I thought particularly interesting was the description of the UX:
> In a statement to supporters Friday, Cruz cited “multiple reports” of race selections changing and added “once you select the Republican party ticket, please be patient and do not select ‘next’ until the ballot has populated all of the selections.”
It reminds me of an era of "Please don't press 'Buy' twice or your credit card could be charged again."
Understandable but hardly justifiable when voting machines first were implemented, but the provider has had many years to improve their product. That they don't suggests they are paid regardless of quality, or it is working as intended.
I think you may be overestimating how often these machines get updated. I don't know about the internals, but as a long time TX resident I can say that the machines I saw last time I voted (2016) didn't look much if any different than the machines I saw at least 10 years ago, and probably longer. Also, there's got to be some amount of overhead related to certification and training for each new design, so the state has plenty of incentive to keep using the same machines.
It makes me think they must be recycling old POS systems from gasoline pumps -- the ones where you twiddle your thumbs, waiting for the display to update.
And, any kind of real QA should have / would have caught this. Anything simulating a real user.
Leaving me with no confidence whatsoever in the design, engineering, and manufacturing of this system. This problem leaves no room for benefit of the doubt.
> “The Hart eSlate machines are not malfunctioning, the problems being reported are a result of user error — usually voters hitting a button or using the selection wheel before the screen is finished rendering,”
That reminds me of the Therac-25: "They determined that data entry speed during editing was the key factor in producing the error condition: If the prescription data was edited at a fast pace (as is natural for someone who has repeated the procedure a large number of times), the overdose occurred." (http://sunnyday.mit.edu/papers/therac.pdf)
I was going to say something similar. In the Therac case, at least part of the fault fell with the operators who should have known what to look for (if things had been well documented and they'd been trained). But this is a rare event, every year (at most) or every 2 or 4 years, for most voters. You expect computers to work these days and to be responsive so the idea that users are at fault for crappy UI/UX is absurd. If something seems to be working then the user in this case has no reason to doubt it because they haven't used these systems with sufficient frequency to be aware of its poor quality and how to respond to it.
> In the Therac case, at least part of the fault fell with the operators who should have known what to look for (if things had been well documented and they'd been trained).
This. Even a humble accountant usually reverses entry errors immediately, yet this critical input was harder to double check.
But note the crucial difference: In the case of the Therac-25, this was merely the explanation, and explaining what causes an issue is crucial to fixing it. It was treated as a software problem, and the vendor was liable. Here it's used to inappropriately blame the user.
The state of Texas should sue Hart eSlate and cite the Therac-25 story to argue that 30 years later, anyone halfway competent should know how to avoid race conditions in a user interface.
We need a federal law that outright bans voting machines for all federal elections that Congress has control over (it'll get rid of them entirely in practice, because no-one will want to waste time and money by maintaining parallel systems).
That will solve all the immediate issues. Think of it as the equivalent of taking down a compromised server.
Then, companies that make those things can go back to the drawing table, actually think about what they're making this time, and try to convince us all that they did it right. It'll take a lot of convincing, and that's exactly how it should be. For starters, I'd want to hear about the exact problem being solved.
What would it take to make this happen? It feels like something that would carry more weight if the initial push came from the IT industry. People will listen better to something like, "I'm a software engineer with 20 years of experience, and in my educated opinion, electronic voting should be banned."
Machines are useful for accessibility. Rather than a total ban on voting machines, I'd rather see a ban on machines that don't produce a paper ballot that can be manually counted, and no results should be considered official until the physical ballots are hand-counted. (Electronic counts are fine to satisfy the desire for instant results.)
That wouldn't necessarily fix this particular issue (machines with bad UI selecting the wrong candidates), but at least it's easy for a voter to determine if something went wrong if the paper ballot is marked incorrectly.
Cynically: "more expensive" is used as a proxy measure for "better" by Americans. Same mistake as healthcare, "Our system must be the best in the civilised world - we spend far more than anybody else".
Pencil and paper are boring and cheap. If your job is just to ensure the state buys enough pencils how do you justify an extra $25 000 next year? When voters insist they want to elect the deputy car wash attendants (another American trait - "democracy is good, therefore electing people is good, so the more elected officers the better") you just add another page to the printed ballot. No opportunity to innovate with auto-filling 600 separate elections from one party line decision.
There isn’t that much money to be gained. I work for a Danish muniplacity and we do digital voter registration, but I don’t think we’ll ever do digital voting because it’s unsafe.
Our system is a little different, here every citizen is mailed a “ticket” they can exchange for the voting ballot in the weeks leading up to the election. If yours is lost in the mail, no worry, we can print you a new one, and you can’t really use someone else’s because it has your name on it and we check.
In every ticket there is a barcode that we scan, to speed handing the out ballots up, this also counts the amount of voters, and that’s the digital part of the election. It’s also the most burdensome, so this is where digitisation saves us time.
The voting is done on paper and counted in hand, and checked with the amounts who have passed through the digital system, if it’s off by more than 1-3 votes there is a recount until it fits.
The counting takes a few hours at each location, but it’s done by the same people who’ve worked the voting place all day to ensure the safety of democracy, so it’s not really that expensive or inefficient.
And that’s not accounting for the cost of voting machines. The digital part of our elections is the most expensive part of the process, because digital systems are expensive.
We use them because they add convenience for the citizens since they eliminate queues, but it would actually be much cheaper to do the whole process on paper.
I’m not sure why America ever installed digital voting machines, but I can’t see any reason to do so. Especially not some that don’t leave a paper trail.
> I’m not sure why America ever installed digital voting machines
Because companies that make them lobbied state governments to use them. Usually by pitching various fraudulent claims, like "it's cheaper" and "it's safer" - but, of course, what really talks is money:
Keep in mind that here in US, even when it comes to the federal elections, the states are the ones that run them, and they have a lot of leeway in doing so. Thus you see a very wide spectrum, all the way from the craziness described in this article, to states like mine where all ballots are paper and election is handled by mail. Similar with voter registration and identifying voters.
