From Our Readers

From Dr. Michael Norden, Vivarto Technologies

"I first began reading the Bell because of my involvement with Vivarto Technologies, a software company focused on improving communication and decision-making. We needed to incorporate technology for secure Internet voting, and The Bell was an invaluable source of information. We learned a great deal about what is possible and what is required for a secure voting system. Notably, as a result of what we learned, Vivarto Technologies chose to partner with Safevote, and incorporate their voting technology. As the nation begins to study election system reform, I believe that The Bell (including archived issues) is required reading for all those wishing to make the most informed contributions."

Panel: The Business of Electronic Voting
Place: Financial Cryptography 2001, Grand Cayman, Feb 21st, 2001 10:40 AM
Panel Chair:  Moti Yung, CertCo
Panelists: Ed Gerck, Safevote.com; Andy Neff, VoteHere.net; Ron Rivest, MIT; Avi Rubin, AT&T research
Abstract: This panel will concentrate on the emerging business of e-voting.

The problems associated with traditional voting machines in a national election---their unreliability, inaccuracy and other potential hazards---were placed in an international limelight by the last US presidential election.  At the same time, but less conspicuously, an industry centered around e-voting has started to emerge, offering various solutions for national, boardroom, company-wide, and other sorts of elections.

Indeed, the cryptographic research community has dealt with issues related to security and robustness of e-voting as a fundamental protocol problem.  In contrast, this panel will discuss issues regarding the real-life aspects of actual implementations of voting systems.

We will discuss basic requirements and problems associated with the reality of election technology and the business built around it, covering issues of reliability, fairness, and scalability, and asking  such questions as: Does one solution fit all situations?  How much security is actually required?  Is e-voting for real?  How far are we from ``real'' voting?  Is the Internet the right arena for voting? What is the interaction between the technology and its quality and the business?  Is it a business at all?  (Is there money to be made, and how?  Alternatively: does e-voting really belong in ``financial cryptography?'')  What are the social and legal implications of e-voting?

We hope to learn about new angles to examine voting problems, to learn about related burning issues of all kinds (social, business, technology), and to learn about new questions for further basic, systems, market, legal or social research.

ISSUES: We will try to cover requirements (based on various scales and at different stages); technical difficulties, controversies, misconceptions (any connection to security/crypto/ etc.? new paradigms?); business and operational aspects (hoping to make money...??); and derived technical and social/governmental aspects.

“The Bell is very interesting. I post it on our internal website. I especially enjoy the articles in terms of laying out the logical conditions needed for security and privacy in an Internet voting system. This is very important. There are a lot of people coming out of the woodwork now who want to build an Internet voting system. But they know little about the nitty gritty of election administration and voter registration. And besides, Internet voting is a complex undertaking. Anyone who wants to be involved in it should read this newsletter.” 

“The information in The Bell on Internet voting will be extremely useful to us in the context of the on-going discussions here in Michigan regarding what we should do after Florida and where do we go from here.”

“The Bell is a fairly well-rounded approach to Internet voting and Internet voting is a very difficult puzzle to do for anyone. You’re hitting a good range of topics. And the attack test in the November 2000 shadow election was set up really well, with practical solutions.”

The article in the Orlando Sentinel headlined “Optical Scanners Topped Pregnant Chads as Most Flawed in Florida” demonstrates how it is possible – yes, even very easy – to misinterpret simple statistics.  The article is comparing the statewide average of invalid pre-scored punch card ballots (3.9%) with the tail end of the variations in invalid optical-scan ballots (5.7%).  The article is comparing whole apples to orange peels and finds, not surprisingly, that apples taste better.

Over the 36 counties in which optical-scan ballots were used, the average percent of invalid ballots was 1.4%.  Over the 15 counties in which pre-scored punch card ballots were used, the average percentage of invalid pre-scored ballots was 3.9%.   I made this calculation myself from the reported percent of invalid ballots (both overvotes and undervotes) cast in each Florida county.  The public statement of the American Society for Quality on the subject of voting equipment used in Florida reported very similar percentages. 

In the worst case for optical-scan ballots, Gadsden County, a rural county in the Florida panhandle on the northern border of the state, had 2,073 invalid ballots out of 16,800 ballots cast, or 12.3%.  Note, however, the small number of ballots cast.  I was told by a North Carolina election official who grew up in Gadsden County that hardly anyone who continues to live there has a high school diploma.  Even the Orlando Sentinel was willing to admit that “Most of the 15 counties using this optical-scan system [with central count rather than precinct count] are small and rural, and together they represent just 4.6% of all the ballots cast ...”

