able to verify the vote before submitting such, this is only to verify - goal above is election programs that REALLY DO what they promise. Let's look at this again. What does a voting machine do? It registers votes. Surely, that can't be a difficult task, so why use a computer? Why not (for Approval or Plurality) just have a simple chip connected to a PROM, with the chip in turn connected to a bunch of switches, one for each candidate, with a matrix display next to each switch, and a final switch to commit the ballot? Such a machine would be provably correct: as long as you have a PROM that hasn't been preprogrammed (this can be checked at the beginning), and the machine hasn't been compromised (rewired switches, backdoor chips), then it'll work as promised. I will use zillion, a stretchable value, below: A zillion precincts each set up for a few of the zillion races voted on in the US. A zillion personnel who must do all the manual labor and guidance of voters. This is a sideline, thus hard to justify learning complex skills, rather than a full-time career for these. A zillion voters, who BETTER
Re: [EM] Why We Shouldn't Count Votes with Machines
On Tue, Aug 12, 2008 at 11:28 PM, rob brown [EMAIL PROTECTED] wrote: How? Do we want an infinite loop of a voter running paper through a cheap printer trying to obtain an accurate ballot record and the machine refusing to print one while it switches a vote wrongly? Or do we want the voter to be able to cancel the ballot and let the poll workers know that he needs a paper ballot instead that he can mark himself? I'm fine with the latter. Actually that seems like a reasonable thing to do. I agree, but that is not happening on all of todays' voting systems. Election officials seem to be hopelessly slow to grasp the problem or the solution. If so, why not let the voters vote on a paper ballot to begin with? Any ideas? Cost? Wrong answer. Paper ballot optical scan systems are so much more economical than e-ballot systems that if you purchase all-new optical scan systems, the on-going cost savings totally pay for the initial purchase within four years and then begin saving taxpayers lots of monies. See http://electionmathematics.org and click on Voting Systems for links to cost comparison studies. But honestly, the big problem I have with paper ballots filled out by hand is that they make the transition to a ranked system a lot harder, both in terms of difficulty filling in the ballot and difficulty counting them. As That is a good argument against using any ranked ballot systems then since the integrity of e-ballot systems cannot be adequately ensured, given the secret ballot and the difficulty of implementing systems to detect and correct errors with a secret ballot. No. Obviously it is trivially easy for any programmer of a voting machine to: You'll note that I said it is essential that the source code be open for viewing by all. Not so trivially easy in that case. Not at all. Making the source code for the voting programs open source does not make all the myriad of other programs, drivers, OS, etc on the voting system open source - that could be used to rig the vote. Also of course election officials do not have the resources to verify software and it would take years to set up systems to verify the software on voting systems *and* require trusted technicians to do so. While I support using open source programs for other reasons, it is *not* the answer to ensuring the accuracy of vote counts. You might want to read this article on the topic, that I wrote with help from dozens of technologists and some voting system experts: http://electionmathematics.org/em-voting-systems/VotingSystemSoftwareDisclosure.pdf and read this recent article: http://nandigramunited.blogspot.com/2008/08/soumitra-and-sitanshu-particularly.html But to do this, an awful lot of people are going to see the error, Well, perhaps 5% of voters would *see* the error (because no fraudster is stupid enough to switch *all* target votes available), but most might think they made a mistake on the first try. The ones who complain, in our experience over the last couple of election cycles, will be soundly ignored. especially if you simply leave it on screen when you print the paper copy. Huh? Try doing that yourself. I do not know if the summary *screen* version of the ballot appears at the same time as you get a chance to check the paper version of the ballot. I don't think that is necessarily an option you would have. And they are going to talk about it. And the next year, people will be a lot more likely to notice. If you followed the voting news nationwide like I do, you would know that people have been talking about it a lot since the November 2004 presidential election, in particular there was lots of vote switching reported in Ohio. Congress even certified the election of a Representative from Florida that everyone knows was not elected by the people there, simply because the machine results had dropped over 14,000 votes from the candidate that everyone knows probably really won the election, and lots of people complained about the screen switching their votes, but it does not matter. The wrong person will still be elected no matter how many people