Voter Verified Paper Audit Trail
Encyclopedia
Voter Verified Paper Audit Trail (VVPAT) or Verified Paper Record (VPR) is intended as an independent verification system for voting machine
s designed to allow voters to verify that their vote was cast correctly, to detect possible election fraud or malfunction, and to provide a means to audit the stored electronic results.
The VVPAT offers some fundamental differences as a paper, rather than computer memory
, recording medium when storing votes. A paper VVPAT is readable by the human eye and voters can directly interpret their vote. Computer memory requires a device and software which potentially is proprietary
. Insecure voting machine records could potentially be changed quickly without detection by the voting machine itself. It would be more difficult for voting machines to corrupt records without human intervention. Corrupt or malfunctioning voting machines might store votes other than as intended by the voter unnoticed. A VVPAT allows voters the possibility to verify that their votes are cast as intended and can serve as an additional barrier to changing or destroying votes.
(DRE), to assure voters that their votes have been recorded as intended. It is intended, and some argue necessary, as a means by which to detect fraud and equipment malfunction. Depending on election laws the paper audit trail may constitute a legal ballot
and therefore provide a means by which a manual vote count can be conducted if a recount is necessary. The solution was first demonstrated (New York City, March 2001) and used (Sacramento,CA 2002) by AVANTE International Technology, Inc..
In Non-document ballot voting systems – both mechanical voting machines and DRE voting machine
s – the voter does not have an option to review a tangible ballot to confirm the voting system accurately recorded his or her intent. In addition, an election official is unable to manually recount ballots in the event of a dispute. Because of this, critics claim there is an increased chance for electoral fraud
or malfunction and security experts, such as Bruce Schneier
, have demanded voter-verifiable paper audit trails. Non-document ballot voting systems allow only a recount of the "stored votes." These "stored votes" might not represent the correct voter intent if the machine has been corrupted or suffered malfunction.
A fundamental hurdle in the implementation of paper audit trails is the performance and authority of the audit. Paper audit systems increase the cost of electronic voting systems, can be difficult to implement, often require specialized external hardware, and can be difficult to use. In the United States 27 states require a paper audit trail by statute or regulation for all direct recording electronic voting machines
used in public election
s.
Another 18 States don't require them but use them either statewide or in local jurisdictions.
Various technologies can be used to implement a paper audit trail.
Systems that allow the voter to prove how they voted are never used in U.S. public elections, and are outlawed by most state constitutions. The primary concerns with this solution are voter intimidation and vote selling.
Dr. Rebecca Mercuri
, the creator of the VVPAT concept (as described in her Ph.D. dissertation in October 2000 on the basic voter verifiable ballot system), proposes to answer the auditability question by having the voting machine print a paper ballot or other paper facsimile that can be visually verified by the voter before being entered into a secure location. Subsequently, this is sometimes referred to as the "Mercuri method
".
Professor Avi Rubin
has testified in front of the United States House Committee on House Administration
in favor of voting systems that use a paper ballot and disfavoring systems that use retrofitted VVPAT attachments. He has said on his personal blog that "after four years of studying the issue, I now believe that a DRE with a VVPAT is not a reasonable voting system."
An auditable system, such as that provided with VVPAT, can be used in randomized recounts to detect possible malfunction or fraud. With the VVPAT method, the paper ballot can be treated as the official ballot of record. In this scenario, the ballot is primary and the electronic records are used only for an initial count or, in some cases, if the VVPAT is damaged or otherwise unreadable. In any subsequent recounts or challenges the paper, not the electronic ballot, would be used for tabulation. Whenever a paper record serves as the legal ballot, that system will be subject to the same benefits and concerns of any paper ballot system.
Matt Quinn, the developer of the original Australian DRE system, believes that in the future there should be a, "There's no reason voters should trust a system that doesn't have it, and they shouldn't be asked to. Why on earth should [voters] have to trust me – someone with a vested interest in the project's success? A voter-verified audit trail is the only way to 'prove' the system's integrity to the vast majority of electors, who after all, own the democracy."
