Accessibility and Auditability in Electronic Voting

A False Choice

The prospect of complications or delay in DRE deployment has alarmed some members of the disability rights community.⁹ That alarm has been fueled by two myths: 1) that VVPAT-enabled DREs do not exist and 2) that only DREs can provide accessible voting to people with disabilities. For example, the American Association for People with Disabilities’ (AAPD) website states, “Touch screen voting systems that provide a [VVPAT] do not exist, have not been tested in the real world, and are not certified.”¹⁰ Further, a recent lawsuit filed on behalf of AAPD and others claims that “only DRE systems, when properly equipped, are accessible and enable voters who are disabled to vote independently, unassisted and in secret.”¹¹ If taken at face value, these statements imply that the push toward verifiable elections must pull us away from accessible elections.

We reject this false choice. Accessible, auditable, federally qualified machines are available for purchase today, and more are scheduled for release in the coming months. Non-DRE methods of accessible voting are both available and in development. Even jurisdictions that have already purchased paperless DREs can take additional steps to increase the integrity of their elections before the November 2004 election.

Options for Auditable and Accessible Voting

The Help America Vote Act (HAVA) rightly required every polling place to have at least one accessible voting machine by January 1, 2006. We support this timetable, and, where possible, we encourage election jurisdictions to provide accessible, auditable voting machines before that date.

Accessible Alternatives to DREs

The controversy over DREs has also distracted the public from the availability of other accessible, auditable voting technologies. Optical scan systems are the most widely used voting technology in the country, and they can be made accessible with both high- and low-tech solutions.

Tactile ballot templates¹² for optical scan ballots can be used, in conjunction with an audio interface, to aid the blind and non-English speakers in casting ballots without assistance and in secret. This technology is used throughout Rhode Island, costs very little, does not require voters to know Braille, and has been endorsed by AAPD’s Jim Dickson, one of the accessible voting community’s most outspoken advocates.¹³

Electronic ballot markers can be used to fill out optical scan ballots. These systems look like traditional DREs, but they record votes on paper ballots instead of internal memory. This kind of machine can match all of a DRE’s accessibility features (audio interface, sip/puff input, multiple languages, etc.), and every vote can be verified before submission:

a.

Avante’s¹⁴ Optical Vote-Trakker¹⁵ is a federally qualified, accessible, electronic ballot-marking system. It was the first system qualified to the FEC’s 2002 voting standards, a designation that means, in part, that it produces a 0% error rate even after 1.5 million votes. Certification is pending in several states.

b.

ES&S, ¹⁶ the world’s largest election equipment manufacturer, is also in the process of attaining federal qualification for an electronic ballot marking system. It will be available later this year.¹⁷

DREs with Voter-Verified Paper Audit Trails

DREs equipped with a VVPAT can also provide auditable, accessible voting:

a.

Avante’s Vote-Trakker¹⁸ is an accessible, VVPAT-equipped DRE that has completed federal testing. It is certified for use in several states and has certifications pending in others.¹⁹ This system has been used successfully in five separate elections and the American Council of the Blind lists the Vote-Trakker as an accessible voting system.²⁰ In addition, Jim Dickson of AAPD has called Avante’s VVPAT an “elegant way” to provide a paper audit trail if one is mandated.²¹

b.

AccuPoll²² produces a federally qualified, accessible, VVPAT-equipped DRE system.²³ The company is actively pursuing state contracts and expects to have equipment in the field for the November 2004 election. The American Council for the Blind lists AccuPoll as an accessible voting system manufacturer.²⁴

c.

Sequoia Voting Systems,²⁵ the country’s third-largest election equipment manufacturer, will have a VVPAT-equipped AVC Edge²⁶ on the market by the summer of 2004. The unit will be deployed in every Nevada election jurisdiction in time for the 2004 presidential election.²⁷

d.

TruVote is in the process of qualifying a VVPAT-equipped DRE. The system also allows voters to verify that their vote was part of the final vote tally via a post-election web interface. The TruVote system should be qualified and available for purchase in the summer of 2004.

Adopting These Solutions

Unfortunately, the existence of accessible, auditable equipment does not guarantee that it will be considered for purchase. Certification hurdles and election official education must be addressed in jurisdictions planning to purchase machines before the November election.

a.

Certification hurdles - The U.S. has a patchwork of different certification requirements, and sometimes these requirements are all that stands between a federally certified voting machine and a market. Where possible, we hope that states will expedite their certification processes to allow the procurement of auditable, accessible machines. This is especially important in states where counties are still trying to purchase new systems before the November election.

b.

Election Official Education - Some election officials have inadequate market knowledge and are therefore unable to make informed decisions about voting machines. For example, Colorado Secretary of State Donetta Davidson recently claimed, “To date, there has not been a single voter-verifiable voting system tested or certified at either a national or state level.”²⁸ Neither part of this statement is true for Colorado, but it nevertheless precludes Colorado from making an informed procurement choice. All of those concerned about elections, whether focused on accessibility or security, should address these kinds of misconceptions.

Jurisdictions that Already Have DREs

Some counties have already purchased paperless DREs, and replacing those machines with one of the systems described above before the November election may be impossible. In those cases, DREs could be used to provide accessible voting if additional safeguards are adopted. California Secretary of State Kevin Shelley recently outlined such a plan, mandating that counties be allowed to use already-purchased DREs under two conditions: DREs must either be equipped with a VVPAT, or they must meet 23 additional security requirements and voters must be allowed to vote on a paper ballot if they so desire. This stopgap solution preserves accessibility for disabled voters and increases election integrity.

It is now clear that DREs have serious problems, many of which stem from inadequate testing procedures or the failure to follow those procedures. At a minimum, every DRE voting technology should be subjected to public “red team” testing, should use only certified election code, and should provide voters with paper ballots upon request.

a.

Certified Code - Software used in elections is required by law to be certified and verified, then held in escrow by election officials who can audit its installation. However, voting machine vendors have repeatedly violated that law, sometimes with the knowledge of election officials, by installing uncertified software on DREs used in real elections.²⁹ This not only introduces unknown code, it also undermines the ability of election officials to use escrowed code to determine if tampering has occurred. Robust performance and security rely on minimizing unknown threats and addressing known problems; failure to follow these basic legal requirements puts our elections at risk.

b.

Red Team Testing - Federal and state certification processes do not currently include time-limited simulations where professionals attempt to subvert a mock election, also known as “red team” attacks. This kind of testing is extremely valuable because it clearly illustrates vulnerabilities while providing a blueprint to correct them. To date, only one red team attack has been conducted with a real voting machine, and it exposed serious problems.³⁰ All DREs should be subjected to this kind of testing, and subsequent recommendations should be made public and then adopted.

c.

Paper Backups - In addition to these steps, election jurisdictions should prepare to provide voters with paper ballots upon request. Every state has procedures for absentee and provisional balloting, and those procedures should be extended to voters who choose not to use a DRE that cannot be audited.

The Road Ahead

American election reform remains a process of years, not months. With a presidential election on the horizon, we understand that only some improvements can be accomplished by November, and others must be deferred. EFF believes that long-term changes like the introduction of open source voting solutions and clear technical standards for accessibility and auditability are important components of a healthy election environment. However, we understand that these goals are not likely to be realized before the next election.