complain about vote switching. Still, with an open source system, I have no clue how a programmer is going to do this at all. Anyone could easily switch out any open source or not program that is compiled into machine language during some routine maintenance and no one would know the difference. Do you really think that election administrators are going to have the funds and that VVV's are going to cooperate to put together a list of all compilers, switches, hardware and firmware versions for every piece of software on their machines so that the versions can be checked after the elections? In Utah, the VVV shipped us atleast three different versions of the voting system software alone, and who knows how many unique versions of hardware, firmware, drivers, and hardware. If you believe that these VVs are standardized, you are
Re: [EM] Why We Shouldn't Count Votes with Machines
On Wed, Aug 13, 2008 at 9:16 AM, Kathy Dopp [EMAIL PROTECTED] wrote: On Tue, Aug 12, 2008 at 11:28 PM, rob brown [EMAIL PROTECTED] wrote: How? Do we want an infinite loop of a voter running paper through a cheap printer trying to obtain an accurate ballot record and the machine refusing to print one while it switches a vote wrongly? Or do we want the voter to be able to cancel the ballot and let the poll workers know that he needs a paper ballot instead that he can mark himself? I'm fine with the latter. Actually that seems like a reasonable thing to do. I agree, but that is not happening on all of todays' voting systems. Election officials seem to be hopelessly slow to grasp the problem or the solution. If so, why not let the voters vote on a paper ballot to begin with? Any ideas? Cost? Wrong answer. Paper ballot optical scan systems are so much more economical than e-ballot systems that if you purchase all-new optical scan systems, the on-going cost savings totally pay for the initial purchase within four years and then begin saving taxpayers lots of monies. See http://electionmathematics.org and click on Voting Systems for links to cost comparison studies. But honestly, the big problem I have with paper ballots filled out by hand is that they make the transition to a ranked system a lot harder, both in terms of difficulty filling in the ballot and difficulty counting them. As That is a good argument against using any ranked ballot systems then since the integrity of e-ballot systems cannot be adequately ensured, given the secret ballot and the difficulty of implementing systems to detect and correct errors with a secret ballot. Well here is where you and I differ. I think if electoral fraud in the US were eliminated, it would be a good thing, but not dramatically change things, any more than eliminating shoplifting would dramatically change our economy. I do not believe that such fraud changes the outcome of a large percentage of elections, and in those it does, it was pretty close anyway. If plurality voting were replaced with a ranked system such as a condorcet method, I beleive it WOULD dramatically change the entire dynamic of politics, in a very, very good way, by nearly eliminating the polarized nature of government due to partisanship. That is huge, comparitively. So my priorities are different. Giving up on fixing a huge problem because it makes it more difficult to fix a much smaller problem is not something I can support. (and btw, I believe this list is about reforming the voting methods, not so much about fixing security problems.so if you are willing to abandon all attempts at reform because you don't think you can solve your particular problem as easily on a reformed system, it seems unlikely to fly here) Making the source code for the voting programs open source does not make all the myriad of other programs, drivers, OS, etc on the voting system open source - that could be used to rig the vote. Also of course election officials do not have the resources to verify software and it would take years to set up systems to verify the software on voting systems *and* require trusted technicians to do so. The whole system top to bottom should be open source. This is not particularly hardplenty of people run pure boxes, on commodity hardware. The obvious choice for OS would probably be Linux, with freeBSD being another option. The whole point of open source is that if the officials don't verify it satisfactorily, someone will. A security researcher could make themselves famous for discovering something malicious in voting software. The only thing that is immune to checking would be the compiler itself, since the compiler needs a compiler to compile itselfbut someone would have had to have done something evil (and very, very brilliant) a long time ago to pull that offgood for a sci fi novel anyway, but not so much in the real world. Well, perhaps 5% of voters would *see* the error (because no fraudster is stupid enough to switch *all* target votes available), but most might think they made a mistake on the first try. Then it is a UI problem. especially if you simply leave it on screen when you print the paper copy. Huh? Try doing that yourself. I do not know if the summary *screen* version of the ballot appears at the same time as you get a chance to check the paper version of the ballot. I don't think that is necessarily an option you would have. What is so hard about that? The point is, if the UI is designed reasonably well, a large percentage of voters will *know* if the machine is cheating. And they are going to talk about it. And the next year, people will be a lot more likely to notice. If you followed the voting news nationwide like I do, you would know that people have been talking about it a lot since the November 2004 presidential election, in
