Report: Security Analysis of the Dominion ImageCast X

Report released this week on vulnerabilities of the Dominion ImageCast, used for the vast majority of the votes in Georgia <Report>

The report was actually submitted to a court on July 1, 2021 – the court considered the information so dangerous to elections that is has largely been suppressed until now!

However in two years, Dominion has made several fixes, yet Georgia Secretary of State Brad Raffensperger is in no hurry to update Georgia machines at least until after the 2024 election.

Note: After planning for a couple of months, I launched CTVoters Count in late 2007, Little did I know that the California Top To Bottom Review would be release at that time! Many are claiming that this report may rival the impact of that California report.

Report released this week on vulnerabilities of the Dominion ImageCast, used for the vast majority of the votes in Georgia <Report>

The report was actually submitted to a court on July 1, 2021 – the court considered the information so dangerous to elections that is has largely been suppressed until now!

However in two years, Dominion has made several fixes, yet Georgia Secretary of State Brad Raffensperger is in no hurry to update Georgia machines at least until after the 2024 election.

Note: After planning for a couple of months, I launched CTVoters Count in late 2007, Little did I know that the California Top To Bottom Review would be release at that time! Many are claiming that this report may rival the impact of that California report.

You do not need to read the whole report. Better to start with a summary from the author, Prof. Alex Halderman. <Summary Report>

…we discovered vulnerabilities in nearly every part of the system that is exposed to potential attackers. The most critical problem we found is an arbitrary-code-execution vulnerability that can be exploited to spread malware from a county’s central election management system (EMS) to every BMD in the jurisdiction. This makes it possible to attack the BMDs at scale, over a wide area, without needing physical access to any of them…

The report was filed under seal on July 1, 2021 and remained confidential until today, but last year the Court allowed us to share it with CISA—the arm of DHS responsible for election infrastructure—through the agency’s coordinated vulnerability disclosure (CVD) program. CISA released a security advisory in June 2022 confirming the vulnerabilities, and Dominion subsequently created updated software in response to the problems. Georgia Secretary of State Brad Raffensperger has been aware of our findings for nearly two years, but—astonishingly—he recently announced that the state will not install Dominion’s security update until after the 2024 Presidential election, giving would-be adversaries another 18 months to develop and execute attacks that exploit the known-vulnerable machines…

The right solution is Voter-Verified-Paper-Ballots and sufficient post-election audits, recounts, and sufficient ballot security. Then even with election systems subject to errors and fraud, election results can be verified and corrected.

Nov 2022 Post-Election Audit Report

From the Press Release:

Watchdog Group: 24 Audits Since 2007 with Little Improvement

Independent Observation and Analysis of Connecticut’s Nov 2022 Post-Election Audit

HARTFORD: We conclude, based on citizen observations and analysis of official municipal post-election vote audit of the November 2022 election, that it failed to meet basic audit standards

After 16 years with disappointing, locally performed, hand-count audits, we recommend replacement of all local hand-count audits with sufficient and efficient electronically assisted manual audits utilizing the UConn Audit Station.

The non-partisan Connecticut Citizen Election Audit has provided volunteer observation and post-election audit reports since the adoption of optical scanners statewide in 2007. Without the hours and mileage incurred by these volunteers after every election nobody but a few election officials would know the actual quality of the audits performed, while officials would have less motivation toward credible audits.

<Press Release .pdf> <Full Report pdf> <Detail data/municipal reports>

From the Press Release:

Watchdog Group: 24 Audits Since 2007 with Little Improvement

Independent Observation and Analysis of Connecticut’s Nov 2022 Post-Election Audit

HARTFORD: We conclude, based on citizen observations and analysis of official municipal post-election vote audit of the November 2022 election, that it failed to meet basic audit standards

After 16 years with disappointing, locally performed, hand-count audits, we recommend replacement of all local hand-count audits with sufficient and efficient electronically assisted manual audits utilizing the UConn Audit Station.