It doesn't have to be that way - Congress has the constitutional authority to regulate: "The Times, Places and Manner of holding Elections for Senators and Representatives, shall be prescribed in each State by the Legislature thereof; but the Congress may at any time by Law make or alter such Regulations, except as to the Places of chusing Senators.". But they don't really use this power much; two prominent examples are the federal law that mandates single-member districts (which is bad, because it prevents states from experimenting with other electoral systems), and the law to establish a single voting day (which is Tuesday, because said law dates 170 years back, when primary consideration was to accommodate people travelling to polling places from remote locations by foot or by horse). Given the importance of federal politics these days, I think it's long overdue for much more stringent regulations to set a baseline that guarantees free and fair elections.
I think you are right about the number of elections. I see American commericals for electing sheriffs, school board trustees etc etc. These people should be promoted based upon performance, experience and skill, not a popularity contest.
Are machines really the only way to solve the accessibility issue? There are many countries out there - including developed countries - that use paper ballots exclusively. Why not adopt their practices wrt accessibility?
Make it a federal crime for voting machines to be inaccurate and allow civil lawsuits about same. Budget a mandatory spend to investigate a randomly selected number of precincts after each election.
A main problem with voting machines is that they are a form of outsourcing of a government function which is critical to our society and our form of government. If we are to have machines, those producing them must be held accountable.
There's even an existing mechanism for this. Just like with buildings and bridges and the like, any voting machine could have a publicly registered design formally signed and sealed by a licensed Professional Engineer who is willing to accept criminal liability for any faults in the design.
All states should do what Oregon does (with optional paper ballet on election day). Opt everyone in when you get an id, none of this register to vote nonsense. Send everyone a ballet in the mail and do mail in or drop off ballots.
I really don't get why it's so hard for more people to get behind, other than the whole, trying to prevent certain groups from voting.
> “The Hart eSlate machines are not malfunctioning, the problems being reported are a result of user error — usually voters hitting a button or using the selection wheel before the screen is finished rendering,” said Sam Taylor, spokesman for the office of Secretary of State Rolando Pablos, who was appointed by Republican Gov. Greg Abbott.
I’m not someone who believes that you should be able to pitch manure, plan an invasion, and conn a ship. But someone can have standards for UX design without knowing about how to execute any of it. An employee of a procurement department certainly should be as part of their core competency. A spokesperson for a government procurement department should be able to communicate that if it is something the department values
Forgive me if I prematurely discount the UX opinions of a Gregg Abbott political appointee explaining that a laughably amateur user experience is the fault of the voters of the opposing party.
Oh we don't disagree on that. I'm saying that this appointee should be better at UX evaluation, not that we should take their opinion as worth anything.
I think it's wound up that way. I do not think it started that way, I think it started that way because there was no incentive for Diebold or other electronic voting vendors to do the right thing, and now keeping things status quo is very easy for an incumbent.
I imagine that it is very hard to convince someone that was elected with electronic voting machines that there is a problem with electronic voting machines.
> That said, paper ballots and hand counting are the answer for secure and accurate vote counts
Hand counts aren't particularly accurate. Change that to paper ballots counted by optical scanners with some clever ballot design using cryptographic techniques to allow voters to verify that their vote was included correctly in the count and to allow independent third party auditing of the results, and then you have a secure and accurate system.
> The problem with any form of voting that allows you to verify your vote was counted correctly, is that anyone can verify you voted 'correctly'.
That's not correct. There are several systems that let you verify your ballot was included in the count and the count is correct, which together show that your vote was counted correctly, without letting anyone verify who specifically you voted for. See Punchscan, Prêt à Voter, and Scantegrity II for examples.
Look at the research literature under end to end auditable voting systems [1] for more on this topic.
Hand-counted pen and paper ballots don't actually provide any way for you to verify that your ballot was included in the count and that the count is correct without letting anyone verify who you voted for. I'm curious what you have in mind here.
This is a solved problem. Independent observers from all parties involved that are allowed to view the entire process from end to end. The issue with computer only voting is that you just have to trust the machine.
In a large election it is a big challenge to ensure that independent observers from all parties are present every place someone could potentially tamper with ballots in storage or in transit between the time they are cast (especially in jurisdictions where polls are open a long time) and are counted and the count is folded into the overall total.
With simple hand counted paper ballots, the voter has no way of knowing that the chain of custody of their ballot was not compromised.
By enhancing the paper ballots with cryptographic techniques, we can make it so that lapses in the chain of custody do not allow tampering with the election results. We can make it so we only need observers from all parties observing at specific places in the process, which is much more practical. We can make it so the voter can know that their vote did it make it into the total and it was counted correctly. We can make it so we can have a fast machine count, but still have a paper trail that supports a hand recount, and we can do this in a way that allows outside independent checking of the machine count.
Cryptographic assurances are besides the point: the threat model is not that someone will change a record in a poorly-observed database. That's only a threat if you decide to make the thing electronic. The easiest way to solve that threat model is to not create it in the first place.
Put another way: the way you protect against the subversion or deception of very few humans is to build a system that by design requires very many humans to be involved.
> In a large election it is a big challenge to ensure that independent observers from all parties are present every place someone could potentially tamper with ballots in storage or in transit between the time they are cast (especially in jurisdictions where polls are open a long time) and are counted and the count is folded into the overall total.
Australia has done it this way for most of a century.
It's easy. Candidates are highly motivated to provide scrutineers because they distrust each other. And the rules require scrutineers to be present and cross-sign to assemble or open ballot boxes.
> With simple hand counted paper ballots, the voter has no way of knowing that the chain of custody of their ballot was not compromised.
With a software solution, no voter has a way of knowing if their vote and everyone else's vote has been counted correctly, unless ... you do verification by hand.
Seriously.
Pen and paper. It works. It's safe at scale. Everyone understands it. The US is not a special case.
> In a large election it is a big challenge to ensure that independent observers from all parties are present every place someone could potentially tamper with ballots in storage or in transit between the time they are cast (especially in jurisdictions where polls are open a long time) and are counted and the count is folded into the overall total.
It's actually pretty easy: Count the ballots at the polling place immediately after the polls close. That leaves no opportunity to leave them unguarded. Publish the results of each place so everyone can reproduce how they are summed up.
I haven't read the paper if you can't tell from the system who you voted for, then you must be trusting the machine to give you some kind of random number which corresponds to each candidate. So it's only a partial verification.
In that case, there is a simple way to do it. Just publish a list of all ballets (by random ID) and their matching votes (by another random ID). No math needed.
There's an article[0] with a powerful quote on the subject: "There is no one election in the United States, there are thousands of independent elections. ... They’re run with their own policies, and their own processes, and, frankly, in a lot of ways, their own vocabulary."