Re: [EM] Why We Shouldn't Count Votes with Machines
On Tue, Aug 12, 2008 at 4:47 PM, Kathy Dopp [EMAIL PROTECTED] wrote: As virtually all (all I know) independent computer scientists (who do not profit from certifying or working for VVV's - vulture voting vendors) agree, it is *not* possible to fix DREs because their fundamental design is flawed. I.e. Any machine cast or machine printed record of ballots is not going to work. The flaws of DRE paper roll ballot printers include (there is a much longer list): Studies show that fewer than 30% of voters check machine-printed paper ballot roll records and fewer than 30% of voters who check (or about 10% of all voters) accurately proofread their machine-printed paper ballot roll records to detect any errors, so that a programmer can switch up to 90% of available target votes in a way that no audit can detect. Also there is a two strikes and you are out rule that prevents the most diligent voter from having a machine-printed paper ballot record that matches the voter's choices. A voter can only cancel ballot casting twice due to an incorrect printed paper roll record. On the third try, the voter receives an error message on the screen warning that the voter has only one more chance to cast their ballot. On the third try, the paper roll ballot record whizzes quickly inside the canister WITHOUT GIVING THE VOTER A CHANCE TO SEE THE PAPER RECORD! The two strikes you are out rule is not inherent to machine voting -- that is fixable, obviously. Regardless, are you suggesting that a programmer could steal an election by just hoping that that every one of the people who had it fail twice in a row is going to simply say oh well and go home, rather than raise holy hell about it? As a programmer myself, I can tell you that any non-stupid (but evil) programmer would have it do it correctly the second timeI mean, you know they are looking that time, so why push your luck for one vote? So the 2 strikes and you're out, silly as it may be, is hardly the issue. I can also tell you that much of the issue here is far out of the field of computer science, and is more in the area of sociology/psychology with a little game theory and economics thrown in. I don't disagree that there are problems with machine voting, some easier to fix than others. (a paper trail is an absolute necessity, for instance, as is open source code) Still I think you are blowing things out of proportion -- to a large enough degree that your propoganda has pulled me out of my typical lurk mode on the list. Shamos is considered a rogue among computer scientists and I am fairly certain that Shamos does not have any degree in computer science, as is true of most experts who support DREs. And I am fairly certain that you didn't spend two minutes researching, as you'd have easily found that he does indeed have a phD in computer science from Yale. Which gives me one more reason to suspect the facts you present. (don't take this as an endorsement of what Shamos says, just a reaction to your logically and factually unsound propaganda) -rob Election-Methods mailing list - see http://electorama.com/em for list info
Re: [EM] Why We Shouldn't Count Votes with Machines
fundamental design is flawed? If so, obvious response is to redo the design. Hi David, The only design that is *not* flawed (that I know of) is voter-marked paper ballots because it provides voter-verifiED ballots. However the optical scanning machines that count them today are very flawed and use no modern security, encryption, or open standard data formats that have been available for many years. They're your basic cheap junk, but far superior to today's basic cheap e-ballot junk. The flaws of DRE paper roll ballot printers include (there is a much longer list): Studies show that fewer than 30% of voters check machine-printed paper ballot roll records and fewer than 30% of voters who check (or about 10% of all voters) accurately proofread their machine-printed paper ballot roll records to detect any errors, so that a programmer can switch up to 90% of available target votes in a way that no audit can detect. I do not see how an auditor could know of and tailor the audit to the particular ballots the programmer did not switch. Huh!? I said: so that a **programmer** can switch up to 90% of available target votes in a way that no audit can detect. Valid audits require manually counting ballots of randomly selected reported unofficial vote counts. The problem is that because only 10% of voters may accurately check machine-printed paper ballot records, ALL MACHINE PRINTED ballots will match erroneous electronic vote totals because 90% of the machine-printed paper ballots can be printed to match erroneous electronic touchscreen ballot records, and