Page 1 of 8

FIXING

THE

VOTE

ELECTRONIC VOTING MACHINES PROMISE TO MAKE

ELECTIONS MORE ACCURATE THAN EVER BEFORE, BUT

ONLY IF CERTAIN PROBLEMS—WITH THE MACHINES

AND THE WIDER ELECTORAL PROCESS—ARE RECTIFIED

By Ted Selker

90 SCIENTIFIC AMERICAN OCTOBER 2004

COURTESY OF SEQUOIA VOTING SYSTEMS

COPYRIGHT 2004 SCIENTIFIC AMERICAN, INC.

Page 2 of 8

Voting may seem like a simple activity—cast ballots, then count them. Complexity arises, how-
ever, because voters must be registered and votes must be recorded in secrecy, transferred se-
curely and counted accurately. We vote rarely, so the procedure never becomes a well-practiced

routine. One race between two candidates is easy. Half a dozen races, each between several can-
didates, and ballot measures besides—that’s harder. This complex process is so vital to our democ-
racy that problems with it are as noteworthy as engineering faults in a nuclear power plant.

Votes can be lost at every stage of the process. The infamous 2000 U.S. presidential election

dramatized some very basic, yet systemic, flaws concerning who got to vote and

how the votes were counted. An estimated four million to six

million ballots were not counted or were prevented

from being cast at all—well over 2 percent of the 150

million registered voters. This is a shockingly large

number considering that the decision of which can-
didate would assume the most powerful office in the

world came to rest on 537 ballots in Florida.

Three simple problems were to blame for these

losses. The first, which made up the largest contri-
bution, was from registration database errors that

prevented 1.5 million to three million votes; this

problem was exemplified by 80,000 names taken off

the Florida lists because of a poorly designed com-
puter algorithm. Second, a further 1.5 million to two

million votes were uncountable because of equip-
ment glitches, mostly bad ballot design. For exam-
ple, the butterfly ballot of Palm Beach County con-
fused many into voting for an unintended candidate

and also contributed to another appalling outcome:

19,235 people, or 4 percent of voters, selected more

than one presidential candidate. Equipment prob-
lems such as clogged punch holes resulted in an ad-
ditional 682 dimpled ballots that were not counted

there. Finally, according to the U.S. Census Bureau,

about one million registered voters reported that

polling-place difficulties such as long lines prevent-
ed them from casting a vote.

Thus, registration and polling-place troubles ac-
counted for about two thirds of the documentable

lost votes in 2000. The remaining one third were

technology-related, most notably ballot design and

mechanical failures. In the aftermath of the 2000

election, officials across the country, at both the fed-
eral and local levels, have scrambled to abandon old

approaches, such as lever machines and punch cards,

in favor of newer methods. Many are turning to elec-
tronic voting machines. Although these machines of-
fer many advantages, we must make sure that these

SCIENTIFIC AMERICAN 91

VOTING

MACHINE—here,

Sequoia Voting Systems’s

AVC Edge—is fairly typical

of direct record electronic

(DRE) voting machines

on the market. Voters enter

their votes via a touch-
screen interface.

COPYRIGHT 2004 SCIENTIFIC AMERICAN, INC.

Page 3 of 8

new systems simplify the election process, reduce errors and

eliminate fraud.

Some countries have introduced electronic systems with

great success. Brazil started testing electronic voting machines

in the mid-1990s and since 2000 has been using one type of ma-
chine across its vast pool of 106 million voters. It has multiple

organizations responsible for different aspects of voting equip-
ment development as part of the safeguards. It also introduced

the machines in carefully controlled stages—with 40,000 voters

in 1996 (7 percent of whom failed to record their votes elec-
tronically) and 150,000 in 1998 (2 percent failure). Improve-
ments based on those experiments reduced the failure rate to

an estimated 0.2 percent in 2000.

