Voting Technology Current Assessment and Future Prospects

Voting Technology; Current Assessment and Future Prospects Caltech/MIT Voting Project Ted Selker selker@media.mit.edu Technology: a process for doing something Iron: 1.orange dirt, 2.partially burnt wood, 3.heat People are bad at repetitive things We communicate best with technology we are used to Process to create security Registration 1- 3 million + Registration is obsolete obsolete? Caltech/MIT voting project Votes that could counted… The process has to want the votes Confusing ballot 1 - 2 million Incumbent top on ballot? Polling place operations 1 million Intermediaries improve confidence? Absentee ballots ?? Rampant coercion? Nov 2000 Votes Stolen or changed? People make mistakes What can people do? Caltech/MIT Voting Project Ted Selker selker@media.mit.edu Familiarity /(Complexity + import) Perceptual & Motor Accessibility Feedback Consider Review and Change “Bad ballot design gave highest error rates” Keeting etal        Two line names Size Crossing two columns Two-page designs Running partner in same font Position Language (YES NO) Ted Selker © 2002, MIT Mistakes and Fraud Protection, detection & correction Observation, confidentiality, redundancy Universal verifiability Voter verifiable Results verifiability Results COTS good or bad?  Perceptual  Graphical Interaction design Many Voting Problems Not Unique  View ability,Color, contrast, size,  Readability, Distinctions, Distinguishably  Precognitive, cognitive,  Feedback; Proprioceptive,  Cognitive Interface  Precognitive recognition issues, Recognition VS Recall (except when conflicting)  Short term memory 7 +- 2 ( in 2 d), depth of info 2 or three  Cognitive load, syntactic, semantic. bored … overloaded  Social issues  You are doing Great…  Your Vote Maters  Androgynous Voice…  Cognitive Styles  Verbal/ Visual  Procedural/Conceptual  Myers Briggs  Physical, perceptual, psychological, neurological Perception & Motor Problems in 2000 Elections  Distinguish ability  Ambiguity: mislabel, association  Alignment  Viewable height/position in list  Poor audio: 1 ... to select gore 2…to select Bush  Feedback and Side effects  Action  Undo … action symmetry? Democrats under “Republican” NY Wrong odometer Boston Everywhere Accessibility??? Several levers below referendum Punch cards, marked ballots…  Visual  Completion  Validation  Counted  Mechanical  Dexterity, accuracy,  Button pressure (x not counted) Optical Scan All but lever Ballots, Registration - In trunks Philadelphia … Special needs complaints DRE  Difficult to pull, push, turn grab or reach  Poll worker training and actions complex conceptual training… A+ checklist & Performance Standards Knowledge and Action will help hi hi hi hi hi hi hi  Usability standards history :Test with appropriate methods  New designs compared to performance bar  Many problems can be found even testing with few people  Perceptual & Motor Accessibility  Perception, Cognition, Action, Social factors  Feedback  Physical,Memory, Emotion  Consider, Mark, Review, Change and Deposit – Coercion free Voters oriented and able to focus Voters oriented and able to focus Coercion?  We disagree so lets neither vote  15 years later one spouse had been voting all along  Ballot marking parties at churches  We like this guy  Said a 45 year old child to their parent in a voting booth  Nursing homes  They have a right to vote  Palm cards  Precinct Captain  Ballot layout  Order on Ballot  Stand in voters •Humiliation, •intimidation, •hand over hand voting •Misinformation •Parallax and other physical access –(arm extension) Defense in Depth? Registration? Access to polling machine Orienting and focusing to know No coercion (other hands, palm cards, money…) Actions and undo obvious and available Feedback that is interpretable Obvious chance to consider and change Demonstration that the vote was recorded Paper is not gold & is not proven • • • • • Paper ballots are mis-marked, checks, x’s circles, write ins, Recounts get different results LA 2004 9 hand changes in ballots with no audit Printed paper has not been readable Paper is not kept (Jan 1 2003 Florida destroy ballots?) Air-gapping Alternatives ,Vote-meter, modular architecture, encrypted votes, open source, process, standards, VVPT Testing Air-gapping alternatives! Passive verifier Digital camera Internal observation Separate authors, etc. Vote-meter Separate verifying computer External observation Open source, Expert observers Verification goal = Air-Gapping Alternatives: Vote-meter, modular architecture, encrypted votes, open source, process, standards, VVPT VVPT Audio Video Votematic N-Version Mechanical Lever insecure available now available now needs development needs development Ways to foil paper trails Disenfranchise in all the normal ways Registration, ballot design, Change, lose, or add paper Question