1) Video of voter behavior during an actual election revealed that most voters do not "verify" their choices by reading the VVPAT.
2) A manual VVPAT recount/audit is labor intensive and expensive, and likely unaffordable to most candidates seeking it.
3) And while VVPAT is designed to serve as a check on DRE (Direct Recording Electronic) vote recorders, it relies on the same proprietary programming and electronics to produce the audit trail.
Other hurdles in the implementation of paper audit trails include the performance and authority of the audit. Paper audit systems increase the cost of electronic voting systems, can be difficult to implement, often require specialized external hardware, and can be difficult to use. In the United States 27 states require a paper audit trail by statute or regulation for all direct recording electronic voting machines
used in public election
s.
Another 18 States don't require them but use them either statewide or in local jurisdictions.
Another security concern is that a VVPAT could print while no voter is observing the paper trail, a form of ballot stuffing
. Even if additional votes were discovered through matching to the voters list, it would be impossible to identify legitimate ballots from fraudulent ballots.
Alternatively the printer could invalidate the printed record after the voter leaves and print a new fraudulent ballot. These ballots would be undetectable as invalidated ballots are quite common during elections. Also, VVPAT systems that are technically able to reverse the paper feed could be open to manipulated software overwriting or altering the VVPAT after the voter checks it.
In November 2003 in Wilton, CT, virtually all voters had to be prompted to find and verify their receipt, increasing the time required to vote and the work for the pollworkers. The VVPAT adds to the complexity of voting, already a deterrent to voting.
In addition, a VVPAT component may not be easily usable by poll-workers
, many of whom are already struggling with DRE
maintenance and use and new elections law requirements. In the 2006 primary election in Cuyahoga County, Ohio, a study found that 9.6 percent of the VVPAT tapes were either destroyed, blank, illegible, missing, taped together or otherwise compromised. In one case the thermal paper was loaded into the printer backwards leaving a blank tape
, which was not realized by voters who couldn't verify the paper trail. The Cuyahoga Election Review Panel proposed in its final report to remove the opaque doors covering the VVPAT except the ones equipped with equipment for blind voters.
In general collecting and counting these printed records can be difficult.
Records printed on continuous rolls of paper is more difficult than counting standard paper ballots or even punch cards.
Alternatively, an attacker could watch the order in which people use a particular voting system and note the order of each particular vote he is interested in. If that attacker later obtains the paper ballot records she could compare the two and compromise the privacy of the ballot. This could also lead to vote selling and voter intimidation.
In 2007, Jim Cropcho and James Moyer executed and publicized a proof of concept for this theory. Via a public records request, the two extracted voter identification from pollbooks, and voter preference from VVPATs, for a Delaware County, Ohio
precinct with multiple voting machines. Because both sets of records independently established the order of electronic ballots cast, they directly linked a voter's identification to his or her preference. Over 1.4 million registered voters in ten Ohio counties were affected. The situation was resolved before the next election by omitting the consecutive numbers on Authority To Vote slips from pollbook records. However, similar vulnerabilities may still exist in other states.
at a June 2005 hearing on Voter Verification in Federal Elections "The blind cannot verify their choices by means of a piece of paper alone in a manner that is either independent or private. Nor can an individual who has a mobility disability, such as hand limitations, verify a piece of paper alone, if that individual is required to pick up and handle the paper."
points out that "Adding a paper printing device to a DRE machine naturally adds another component that can fail, run out of ink, jam or run out of paper. If DREs are alleged already to be prone to failure, adding a paper trail cannot improve that record." In Brazil in 2003, where a small number of
precincts had installed paper trails, failure of the printers delayed voters by as much as 12 hours,
a figure that would be catastrophic in the U.S.
Current implementation of VVPAT systems use thermal printer
s to print their paper ballot records. Ballot records printed on the thermal paper
will fade with time. Also, heat applied to the paper before or after the election can destroy the printing.
voting machines that lack a VVPAT, implementation can be expensive to add and difficult to implement due to the specialized external hardware required. To add a VVPAT component to a DRE
machine, a jurisdiction would be required to purchase the system designed by the vendor of the DRE
machine with a no bid, sole source purchase contract. That assumes the vendor has designed a component that is compatible with the DRE
machine in use. The vendor may not have developed a VVPAT component that is compatible with the DRE
machine in use, thus requiring the jurisdiction to purchase an entirely new voting system
.