The non-partisan Connecticut Citizen Election Audit has provided volunteer observation and post-election audit reports since the adoption of optical scanners statewide in 2007. Without the hours and mileage incurred by these volunteers after every election nobody but a few election officials would know the actual quality of the audits performed, while officials would have less motivation toward credible audits.

  • The audits were not conducted and reported as required by law. The Secretary of the State’s Office continues to fail to take responsibility for that failure by local officials.
  • Human error was still considered an acceptable explanation of differences between machine and manual counts. This defeats the purpose of the audits.
  • Weaknesses in ballot chain-of-custody and security procedures necessary for confidence that ballots were not tampered with between the election and the municipal audit counting sessions.
  • The short schedule for audits and dates for electronic audits not announced sufficiently in advance cause both registrars and the Citizen Audit to scramble to conduct and observe audits – they should be added to the annual election calendar months in advance.
  • There were at least three municipalities with new registrars, neither of which had previously performed audits. This resulted in various failures to follow procedures and in one case failure to allow transparency required by the procedures.

The public, candidates, and the Secretary of the State should expect local election officials to be able to organize audits and produce accurate, complete audit reports. The public should expect the Secretary of the State’s Office to take the lead in ensuring that the audit is scheduled in advance, complete, and publicly verifiable.

We are pleased with the following developments:

  • Electronic audits again included random manual verification comparing some paper ballots to Cast Vote Records produced by the audit station.
  • There was a significant reduction in incomplete forms.

We emphasize that this report does not question any election official’s integrity.

All reports and backup data are available online at: https://www.CTElectionAudit.org.

<Press Release .pdf> <Full Report pdf> <Detail data/municipal reports>

Why doesn’t anyone know what a voting machine costs?

We recently hosted a discussion on the Price of Voting Machines. Now an article in Politico gives the background story.

Politico: One Man’s Quest to Break Open the Secretive World of American Voting Machines

It began to dawn on Caulfield, slowly at first, that the amount the public didn’t know about these companies was vast. Quarterly profits, regional market share, R&D budgets, even the number of employees—often, there was simply nothing. “Basic, basic data—the basic layout of the industry—was just not out there,” Caulfield recalls. “Eventually, we realized that it didn’t exist.”…

Caulfield’s work points toward something more radical than perhaps even its author intended: a new reason to question the marriage of election administration and private industry. “What kinds of machines would we make if we declared this a public good, and had it produced in public laboratories?” Bollinger asked …

We recently hosted a discussion on the Price of Voting Machines. Now an article in Politico gives the background story.

Politico: One Man’s Quest to Break Open the Secretive World of American Voting Machines <read>

It began to dawn on Caulfield, slowly at first, that the amount the public didn’t know about these companies was vast. Quarterly profits, regional market share, R&D budgets, even the number of employees—often, there was simply nothing. “Basic, basic data—the basic layout of the industry—was just not out there,” Caulfield recalls. “Eventually, we realized that it didn’t exist.”…

But by far, Caulfield’s most significant discovery was to put a figure on the total size of the industry. He estimated the entire revenue footprint of all the companies in the United States was $350 million. That meant the entire elections industry in the world’s richest democracy was about the peak size of the R&D department of the camera company GoPro. The private voting sector wasn’t like a secretive and well-heeled defense contractor. It was more like the manufacturers of arcade machines or jukeboxes, grasping for market share with a product they could sell at best once a decade.

Mark Lindeman, a longtime voting expert who leads Verified Voting, explained the difficulty this poses for election clerks whenever they attempt to buy a new fleet of voting machines. “Election officials have no way of knowing what a fair market price could possibly be,” Lindeman said. He compared it to a recent experience he had buying his car, a Chevy Volt. At the dealership, “My wife and I got run in circles, while we waited for the dealer to give a price that was sensible,” he said. “How did we know it was sensible? Well, we went to the Consumer Reports website and got an idea of what a fair market value would be.” He added, “Election officials have no way to do that.”…