The worst case for pre-scored punch card ballots was Duval County, where there were 26,909 invalid ballots out of 291,000 cast or 9.23%.  Duval County includes the city of Jacksonville and some beach communities.  Also, Palm Beach County, which includes the city of West Palm Beach and other communities such as Delray Beach, used pre-scored punch card ballots and had 29,702 invalid ballots out of 462,900 ballots cast, or 6.42%.  Invalid ballot percentages for Duval and Palm Beach are both more than the cited 5.7% for the worst cases of optical-scan ballots.

“Of course, we cannot continue to allow voting systems to be wrong in 120,000 out of 6 million votes, or to cost $3 or even $1 dollar per vote. Voting requirements need to be realistic, strong and practical, and cost us no more than a few cents per vote. I think that the 16 requirements published in The Bell reflect current law and what is needed today from voting systems in the U.S.” 

“I am very happy to be on your subscription list for The Bell. I read it religiously and I find it very informative, particularly because you are not afraid to venture into a level of technical detail that I have not seen anywhere else!”

“I find The Bell very informative.”

“Direct democracy and other ideas may be coming thanks to electronic voting but we’re gonna implement existing democratic systems electronically first. There are dangers with more direct forms of democracy and this delay is a welcome one. 

Directly allowing people to make big decisions at first blush seems more democratic but I don’t believe is. Firstly, people become apathetic if they get asked to vote too much. Can you really expect people to go to the effort of learning all the issues before voting on every decision? Don’t they have lives to lead which is why they entrust representatives?

There is also the risk of emotional votes which are soon regretted. In the UK we often get calls for drastic legislation after tragedies such as a child being abducted and murdered or unnecessary accidents. People get caught up in the moment and don’t think through the full (civil liberty, economic, etc.) implications of what they call for. Direct democracy might not leave room for such reflection.”

“I used the Safevote system myself and I liked it. It was very easy to use. Overall I can say that the test in our county was successful and the reaction from the people who voted on the system was very favorable. Many voters I talked to wanted to know when they would be able to use it for real, including voting from their homes or offices. I think Internet voting can also be used at the precinct, allowing voters to cast their ballots anywhere in the county. Voting was reasonably fast and could have been even faster if there were more than one computer issuing DVCs.  My staff members also found the system easy to use and operate.”

“The Bell is excellent. It looks at difficult situations head-on. It’s very concise and focused. My work involves Internet security and I find it a valuable resource.”

“It’s a fantastic newsletter. Very educational. And there’s so much different information covered. It helps us to keep in tune with what’s happening out  there and to understand all of the changes that are going to be coming our way.”

“Internet voting on a large scale basis is many years away from being practical and secure. The Federal Election Commission does not support the idea of Internet voting nor does the Public Integrity Unit of the United States Justice Department. In any event, until it is permitted by law in Georgia it won’t be reality here.”

...”The Bell, a newsletter that I have enjoyed reading up to the October issue. ... when will the November issue of Bell be out?”

“Thank you for keeping me up to date with issues of The Bell. It is exciting to watch the progress that is being made in the area.”

“Thanks for providing this excellent newsletter.”

“I encourage you to read this study [on U.S. public sector elections] in this newsletter [THE BELL]. It bullets out the concerns and positive reactions of real life election administrators to the potential of Internet voting. Election administrators are ones that hold the real power in any transition toward Internet voting.”

"After I read the first issue, I felt compelled to subscribe. 

Everything is going in the direction of the Internet, including public elections, and I find The Bell a useful tool in keeping up to date with news and information in the area of Internet voting, especially as it relates to election procedures. However, security concerns have to be addressed."

"I’m always looking for ways to better serve the public so I try to stay abreast of anything having to do with elections. The Bell is very useful in that regard. I read it to find out what’s going on in the world, what the new ideas are. We don’t want to reinvent the wheel. But Internet voting will have to be made secure. There can’t be dead people voting. And you have to be certain that only qualified voters can vote. These are big problems today and Internet voting will have to deal with them."

"I’m happy with it. The Bell is very informative. I send the PDF version to all of the senior staff. Some of the newsletters I read cover only one area like the Federal Election Commission. But The Bell brings interesting information together from outside the election community. It also keeps me informed about what other counties are doing regarding Internet voting."

"I found The Bell very informative. It has a lot of good information from different sources all in one place."

"Just want to provide some feedback on your first issue of The Bell. It was sent to the County Clerk in Riverside County who does not have responsibility for elections; but it eventually was forwarded to me. I am the Registrar of Voters for the County of Riverside and report independently as a separate Department Head to our Board of Supervisors. I found The Bell to be extremely informative, and look forward to receiving future issues.