For jurisdictions not currently using direct recording electronic
voting machines, the introduction of a new voting system
that includes a VVPAT component would have less implementation challenges.
Some implementations of the VVPAT place a high cognitive burden on the voter and are extraordinarily error prone.
voting machines be performed on Election Day
to protect against machine malfunction. However, the partial tallying of votes before the polls have closed could create a problem similar to the occurrence in American national elections where a winner is declared based on East Coast results long before polls have closed on the West Coast. In addition, the partial tallying of votes before the polls have closed may be illegal in some jurisdictions. Others have suggested that random audits of direct recording electronic
voting machines be performed after the election or only in the event of a dispute.
In the event an audit is performed after the election and a discrepancy is discovered between the ballot count and the audit count it is unclear which count is the authoritative count. Some jurisdictions have statutorily defined the ballot as the authoritative count leaving the role of an audit in question. Because VVPAT is a recent addition to direct record
voting systems the authority question remains unclear.
Voting machine
Voting machines are the total combination of mechanical, electromechanical, or electronic equipment , that is used to define ballots; to cast and count votes; to report or display election results; and to maintain and produce any audit trail information...
s designed to allow voters to verify that their vote was cast correctly, to detect possible election fraud or malfunction, and to provide a means to audit the stored electronic results.
The VVPAT offers some fundamental differences as a paper, rather than computer memory
Computer storage
Computer data storage, often called storage or memory, refers to computer components and recording media that retain digital data. Data storage is one of the core functions and fundamental components of computers....
, recording medium when storing votes. A paper VVPAT is readable by the human eye and voters can directly interpret their vote. Computer memory requires a device and software which potentially is proprietary
Proprietary software
Proprietary software is computer software licensed under exclusive legal right of the copyright holder. The licensee is given the right to use the software under certain conditions, while restricted from other uses, such as modification, further distribution, or reverse engineering.Complementary...
. Insecure voting machine records could potentially be changed quickly without detection by the voting machine itself. It would be more difficult for voting machines to corrupt records without human intervention. Corrupt or malfunctioning voting machines might store votes other than as intended by the voter unnoticed. A VVPAT allows voters the possibility to verify that their votes are cast as intended and can serve as an additional barrier to changing or destroying votes.
Overview
The Voter Verified Paper Audit Trail (VVPAT) is a method of providing feedback to voters using a ballotless voting system, including a direct recording electronic voting systemDRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
(DRE), to assure voters that their votes have been recorded as intended. It is intended, and some argue necessary, as a means by which to detect fraud and equipment malfunction. Depending on election laws the paper audit trail may constitute a legal ballot
Ballot
A ballot is a device used to record choices made by voters. Each voter uses one ballot, and ballots are not shared. In the simplest elections, a ballot may be a simple scrap of paper on which each voter writes in the name of a candidate, but governmental elections use pre-printed to protect the...
and therefore provide a means by which a manual vote count can be conducted if a recount is necessary. The solution was first demonstrated (New York City, March 2001) and used (Sacramento,CA 2002) by AVANTE International Technology, Inc..
In Non-document ballot voting systems – both mechanical voting machines and DRE voting machine
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
s – the voter does not have an option to review a tangible ballot to confirm the voting system accurately recorded his or her intent. In addition, an election official is unable to manually recount ballots in the event of a dispute. Because of this, critics claim there is an increased chance for electoral fraud
Electoral fraud
Electoral fraud is illegal interference with the process of an election. Acts of fraud affect vote counts to bring about an election result, whether by increasing the vote share of the favored candidate, depressing the vote share of the rival candidates or both...
or malfunction and security experts, such as Bruce Schneier
Bruce Schneier
Bruce Schneier is an American cryptographer, computer security specialist, and writer. He is the author of several books on general security topics, computer security and cryptography, and is the founder and chief technology officer of BT Managed Security Solutions, formerly Counterpane Internet...