Voting Technology

VOTING SYSTEMS have a long history of advancing with tech-
nology. In ancient Greece, Egypt and Rome, marks were made

for candidates on pieces of discarded pottery called ostraca. Pa-
per superseded pottery in the hand-counted paper ballot, which

is still used by 1.3 percent of U.S. voters. Other modern tech-
nologies are lever machines, punch cards and mark-sense bal-
lots (where each candidate’s name is next to an empty oval or

other shape that must be marked correctly to indicate the selec-
tion, and a scanner counts the votes automatically). The table

on pages 94 and 95 summarizes the benefits and drawbacks of

each of these methods and suggests ways to improve them. A

lengthier discussion of nonelectronic systems is at www.sciam.

com/ontheweb.

Electronic voting machines have been around for 135

years—Thomas Edison patented one in 1869. Elections started

testing electronic voting machines in the 1970s, when display-
ing and recording a ballot directly into a computer file became

economical. At first, many were mixed-media machines, using

paper to present the selections and buttons to record the votes.

Officials had to carefully align the paper with the buttons and

indicator lights. Electronic voting machines that use such pa-
per overlays are still on the market. More modern direct record

electronic (DRE) voting machines present the ballot and feed-
back information on an electronic display, which may be com-
bined with audio.

Such machines have many advantages: they can stop a vot-
er from choosing too many candidates (called overvoting), and

they can warn if no candidate is picked on a race (undervoting).

For instance, when Georgia changed over to DREs in 2002,

residuals (the total of overvotes and undervotes combined)

were reduced from among the worst in the nation at 3.2 per-
cent on the top race in 2000 to 0.9 percent in 2002. So-called

ballotless voting allows the machines to eliminate tampering

with physical ballots during handling or counting. (Lever ma-
chines, dating back to 1892, share many of those features.)

Yet the birthing of DRE voting equipment in the U.S. has not

been easy. The voting machine industry is fragmented, with nu-
merous companies pursuing a variety of products and without

a mature body of industry-wide standards in place. Deciding

what is a good voting machine is still being discussed by various

advocacy organizations and groups such as the IEEE Project

1583 on voting equipment standards. Allegations of voting com-
panies using money to influence testing and purchasing of

equipment are not uncommon.

Complicating matters, local jurisdictions across the coun-
try have different rules and approaches to testing and using vot-
ing equipment. Some counties, such as Los Angeles, are so-
phisticated enough that they commission voting machines built

to their own specifications. Many other municipalities know so

little about voting that they employ voting companies to run

the election and report the results.

Polling-place practices add further hazards of insecurity and

potential malfunctions. I recall walking into the central election

warehouse (where the voting machines are stored and the

precinct vote tallies are combined) in Broward County, Flori-
da, when it was being used for a recount in December 2002.

The building’s loading dock was opened to the outdoors for

ventilation. The control center for tallying all the votes was a

small computer room; the door to that room was ajar and no

log was kept of personnel entering and leaving.

Beyond external issues, DRE machines themselves have had

technological shortcomings that have slowed their adoption.

Voters have found their displays confusing or challenging to

use. Software bugs and difficulties in setting up DREs have also

presented problems. During the 2002 Broward County re-
count, I was allowed to try out machines from Electronic Sys-
tems and Services (ESS), one of the country’s major election ma-
chine makers. The ESS machines had an excessive undervote

because the “move to next race” button was too close to the

“deposit my ballot” button. An audio ballot was so poorly de-
signed it took about 45 minutes to vote.

On machines made by the company Sequoia, people who

chose a straight party vote and then tried to select that party’s

presidential candidate were unaware that they were deselecting

their presidential choice. A massive 10 percent undervote was

registered in one county using Sequoia machines in New Mexico.

Examining the insides of new voting machines still reveals

92 SCIENTIFIC AMERICAN OCTOBER 2004

■ Following the infamous 2000 presidential election,

electoral officials around the country have scrambled to

upgrade their voting technology with newer systems,

such as direct record electronic voting machines (DREs).

■ A state or county that is considering buying DREs should

hire experts to test the machines thoroughly for bugs,

malicious software and security holes and to assess the

quality of the user interface.

■ Election officials and polling-place workers should be well

versed in the operation of their machines and should follow

practices that do not compromise the security of the vote.

■ In addition to these technology-related issues, the voter

registration process and polling-place practices in general

must be improved to prevent massive losses of votes.