Machines are usually bought by local jurisdictions. Some states cover the costs for all elections; some for only some elections; over 6 cover nothing. In any case, local jurisdictions are faced with a conundrum: do we spend money for something that's used only a couple days a year, or fund more immediately beneficial programs (roads, aid programs, etc.)? Budgets can't even keep up with replacing equipment, let alone thorough code and security reviews. Assuming the administrators even recognize what kind of work needs done. It's outside their experience, and when you start considering the kind of attack vectors that freaking nation states can literally create, even the best efforts of well-intentioned election officials are going to be wholly insufficient. And when nation states that are willing to put in the effort are the threat you're protecting against, everything changes.
Individual states are unlikely to try and setup the kind of review that you're looking at. Or--possibly--even realize that they need to. It's expensive, and the people they're relying on to inform them about these matters are often the people selling the machines. Worse, you're looking at at least 50 separate efforts to secure voting machines. They may, or may not, somehow wind up coordinating with each other. The federal government could, but states guard their control over elections fiercely: just look at how almost all of them told the Obama administration to go pound sand when DHS warned them of potential hacking attempts.
Unless there's a major, undeniable breach, I don't expect much to change anytime soon in most states. Even then, we'll probably see a shift to paper ballots rather than the sort of hideously expensive expenditures needed for the sort of rigorous IT security efforts we now know are necessary for electronic voting in the current threat environment. Otherwise, we'll be lucky to see piecemeal incremental improvements when individual states get around to them.
Regulations seem to me like they are always reactionary to bad shit happening, we're just too dumb to be prescient enough to get ahead of the problems because we are too arrogant to think we'll make the same mistakes we always make and because we think our intentions are insurance against those mistakes if they do happen.
One problem with voting machines is that "bad stuff happening" can be beneficial to the people in charge of overseeing them, quite the opposite of gambling machines.
I think it makes sense that regulations are reactionary against bad shit that has (traffic fatalities, market manipulation, food and drug safety, etc) or is currently happening (global climate change). If we tried to write regulations against everything that might possibly maybe go wrong, I imagine we would end up with an unworkable regulatory landscape that ends up doing more harm than good. And I say this as someone who thinks regulations are a good thing on balance.
Why is the US so set on voting machine to begin with? They clearly aren't secure, and apparently they are't as user-friendly as the paper ballots they're replacing?
A few months ago it was announced that Denmark is dropping all plans for electronic voting in the foreseeable future. There a to many issues with the voting machines and holding a paper ballot election is neither expensive nor complicated.
The funny thing is that, when we go to a polling place on election day, we will almost always get a paper ballot to be used with an optical scan reader. This system actually hits me as an ideal: the electronic reader can be simpler and fairly decoupled from other systems, and each voter will leave a paper trail that should clearly indicate their intent. Admittedly, the electronic readers we use are probabally insecure and awful, but the concept hits me as fairly reasonable.
In this case, we are in the early voting period, and there are a reduced number of polling places - and each polling place can be used by any voter in that county, which means that voters might be (and probabally are) voting on slightly different races and using slightly different ballots. These machines remove the need for the early polling places to have a lot of valid paper ballots on hand while still allowing each voter to see and vote in all races they would be able to vote in on election day.
It's actually a fairly good use of voting machines, even if it would be nice if the machines were something other than terrible.
I'm a South Korean national living in the Silicon Valley area. I've participated in South Korean election several times, including one (or two?) congressional election. Luckily for me, they open a voting booth in San Jose so that every Korean citizen in the area can come and vote.
When I arrive, they ask for my ID (i.e., passport), look up my registered address, and the computer automatically prints out the correct set of ballots, and an envelope with the correct return address. I take them to the voting booth, stamp on the candidates I like, put the ballots into the envelope, seal the envelope, and put it in a box, and later all the envelopes in the box will be sorted and sent to the correct district so that they can be counted at the actual election day.
Another Texan here. That has not been my experience.
I've lived and voted in Austin for 15 years and have never seen a single paper ballot. Our voting machines are, and have been, simple screens with a scrolly-wheel interface. They produce no paper record for you to review or deposit anywhere.
This would, to me, seem to be a minimum requirement for anyone to have any belief that their vote has been counted correctly.
There is a paper record. Watch the people running the ballots next time. Your session there was recorded but your vote is not directly tied to you as that would be illegal.
The 2000 presidential election was really close in the state of Florida. There were some legitimate issues with the design of the paper ballots, and this generated a lot of controversy.
This really upset a lot of people and they wanted _something_ to be done. A lot of people naively felt computerizing it would automatically fix everything. They were wrong, but that's how we got here.
There's no contradiction between paper ballots and speed. In my country we all vote with paper ballots, then at the closing of the polling stations the members of each voting table punch the results of their urn into a laptop which connects to the electoral authority. In 3-4h max the elections results are out.
For security however, after punching the numbers into the laptop, ballots are re-sealed into the urn and physically sent to the electoral authority, where in the following days public officers count them manually again. There has never been any meaningful deviation detected to date.
This way, you have the security of paper ballots (they are on sight of party volunteers at all times) with the speed of electronic vote aggregation.
Are you Mexican? Our system is the same, but a critical factor helps it. Every citizen has a voting credential, and every booth has a list of voters. You can't vote without your id, and while you can vote in secret, you can only vote in your designated booth.
This gives the system its agility. Our recent presidential election had a reliable statistical advance (PREP) at 23:00 the same day, and the next day every single vote of every remote booth was fully accounted, and the result confirmed the PREP.
The Mexican electoral system is surprisingly effective, yet we have the same core problem of democracy: we need better candidates and less gullible voters :/
This thread [1] on /r/Mexico made me think that voting credentials don't work very well. I haven't read any technical analysis of the system, but everyone in the thread is talking about how easy it is to vote multiple times.
In Alameda County you deposit non-provisional paper ballots in a scanner which tallies it up. At the end of the day you get a printout of results (assuming there are enough voters to preserve privacy) which is posted outside and submitted to the election office. The machine's flash memory is also submitted, as are the paper ballots.
Paper ballots mailed to voters are speedy, convienent, reliable. Especially when read with a machine. Plus anyone can do Quality Assurace by counting a portion of ballots themselves, and comparing it to the scanned total, making it hard to rig.