In the data, Caulfield discovered clerks who were buying the same voting machines from the same company, but seeing significantly different discounts than their peers—sometimes in the same state. In California, Mono County and Placer County both purchased orders of Dominion equipment, including the ImageCast Evolution, a voting machine priced at $7,200. But Mono received a 5 percent discount off of its bottom-line order, while Placer, 128 miles away, saw a mark-off of nearly 25 percent. Volume didn’t necessarily matter, either: Dodge County, Wis. purchased the same ES&S machines that Polk County, Fla. did. Even though Polk County bought substantially more machines and equipment, Dodge got a discount seven times larger than Polk’s—a mismatch Caulfield spotted in other states, including Texas and Virginia…

A business model in which repair and maintenance costs are the most stable source of revenue might not, to put it delicately, create optimal incentives for designing hassle-free technology. In fact, as Caulfield and Coopersmith suggested, it might not be financially wise to regularly roll out new models at all…

Caulfield’s work points toward something more radical than perhaps even its author intended: a new reason to question the marriage of election administration and private industry. “What kinds of machines would we make if we declared this a public good, and had it produced in public laboratories?” Bollinger asked when I called him this spring, just before Caulfield’s report went public. He drew an analogy to the life sciences and human biology, sectors where the U.S. government has made hundreds of billions of dollars in public research investment. “We have public funding for all kinds of development of things. But we leave this—.” Bollinger cut himself off and laughed. “We leave this essential object and thing, which is so critical, to the free market?”…

Risk Limiting Audits: A Guide for Global Use

A recent report, Risk Limiting Audits: A Guide for Global Use is about the most comprehensive and balanced introduction to Risk Limiting Audits that I have seen. Its 38 pages will take an hour or two to read in detail, and well worth it.

I am a fan of Risk Limiting Audits, yet I am concerned that they are misunderstood in several dimensions:

  • RLAs are not a panacea:…

A recent report, Risk Limiting Audits: A Guide for Global Use <read> is about the most comprehensive and balanced introduction to Risk Limiting Audits that I have seen. Its 38 pages will take an hour or two to read in detail, and well worth it.

I am a fan of Risk Limiting Audits, yet I am concerned that they are misunderstood in several dimensions:

  • RLAs are not a panacea: They are one type of audit among that others that need to be performed among several. Complementary audits are needed as a prerequisite to trusted RLAs, such as auditing the security of ballots presented for the RLA. RLAs done well, only assure that ballots were counted and tabulated correctly enough. There are other audits needed to determine the legitimacy of the election, such as the accuracy of voting lists and the integrity of the check-in lists and processes.
  • RLAs are not easy or simple: Some tout RLA benefits claiming that they are easy and simple. They are not. They are complicated and require attention to detail. They require scientific expertise to organize, execute, and understand, and for the most part trust on the part of the public in that science. They may be efficient, yet not simple to implement and understand.
  • RLAs have not been uniformly done well and backed by sufficient laws and procedures: Most state laws and procedures are insufficient and, at best, add confidence to the very few contests actually subject to such audits.
  • The larger the contest audited, the more efficient a RLA can be: Statewide contests and Congressional races can be reasonably to highly efficient. Auditing local contests, especially all local races can be expensive and time consuming, approaching the cost of recounting those contests by hand.

While optimistic, the Guide, points to all the details at a high-level, while avoiding all the statistical details. That makes it readable It does not avoid pointing out all other audits and their necessity.  It also emphasizes the need for transparency and public verifiability – often neglected in RLAs and other audits.

 

Study: The Price of Voting (Machines) – Valuable, Timely, and Facinating

Last week, I moderated a discussion featuring the authors of The Price of Voting, a study of what jurisdictions actually pay for voting machines.

The study is a great contribution to jurisdictions, including states like Connecticut, that are considering evaluating voting machines.

Five quick conclusions that I find relevant to Connecticut:

  1. If you are not getting about a 20% discount, you are paying too much…

Last week, I moderated a discussion featuring the authors of The Price of Voting, a study of what jurisdictions actually pay for voting machines.

