New Jersey’s experiment in letting victims of Hurricane Sandy vote via email has left some voters unable to cast their ballot. A buggy electronic voting machine in Pennsylvania refused to accept votes for President Obama. And the confidence of some voters in Ohio has been eroded by what they contend are potentially nefarious last-minute updates to the software of voting machines in their state.
These might seem like isolated incidents, but they are united, says Andrew Appel, head of the Computer Science department at Princeton, by one common problem: Electronic voting systems are not transparent.
Appel is not alone–many of his colleagues in computer security have concluded that the best way to ensure that votes are not tampered with is to have them recorded on paper before they are recorded by a computer. That way, if there is any question whether voting machines were subject to tampering, or even just software bugs and human error, there is always a physical record that can be verified by any election observer.
“It’s an odd situation to be in where the people who are being called luddites are engineers,” says Matt Blaze, director of the distributed systems lab at the University of Pennsylvania. “In the case of electronic voting, you have this reversal of the normal roles where the people who are closest to the technology are warning that there might be some pitfalls you want to think carefully about.”
That’s one reason why Germany’s highest court ruled electronic voting unconstitutional in 2009, and most of Western Europe has backed away from the practice. The same is true of most states in the US, where only six holdouts continue to allow voting on machines with no paper record as a backup. Those that do allow it are Georgia, South Carolina, Louisiana, Maryland, Delaware and New Jersey.
Estonia and, for the time being, New Jersey, are apparently the only two places in the world where voting online is possible. This kind of voting is especially vulnerable to interference. Attacks already used to steal money from individuals’ and businesses’ bank accounts could be used to change votes issued from individuals’ computers, says Appel. In 2009, Appel demonstrated that voting machines could be tampered with in a way that would allow a hacker to manipulate their functioning remotely, in election after election.
Email, the voting mechanism used in New Jersey, is especially insecure, since anyone can fake an email from any address on the internet. That could be one reason New Jersey officials are requiring that voters follow up their email vote with a mailed-in ballot, but the entire system is already overwhelmed. (Blaze urges any New Jersey residents to skip the state’s email voting system, which was implemented in just two days, and file a provisional ballot at any New Jersey polling station.)
So what’s the solution? “I think optical scan paper ballots are the most reliable and secure option for US for the foreseeable future,” says Appel. In this system, voters fill out a paper ballot–by hand–in a way that can be read by machines. (If you’ve ever taken a standardized test, it’s basically the same system: use a pencil or pen to darken the circle corresponding to your choice.) This combines the best of paper voting systems with some of the speed of computerized voting systems, since especially complicated ballots can be machine read and tabulated.
“In some states in today’s election there will be 30 different races and 10 different ballot questions,” says Appel, and these are exactly the sort of ballots that can benefit from being filled out by hand but counted by machine.
Around the world, countries including Switzerland, Spain, Brazil, Australia and India have embraced electronic voting. In Canada, for example, some argue that voting over the internet would increase voter turnout. That might be true, but, says Blaze, this type of voting would still be a mistake.
“Unfortunately we don’t know how to build [electronic voting] systems that are reliable enough to know what has been done correctly and hasn’t been tampered with,” says Blaze. “The most important thing [in an election] is that we have confidence in the outcome–that we’ve counted the votes correctly and the declared winner was the person who really got the majority of the votes.”
“One of the most important functions of an election,” Blaze adds, “is not just to figure out who has won, but to convince the losers that they’ve lost.”