the voters would not notice it; and no audit can detect the fraud. Voters *could* detect the fraud, but the 10% of voters who notice that their first ballot did not match their choices and cancels their first ballot, may think that they made a mistake rather than the machine when the second time they try to cast their ballot after canceling it on the first try when they notice the erroneous paper ballot, their paper ballot then *does* match their choices. As I said, 10% of the ballots can *not* be switched by the programmer (only 90% of target paper ballots and their e-ballots can be switched by the programmer), but ALL the printed ballots will match the erroneous e-ballot totals. This particular DRE hack was published back around May 2005 in the Brennan Center Report The Machinery of Democracy and is why virtually all (everyone I know and I have written papers with dozens of PhD computer scientists on voting system topics) computer scientists oppose using e-ballot voting systems with machine-printed paper ballot records. Also there is a two strikes and you are out rule that prevents the most diligent voter from having a machine-printed paper ballot record that matches the voter's choices. A voter can only cancel ballot casting twice due to an incorrect printed paper roll record. On the third try, the voter receives an error message on the screen warning that the voter has only one more chance to cast their ballot. On the third try, the paper roll ballot record whizzes quickly inside the canister WITHOUT GIVING THE VOTER A CHANCE TO SEE THE PAPER RECORD! What does it matter? How come the redesign failed to attend to properly recording the vote? I do not get your question. If you want to know more about this particular Two Strikes You're Out flaw of DRE-printed paper ballot records, either: 1. If you personally vote on a DRE, try cancelling your ballot twice and then see what happens when you cast your ballot on the third try. (Take a picture of the warning screen with your cell phone before pushing the button, and then watch the ballot quickly roll up before you can see what is on it.) or 2. Read the NJ Institute of Technology studies of DRE printers which caused NJ to refuse to certify any of the DRE paper printers. Without a limit on the number of times a voter can try to print a matching paper ballot record, and without a way for the voter to bail out of casting a vote on a DRE which refuses to create an accurate paper ballot record, then obviously there would be other problems, like running out of paper in the paper rolls (poll workers frequently have problems loading the paper, load it backwards so it does not print, and the papers frequently jam while printing, or keep the covers closed so voters don't see the paper ballot records, or voters can easily sabotage the paper so that it appears to work during the elections but all the records are erased at the end of the election. (See the CA SoS study of voting systems.) Sigh, so the FLAW is the inanity and expense and hassle of trying to keep a printer running in every polling booth during elections rather than using a less costly paper ballot, and more importantly the fact that the machine, rather than the voter is marking the paper ballot record. Fix that cannot be done without switching to voter marked optical scan paper ballots. Huh? There seems to
Re: [EM] Why We Shouldn't Count Votes with Machines
Message: 2 Date: Tue, 12 Aug 2008 18:17:49 -0700 From: rob brown [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines The two strikes you are out rule is not inherent to machine voting -- that is fixable, obviously. How? Do we want an infinite loop of a voter running paper through a cheap printer trying to obtain an accurate ballot record and the machine refusing to print one while it switches a vote wrongly? Or do we want the voter to be able to cancel the ballot and let the poll workers know that he needs a paper ballot instead that he can mark himself? If so, why not let the voters vote on a paper ballot to begin with? Any ideas? Regardless, are you suggesting that a programmer could steal an election by just hoping that that every one of the people who had it fail twice in a row is going to simply say oh well and go home, rather than raise holy hell about it? No. Obviously it is trivially easy for any programmer of a voting machine to: a. make the printed ballot record match an erroneous e-ballot record on the voters first try b. in the 10% of cases when a voter notices the error on the paper ballot and cancels the ballot, the programmer than makes the paper printout and the electronic record match exactly what the voter wants. Recall that I said that the programmer would only be able to switch up to 90% of the target votes without any audit able to detect it. The voter would either think that he must have made a mistake on the first try, or complain about his vote being switched. We have already seen hundreds or thousands or cases of voters in the last two election cycles complaining that their votes have been switched to the wrong candidates with DREs and election officials have mostly ignored the problem or chalked it up to touchscreen callibration problems (which does cause similar behavior) As