paper result in any way Print what they want to see (but don’t check) Problems with a separate paper trail. People can’t verify their receipts: Chicago (2002, 2003) Wilton Ct 2003          No way for ballot worker to help Connection broken Paper out Paper jam Ink out Printer broken Paper looks different Format different than DRE Separate thing to look at         Extra time & step for voting Lighting, readability Special needs (dyslexia, ADHD, blind ) Extra steps for ballot worker Collecting the ballots Ballots could be exchanged Re-voting a machine at end of day Rereading ballots Hacking a VVPT Hack vote and print almost readable receipt 1 in 50 1 in 10 people that see that do anything (Chicago) 1 in 500 (one per precinct has this problem Print again - it fixes itself Call a judge - first time in the day at that polling place They say print it again -it fixes itself They come into the booth -!yikes they are arrested! They shut down the booth -!yikes only a few machines Votematic audit trail System would have to be built Separate machine with code from others Shows same ballot selections as made Records them separately Advantages Machine readable Ballot box integrity Usability Camera Audit Trail Can be done now Camera or video cable record screen as you do it. You see the feed on a non computer screen Record on a tape or CD Advantages to VVPT Ballot box integrity, verify as you go, machine readable An Audio Audit trail with today’s DRE hardware Speaks each selection (while on your mind) Stored on a tape or write once media Advantages machine verifiable, improves user interface, voting box integrity, storability, transportability N-version Audit trail Secure Architecture for Voting Electronically SAVE Many internal programs check on each other Multiple databases in government voting center Report from deposit in governmental tally database Advantage End to end verification Secure Architecture for Voting Electronically No single anything voting UI, registration, witness and aggregator layers… VOTER n VOTER n+1 VOTER n+2 Voter and voter system See the same bitmap N A M E S Voter can authenticate datum while voting. Authentication Site No. 1 Authentication Site No. 2 Authentication Site No. 3 K E Y S Vote Vote Vote Votes live on multiple viewable databases Votes live on a viewable databases Game Machine approach (computers get very old in 7 years) Oversight of closed game machine manufacture Each voting machine a different CD Stored and transmitted redundantly Sell the machines after each election cycle? Verification goal = Air-Gapping Alternatives: Vote-meter, modular architecture, encrypted votes, open source, process, standards, VVPT VVPT Audio Video Votematic N-Version Mechanical Lever insecure available now available now needs development needs development Problems have not been voter verifiable Brevard 4000 Volusia 16022 Boone County 10000 Many places Many places Dallas Many places Georgia Indiana ? Recent Republican Mail in Absentee Back end software Back end software Back end software Odometer problems Altered paper ballots Destroyed paper ballots Replaced paper ballots Not close enough to recount User interface (straight vote) Shown on UI No secrecy ! What will improve Voting Follow Brazil's example (associate with best scientists)  Separate Election commission, Equipment manufactures and design activities  Funded requirements gathering team outside election commission  Funded reference platform coding team outside election  Equipment inexpensive and replaceable through open competitions Performance based standards: All standards are relative to best of breed Reference Platform: Brazil Renewed belief in government!! Electronic voting; 96, 98, 2000  96 Unisys 7% failure  98 Procomp  2000 Procomp .02% failure 106,000,000 votes Trusted Scientific organization  Create requirements Trusted Technical organization  Create reference platform Companies (5)  Create demons ratable products for bid Government election officials  Create open viewing and decision of vendor Voting Technology; Current Assessment and Future Prospects AAAS Panel: 2/15/2004 Caltech/MIT Voting Project Ted Selker selker@media.mit.edu Technology: a process for doing something Iron: 1.orange dirt, 2.partially burnt wood, 3.heat People are bad at repetitive things We Communicate best with technology we are used to Process to create security Bring in experts Non election industry funded help; HAVA? Centers for study Reference platform creation Testing equipment Testing processes Testing new User experiences Checks and Balances with teeth 3 University centers for voting  User experience  Polling place, Ballot, administration,  Administration  Back end, Forensics, Operations  Voting architectures, Security,  Voter education/registration 2 Research centers for watchdog  Evaluate voting research  Evaluate voting  Reference platforms