Some states use paper ballots with bubbles that are filled in with pencil or ink. The benefit is that they're simply tabulated automatically and provide an original record to refer to.
That's literally the only way I've ever voted, in 2 different states. Scantron is a perfectly reasonably way to do things, and the technology has been around for ages.
Scantron doesn't allow for write-in candidates and it's very easy to design an unusable scantron form that's confusing and difficult to follow. Another issue is that often the scantron circles are small and too close together, making it difficult for people without fine motor control to vote: the solution is a form with much larger circles and spacing but that would be wasteful and inefficient for the majority of voters.
The Washington voting system allows for write-in candidates despite also having a bubble that the voter fills in with ink or pencil. If the write-in votes outnumber any of the winning candidates, they could hypothetically count them by hand, but that never really happens.
You fill in the center of the arrow for who you're voting for, and there's an entry at the bottom for writen-ins. Afterwards this is scanned by a machine and the paper put in storage.
There are plenty of issues with 'fill in the bubble' type ballots. Bubbles partially filled in, filled in then crossed out with another bubble filled in, etc...
>“The Hart eSlate machines are not malfunctioning, the problems being reported are a result of user error — usually voters hitting a button or using the selection wheel before the screen is finished rendering,”
This is a problem with the machine and the people who made it, not the people using it. "User error" is usually an poor excuse for lazy and/or bad design.
Reminds me of the time I worked the polls in 2004 in NC, which was (maybe still is) using electronic touchscreen voting. I clearly remember an elderly woman with very poor fine motor control. Her hand was shaking terribly. I watched her hit the "next" button and, due to the shaking, press it multiple times and skip most of the ballot.
I asked her if she wanted my help to go back and finish her ballot. She declined, saying she'd managed the vote for President and that was all she really cared about.
Not usually—always. How can you ever blame someone when software doesn't do what they expected it to? What should they have done differently?
And people internalize this stuff! When poorly-written software does something unexpected, they blame themselves, calling themselves "stupid" or "not good with computers". It's not you, it's us!
The Texas Hart eSlate machines do not provide receipts or other forms of paper trail
So, they fail Voter Verified Paper Trail (https://www.verifiedvoting.org/verifier/#year/2018/state/48). In this case, it doesn't matter what ever you see on the final page, what is stored in the computer can't be audited. It's been 15 years since technologists have been stating that we need a voter verified paper trail.
Has anyone here worked on developing a voting machine?
Why is this such a complicated problem? There doesn't seem to be any many issues to consider when designing the interface, logic, and storage for one of these machines. I feel like many programmers could develop something like this in a matter of hours.
I can imagine some issues if you try to introduce networking, but I don't see any reason why networking should be necessary. Just keep it simple.
Many people advocate for paper and pencil because of it's simplicity, but it should be obvious why that is potentially a much more complicated solution. It relies on humans to record and later read a large amount of information delivered in small chunks. Humans are terrible at that! Getting a machine to read data from the printed page hardly seems any more trivial. That's not even to mention the potential issues that arise from managing the large amount of physical voting cards.
If anyone has worked on one of these machines, I'd be very interested to hear their thoughts on the matter.
Because a software/hardware solution is inherently inscrutable to the overwhelming majority of the population. It's amenable to hacking and not amenable to auditing.
The problem is NOT "build a zero-stakes voting web app", it's more like "build a voting machine which ensures the voter can audit their vote and election auditors can audit election tallies with full transparency, and with a threat model of people trying to hack the voting machines to control election results". Getting better than pencil, scannable paper ballots, and auditors from all (political) parties involved in that election to cover vote counting / recounts –– that's the really, really hard part.
Are you saying it's a public consciousness thing, then?
When I vote, it is my understanding that when I stuff my paper ballot into the box (or sometimes even just hand it over to someone), I am forced to trust the staff to account for my vote. Personally, I don't feel like I'm any more protected against bad actors by using pencil-and-paper.
The only truly-auditable solution I can think of is to have everyone make their vote public, but that is obviously not a reasonable solution.
There are eyes on your ballot and the voting urn, and there may be observers from different political parties present at your polling location, also keeping eyes on the ballots and the urns.
At your polling place, you count the number of ballots going into each urn, and you count the number of ballots coming out of each urn when voting is over. You do a preliminary counting of the ballots, and then they get put back into the urns, that are then sealed, and sent off to some central place for a second counting.
So at every step there are multiple eyes on all pieces, and there are many points where you can discover discrepancies that might indicate cheating. And you can have as many observers as you like at any part of the process, from opposing political parties. So you use their distrust of each other to create trust in the process.
Voting systems are like banks or computer systems: it's not humanly possible to invent one that is safe from fraud, malfeasance, or even human error. Except unlike banks and computer systems, voting systems are by their very nature designed and operated by the very people who would benefit from manipulating them.
Political distrust only goes so far, because winning elections tends to give you more control over the government, which in turn allows you to manipulate elections so that you continue to win them. On the local level, the opposition party often diminishes to the point where not only do they lack the manpower and organization to effectively even contest elections, but the national party effectively abandons the area entirely.
> Political distrust only goes so far, because winning elections tends to give you more control over the government, which in turn allows you to manipulate elections
In banana republics, sure, in civilized countries, not so much.
> On the local level, the opposition party
Again, I'm sorry the US has the incredibly shitty first-past-the-post election shit, because that is the cause of the inevitable two-party system shit.
If the US had a better representative democracy, this wouldn't be a problem.
However, even with the situation you describe, it should be possible to guess which districts will be the closest in margin, and make sure you put more eyes on those districts, in favor of districts that are sure to go either way. That's good enough to secure the election result.
> Again, I'm sorry the US has the incredibly shitty first-past-the-post election shit, because that is the cause of the inevitable two-party system shit.
It's not just the US; it's every English-speaking country except New Zealand. Proportional representation doesn't really stop governments from manipulating their elections either--for example, the Russian Duma has proportional representation.
That's an interesting point. We could require voting software and hardware be open-source, but I guess there's still opportunity for it to be tampered with during its deployment an operation. Hardware and software are complicated, so it's not as easy for the average worker at the polling location to verify.
We could have a solution where the hardware and software are developed independently and both include logic to independently verify the other's authenticity... but that's still open to attack vectors (however difficult they may be).