, have demanded voter-verifiable paper audit trails. Non-document ballot voting systems allow only a recount of the "stored votes." These "stored votes" might not represent the correct voter intent if the machine has been corrupted or suffered malfunction.
A fundamental hurdle in the implementation of paper audit trails is the performance and authority of the audit. Paper audit systems increase the cost of electronic voting systems, can be difficult to implement, often require specialized external hardware, and can be difficult to use. In the United States 27 states require a paper audit trail by statute or regulation for all direct recording electronic voting machines
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
used in public election
Election
An election is a formal decision-making process by which a population chooses an individual to hold public office. Elections have been the usual mechanism by which modern representative democracy operates since the 17th century. Elections may fill offices in the legislature, sometimes in the...
s.
Another 18 States don't require them but use them either statewide or in local jurisdictions.
VVPAT Application
- Attachment of a printer to direct recording electronic (DRE)DRE voting machineA direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting machines that print paper records stored within the machine. Such designs usually present the record to the voter behind a transparent surface to enable a voter to confirm a printed record matches the electronic ballot. The records can be manually counted and compared to the electronic vote totals in the event of a dispute. The solution linking electronic ballot images and the voter verified paper record with randomly generated unique voting session identifier is covered by patents issued and pending to AVANTE International Technology, Inc.
- Attachment of a printer to direct recording electronic (DRE)DRE voting machineA direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting machines that print paper records on special paper with security features. The printed page contains both a plain text record and a simple barcode of the voter's selections. This page is the official ballot that is then fed through a scanner into a locked ballot box so that all originals are saved in case of the need for a recount or audit. The electronic record from the DRE is compared with the barcode scanner record and in case of any discrepancy the paper ballots are used to determine the official vote, not the electronic record. The voter has the ability to proofread the ballot before it is placed into the scanner/lockbox and have it voided if there is any error, just as has always been possible with existing manual voting systems.
- Attachment of a printer to direct recording electronic (DRE)DRE voting machineA direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting machines that print an encrypted receipt that is either retained by the voter or stored within the machine. If the receipt is retained, the receipts can be manually counted and compared to the electronic vote totals in the event of a dispute. These systems have not been used in elections in the United StatesElections in the United StatesThe United States has a federal government, with elected officials at the federal , state and local levels. On a national level, the head of state, the President, is elected indirectly by the people, through an Electoral College. In modern times, the electors virtually always vote with the popular...
.
- Creation of an encrypted audit trail at the same time the electronic ballot is created in an direct recording electronic (DRE)DRE voting machineA direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting machine, a form of witness system. The audit trail can be accessed and compared to the electronic vote totals in the event of a dispute.
- Use of precinct-based optical scan or mark-sense tabulators instead of DREs. In this simple and cost-effective system, voters fill out paper ballots which are then counted electronically by a tabulator at the precinct, similar to the technology used to score standardized tests. Optical scan machines have been in use for decades, and provide a voter-verified audit trail by default. Tabulators can detect overvotes at the poll so that the voter can be given the opportunity to correct a spoiled ballot.
Systems that allow the voter to prove how they voted are never used in U.S. public elections, and are outlawed by most state constitutions. The primary concerns with this solution are voter intimidation and vote selling.
Dr. Rebecca Mercuri
Rebecca Mercuri
Dr. Rebecca Mercuri, Ph.D is an expert in computer security, especially in electronic voting where she has been researching, writing about, and testifying since 1989...
, the creator of the VVPAT concept (as described in her Ph.D. dissertation in October 2000 on the basic voter verifiable ballot system), proposes to answer the auditability question by having the voting machine print a paper ballot or other paper facsimile that can be visually verified by the voter before being entered into a secure location. Subsequently, this is sometimes referred to as the "Mercuri method
Mercuri method
The "Mercuri method" is another name for a Voter Verified Paper Audit Trail—a modification to DRE voting machines that provides for a physical audit record that may be used to verify the electronic vote count. Because these machines record votes internally, in computer software, vote fraud may...
