Direct Recording Electronic (DRE) voting machines are computerized voting machines that tally the vote internally. While a paper record for auditing suspect elections are required in some jurisdictions they are best known for their less advanced versions which do not keep a record of each vote. Some countries, such as Venezuela, Australia and Brazil require voting machines to keep a voter verifiable ballot .
Vendor's claims of security
While the makers of DRE's claim the lack of a verifiable record reduces maintenance, computer security experts believe this makes them ideal for rigging elections. Their most controversial use has been in U.S. Elections in 2002 and 2004. Problems encountered in the 2002 elections in the U.S. led Australia and Brazil to demand voter verifiable ballots in their elections.
DRE vendors also claim that lever voting machines are as susceptible to fraud as DRE's. While it is easy to fix the votes from one lever machine by simply sanding down a gear, this can be detected in an audit, and will show up in the election statistics as undervotes if significant. On the other hand, DRE software can easily self-modify into cheat mode during the election, and then self-modify to destroy all evidence of the cheat mode when the election is over. DRE's can also throw the election with minute vote rigging that would be within the margin of error of any one exit poll. The ACM conducted a study showing only 2 votes in each precinct would have been need to flip the elections of most U.S. Presidents in the 20th century. In the 2004 several politicians were caught rigging lever voting machines, it is important to note however that rigging a multi-precinct election requires a conspiracy when using lever voting machines, but it one malcontent is required to change the votes on all DRE's.
Benefits of computerized voting machines
The DRE voting machines typically take the form of a box or enclosure (rather like an ATM) or a laptop computer. Indian voting machines use a two-piece system with a balloting unit presenting the voter with a button (momentary switch) for each choice connected by a cable to an electronic ballot box. [1][2]
DRE voting systems are often favored because they can incorporate assistive technologies for handicapped people, allowing them to vote without involving another person in the process. They can also offer immediate feedback on the validity of a particular ballot so that the voter can have an opportunity to correct problems if they are noticed. This is particularly important, with a good user interface the problem of spoiled ballots could be greatly reduced by using computerized voting machines. If the votes are not counted however, there is little point in determining the intent of the voter.
Some precincts require that the entire ballot be presented to the voter simultaneously. This requirement was intended to reduce undervotes, when a voter votes in some races but misses others. DRE systems in these polling places need particularly large screens to accommodate all choices and it was discovered in the 2004 U.S. elections that this increased undervotes because the voter was required to push a small VOTE button on the screen before the votes would be counted, and many voters missed this and their vote was not counted.
It is because of the benefits of DRE's and the HAVA that most DRE's have been installed, not because they make rigging elections easier. Some elections officials have even gone back to paper and pencil when informed of the problems with un-auditable DRE's.
Reducing the ease of vote rigging with DREs
A fundamental challenge with DRE voting machines is the re-count of votes to verify that the hardware/software involved performed its task correctly. Rebecca Mercuri has written a report on the basic voter verifiable ballot system, which addresses the problem by having the voting machine print a paper ballot or receipt that is verified by the voter before being dropped into a ballot box. The paper ballot is treated as the official ballot. The ballot is primary and the electronic records are used only for an initial count which can be disputed at no cost to the disputee. A random audit of the precincts is to ensure the integrity of the process when there is no official recount request. This solution has the problems of traditional paper ballots for an audit, the ballot boxes must be kept secure against vote excanges. A solution very much like this is used in New Mexico, with the exception that the ballot is not given to the voter and is not deposited in a secure ballot box.
Many voters have also suggested a receipt could be given to the voter so that he could verify that his vote was counted correctly by consulting some public record after the election. But this has the same problem as absentee ballots, voter intimidation. There are cryptographic solutions that at least assert that your vote was counted, correctly or not, David Chaum (in 1988) proposed a solution to the repeatability and verifiability issues that allows the voter to verify that the vote is cast appropriately and that the vote is counted. His system has the computerized voting machine printout a two layer ballot. The layers, when combined, show the human-readable vote. The voter selects one layer to destroy at the poll and takes the other layer as a receipt, and the voter can verify that his particular vote was counted with that receipt, but the actual vote cast is thoroughly encrypted. This system guards against fraudulent undervotes, which are less detectable than ballot stuffing (which generally requires forging signatures.). However the Chaum system does not ensure against ballot stuffing, nor against misscounting the vote, unless the vote is revealed, opening voters up to intimidation.
Security experts, such as Bruce Schneier, have also suggested open source voting machine software, or at the very least, code publically available for inspection, but this in itself is not enough as the code running on the machine might differ from that which has been inspected. The operating system, BIOS, firmware and other hardware can also be used to hide malicious code and need to be inspected. In Australia the software used is Open Source, but the other sources of error have caused the government to insist on a voter verifiable paper ballot.
Matt Quinn, the developer of the original Australian DRE system, believes that in the future there should be a voter verifiable ballot , "There's no reason voters should trust a system that doesn't have it, and they shouldn't be asked to. Why on earth should [voters] have to trust me -- someone with a vested interest in the project's success? A voter-verified audit trail is the only way to 'prove' the system's integrity to the vast majority of electors, who after all, own the democracy."
External links
Last updated: 10-10-2005 03:30:51