Overview/Electronic Voting

COPYRIGHT 2004 SCIENTIFIC AMERICAN, INC.

Page 4 of 8

many physical security faults. For example, some machines have

a lifetime electronic odometer that is supposed to read every vote

that the machine makes. But the odometer is connected to the

rest of the machine by a cable that a corrupt poll worker could

unplug to circumvent it without breaking a seal.

Source code for voting machines made by different compa-
nies, like most commercial software, is a trade secret. Election

machine companies allow buyers to show the source code to

experts under confidential terms. Unfortunately, the local elec-
tion officials might not know how to find a qualified expert.

And when they find one, will the voting companies be required

to listen? For instance, in 1997 Iowa was considering a voting

machine made by Global Election Systems, which was later

bought out by Diebold. Computer scientist Douglas W. Jones

of the University of Iowa pointed out security issues, and the

state bought Sequoia machines instead. In February 2003

Diebold left its software on unsecured servers, and DRE crit-
ics posted Diebold’s code on the Internet for everyone to see.

The problems that Jones saw six years earlier had not been

fixed. Any person with physical access to the machines and a

moderate amount of computer knowledge could have hacked

into them to produce any outcome desired.

The best computer security available depends on sophisti-
cated encryption and carefully designed protocols. Yet to know

the system has not been compromised requires testing. DRE

machines have not received the constant testing that they re-
quire. Security of today’s voting machines is wholly dependent

on election workers and the procedures that they follow.

Because virtually all tallies, no matter what voting method

is used, are now stored and transmitted in some electronic form,

computer fraud is possible with all voting systems. The advent

of DRE machines potentially allows such tampering to go

www.sciam.com SCIENTIFIC AMERICAN 93

DON FOLEY (illustration); COURTESY OF SEQUOIA VOTING SYSTEMS (photograph)

AUDIT TRAILS

VERIVOTE PRINTER UPGRADE to Sequoia Voting

Systems’s AVC Edge voting machine produces

a paper copy of the votes made on it and

displays it behind a window. Before leaving the

voting booth, the voter can verify her vote by

inspecting the paper record, which is retained

by the machine for use in recounts

An audit trail printed on

paper or recorded on tape

or CD would enable an

independent recount

of votes made on an

electronic voting machine.

1Voter makes selections

using a touch screen

2Audio confirmation

is played to the voter

over headphones as each

selection is made

3A tape recorder

also records the

audio confirmations,

providing a permanent

human- and machine-
readable audit trail for

the votes

COPYRIGHT 2004 SCIENTIFIC AMERICAN, INC.

Page 5 of 8

unchecked from the point at which the voter attempts to cast

a ballot. Schemes for altering ballots have always existed, but

a computerized attack could have widespread effects were it

waged on a large jurisdiction that uses one kind of software on

one type of machine. Using a single system allows large juris-
dictions to get organized and improve their results but must be

accompanied by stringent controls.

The successful reduction of residuals across all of Georgia,

mentioned earlier, is a case in point. Thorough tests on the

DREs at Kenisaw State University found many problems,

which were resolved before the machines were put into use.

This rigorous testing and careful introduction of the machines

were central to the state’s success.

Electronic Fraud

HOW CAN WE FIND all the dangers created by bad software

and prevent or correct them before they compromise an elec-
tion? Reading source code exposes its quality and its use of se-
curity approaches and can reveal bugs. But the only complete-
ly reliable way to test software is by running it through all the

possible situations that it might be faced with.

In 1983 Ken Thompson, on receipt of the Association for

Computing Machinery’s Turing Award (the most prestigious

award in computer science), gave a lecture entitled “Reflections

on Trusting Trust.” In it he showed the possibility of hazards

such as “Easter eggs”—pieces of code that are not visible to a

reader of the program. In a voting machine, such code would do

nothing until election day, when it would change how votes

were recorded. Such code could be loaded into a voting machine

in many ways: in the voting software itself, in the tools that as-
semble the software (compiler, linker and loader), or in the tools

the program depends on (database, operating system scheduler,

memory management and graphical-user-interface controller).