Five quick conclusions that I find relevant to Connecticut:

  1. If you are not getting about a 20% discount, you are paying too much.
  2. Most voting machines cost about the same, so you might be able to pick the most suited if all bids are actually competitive.
  3. Connecticut should plan on about $12,000,000 for the initial purchase and about 10% of that per year for maintenance.
  4. There are also costs beyond the initial purchase and subsequent maintenance.
  5. Plus Connecticut may spend an additional $5,000,000 for initial purchase of a machines intended for those with disabilities, and perhaps $3,000,000 for initial purchases of ePollbooks.

Valuable, timely, and fascinating.

It seems that most jurisdiction pay about 20% off. What about those that paid more, far more? Did officials get too enamored of one solution? Did vendor sales staff get too close to the officials making the decisions? Were too many officials former vendor employees?

Beyond equipment maintenance the ongoing costs are: payments to vendors for expensive proprietary ballot paper based on claims that other papers will not do; ballot printing; ballot programming; and other services provided by the vendor(s) in managing the election which are outsourced from officials.

New Paper: Evidence Based Elections

A new paper by Andrew Appel and Philip Stark: EVIDENCE-BASED ELECTIONS:CREATE A MEANINGFUL PAPER TRAIL,THEN AUDIT  Provides a thorough description of how the public can be assured of election outcomes, in spite of hack-able voting equipment.

The bottom line: The only reliable method available is Voter-Marked Paper Ballots, with strong security for the ballots, followed by sufficient post-election audits. Other technologies, including Ballot Marking Devices and Internet voting are insufficient.

Anyone interested in trustworthy elections should read this paper – especially those who think that expensive Ballot Marking Devices should be trusted. And those who think it is impossible to use technology to count votes accurately.

A new paper by Andrew Appel and Philip Stark: EVIDENCE-BASED ELECTIONS:CREATE A MEANINGFUL PAPER TRAIL,THEN AUDIT  <read> Provides a thorough description of how the public can be assured of election outcomes, in spite of hack-able voting equipment.

The bottom line: The only reliable method available is Voter-Marked Paper Ballots, with strong security for the ballots, followed by sufficient post-election audits. Other technologies, including Ballot Marking Devices and Internet voting are insufficient.

Anyone interested in trustworthy elections should read this paper – especially those who think that expensive Ballot Marking Devices should be trusted.

The vulnerability of computers to hacking is well understood. Modern computer systems, including voting machines, have many layers of software, comprising millions of lines of computer code; there are thousands of bugs in that code. Some of those bugs are security vulnerabilities that permit attackers to modify or replace the software in the upper layers,so we can never be sure that the legitimate vote-counting software or the vote-marking user interface is actually the software running on election day. One might think, “our voting machines are never connected to the Internet, so hackers cannot get to them.” But all voting machines need to be programmed for each new election: They need a “ballot-definition file” with the contests and candidate names for each election, and lists of the contests different voters are eligible to vote in. This programming is typically done via removable media such as a USB thumb drive or a memory card. Vote-stealing malware can piggyback on removable media and infect voting machines—even machines with no network connection. There is a way to count votes by computer and still achieve trustworthy election outcomes. A trustworthy paper trail of voter selections can be used to check, or correct, the electoral outcomes of the contest in an election…

If a BMD is hacked and systematically steals 5% of the votes in one contest and only 7% of voters inspect their ballots carefully enough to notice, then the effective rate of vote-theft is5% ?93% ,or 4.65%;this is enough to change the outcome of a moderately close election. The same analysis applies to a DRE+VVPATsystem.One might think:“not everyone needs to carefully verify their ballots;” if only 7% of voters carefully inspect their ballots, they can serve as a kind of “random audit” of the BMDs. But this sentiment fails to hold up under careful analysis…

in our hypothetical scenario in which a hacked BMD steals 5% of the votes, and 7% of voters carefully inspect their ballots (and know what to do when they see a mistake), then7% ?5% ofvoters will alert a pollworker; that is, 1 in every 285 voters will claim their paper ballot was mismarked—if the voters do not assume it was their own error. The BMD would successfully steal “only” 4.65% of the votes.One might think:“but some voters caught the BMD cheating, red-handed.” But nothing can be done. It is a rare election official who would invalidate an entire election because 1 out of 285 voters complained.