All that said, the urn system you described does not reflect any experience I've had. I've always been asked to fill out a single paper form with choices for multiple offices and submit the form to either a ballot box or a worker at the polling location. That complicates the tallying process, but I can definitely see how it is still easier to audit than a voting machine.
You can have machines that receive and scan the ballot (instead of a simple box), without losing the paper trail, and keeping a count of the number of submitted ballots (the number of used ballots is also controlled and counted).
> When I vote, it is my understanding that when I stuff my paper ballot into the box (or sometimes even just hand it over to someone), I am forced to trust the staff to account for my vote. Personally, I don't feel like I'm any more protected against bad actors by using pencil-and-paper.
> Why is this such a complicated problem? There doesn't seem to be any many issues to consider when designing the interface, logic, and storage for one of these machines. I feel like many programmers could develop something like this in a matter of hours.
I have just watched a video recently posted on youtube showing the innards of the Brazilian electronic ballot (which will be used for the 2nd turn elections on the whole country this Sunday): https://www.youtube.com/watch?v=4wrMLzqgKEI (unfortunately, in Portuguese only). He mentions some issues, for instance reliability: with tens of thousands of these devices, some will break, and you must be able to replace the device without losing votes. The device must be resistant to vandalism. The votes must be scrambled after each ballot so that it's not possible to discover who you voted for after the fact. For the same reason, it must be hard to insert a keylogger registering the keypresses. The central counting must be auditable. And so on.
The system that's currently spreading records votes with pen and paper and then scans them with a machine, which can be audited and recounted and all that, and it tests very well. The entire state of California uses it successfully, plus a bunch of other places.
I like how flippantly disregarding the authorities are about this. Oh just make sure to sloooow down folks! No mention if the people complaining were allowed to change their votes.
YET someone that is barred from voting, someone that did jail time typically, is thrown in the fucking slammer for one vote cast (and they typically didn't even know they were not allowed to).
The machines in question display all of your selections on a separate screen for the voter to review and approve before the ballot is cast. Since the voters noticed a change they either noticed it before getting to this screen or on this screen. Either way they had an opportunity to go back and change their vote before the ballot was cast.
If it's user error, there should be reports of votes being switched both ways. Why do I get the feeling that's not actually the case? I can smell a pile of BS that big all the way from Massachusetts.
I can think of a few reasonable explanations. The first being that it probably defaults to whoever is at the top of the ballot. I.E. The incumbent and in this case a Republican.
"Never attribute to malice that which is adequately explained by stupidity."
I agree that this is not 'user error'. I would say its a 'poorly made interface', but bargl is right. Your initial claim was:
>If it's user error, there should be reports of votes being switched both ways.
Bargl gave a counter-example, showing that a lack of bi-directional changes doesn't place such constraints on the possible nature of the problem.
> I can think of a few reasonable explanations. The first being that it probably defaults to whoever is at the top of the ballot. I.E. The incumbent and in this case a Republican.
"Never attribute to malice that which is adequately explained by stupidity."
He wasn't claiming that the defaults must be relevant, only that they could be relevant.
I wonder if one or the other party is more likely to vote expressly straight-ticket, i.e. check a box that says "just vote for all Democratic/Republican candidates"
Given that it's supposedly some scroll-wheel related input issue, I suspect the vote is being changed to the next entry on the list in a particular direction. That potentially fits with Democrat votes being changed to Republican ones and Republican ones to no vote at all, which is what people have been complaining about.
What can I do to prevent my district from using electronic voting machines?
With paper ballots, I know that there's no way my selection was changed before it was given to the poll worker (who is subject to public observation). With voting machines, I have no idea what the poll worker received.
Aside from something illegal like knocking over all your precinct's evoting machines domino-style, to force the precinct to issue paper provisional ballots instead, I think the proper remedy is to get seriously involved in your state's Secretary-Of-State election (or equivalent).
It seems like there should be some sort of nationwide ActBlue campaign to specifically focus on whatever Sec-Of-State races are relevant for that election season.
experts have been advising governments to not use electronic voting machines unless they can print out a paper receipt since ~1997 and nobody has listened so good luck.
I vote in Chicago, and our electronic voting machines print a paper receipt. The process is as follows:
1) Write your name and address on a piece of paper.
2) Hand it to the worker, who looks you up on the computer.
3) The worker writes your ward/precinct on the piece of paper and asks you to confirm and sign.
4) The ballot is loaded onto a smart card and given to you.
5) You choose any open voting machine and insert the smart card.
6) The voting machine presents your ballot and you press a button to confirm it is the correct one.
7) You do your voting.
8) The voting machine shows you all of your votes, screen by screen and you confirm them.
9) The voting machine prints your votes, page by page on a roll of paper (behind clear plastic) and you confirm them.
10) The voting machine asks if you are really, really sure and you confirm.
11) The smart card pops out of the machine and you drop it in a box on the way out.
If you do early voting, you can only vote electronically. If you vote on election day, you can choose a paper ballot if you wish. Early voting is electronic only because you can vote anywhere in the city (if you work downtown you can do so on your lunch break no matter where in the city you live) and there are dozens of different ballots because we vote on things at the neighborhood level in addition to state and national candidates. Having paper ballots would be quite challenging.
Since all politicians operate reactively and not proactively with these sorts of things, it will take someone actually compromising an election and changing the outcome by manipulating vulnerable electronic voting machines before any action is taken. Even then, we'll probably just end up with a new model of electronic voting machine that fixes the one vulnerability used. So, good luck indeed.
Actually, it will take someone actually compromising an election in a way that is unassailably and unquestionably broken. At that point the elected officials (who presumably have succeeded under the existing broken voting system) will rise up to fix the problem based on scientific evidence and their understanding of statistics.
Thankfully we can be sure that our votes have not been compromised in the past and there are no actors in the system who might benefit from avoiding looking into possible compromises.
> At that point the elected officials (who presumably have succeeded under the existing broken voting system) will rise up to fix the problem based on scientific evidence and their understanding of statistics.
What motivation do they have to fix a system that put them in office in the first place? (hint: none, there is no motivation)
Yea I know you were joking, but I was highlighting a major problem with the current system we have: the only people who can fix it tend to benefit most from having it broken in their favor.
Don't even need to change the votes, a bad actor can simply gain a national platform by engineering some kind of DoS on voting day causing an expensive do over.
It's not impossible to change votes on an individual level, but all the attacks against it don't scale at all.