Tests must therefore be conducted to catch Easter eggs and

bugs that occur only on election day. Many electronic voting

machines have clocks in them that can be set forward to the day

of the election to perform a test. But these clocks could be ma-
nipulated by officials to rerun an election and create bogus vot-
ing records, so a safer voting machine would not allow its clock

to be set in the field. Such machines would need to be tested

for Easter egg fraud on election day. In November 2003 in Cal-
ifornia a random selection of each electronic voting system was

taken aside on the day of election, and careful parallel elections

were conducted to show that the machines were completely ac-
curate at recording votes. These tests demonstrated that the vot-
ing machines were working correctly.

To prepare for a fraud-free voting day requires that every ef-
fort be made to create voting machines that do not harbor ma-
licious code. The computer science research community is con-
stantly debating the question of how to make provably secure

software. Computer security experts have devised many ap-
proaches to keep computers reliable enough for other purpos-
es, such as financial transactions. Financial software transfers

billions of dollars every day, is extensively tested and holds up

well under concerted attacks. The same security techniques can

be applied to voting machines. Some researchers believe that the

security precautions of “open source” (making the programs

available for anyone to examine) and encryption techniques can

help but not completely guard against Easter eggs.

Guarding votes against being compromised has always re-

94 SCIENTIFIC AMERICAN OCTOBER 2004

ELIZA JEWETT

EXISTING VOTING TECHNOLOGIES

Improving or optimizing an existing technology may be a better choice for many counties than hasty adoption of a new system—

introduction of a new technology is often accompanied by an increase in errors.

TECHNOLOGY Hand-counted Lever machines Punch cards

paper ballots

COMMENTS ■ Used by 1.3 percent of U.S. ■ First used in 1892 in Lockport, N.Y. ■ First used in 1964 in Fulton

and De Kalb counties, Georgia

ADVANTAGES ■ Simple ■ Overvotes are impossible ■ Removes human errors of tallying

■ Lowest residual* rate ■ Guarantees secrecy of vote ■ Compact machines

DISADVANTAGES ■ Recounts differ from original count ■ Bulky, massive machines ■ Hard to punch holes correctly

by twice as much as machine-counted ■ Defective odometers common ■ Often punch wrong hole

votes do ■ Misreading of odometers ■ Ballot design troubles

■ Persistent allegations of votes being ■ Voting falloff on lower races (for ■ Card readers jam frequently

altered, added, lost, and so on Senate, state office, for example) ■ Ballot easy to spoil

WAYS TO IMPROVE ■ Count by mechanical scanner ■ Check and service before each election ■ Optical way to check ballot while

■ Treat paper with light, heat or coating ■ Monitor odometers with video cameras in booth might help

material to make vote indelible ■ Improve labeling of groups of levers

forming a race

■ Adjustable height of machines

COPYRIGHT 2004 SCIENTIFIC AMERICAN, INC.

Page 6 of 8

quired multiple human agents watching each other for mistakes

or malice. The best future schemes might include computer

agents that check one another and create internal audits to val-
idate every step of the voting process. The Secure Architecture

for Voting Electronically (SAVE) at the Massachusetts Institute

of Technology is a demonstration research project to explore

such an approach. SAVE works by having several programs car-
ry out the same tasks, but while using such different methods

that each program would have to be breached separately to

compromise the final result. The system knows to call foul when

too many modules disagree.

Audit Trails

SOME CRITICS INSIST that the best way to ameliorate such

attacks is by providing a separate human-readable paper ballot.

This widely promoted scheme is the voter-verified paper ballot

(VVPB) suggested by Rebecca Mercuri, then at Bryn Mawr Col-
lege. The voting machine prints out a receipt, and the voter can

look at it after voting and assure himself that at least the paper

records his intention. The receipt remains behind a clear screen

so no one can tamper with it during its inspection, and it is re-
tained by the machine. If a dispute about the electronic count

arises, a recount can be conducted using the printed receipts. (It

is not a good idea for the voter to have a copy, because such re-
ceipts could encourage the selling of votes.)