a programmer myself, I can tell you that any non-stupid (but evil) programmer would have it do it correctly the second timeI mean, you know they are looking that time, so why push your luck for one vote? So the 2 strikes and you're out, silly as it may be, is hardly the issue. Huh? I mentioned TWO SEPARATE ISSUES: 1. the programming hack that can switch 90% of target votes without audits being able to detect it. 2. the 2 strikes you're out rule that *all* DREs currently use today that prevents even the 10% of diligent voters who detect errors in their paper printed records from being able to generate a correct machine-printed paper ballot record. If you prefer not have *any* paper ballot record, then ofcourse there is no way to check the accuracy of the machine counts independent of the programming. I can also tell you that much of the issue here is far out of the field of computer science, and is more in the area of sociology/psychology with a little game theory and economics thrown in. Really? OK, but *all* independent computer scientists (that I know) oppose the use of e-ballot voting systems for very solid logically correct reasons. It is true that e-ballots with machine printed paper records *might* work (although still expensive and subject to DOS attacks) *IF* you could train all voters and election officials and poll workers adequately how to handle doing elections with them, but that seems like a very remote possibility unless you want to begin lessons in how to use e-ballot paper trail voting systems in grammar school as a course and have paper ballots as backup available in every polling location and train pollworkers and voters to recognize when the machines look like vote fraud may be going on, etc. Human factors must be considered realistically. I don't disagree that there are problems with machine voting, some easier to fix than others. (a paper trail is an absolute necessity, for instance, as is open source code) Again, virtually all *independent* computer scientists who are voting system experts disagree with you and believe that voter-marked paper ballots are essential and that paper trails are inadequate as I've tried to explain some of their flaws here. Still I think you are blowing things out of proportion -- to a large enough degree that your propoganda has pulled me out of my typical lurk mode on the list. Well using words like propaganda and blowing things out of proportion are very skillful ways to try to discount real facts, but do not impress me, or most people as much as concrete facts do. Shamos is considered a rogue among computer scientists and I am fairly certain that Shamos does not have any degree in computer science, as is true of most experts who support DREs. And I am fairly certain that you didn't spend two minutes researching, as you'd have easily found that he does indeed have a phD in computer science from Yale. Which gives me one more reason to suspect the facts you present. (don't take this as an endorsement of what Shamos says, just a reaction to your logically
Re: [EM] Why We Shouldn't Count Votes with Machines
Somehow we are not connecting, but I will try one more time. On Tue, 12 Aug 2008 21:34:56 -0600 Kathy Dopp wrote: fundamental design is flawed? If so, obvious response is to redo the design. Hi David, The only design that is *not* flawed (that I know of) is voter-marked paper ballots because it provides voter-verifiED ballots. I SAID: redo the design! Looking around at other known failures DOES NOT COUNT, beyond perhaps learning better what to avoid. However the optical scanning machines that count them today are very flawed and use no modern security, encryption, or open standard data formats that have been available for many years. They're your basic cheap junk, but far superior to today's basic cheap e-ballot junk. Ditto! The flaws of DRE paper roll ballot printers include (there is a much longer list): Studies show that fewer than 30% of voters check machine-printed paper ballot roll records and fewer than 30% of voters who check (or about 10% of all voters) accurately proofread their machine-printed paper ballot roll records to detect any errors, so that a programmer can switch up to 90% of available target votes in a way that no audit can detect. I do not see how an auditor could know of and tailor the audit to the particular ballots the programmer did not switch. Huh!? I said: so that a **programmer** can switch up to 90% of available target votes in a way that no audit can detect. Valid audits require manually counting ballots of randomly selected reported unofficial vote counts. The problem is that because only 10% of voters may accurately check machine-printed paper ballot records, ALL MACHINE PRINTED ballots will match erroneous electronic vote totals because 90% of the machine-printed paper ballots can be printed to match erroneous electronic touchscreen ballot records, and the voters would not notice it; and no audit can detect the fraud. Voters *could* detect the fraud, but the 10% of voters who notice that their first ballot did not match their choices and cancels their first ballot, may think that they made a mistake rather than the machine when the second time they try to cast their ballot after