You may or may not be aware that Riverside County just purchased Sequoia-Pacific’s DRE Touch Screen Voting System, The Edge. To provide for a county of 7200 square miles and nearly 1,000 polling locations, we invested $14 million in purchasing 4,250 units. It is a tremendous challenge, particularly in a Presidential election year. Currently, we have a 20-year old mark-a-vote voting system, which has served us reliably. However, for all the reasons pointed out in your columnist’s [Roy G. Saltman] comparison of voting systems, we were compelled to search for a replacement, particularly for a county of our size with its inherent escalating printing costs. We were investing more than $1 million in printing costs; and when 50% or less turn out at the polls, we must destroy that major tax investment with each election even though we are required to print sufficient ballots for the electorate.

Sequoia-Pacific’s Edge met all the criteria for a new voting system you outlined on page 7 and more in our evaluation. Primarily, it offers the security of a stand-alone system with individual units that are not connected to a network. It also has a closed operating system that is not able to be accessed from unauthorized intrusion. Its multi-lingual programming capability, larger font size flexibility, and each self-contained unit is a combined voting booth, electronic ballot and tabulator which is accessible for those in wheelchairs and motorized scooters. Next year, we will be adding the audio component for the visually-impaired voters. We estimate that the DRE touch-screen units will save a minimum of $600,000 in printing costs for each election. On November 7th, we will be implementing it county-wide so I will look forward to sharing the results with you. We are also interested in Internet voting applications as an option once certification is achieved; but in the meantime, we had to move forward with a certified alternative that achieved all the criteria you listed plus another important one...and that is the simplicity of its design and functionality which are extremely intuitive for our pollworkers and voters.

Thank you again for the service you are providing through this new periodical and the commitment you share with elections administrators to provide voting systems which are accurate, secure, rapid in tabulating results and engender the confidence of the public."

"The Private Sector won’t wait" in the July issue of The Bell usefully distinguishes ‘delegation proxy voting’ from ‘transfer proxy voting’. In the article it is suggested that this difference aligns with proxy voting in the public sector and the private sector respectively. This may be the case in the USA, but it is not so in the UK. Established proxy practice in the private sector also appears to differ markedly between the USA and the UK.

The development of a general taxonomy in this field will be useful, but it will have to take note of differences in practice around the globe as the Internet becomes more widely used for formal voting and similar legally controlled purposes. A taxonomy based solely on US practice is unlikely to aid common understanding and may hinder adoption of the technology.

In the UK ‘a proxy’ is not usually "a written authorization", but rather a person who has been authorised to act on behalf of someone else. The instrument appointing the proxy must be in writing and must be signed by the person authorizing the proxy. If the written instrument has been effected under a power of attorney or other authority, it must be accompanied by a certified copy of that power of attorney or other authority (Note: The use of electronic signatures for legal purposes is not yet permitted in the UK, although the primary legislation is now in place).

In UK public elections the person appointed as proxy always casts a ‘delegated proxy vote’ as there is no way the authorizing elector can confirm that his or her wishes have been followed. As we have the option of postal voting if we cannot attend a polling place, it is only those who are unable to read or mark the ballot paper themselves who are likely to engage a proxy for public elections.

In the private sector in the UK, the person appointed as proxy may cast a ‘delegated proxy vote or a ‘transferred proxy vote’ or any combination of the two, depending on the authorization given by the person entitled to vote. For a company general meeting, a shareholder may appoint as his or her proxy the chairman of the meeting or any other person who need not be a shareholder in that company. The shareholder can give the proxy complete discretion about how the proxy vote should be used (a series of ‘delegated proxy votes’) or can mandate the proxy as to how the vote is to be cast on all the issues specified on the agenda by appropriate indications on the instrument of authorisation (a series of ‘transferred proxy votes’). When the shareholder mandates the proxy on only some of the issues, the result will be a mixture of ‘delegated proxy votes’ and ‘transferred proxy votes.’ For company general meetings, the instrument of authorization (the ‘proxy form’) usually lists the issues on which votes will be required, with boxes for the shareholder to mark ‘For’ or ‘Against’. Many private organizations, not controlled by UK company law, operate similar arrangements, though they may restrict the choice of proxy to someone who is a member of the organization.

An issue that arises from time to time in private organizations is what discretion a fully mandated proxy should have in votes on issues not specified on the agenda of a meeting. These can be important procedural motions or amendments to listed motions where the constitution of the organization allows such amendments to be tabled at the meeting. An absent member may be quite happy to allow full discretion to a fellow member of his or her own choosing, but may have reservations about giving such discretion to the chairman of the meeting as the chairman may not share that member’s views. If the Internet makes proxy voting more common, this is an issue private organizations will have to address."