Although the VVPB looks quite appealing at first glance, a

deeper inspection exposes some serious flaws. First, it is com-
plicated for the voter. Elections in this country often have many

races. Validating all the selections on a separate paper after the

ballot has been filled out is not a simple task. Experience shows

that even when confronted with a printout that tells voters in

which race they have made a mistake, few are willing to go back

and correct it. Anything that takes a voter’s attention away from

the immediate act of casting a ballot will reduce the chances of

the person voting successfully. Every extra button, every extra

step, every extra decision is a source of lost votes.

The scheme is also complicated for the officials. If a voter

claims fraud, what is the official to do? The voter claims she vot-
ed for Jane, but both the DRE screen and the receipt show a vote

for John. Should they close the polling station? On top of this,

the officials are not legally allowed to see an individual voter’s

ballot.

VVPB addresses only a small part of the fraud problem. The

paper trails themselves could be made part of a scheme for de-
frauding an election if a hacker tampers with the printing soft-
ware. The paper can be manipulated in all the usual ways after

the election.

A better option would allow people to verify their selections

www.sciam.com SCIENTIFIC AMERICAN 95

TED SELKER is the Massachusetts Institute of Technology direc-
tor of the California Institute of Technology/M.I.T. voting project,

which evaluates the impact of technology on the election process.

A large part of his research in voting concerns inventing and test-
ing new technology. Examples include new approaches to user in-
terfaces and ballot design and secure electronic architectures.

Selker’s Context Aware Computing group at the M.I.T. Media Labo-
ratory strives to create a world in which people’s desires and in-
tentions guide computers to help them. This work is developing

environments that use sensors and artificial intelligence to form

keyboardless computer scenarios.

THE AUTHOR

Mark-sense Electronic machines Internet voting, phone

ballots messaging, interactive TV

■ First used in 1962 in California ■ First used in 1976 ■ Internet voting first used in 2000 primary

in Phoenix, Ariz.

■ With in-precinct scanning, has lowest ■ Overvotes are impossible ■ Vote from home

residuals of any mechanical method ■ No human errors of tallying ■ People with physical disabilities can use their own

■ Easier than punching holes ■ Easy for people with physical disabilities to use special-needs setup

■ Voter can read candidates right on ballot ■ Good feedback ■ No human errors in tallying

■ Ballot readers are slower, harder to calibrate ■ User interface often poor ■ Concerns about malicious software, network

and more prone to jamming than card readers ■ Concerns about malicious software problems and hackers

■ Bulky ballot ■ Concerns about computer obsolescence

■ Ballot easy to spoil

■ Use an in-precinct scanner to catch problems ■ Test ballots ■ Use special Web browser

and give the voter a second chance to vote ■ Consider closed systems ■ System on a CD

■ Use DRE to mark ballot ■ Test system, including on day of election ■ New approaches to security needed,

■ “Fill in the shape” version better such as multiple software agents

than “connect the arrow” version

*Residuals are ballots with votes for too many (overvote) or too few (undervote) candidates.

COPYRIGHT 2004 SCIENTIFIC AMERICAN, INC.

Page 7 of 8

with recorded audio feedback. An audio transcript on tape or a

CD has an integrity that is harder to compromise than a collec-
tion of paper receipts. Most current electronic voting machines

can be set up to speak the choices to the voter while he looks at

the visual interface. The tape can be read by a computer or lis-
tened to by people. Because misreads of paper are a major dif-

ficulty with all counting machines today, the tape can be better

verified than paper receipts. An audio receipt is also preferable

to a paper receipt because it is hard to change or erase the au-
dio verifications without such alterations being noticed (think

about the 18-minute gap on the Watergate tapes). Also, a small

number of cassette tapes or CDs are easier to store and trans-
port than thousands of paper receipts.

Other proposals for voter verification include recording the

video image of the DRE and showing the ballot as it has been

received by the central counting databases while the voter is in

the booth. The advantage of these techniques is that they are

passive—they do not require additional actions on the part of

the voter.

Here is how voting might go using a well-designed audio

record. Imagine you are voting on a computer. You like Abby

Roosevelt, Independent. You press the touch-screen button for

your choice. The name is highlighted, and the vote button on

one side is replaced with an unvote button on the other side. The

tab on the screen for this race shows that a selection has been

made. The earphones you are wearing tell you that you have vot-
ed for “Ben Jefferson” (and these words are recorded on a back-
up tape).