".
Professor Avi Rubin
Avi Rubin
Aviel David Rubin a graduate of the University of Michigan and Professor of Computer Science at Johns Hopkins University, Technical Director of the Information Security Institute at Johns Hopkins, Director of ACCURATE, President and co-founder of and an expert in systems and networking security...
has testified in front of the United States House Committee on House Administration
United States House Committee on House Administration
The United States House Committee on House Administration deals with the general administration matters of the United States House of Representatives.-Jurisdiction:...
in favor of voting systems that use a paper ballot and disfavoring systems that use retrofitted VVPAT attachments. He has said on his personal blog that "after four years of studying the issue, I now believe that a DRE with a VVPAT is not a reasonable voting system."
An auditable system, such as that provided with VVPAT, can be used in randomized recounts to detect possible malfunction or fraud. With the VVPAT method, the paper ballot can be treated as the official ballot of record. In this scenario, the ballot is primary and the electronic records are used only for an initial count or, in some cases, if the VVPAT is damaged or otherwise unreadable. In any subsequent recounts or challenges the paper, not the electronic ballot, would be used for tabulation. Whenever a paper record serves as the legal ballot, that system will be subject to the same benefits and concerns of any paper ballot system.
Matt Quinn, the developer of the original Australian DRE system, believes that in the future there should be a, "There's no reason voters should trust a system that doesn't have it, and they shouldn't be asked to. Why on earth should [voters] have to trust me – someone with a vested interest in the project's success? A voter-verified audit trail is the only way to 'prove' the system's integrity to the vast majority of electors, who after all, own the democracy."
Common problems
Commonly VVPAT problems are:1) Video of voter behavior during an actual election revealed that most voters do not "verify" their choices by reading the VVPAT.
2) A manual VVPAT recount/audit is labor intensive and expensive, and likely unaffordable to most candidates seeking it.
3) And while VVPAT is designed to serve as a check on DRE (Direct Recording Electronic) vote recorders, it relies on the same proprietary programming and electronics to produce the audit trail.
Other hurdles in the implementation of paper audit trails include the performance and authority of the audit. Paper audit systems increase the cost of electronic voting systems, can be difficult to implement, often require specialized external hardware, and can be difficult to use. In the United States 27 states require a paper audit trail by statute or regulation for all direct recording electronic voting machines
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
used in public election
Election
An election is a formal decision-making process by which a population chooses an individual to hold public office. Elections have been the usual mechanism by which modern representative democracy operates since the 17th century. Elections may fill offices in the legislature, sometimes in the...
s.
Another 18 States don't require them but use them either statewide or in local jurisdictions.
Security Concerns
The introduction of malicious software into a VVPAT system can cause it to intentionally misrecord the voter's selections. This attack could minimize detection by manipulating only a small percentage of the votes or for only lesser known races.Another security concern is that a VVPAT could print while no voter is observing the paper trail, a form of ballot stuffing
Ballot stuffing
Ballot stuffing is the illegal act of one person submitting multiple ballots during a vote in which only one ballot per person is permitted. The name originates from the earliest days of this practice in which people literally did stuff more than one ballot in a ballot box at the same time...
. Even if additional votes were discovered through matching to the voters list, it would be impossible to identify legitimate ballots from fraudulent ballots.
Alternatively the printer could invalidate the printed record after the voter leaves and print a new fraudulent ballot. These ballots would be undetectable as invalidated ballots are quite common during elections. Also, VVPAT systems that are technically able to reverse the paper feed could be open to manipulated software overwriting or altering the VVPAT after the voter checks it.
Usability and ergonomic concerns
For the voter the printed record is "in a different format than the ballot, in a different place, is verified at a different time, and has a different graphical layout with different contrast and lighting parameters."In November 2003 in Wilton, CT, virtually all voters had to be prompted to find and verify their receipt, increasing the time required to vote and the work for the pollworkers. The VVPAT adds to the complexity of voting, already a deterrent to voting.