How many votes do you need to sway an election? There are about 50 precincts in my county, which is one of 67 counties in my state.
Even if you somehow manage to rig each precinct flawlessly, that's still a lot of people that have to know about the rigging, over a pretty large area, and not one of them can get caught or the whole thing is over.
And if the elections are done right, there should be a number of people from the public at each precinct watching those ballot boxes all day, counting along when tallying votes, and ensuring nobody casts more than one vote or tampers with the box. Hell, you don't even need to speak english or have gone to high school to help secure an election like this, literally anyone can do it.
Paper ballots don't break down, they don't have glitches, they don't require 24/7/365 security to prevent tampering, they don't require nearly as many ballot workers or helpers, they can't "underestimate" voter turnout and only have 2 machines in a precinct to make people not want to wait hours to vote, and they aren't going to be able to be hacked by one guy at the dock yard alone with a shipping container full of voting machines.
It's not perfect, but it's a hell of a lot better than voting machines, mechanical or electronic.
How so? Ballots are cast in public, collected in public, and counted in public (not the case with mail-in or electronic voting). Anyone can participate and request any poll worker be removed.
Of course voter intimidation is a threat, but that doesn't have anything to do with the process of casting and counting ballots.
start a company that makes paper ballot machines, generate some lucrative government contracts, and partnerships with many high profile paper mills. then, hire lobbyists to discuss the evils of electronic ballots with officials while golfing.
Does the machine flip the user's straight-ticket UNIFORMLY across the possible parties? Or does it seem to favor one party over all the others?
If this is really user error, the simplest solution for this is for half the machines to place the republican straight ticket first on the wheel, and on the other half, to place the democrat straight ticket first.
But somehow I think that level of fair-mindedness will be unlikely. (BTW, I lived in TX for a bit, so my jaundice was fairly earned.)
Voting machines are inherently wrong because any bugs are unacceptable, especially in this case where "performance" is irrelevant. Paper and pen(cil) is the way to go. Draw a line, that's it. No fuckery.
In theory, maybe. In practice, how do we do that? There have been zero successful investigations as a result of "flaky" voting machines in America to my knowledge.
And what are the incentives for using voting machines? They are harder to verify than people from multiple parties counting lines drawn on a sheet of paper. They are susceptible to conflicts of interest, general incompetence, and security risks.
I've read a few studies in the past. What you do to experiment is send people to use the equipment, then quiz them about how they voted, and see what the equipment says they voted. Problems like the confusing "butterfly ballot" in the famous Florida election pop right out.
You can also look at issues like undervotes and overvotes from the actual election. And ask people if they have any complaints about the process.
This is all somewhat studied already. We should study it a lot more.
This is in addition to doing systematic post-election recounts of a small % of ballots to verify that the counting machines are working.
Finally, everything is a voting "machine", including optical scan cards. Even if hand-counted. You should measure how well they work.
Even if we somehow verify that reliable machines exist, how do we verify that the machines haven't been tampered with? So far we've seen all sorts of problems with the machines in practice, usually in favor of the party in power.
What's our incentive to switch to machines? Speed isn't a concern here.
One good way to implement this is with paper ballots and optical scan machines. You get speed/less labor with accuracy.
But you still need to study that the paper ballots are reliably usable by all types of voters, in addition to verifying that the machines count accurately.
Paper ballots aren’t immune to issues. Like the Al Franken election and ballots in the trunk; hanging chads in Florida; etc. I don’t know what the answer is here. I do not trust electronic voting machines. Paper isn’t immune to issues. Personally I’d love to see a dual system: votes are recorded electronically with a paper receipt.
This is a problem with overtechnical solutions already. Random mechanical points of failure. Pencil drawing a line is unambiguous.
Re: ballots in a trunk
This was an auditing/ procedural issue.
Re: receipts
Why not just turn in the receipts and count them. Why have a black box do the counting? If a machine says candidate A had a thousand forty votes and B had a thousand thirty, what are you going to do? How do you know if your receipt lied?
If people keep their receipts, you no longer have anonymous voting. And what are you going to do, track down every voter?
If those running the election keep the receipts, they should just count them manually.
The receipt is not to be taken by the voter. The voter will check that the receipt is correct and it will be deposited into the voting urn. Then, manual counting may be done for all precincts or by sampling.
Right. And in the paper-plus-optical-scan system, the receipt is the thing the voter directly marked. No machine between voter and ballot, no different thing to check.
Pencils scare me. Mutable paper trails seem less than ideal. I think I prefer a pen along with an option to request a new form in the event of a mistake. Optical scan for counting along with a paper trail for random sampling. I don’t know the perfect system, but a dual recording mechanism for back checks seems better than just relying on paper or just relying on machines.
Paper ballots with optical scan machines are popular in states that care about these issues. Compared to your suggestion there are fewer machines, easier recounts and audits, and it's very easy for the public to understand.
... I wasn't recommending using the worst possible paper ballot. The modern version, that tests well, is where you draw a line to complete an arrow. And this modern version is the one that's becoming popular.
Hand counting is important, because it involves many eyes. If you want to manipulate the counting on a huge scale you cant, if you have to worry about idealistic volunteers.
If you let a machine count, you loose these checks.
It is not only about bugs. It is also about the question whether everybody can wrap their head around it. This is a problem with every electronic/digital voting process – even if you are a engineer figuring out if that machine is safe would be not that straightforward.
If speed is not an issue then the voting mechanism that everybody (even the technically unskilled) can understand is the best.
And beeing slow is not a bug, it is a feature. A feature that prevents all kinds of things from happening that would undermine trust in the system as a whole.
When I said "errors" I didn't only mean bugs. I mean failing to have a counted vote that's the same as what the voter intended.
The method I like most is paper ballots with optical scanners, which the general public can understand. Random audits for confirmation, yes, the general public can understand. Recounts, and hand recounts, yes, the general public can understand.
It just doesn't take that long to count by hand. You wait an extra day or week or two to get the final count. So what? This has consequences for years, so take your damn time and count every single ballot.
A machine cannot be watched in the same way a human can. No scrutineer can prove that a ballot was counted correctly without ... seeing it counted.
And beeing slow is not a bug, it is a feature. A feature that prevents all kinds of things from happening that would undermine trust in the system as a whole.