Wait a minute! “Ben Jefferson”? You realize that you must

have pressed the wrong button by mistake. You study the

screen and see a prominent “cancel vote” button. You press it.

“Vote for Ben Jefferson for president canceled,” the computer

intones onto a tape and into your ears. The screen returns to its

prevote state, and this time you press more carefully and are re-
warded with “Vote cast for Abby Roosevelt, Independent, for

president.” You go on to the Senate race.

The features just described are designed to give feedback

in ways you are most adept at understanding. People are good

at noticing labels moving, tabs changing, and contrast and tex-
ture changes. We have trouble doing things accurately without

such feedback. The audio verification comes right at a time

when the user is performing the action. Perceptual tasks (see-
ing movement and hearing the audio) are easier to perform than

cognitive ones (reading a paper receipt and remembering all the

candidates one intended to vote for). A tape or CD recording is

a permanent, independent transcript of your vote.

96 SCIENTIFIC AMERICAN OCTOBER 2004

In the Courts and in the News

In recent months, electronic voting machines have been in the news a lot, as groups file legal actions both for and against use

of the machines and new problems with elections are uncovered. —Graham P. Collins, staff editor

March—In a case brought by the American Association of

Disabled Persons, a federal judge in Florida orders Duval County

to have at least one machine that allows the visually impaired to

vote without assistance at 20 percent of its polling places. Duval

County appeals, and in April the judge stays his own ruling.

April—In Maryland, local politicians and activists from the

Campaign for Verifiable Voting file suit against the Maryland

Board of Elections to block the use of the state’s 16,000 direct

record electronic (DRE) voting machines, which do not have

printers to produce paper receipts as required by state law. The

move follows reports of glitches in the March 2 primary election;

some voters who demanded paper ballots were given them but

later learned their votes were invalidated.

April—Citing security and reliability concerns and following

problems in the March 2 primary election, California’s secretary

of state bans the use, in the November 2004 election, of more

than 14,000 DREs made by Diebold, Inc. He also conditionally

decertifies 28,000 other DREs, pending steps to upgrade their

security. (Some counties have their systems recertified in

June.) Three counties file suit to block his order. A group of

disabled voters also sues to undo the order. In addition, the

California secretary of state recommends that the state’s

attorney general look into possible civil and criminal charges

against Diebold because of what he calls “fraudulent actions by

Diebold.” A report accuses the company of breaking state

election law by installing uncertified software on DREs in four

counties and then lying about those machines.

May—In Florida, Representative Robert Wexler sues to block the

use of Election Systems and Services voting technology in

Broward and Miami-Dade counties.

June—The League of Women Voters, which in 2003 endorsed

paperless electronic voting, drops that support. Instead it

adopts a resolution to favor “secure, accurate, recountable and

accessible” systems such as those with printed receipts.

June—The head of the Election Assistance Commission calls

for tougher security measures for electronic voting by the

November election.

July—Advocacy groups in Florida ask a Tallahassee judge to

step in before the August 31 primary election and override

Governor Jeb Bush’s decision not to allow manual recounts in

the 15 counties that have touch-screen voting machines. Also in

Florida, audit records of the 2002 governor’s primary and

general election are reported permanently lost because of

computer failures. After a few days the records are rediscovered

on a disk in an adjoining room.

September—Nevada, in a primary election, will be the first to

use DREs that print paper receipts statewide.

COPYRIGHT 2004 SCIENTIFIC AMERICAN, INC.

Page 8 of 8

These features are all implementable now as ballot im-
provements on current voting machines. Extra work would be

needed to allow sight- or hearing-impaired people to verify mul-
tiple records of their ballot as well.

Some researchers are studying alternatives to DREs, in the

form of Internet voting or voting using familiar devices such

as the phone. Since May 2002, England has been experiment-
ing with a number of systems intended to increase turnout.

These methods include mailing in optically readable paper bal-
lots (absentee voting), using a standard phone call and the

phone’s keypad, using the instant-messaging facilities on cell

phones and using interactive TV that is available in English

homes. Swindon Borough, for example, included more than

100,000 voters in an experiment using the Internet and tele-
phones. A 10-digit PIN was hand-delivered to voters’ homes.