canceling it on the first try when they notice the erroneous paper ballot, their paper ballot then *does* match their choices. As I said, 10% of the ballots can *not* be switched by the programmer (only 90% of target paper ballots and their e-ballots can be switched by the programmer), but ALL the printed ballots will match the erroneous e-ballot totals. This particular DRE hack was published back around May 2005 in the Brennan Center Report The Machinery of Democracy and is why virtually all (everyone I know and I have written papers with dozens of PhD computer scientists on voting system topics) computer scientists oppose using e-ballot voting systems with machine-printed paper ballot records. I give up on deciphering most of this. I do agree on opposing such machine-printed paper ballot records. Also there is a two strikes and you are out rule that prevents the most diligent voter from having a machine-printed paper ballot record that matches the voter's choices. A voter can only cancel ballot casting twice due to an incorrect printed paper roll record. On the third try, the voter receives an error message on the screen warning that the voter has only one more chance to cast their ballot. On the third try, the paper roll ballot record whizzes quickly inside the canister WITHOUT GIVING THE VOTER A CHANCE TO SEE THE PAPER RECORD! My point, again, was DO the needed redesign, don't cry over present spilt milk. What does it matter? How come the redesign failed to attend to properly recording the vote? I do not get your question. If you want to know more about this particular Two Strikes You're Out flaw of DRE-printed paper ballot records, either: 1. If you personally vote on a DRE, try cancelling your ballot twice and then see what happens when you cast your ballot on the third try. (Take a picture of the warning screen with your cell phone before pushing the button, and then watch the ballot quickly roll up before you can see what is on it.) or 2. Read the NJ Institute of Technology studies of DRE printers which caused NJ to refuse to certify any of the DRE paper printers. Without a limit on the number of times a voter can try to print a matching paper ballot record, and without a way for the voter to bail out of casting a vote on a DRE which refuses to create an accurate paper ballot record, then obviously there would be other problems, like running out of paper in the paper rolls (poll workers frequently have problems loading the paper, load it backwards so it does not print, and the papers frequently jam while printing, or keep the covers closed so voters don't see the paper ballot records, or voters can easily sabotage the paper so that it appears to work during the elections but all the records are erased at the end of the election.
Re: [EM] Why We Shouldn't Count Votes with Machines
On Tue, Aug 12, 2008 at 9:01 PM, Kathy Dopp [EMAIL PROTECTED] wrote: Message: 2 Date: Tue, 12 Aug 2008 18:17:49 -0700 From: rob brown [EMAIL PROTECTED] Subject: Re: [EM] Why We Shouldn't Count Votes with Machines The two strikes you are out rule is not inherent to machine voting -- that is fixable, obviously. How? Do we want an infinite loop of a voter running paper through a cheap printer trying to obtain an accurate ballot record and the machine refusing to print one while it switches a vote wrongly? Or do we want the voter to be able to cancel the ballot and let the poll workers know that he needs a paper ballot instead that he can mark himself? I'm fine with the latter. Actually that seems like a reasonable thing to do. If so, why not let the voters vote on a paper ballot to begin with? Any ideas? Cost? Presumably they don't use the paper ballot to begin with because then they have to be hand counted or have an optical reader at each station. Hand counting a few is reasonable (or sending them in to be counted on an optical reader), hand counting all, or having modern optical machines at each polling station, can be very expensive. But honestly, the big problem I have with paper ballots filled out by hand is that they make the transition to a ranked system a lot harder, both in terms of difficulty filling in the ballot and difficulty counting them. As you probably know, I am a big advocate of ranked systems (especially condorcet), as plurality is (among other sins) the source of partisanship which I consider the biggest problem of government. Regardless, are you suggesting that a programmer could steal an election by just hoping that that every one of the people who had it fail twice in a row is going to simply say oh well and go home, rather than raise holy hell about it? No. Obviously it is trivially easy for any programmer of a voting machine to: You'll note that I said it is essential that the source code be open for viewing by all. Not so trivially easy in that case. Not at all. a. make the printed ballot record match an erroneous e-ballot record on the voters first try b. in the 10% of cases when a voter notices the error on the paper ballot and cancels the ballot, the programmer than makes the paper printout and the electronic record match exactly what the voter wants. But to do this, an awful lot of people are going to see the error, especially if you simply leave