2004, Bush vs Kerry in Ohio. The voting commissioner was Republican and had promised to deliver Ohio. Without Ohio, Bush would not have won the election.
Heavily Republican precincts were set up so that voting was easy all day.
Heavily Democratic precincts in Cincinnati got so backlogged that they closed the door and people had to be in line for hours to vote.
Bush won the state by 2.1%. He carried Harris County, which includes Cincinnati. No Republican has carried Harris County since.
Now tell me. Does the feature of voting "beeing slow" improve your faith in the fairness of that election?
Voting machines haven't fixed the problem, which is the lack of independent electoral commissions. And they never will. But paper ballots are far less easy to subvert than machine ballots.
Yes but given limited resources it's more feasible to obtain a random sample of the population you're looking to gain insight with and derive your observations from the sample.
I live in Austin and have been voting with these machines for the last 8 years, including earlier this week.
The UI for the ballot is a series of rectangular tiles separated into two columns on a series of pages. Each tile represents a given race or proposition, with a title header, a description field, and then the various options to vote for stacked vertically as a collection of { radio button, option title }.
In order to navigate between pages, there are two digital "arrow" buttons for "Next" and "Back". To navigate within a page, and then within a tile, there is a clicky scroll wheel (rotation quantized in something on the order of 30 degree increments). To make a selection there is a separate button digital button "Enter".
The way the straight party selection is presented is as the first tile on the first page of partisan ballot options. Selecting straight party isn't a separate option on the underlying ballot; rather it is UI layer feature that fills in all of the partisan election options with the party of choice as if you had individually selected all of them.
I've never experienced the phenomenon described in the article, but I can imagine how it might happen. There is visible latency in interactions (selecting an option, moving between options/pages) and I could imagine someone selecting the straight party choice, pressing "Enter", not seeing an immediate result and pressing Enter again while rotating the wheel, and then being confused when they see the first partisan election race not reflecting their vote because they inadvertently made another selection on that race.
This seems like an easy thing to address and something that could/should have come up in UX usability testing. If anything should go through rigorous accessibility and usability testing, it should be voting processes (and that hold for whether elections are mediated by machines, paper ballots, or some other method).
Based on the "wait for all candidates to have loaded" description, I had a thought that no one else seems to have had yet, and you may be able to confirm it as a possibility: Do the names ever shift around?
The thought is, lets say there's 3 candidates, Alex, Becky, and Carl, and they're supposed to show in that order. But due to the slow loading time, you first see Becky and Carl, then Alex loads in a moment later and the other two shift down.
Since you've described the straight party selection as a separate button/option, the thought I had was, what if picking that is supposed to choose Becky, so Option 2. But if you hit it too soon, you've selected Becky as Option 1. And then Alex loads in and Becky becomes Option 2, but the vote didn't shift - it's still on Option 1.
Does that sound like a possibility, with your experience with these machines?
I'm strongly opposed to voting machines, but if we're going to be stuck with them, enabling "straight ticket" as an easy selection shouldn't be an option. I even vote "straight ticket", so I understand why a person might, but we should aspire to it not being necessary, and shouldn't enable it.
I'd even go as far as to say that it would make sense to not even list the party on ballots. If the only information a person has about a candidate is their name and the (D) or (R) next to it, they might just not be informed about that particular race. I'm less sure of that opinion though, and wouldn't defend it as ardently.
I would agree that democracy works better the more informed the voters are, however the very idea of taking steps to discourage 'voting while ignorant' is highly controversial in the US. We have a history of disenfranchising voters which is at the back of most people minds when the topic comes up.
If someone would choose to not vote in a particular race on their ballot because they didn't know which candidate was the (D) and which was the (R) that's hardly disenfranchisement.
But it's also not the main point I was trying to argue.
There is something nice about a person voting in a place with enforced privacy. Families filling out their ballots together on the kitchen table may be fine for most, but for others the boxes they check would be different in a private polling booth. These people are disenfranchised in with mail-in ballots.
In Oregon, the entire state votes by mail in ballots, which we receive like 2 weeks ahead of election day. This means I can vote when I am not at work, and don't have to miss work to do so. It's amazing, more states should implement this.
As a kid in Michigan I remember my parents waiting in long lines to vote. After 20 years as a voter in Oregon I have to say our system is great. We recently received the voter guide by mail, and will receive our actual ballot shortly. Take your time filling in the scantron circles while you peruse the guide, put it in the anonymity envelope, sign it to attest, drop it at city hall or the library. I work for a major internet company, including on election systems, and yet I still love this paper system. If there is any discrepancy, they just recount.
No missed work, no lines, no profiling. I read all the articles about issues with polling stations and all I can think about is systemic disenfranchisement.
There are two envelopes. The outer envelope has your name on it, you sign that and return it. You can mail it in if you like, or drop it at special drop boxes around town (I always do this because I'm prone to waiting to the last minute.)
The inner envelope is anonymous. They verify the outer envelope and open it, then pass the inner envelope to a separate area/volunteers to do the counting.
The contents of the voter guide are submitted by the candidates. For ballot measures, pro- and con- statements are submitted by sponsors or members of the public. I don't have mine handy but I think they actually print several pro/con statements for each.
I'm not sure how unique this is but ballot measures actually have brief statements printed on the ballot explaining what they will actually do, preventing issues where you're like "wait should I vote yes or no on this if I want this thing banned?"
> A YES vote will: Instruct the legislature to write a law preventing future taxes on groceries. A NO vote will: not send any recommendation to the legislature.
Yeah, I moved to Oregon recently and found the ballot structure to be pretty good.
It outlines the different propositions, explains what happens for a yes or no vote and then has multiple pages devoted to showing arguments for and against mailed in by concerned citizens and organizations.
Parties are allowed to enter their own party descriptions. I haven't read the sections on candidates yet
Access to voting is _so_ Oregon. The rest of us are into voter suppression this year, silly hippies.
Seriously, yes, that system is preferred to increasing access and activity in our democracy, but it seems there's a large contingent that feel it's in their party's best interest to not make it easier to vote. I'm sure it's fair to claim that they honestly believe their party in power is for the good of the country, but then everyone feels that way about their desired political trajectories.
You might be thinking of Colorado where they somehow failed to notice that a truck with a bunch of ballots to be sent to voters wasn't unloaded at the post office until people started complaining that they didn't get a ballot. This is quite different from losing voted ballots or not recording a vote correctly.