This PIN was used in conjunction with a password the voters

had been sent separately to authorize them to vote. No fraud

was detected or reported. But the effort only improved turnout

by 3 percentage points (from 28 to 31 percent).

In contrast, introducing the option of absentee voting in-
creased voter turnout by 15 percentage points—but with a down-
side: large-scale vote buying was reported in Manchester and

Bradford. (Being able to prove whom you have voted for, such

as by showing the ballot you are mailing in, enables vote buying.)

What Must Be Done

THE UNIVERSAL ADOPTION of perfect voting machines will

not be happening anytime soon. But quite independent of the

specific machines used, much can and should be done simply

to ensure that votes are collected and accurately counted in the

U.S. We must be adamant about the following improvements:

1. We must simplify the registration system. The largest loss

of votes in 2000 occurred because errors in registration data-
bases prevented people from voting. Registration databases

must be properly checked to make sure they include all eligi-
ble people who want to be registered. We must develop na-
tional standards and technology to ensure that people can reg-
ister reliably but that they do not register and vote in multi-
ple places.

2. Local election officials must understand the operation of

their equipment and test its performance thoroughly when it

is delivered and before each election. DREs should be tested

on election day, using dummy precincts.

3. Local election officials must teach their workers using sim-
ple procedures to run the equipment and other processes. Bal-
lot making, marking, collecting and counting all must be care-
fully set up to avoid error and fraud. Many voting officials in-
advertently use procedures that compromise accuracy,

security and integrity of ballots by, for example, turning off

precinct scanning machines that check for overvotes and in-
specting and “correcting” ballots.

4. Each step in the voting process must be resistant to tam-
pering. Collecting, counting and storing of ballots must be

done with documentation of who touches everything and with

clear procedures for what to do with the materials at each

stage. Multiple people must oversee all critical processes.

5. Each task in the voting process must be clear and accessible,

have helpful feedback and allow a person to validate it. Per-
ceptual, cognitive, motor and social capabilities of people must

be taken into account when designing machines and ballots.

Ballot designs should pass usability and countability tests be-
fore being shown for final approval to the parties invested in the

election. Voters must be able to understand how to make their

selections, and votes must be easy to count in mass quantities.

6. The government should invest in research to develop and

test secure voting technology, including DREs and Internet

voting. Rushing to adopt present-day voting machines is not

the best use of funds in the long term.

7. Standards of ethics must be set and enforced for all poll

workers and also for voting companies regarding investments

in them and donations by them or their executives.

Only when these requirements are met will we have a truly

secure and accurate voting system, no matter what underlying

technology is used.

www.sciam.com SCIENTIFIC AMERICAN 97

COURTESY OF DIEBOLD ELECTION SYSTEMS

Misvotes, Undervotes and Overvotes: The 2000 Presidential Election in

Florida. Alan Agresti and Bret Presnell in Statistical Science, Vol. 17, No. 4,

pages 436–440; 2002. Available at web.stat.ufl.edu/~presnell/Tech-
Reps/election2000.pdf

A Better Ballot Box? Rebecca Mercuri in IEEE Spectrum, Vol. 39, No. 10,

pages 46–50; October 2002. Available at

www.spectrum.ieee.org/WEBONLY/publicfeature/oct02/evot.html

Security Vulnerabilities and Problems with VVPT. Ted Selker and Jon

Goler. April 2004. Available at

www.vote.caltech.edu/Reports/vtp_wp13.pdf

The Caltech/M.I.T. Voting Technology Project is at www.vote.caltech.edu;

the project’s July 2004 report with recommendations for the 2004

presidential election is at www.vote.caltech.edu/Reports/EAC.pdf

The U.S. Election Assistance Commission Web site is at www.eac.gov

MORE TO EXPLORE

DIEBOLD ELECTION SYSTEMS’S AccuVote TSX, another typical modern

electronic voting machine, was decertified in California.

COPYRIGHT 2004 SCIENTIFIC AMERICAN, INC.