Comments on new Federal Voting Systems Guidelines

Last week I submitted comments for the State Audit Working Group on the proposed (Voluntary Voting Systems Guidelines) VVSG 2.0 standards which will define future voting system standards. Looking over all the submissions, ours were likely the most extensive detailed comments submitted. In total our submission was about three hundred and fifty pages!

By far the largest number of comments were from disability rights groups and individuals supporting their positions, many redundant. Access for the disabled is one of the most controversial and critical issues.

There are other issues with the proposed guidelines. The proposal is a far from a finished product, with wide-ranging comments. It will be a huge task to complete them, far more challenging to complete well.

Last week I submitted comments for the State Audit Working Group on the proposed (Voluntary Voting Systems Guidelines) VVSG 2.0 standards which will define future voting system standards. Looking over all the submissions, ours were likely the most extensive detailed comments submitted. In total our submission was about three hundred and fifty pages!  You might consider reading the cover letter and then the Glossary Comments which have their own cover letter. In all, we spent over 200 hours developing and agreeing upon our comments. We were pleased to have thirteen signers and endorsements in comments from others groups : <SAWG Comments>

In all there were seventy-seven comments from various voting integrity, vendor, disability rights groups, and individuals <All Comments>

By far the largest number of comments were from disability rights groups and individuals supporting their positions, many redundant. Access for the disabled is one of the most controversial and critical issues. Many argue that everyone should vote on exactly the same voting machines so that all have equal access. There are several problems with this argument which would have us all vote on BMDs (Ballot Marking Devices): BMDs are not fully developed to meet the needs of the disabled, they need lots of work; Despite voting on identical machines, BMDs provide multiple interfaces for those with various disabilities , leaving voters not actually voting the same way anyway; BMDs cost about four times what a combination of a single BMD per polling place with VMPB (Voter Marked Paper Ballots) for most voters; BMDs do not serve some voters with disabilities  who cannot use them but can use paper ballots; BMDs are often the cause of the long lines we see in Georgia, Pennsylvania and elsewhere – almost non-existent in CT which has the single BMD and VMPB model; those long lines hurt the vast majority of those with disabilities who have issues with walking and standing in line for hours. I would favor investing the savings in BMD research and preparing to replace that one BMD per polling place as better solutions are developed. For some interesting comments on the challenges of the disabled that do not take the standard advocacy line, read the comments from <Marybeth Kuznik>, <Noel Runyan>, and <Harvie Branscomb>.

There are other issues with the proposed guidelines: They spend too little on vote-by-mail equipment; fail to fully recognize early voting; are too detailed in some areas and sketchy in others; provide for unsafe Recallable Ballots; and as vendors point out are often too prescriptive and expensive to implement. The proposal is a far from a finished product, with wide-ranging comments. It will be a huge task to complete them, far more challenging to complete well.

Verified Voting’s Policy on DREs and BMDs

This week Verified Voting released a Policy on DREs and BMDs. It is consistent with our  views.

But it’s not enough for a voting system to “check the box” on paper – to print paper records that voters may not even notice or examine. To be trustworthy, elections need to be based on voter-marked paper ballots. Whether these ballots are marked by hand or by device, for them to be considered voter-marked, voters should know what they say!

As they say: “We have had some long and sometimes difficult conversations about these topics, and we look forward to more.”

This week Verified Voting released a Policy on DREs and BMDs <read>. It is consistent with our  views <The Case Against Trusting Democracy to BMDs>

From the summary:

But it’s not enough for a voting system to “check the box” on paper – to print paper records that voters may not even notice or examine. To be trustworthy, elections need to be based on voter-marked paper ballots. Whether these ballots are marked by hand or by device, for them to be considered voter-marked, voters should know what they say!