In addition, a VVPAT component may not be easily usable by poll-workers
Election judge
In the United States an election judge is an official responsible for the proper and orderly voting in local precincts. Depending on the state, election judges may be identified as members of a political party or non-partisan...
, many of whom are already struggling with DRE
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
maintenance and use and new elections law requirements. In the 2006 primary election in Cuyahoga County, Ohio, a study found that 9.6 percent of the VVPAT tapes were either destroyed, blank, illegible, missing, taped together or otherwise compromised. In one case the thermal paper was loaded into the printer backwards leaving a blank tape
, which was not realized by voters who couldn't verify the paper trail. The Cuyahoga Election Review Panel proposed in its final report to remove the opaque doors covering the VVPAT except the ones equipped with equipment for blind voters.
In general collecting and counting these printed records can be difficult.
Records printed on continuous rolls of paper is more difficult than counting standard paper ballots or even punch cards.
Privacy concerns
DRE VVPAT systems that print the ballot records out in the order in which they were cast (often known as reel-to-reel systems) raise privacy issues, if the order of voting can also be recorded. VVPAT printers that cut the paper after each ballot to form individual ballots can avoid this concern. Many jurisdictions also record the order in which voters vote, thus possibly compromising the secrecy of the vote. If there are multiple voting machines it would be more difficult to match between the full voter list and the VVPATs.Alternatively, an attacker could watch the order in which people use a particular voting system and note the order of each particular vote he is interested in. If that attacker later obtains the paper ballot records she could compare the two and compromise the privacy of the ballot. This could also lead to vote selling and voter intimidation.
In 2007, Jim Cropcho and James Moyer executed and publicized a proof of concept for this theory. Via a public records request, the two extracted voter identification from pollbooks, and voter preference from VVPATs, for a Delaware County, Ohio
Delaware County, Ohio
Delaware County is a fast-growing suburban county in the state of Ohio, United States, within the Columbus, Ohio Metropolitan Statistical Area. According to the United States Census Bureau's 2004 population estimates, Delaware County's population of 142,503 made it the fastest growing county in...
precinct with multiple voting machines. Because both sets of records independently established the order of electronic ballots cast, they directly linked a voter's identification to his or her preference. Over 1.4 million registered voters in ten Ohio counties were affected. The situation was resolved before the next election by omitting the consecutive numbers on Authority To Vote slips from pollbook records. However, similar vulnerabilities may still exist in other states.
Effectiveness concerns
Also problematic is that voters are not required to actually check the paper audit before casting a ballot, which is critical to "verifying" the vote. While the option to look at the paper may provide comfort to an individual voter, the VVPAT does not serve as an effective check on malfunction or fraud unless a statistically relevant number of voters participates.Accessibility concerns
Current VVPAT systems are not usable by some disabled voters. Senator Christopher Dodd (D-CT) testified before the United States Senate Committee on Rules and AdministrationUnited States Senate Committee on Rules and Administration
The Senate Committee on Rules and Administration is responsible for the rules of the United States Senate, with administration of congressional buildings, and with credentials and qualifications of members of the Senate, including responsibility for dealing with contested elections.The committee...
at a June 2005 hearing on Voter Verification in Federal Elections "The blind cannot verify their choices by means of a piece of paper alone in a manner that is either independent or private. Nor can an individual who has a mobility disability, such as hand limitations, verify a piece of paper alone, if that individual is required to pick up and handle the paper."
Reliability Concerns
VVPAT systems can also introduce increased concern over reliability. Professor Michael ShamosMichael Ian Shamos
Michael Ian Shamos is an American mathematician, attorney, book author, journal editor, consultant and company director. He is Michael Ian Shamos (born April 21, 1947, and often referred to as Mike Shamos) is an American mathematician, attorney, book author, journal editor, consultant and company...
points out that "Adding a paper printing device to a DRE machine naturally adds another component that can fail, run out of ink, jam or run out of paper. If DREs are alleged already to be prone to failure, adding a paper trail cannot improve that record." In Brazil in 2003, where a small number of
precincts had installed paper trails, failure of the printers delayed voters by as much as 12 hours,
a figure that would be catastrophic in the U.S.