it on screen when you print the paper copy. And they are going to talk about it. And the next year, people will be a lot more likely to notice. Still, with an open source system, I have no clue how a programmer is going to do this at all. If there is someone that smart (and lacking of ethics), he is probably very, very rich, as he probably has already put undetected code in the linux kernel that is giving him back doors to an awful lot of servers out there moving an awful lot of money. Most likely though, no one is able to hide such devious stuff in code visible to security researchers. Recall that I said that the programmer would only be able to switch up to 90% of the target votes without any audit able to detect it. Only if every single voter got a wrong ballot printed. You really think this would go unnoticed? Your scenario is absurd, at least on the scale you talk about. The voter would either think that he must have made a mistake on the first try, or complain about his vote being switched. Yes, and a lot of people complaining would draw more attention to it, and more people would start checking. If it happened on a large scale, the problem would be tracked down, and the programmer would be put away for a long time. But if it is open source, even that scenario is (for all intents and purposes) impossible. We have already seen hundreds or thousands or cases of voters in the last two election cycles complaining that their votes have been switched to the wrong candidates with DREs and election officials have mostly ignored the problem or chalked it up to touchscreen callibration problems (which does cause similar behavior) Not if the UI is done reasonably. The touch screen should show what you selected, very clearly, in big bold letters so you know you did it right, and allow you the opportunity to change it before printing out the paper. If it then prints out a different thing, that is obviously not touchscreen calibration, and if it does it for a significant number of people that isn't going to last long before you have the townspeople carrying torches. As a programmer myself, I can tell you that any non-stupid (but evil) programmer would have it do it correctly the second timeI mean, you know they are looking that time, so why push your luck for one vote? So the 2 strikes and you're out, silly as it may be, is hardly the issue. Huh? I mentioned TWO SEPARATE ISSUES: Ok, well you complained loudly about the two
[EM] Why We Shouldn't Count Votes with Machines
Summary: Shamos describes MANY serious problems with elections that NEED fixing. Offers some serious thought about fixes, including making DREs usable. Responses concentrate on fact that present DREs and paper ballots have problems, and do not consider fixing the DREs. I am inclined to agree with Shamos. There are TOO MANY horror stories! Contracts SHOULD be written to pay reasonably for reasonable effort BUT provide for refunds that include paying users for their pain when what is delivered is too unreasonably sick. I DID get some useful responses - THANKS: On Wed, 6 Aug 2008 11:13:17 -0400 (EDT) Stephen Unger [EMAIL PROTECTED] wrote: I am familiar with the Shamos article ... Rather than respond to it myself, I will point to what I think is an excellent rebuttal by Ron Crane et al at: http://74.125.45.104/search?q=cache:W41nVB7aNl8J:www.verifiedvoting.org/downloa ds/shamos-rebuttal.pdf+michael+shamos+voting+responsehl=enct=clnkcd=4gl=us client=firefox-a I do, incidentally, agree with the Shamos criticism of reliance on paper trails generated by DREs. On Wed, 6 Aug 2008 13:49:22 -0400 Rick Carback [EMAIL PROTECTED] wrote: Useful responses to Shamos? There was something published at VoComp: http://vocomp.org/papers/shamos-rebuttal.pdf It points out some problems with Shamos but doesn't really conclude that machines shouldn't be involved. I think there are disagreeable things in both papers. Google scholar might have others... If you find something i'd be interested in reading it. I could not read this pdf file, but accept Rick's opinion. On Wed, 06 Aug 2008 08:22:00 -0400 I wrote: Thank you! Shamos, while long, is well worth studying! Are there any useful responses? ... On Tue, 5 Aug 2008 19:50:17 -0400 Rick Carback wrote: The problem with hand counting is that it is not always clear that the record tabulated was the record generated by voters. You are trading something with a 40-50 year history of not being good enough with something that has thousands of years of history showing it's not good enough. It's a system we know doesn't work. An argument that says the older way was less bad is perfectly acceptable, but you have to concede that it leaves much to be desired. All but the fraction of a percent of the observers and counters involved in the process get no assurance that their votes were counted faithfully. You might want to read and respond to Shamos: http://euro.ecom.cmu.edu/people/faculty/mshamos/paper.htm ... -- [EMAIL PROTECTED]people.clarityconnect.com/webpages3/davek Dave Ketchum 108 Halstead Ave, Owego, NY 13827-1708 607-687-5026 Do to no one what you would not want done to you. If you want peace, work for justice. Election-Methods mailing list - see http://electorama.com/em for list info