For Ballot Marking Devices (BMDs), that means the systems, and the procedures around them, should demonstrably support voter verification. They should ensure that voters deliberately and intentionally check their printed ballots carefully enough to detect, correct, and report any errors. It also means that pollworkers should be trained to follow specific protocols if BMDs are not recording voters’ intent accurately during voting.

It is far from clear that any currently available BMD meets a high standard of voter verification in practice. Published research is scanty, but it suggests that many voters may barely look at their ballots – let alone look closely enough to notice any changes. This is a usability defect that threatens election integrity. If voters are unable to use voting systems and election procedures safely, the systems and procedures must change to protect our elections. Now is the time to revisit those procedures and adapt them to optimize the use of new technology…

Given present knowledge, we think the best approach has some basic elements:

    • Select BMDs that are easiest for voters to verify. Avoid BMDs with radical flaws such as being able to add, change, or destroy votes on ballots after voters cast them.
    • Allow in-person voters to choose between hand-marking ballots and using BMDs. When a polling place has one or two BMDs, a variety of voters should be encouraged to use them.
    • Make sure contingency plans are in place for everything that could go wrong with BMDs, from isolated malfunctions through massive subversion. Such plans include having emergency paper ballots on hand in precincts that use BMDs for all voters.
    • Systematically study best system designs and procedures to ensure that votes are verified and protected. Support continuous improvement in systems and procedures.

As they say: “We have had some long and sometimes difficult conversations about these topics, and we look forward to more.”

Working Paper: Social Media, Disinformation and Electoral Integrity

A new paper articulates the two distinct problems that threaten our elections Social Media, Disinformation and Electoral Integrity

Since the 2016 United States (U.S.) presidential election, the issue of social media and disinformation has gained increasing attention as a fundamental threat to the integrity of elections worldwide. Whether by domestic actors, such as candidates and campaigns, or through foreign influence campaigns, the ability of voters to make informed choices based on fair and balanced information has been significantly skewed. This working paper attempts to examine the challenges that this issue poses to electoral integrity and what responses election management bodies (EMBs) and international nongovernmental organizations (INGOs) such as the International Foundation for Electoral Systems (IFES) can take to attempt to mitigate the negative consequences. The solutions presented in this paper aim to assist key stakeholders to meet this emergent and mutable threat…

A new paper articulates the two distinct problems that threaten our elections Social Media, Disinformation and Electoral Integrity <read> Earlier today I moderated a private discussion of the paper with one of the authors.

Since the 2016 United States (U.S.) presidential election, the issue of social media and disinformation has gained increasing attention as a fundamental threat to the integrity of elections worldwide. Whether by domestic actors, such as candidates and campaigns, or through foreign influence campaigns, the ability of voters to make informed choices based on fair and balanced information has been significantly skewed. This working paper attempts to examine the challenges that this issue poses to electoral integrity and what responses election management bodies (EMBs) and international nongovernmental organizations (INGOs) such as the International Foundation for Electoral Systems (IFES) can take to attempt to mitigate the negative consequences. The solutions presented in this paper aim to assist key stakeholders to meet this emergent and mutable threat…

While many aspects of traditional media and elections literature are pertinent to the topic of disinformation, there are many fundamental differences that make thinking in this field unique and potentially require an altered set of analytical tools to help theoreticians and practitioners more accurately navigate this space...