"Thank you for your timely commentary. I was the editor of the paper collecting text from Dr. Gerck and also from Elaine Maurer. That classification was an attempt by Dr. Gerck to distinguish two equally named but different voting processes in public and private sectors. As the article directly noted, "...if additional items come up for a vote at the meeting, that were not in the proxy document, then the proxy document may authorize management to use its best judgment to vote on those issues – which corresponds to delegation proxy voting." Thus in the U.S., private sector "proxy voting" can be either "delegated proxy voting" or "transferred proxy voting" – but the mainstream usage is the latter form.

The word taxonomy that you apply (and which the article does not) is appropriate here but only if we abandon the designation "proxy," that is completely misleading as the article notes, when one compares public with private voting. In fact, that classification could delete the word "proxy" and just talk about "delegation voting" and "transfer voting" However, doing so would not in my opinion do much to shed light on the inconsistent use of the designation "proxy voting" between the private and public sectors in the U.S. And, of course, in the U.S. "proxy" also usually denotes a person (as in the UK), which adds another potential pitfall."

"I think it's great...very informative. My staff and I got information in the newsletter we have no other way of getting."

"In regard to THE BELL's June headline"Would You Vote Naked?", I commented some time ago that if you can use the Internet to vote in the privacy of your own home, then you could indeed vote naked."

In the June 2000 issue of THE BELL, Roy G. Saltman, in his article ‘Voting Systems, Conclusion', writes: "Typically, DRE machines are not designed to retain individual voter-choice sets."

This is not true!

Virtually all DRE systems on the U.S. market have been certified to the FEC's Voting Systems Standards. (For a complete list of certified systems, see www.electioncenter.org/about/nased.html) These standards are quite specific about the storage of individual voter ballot images. For example, section 2.3.2 of the Standards, "Accuracy and Integrity", states in part:

To attain a measure of integrity over the process, the DRE systems must also maintain an image of each ballot that is cast, such that records of individual ballots are maintained by a subsystem independent and distinct from the main vote detection, interpretation, processing and reporting path. 

The electronic images of each ballot must protect the integrity of the data and the anonymity of each voter, for example, by means of storage location scrambling. The ballot image records may be either machine-readable or manually transcribed (or both), at the discretion of the vendor.

The Voting Systems Standards have been in existence since 1990; it is surprising that Mr. Saltman was unaware of this requirement. 

THE BELL was not clear in identifying the year in which my chapter in Advances in Computers was first published. Volume 32 of Advances in Computers was published in 1991, which means that my chapter was completed in 1990. Of course, since then, DRE machines have been designed to record voter-choice sets. I was one of the originators of the requirement that they should be so designed.

Please see page 6 of my report Accuracy, Integrity, Security in Computerized Vote-Tallying, NBS Special Publication 500-158, published in 1988. To quote: "Each voter-choice set (i.e., the machine's record of all choices of a voter) should be retained in the machine on a removable non-volatile medium (e.g., magnetic disk). Storage locations of the voter-choice sets would have to be randomized to prevent association of a particular set with a particular voter. The retention of the voter-choice sets makes possible a verification (on an independent machine) of the DRE machine's summation of the voters' choices that it recorded....."

Thank you for the opportunity to clarify this point.

From Einar Stefferud, Network Management Associates:

"Paradigm shifts cannot be avoided if we wish to solve the issues involved with Internet voting. We need to deal with trust in the Internet. We need to fully understand the implications of the fact that voting and other Internet transactions involve much more than just two parties, as Ed Gerck discusses in The Bell in terms of a multi-party trust model."

“Very informative and enlightening...Thanks!"

"Enjoyed the first issue of The Bell. Internet technology is becoming so pervasive that in the next decade it will touch on and affect most aspects of people's lives. The focus of The Bell on Internet voting uniquely facilitates practical discussions (on such the topics of privacy, security, trust and related policies) which are desperately needed to prepare for this eventuality."

"The Bell (Kolokol) was the name of the newsletter published by Alexander Herzen in the 1850s. Herzen was an advocate of the Russian peasant commune pre-emancipation of the serfs. While I consider myself internet technology savvy, one of the intriguing things about what these folks [at The Bell] are on to, as I am coming to realize, is that the technology issues of voting on the internet are generally not at all understood. It looks like they may be able to play a very useful educational role."

"Writing about the new internet voting newsletter, Ed Gerck explained that in naming it "The Bell" .... 'the idea was to use the image of a bell because mission bells were used in colonial California for telling time, announcing events, and for passing on news from one city to another.' And perhaps subliminally there was, romantic tho' it be in these internet speed times, the bell-associated ideal of liberty, even if occasionally cracked in practice."

"Thanks for this new publication, "The Bell." Those of us already involved in internet voting will benefit from it greatly and hope we can contribute as well."

“Thank you for the copy of your first edition. I read it with interest and found it very interesting and informative.... Good luck with the publication.”

"Very good newsletter. I would love to continue to receive it."

"I found "The Bell" quite informative."