I question whether the vote coercion/purchase opportunities opened up by mail voting are actually "huge" compared with in-person voting. But even if so, these opportunities don't scale easily and potential damage is limited.
If some malefactor wanted to buy 1 million votes at an average price of $50 each, that's $50 million of somewhat traceable money and 1 million people, some fraction of whom are certain to reveal they were paid. It won't remain a secret, and it will leave numerous evidence trails.
Contrast with fully electronic voting fraud - scalable, hard to detect, and (when well-executed) leaves little evidence to support nullifying an election and forcing a do-over.
IIRC, last I checked something like half the states in the US allow you to get a paper ballot ahead of time for no particular reason so in those states vote by mail wouldn't change anything.
I would say that vote by mail isn't always the best option depending on circumstances but today in the US there is not much vote buying or coersion and it seems like a clearly less bad option than any of the alternatives considering how they are actually implemented. I would not recommend it for Mexico, which already has widespread vote buying even without being able to verify who voters actually vote for.
I don't disagree, but considering that everyone has a camera in their pocket at all times -- including in the votig booth -- these days, I wonder if the opportunity gap for coercion is really all that big.
> On the other hand, voting by mail opens up huge opportunities for coercion or vote buying/selling.
Not any more than any current systems do. You have to sign the ballot, and if the signature does not match what you submitted in your voter registration thing, they kick it back to you.
Unless you are insinuating that the USPS mail folks could collect them all and send in forgeries?
The phrase "opportunities for coercion or vote buying/selling" in the above post refers to opportunities for a malefactor to be physically present while a voter is filling out the ballot and coerce/bribe the voter to fill out the ballot a certain way. Voting at a polling place guards against this by requiring that the voter cast a ballot privately, out of the view of anyone else.
You don't sign the ballot. You sign a paper that gets sent along with the ballot. If things are done properly, the person checking your signature doesn't see your vote and the person counting your vote won't see your signature.
Yea I wasn't totally accurate in my response. The point is, voter fraud by mail requires accurately forging a LOT of signatures.
Alternatively, the state can pay for the return stamp, but will likely have to pass some tax measure to fund it (in Oregon, state budget must be balanced), so in the end voters would still be buying the stamp. This is less efficient since now there would be stamps bought that folks have no intention of using since they drop them off.
No need to forge signatures, you just order all your kids and grandkids to vote like you say, or they will be ostracized by the rest of the family.
Or you order all your employees to vote like you say, or they will be fired. If they don't snap a pic of a ballot filled out to your liking, out the door they go.
Or you just buy the votes of anyone. $50 for a pic of a "correctly" filled out ballot. That scales pretty nicely.
I see your point, but don't agree that it 'scales pretty nicely' since it would rely on all participants keeping quiet about it, which definitely prevents it from scaling at all since you won't be able to openly advertise you are doing this without drawing fire from election officials.
Washington state has had vote-by-mail for everyone for a while now too. This year they made it free to mail back the return envelope, which made a good experience even better.
IMO it should be called voter suppression when this isn't done (as in Oregon) since rural voters are less likely to have convenient drop boxes. Mild voter suppression compared to what some states are doing but still politically motivated voter suppression.
Rural voters are likely not strangers to buying a $0.40 (or whatever they cost now) stamp and putting things in the mail, since they almost certainly have to mail other things in (e.g. bills).
Another Oregon voter here. I just finished filling out my ballot in the privacy of my home, with the voter pamphlet at my side for reference. So simple and sane.
It's a great option but has the same problem (to smaller degree) as electronic voting machines, that the process is not entirely observable by the public.
In Washington State, every county processes mailed in ballots. These offices are required to allow observers to watch the entire counting process. You can even go to the website and watch live video from any number of cameras.
Essentially every computer expert says that using computers for voting is a really bad idea. We do it anyway. Is there any other area where we do something like this?
Voting by mail, as we have in Washington and Oregon, makes it so easy to vote. And, now we don't even need a stamp on our ballots. I don't know that any system is perfect, but one really has no excuse to not vote and to vote accurately when they have plenty of time and can do it from the comfort of their home.
Voting by mail is an abomination that goes entirely against the idea of a secret ballot, allowing voter coercion, and sometimes even voting fraud. There is a reason most democracies don't do it.
We have loads of disenfranchised people, deliberately put in that spot by manipulative voter ID policies, along with report after report about security flaws in voting machines. Tell me again what’s wrong with voting by mail?
It seems the system could be configured to default to 'no selection' rather than default to one choice or another. Then the 'page rendering' issue can be absolved of artificial influence perceived or otherwise.
This is a forum populated with thousands of smart and talented engineers all discussing the absurdity of US voting systems and suggesting great fixes. There is clearly a problem to be solved here—and it might even be lucrative to solve it. Seems like a reasonable idea for a startup company: making cheap, audit-able polling devices that can be sold to any county in the country and any country in the world. Someone here should take a stab at it.
Or, as engineers, we can propose an existing solution that is trustworthy and well-proved: pen and paper.
It has proved its reliability in thousands of elections. It is cheap, universally-understood and basically impossible to subvert to a meaningful level of impact. It is understood by everyone who can vote.
Democracy doesn't need us to show off how clever and creative we are. It needs boring, simple, reliable mechanisms.
“The Hart eSlate machines are not malfunctioning, the problems being reported are a result of user error — usually voters hitting a button or using the selection wheel before the screen is finished rendering"
More like a page loading issue. Probably need to look at optimizing the page or display a simple big "LOADING..." in the middle of the screen while all fields and field values are being loaded. Also disable the actual page (all submit or selection buttons) while page is being loaded.
Definitely not user error. Different locations have different internet connection speed that will effect page loading.
> Different locations have different internet connection speed that will effect page loading.
Wait, what?
Are you claiming that these insecure, unusable, unfit-for-purpose excuses for a POS machines are also INTERNET-CONNECTED?
(For the record: if the page render after an action takes more than 100ms under any circumstances, the system is by definition broken. That's the lowest of the Nielsen thresholds.)
> In a statement to supporters Friday, Cruz cited “multiple reports” of race selections changing and added “once you select the Republican party ticket, please be patient and do not select ‘next’ until the ballot has populated all of the selections.”
It reminds me of an era of "Please don't press 'Buy' twice or your credit card could be charged again."