Experts clearly opine that a clear differentiation should be made between cyber threats and cyber-enabled (technology) information operations. The main relevance lies in the proper allocation of resources for tackling each unique set of problems. This is in terms of human expertise, material resources, the strategies to be implemented,and the specific technologies that need to be developed and deployed. The mistake of putting both under the umbrella of cyber threats has been repeatedly made with obvious consequences…

Agents include independent trolls (“human-controlled accounts performing bot-like activities” or harassing others online),9paid trolls, conspiracy theorists, disinformation websites, partisan media, politicians, foreign governments, influential bloggers, activists or government officials, and ordinary users gathered en masse.10Their intents and targets vary; for example, domestic partisan agents may use disinformation to win campaigns through smear tactics, hostile foreign state or nonstate authoritarian agents may intend to structurally undermine democracy by increasing intolerance and polarization, and disaffected anarchic agents may intend to dismantle state institutions and social order. While many are primarily concerned at the moment with automated/inauthentic means of amplifications, there is a growing need to also start addressing the role played by parties, politicians and hyperpartisan media in creating, disseminating and “endorsing” disinformation and divisive contents…

Humans did not evolve to process information and respond rationally; instead, they usemental shortcuts to simplify decision-making. These heuristics combine with another evolved feature, the need to belong to a group, to create vulnerabilities to the kind of systematic manipulation disinformation campaigns use. Our heuristics and biases dispose us to believe information when it is presented in certain ways and wanting to send the proper in-group signals lead people to spread information even if they don’t necessarily trust it…

People are generally more attracted to news with false information than with true information. In a 2018 study on the spread of news stories on Twitter, the MIT Media Lab found that “falsehood diffused significantly farther, faster, deeper, and more broadly than the truth in all categories of information.”24The truth took “about six times as long as falsehood to reach 1,500 people,” and, controlling for relevant variables, falsehoods were “70% more likely to be retweeted than the truth…

The paper also provides a very good definition of various types of disinformation, misinformation etc.

Unfortunately, as of yet, there is no list of clear solutions. The paper provides a good survey of what is and has been done, and the potential areas that might provide mitigation.

 

 

Handmarked paper ballots more verifiable than ballot marking devices

New study The study What Voters are Asked to Verify Affects Ballot Verification: A Quantitative Analysis of Voters’ Memories of Their Ballots

As a practical matter, do voters verify their BMD-printed ballot cards, and are they even capable of it?  Until now, there hasn’t been much scientific research on that question…

  1. In a real polling place, half the voters don’t inspect their ballot cards, and the other half inspect for an average of 3.9 seconds (for a ballot with 18 contests!).

  2. When asked, immediately after depositing their ballot, to review an unvoted copy of the ballot they just voted on, most won’t detect that the wrong contests are presented, or that some are missing.

New study summarized by Andrew Appel: Why voters should mark ballots by hand <read>

Because voting machines contain computers that can be hacked to make them cheat, “Elections should be conducted with human-readable paper ballots. These may be marked by hand or by machine (using a ballot-marking device); they may be counted by hand or by machine (using an optical scanner).  Recounts and audits should be conducted by human inspection of the human-readable portion of the paper ballots.”

Ballot-marking devices (BMD) contain computers too, and those can also be hacked to make them cheat.  But the principle of voter verifiability is that when the BMD prints out a summary card of the voter’s choices, which the voter can hold in hand before depositing it for scanning and counting, then the voter has verified the printout that can later be recounted by human inspection.

But really?  As a practical matter, do voters verify their BMD-printed ballot cards, and are they even capable of it?  Until now, there hasn’t been much scientific research on that question.

A new study by Richard DeMillo, Robert Kadel, and Marilyn Marks now answers that question with hard evidence:

  1. In a real polling place, half the voters don’t inspect their ballot cards, and the other half inspect for an average of 3.9 seconds (for a ballot with 18 contests!).

  2. When asked, immediately after depositing their ballot, to review an unvoted copy of the ballot they just voted on, most won’t detect that the wrong contests are presented, or that some are missing.

The study What Voters are Asked to Verify Affects Ballot Verification: A Quantitative Analysis of Voters’ Memories of Their Ballots <read>

Recognize that ballot marking devices, like the IVS used in Connecticut, are a valuable vehicle for those with disabilities. Voters without disabilities should avoid them. Leave them for those that need them. There are two other reasons to encourage the vast majority of voters to use hand-marked paper ballots. Ballot marking devices are much more expensive than voting booths for marking paper ballots and can lead to long lines.