November 9, 2006 | By Matt Zimmerman

Who's Afraid of Virginia's Voting Machines?

Down over 7,000 votes to Democratic challenger Jim Webb, Virginia Senator George Allen today conceded. "It is with deep respect for the people of Virginia," Allen said, "that I do not wish to cause more rancor by protracted litigation which would in my judgment not alter the results."

With all due respect to Sen. Allen, how could he know for sure?

The long history of problems with electronic voting systems should have given him at least slight pause, especially in light of last week's documented incidents of Hart Intercivic voting machines apparently truncating the names of several candidates on the summary page, including the name of his opponent, now-Senator-elect Jim Webb. Or reports from election day that ES&S iVotronic machines in Sarasota, Florida, recorded 10,000 fewer votes for a Congressional race than for other high-profile races.

The majority of Virginia counties use touchscreen direct recording electronic (DRE) voting machines, and most of those counties use DREs that do not generate voter-verified paper ballots. Instead of creating anything truly useful for officials to recount, the machines simply reproduce data that is already in memory, in effect reprinting the results rather than recounting ballots in any meaningful sense. Mechanical problems or manipulation affecting the initial vote totals would most likely not be spotted by simply reprinting the same results.

More troubling, Virginia's recount statute nowhere explicitly gives candidates access to the only materials generated by DREs that could be relevant to determining whether votes were miscounted or manipulated: backup memories and audit logs. According to Virginia law, in order to "redetermine" DRE totals as part of a recount, "[R]ecount officials shall open the envelopes with the [end of the day vote summary] printouts and read the results from the printouts. If the printout is not clear, or on the request of the court, the recount officials shall rerun the printout from the machine..." In other words, a recount of Virginia DRE vote totals would by default consist of recount officials looking at the same summary totals that were printed out earlier in the process or, if the printout was unclear or (at the discretion of the court), generating an identical summary printout.

While optical scan ballots are capable of hand-counting if need be (and legal provisions are in place in Virginia to perform such a hand-count), paperless DREs have effectively eliminated that capability. At the same time, Virginia law appears to excuse the DREs' shortcomings and effectively removes ballots cast on such machines from recount scrutiny, replacing a process designed to verify results with an antithetical "trust the technology" farce.

Virginia election law, like state law around the country, remains woefully behind the times when it comes to adequately considering new voting technology and the vulnerabilities that come with it. In Virginia, outgoing Senator Allen's concession eliminated the need for the spectacle of county election officials proudly declaring that they could once again read pieces of paper that announced vote totals that they could not independently verify. It has not eliminated, and should not eliminate, the drive to both improve the technology and to correct Virginia's law. Without state or national legislation that sets tougher standards, the procedural mess avoided today will eventually arrive.


Deeplinks Topics

Stay in Touch

NSA Spying

EFF is leading the fight against the NSA's illegal mass surveillance program. Learn more about what the program is, how it works, and what you can do.

Follow EFF

EFF will speak at Black Hat Briefings on both government surveillance and export controls. https://eff.org/r.nilc #BHUSA

Jul 6 @ 7:14pm

Massive leak of Hacking Team docs exposes the firm selling spyware to authoritarian governments: https://eff.org/r.f6bu

Jul 6 @ 4:40pm

Newest leak of TPP's IP chapter reveals how countries are converging on anti-user copyright takedown rules: https://eff.org/r.jedp

Jul 6 @ 3:40pm
JavaScript license information