Current implementation of VVPAT systems use thermal printer
Thermal printer
A thermal printer produces a printed image by selectively heating coated thermochromic paper, or thermal paper as it is commonly known, when the paper passes over the thermal print head. The coating turns black in the areas where it is heated, producing an image...
s to print their paper ballot records. Ballot records printed on the thermal paper
Thermal paper
Thermal paper is a special fine paper that is coated with a chemical that changes color when exposed to heat. It is used in thermal printers and particularly in inexpensive or lightweight devices such as adding machines, cash registers, and credit card terminals.The surface of the paper is coated...
will fade with time. Also, heat applied to the paper before or after the election can destroy the printing.
Implementation concerns
It can be significantly more difficult to implement a VVPAT as an after-the-fact feature. For jurisdictions currently using direct recording electronicDRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting machines that lack a VVPAT, implementation can be expensive to add and difficult to implement due to the specialized external hardware required. To add a VVPAT component to a DRE
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
machine, a jurisdiction would be required to purchase the system designed by the vendor of the DRE
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
machine with a no bid, sole source purchase contract. That assumes the vendor has designed a component that is compatible with the DRE
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
machine in use. The vendor may not have developed a VVPAT component that is compatible with the DRE
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
machine in use, thus requiring the jurisdiction to purchase an entirely new voting system
Vote counting system
There exist various methods through which the ballots cast at an election may be counted, prior to applying a voting system to obtain one or more winners.-Manual counting:Manual counting requires a physical ballot that represents voter intent...
.
For jurisdictions not currently using direct recording electronic
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting machines, the introduction of a new voting system
Vote counting system
There exist various methods through which the ballots cast at an election may be counted, prior to applying a voting system to obtain one or more winners.-Manual counting:Manual counting requires a physical ballot that represents voter intent...
that includes a VVPAT component would have less implementation challenges.
Some implementations of the VVPAT place a high cognitive burden on the voter and are extraordinarily error prone.
Legal Questions Around VVPAT
One important question of VVPAT systems is when should an audit be performed? Some have suggested that random audits of direct recording electronicDRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting machines be performed on Election Day
Election
An election is a formal decision-making process by which a population chooses an individual to hold public office. Elections have been the usual mechanism by which modern representative democracy operates since the 17th century. Elections may fill offices in the legislature, sometimes in the...
to protect against machine malfunction. However, the partial tallying of votes before the polls have closed could create a problem similar to the occurrence in American national elections where a winner is declared based on East Coast results long before polls have closed on the West Coast. In addition, the partial tallying of votes before the polls have closed may be illegal in some jurisdictions. Others have suggested that random audits of direct recording electronic
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting machines be performed after the election or only in the event of a dispute.
In the event an audit is performed after the election and a discrepancy is discovered between the ballot count and the audit count it is unclear which count is the authoritative count. Some jurisdictions have statutorily defined the ballot as the authoritative count leaving the role of an audit in question. Because VVPAT is a recent addition to direct record
DRE voting machine
A direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
voting systems the authority question remains unclear.
Examples
Several voter verifiable audit trail systems exist. They include:- AccuVote TSX with Printer
- AVC Edge with VeriVote Printer
- Sequoia Voting Systems' Edge2Plus
- Sequoia Voting Systems' AdvantagePlus
- eSlate with Voter Verifiable Paper Audit Trail
- iVotronic Real Time Audit Log
- AVANTE DRE VOTE-TRAKKER with Voter-Verified Paper Record
- Smartmatic's SAES System
See also
- 2004 United States election voting controversies2004 United States election voting controversiesDuring the 2004 United States presidential election, concerns were raised about various aspects of the voting process, including whether voting had been made accessible to all those entitled to vote, whether ineligible voters were registered, whether voters were registered multiple times, and...
- DRE voting machineDRE voting machineA direct-recording electronic voting machine records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter ; that processes data by means of a computer program; and that records voting data and ballot images in memory components...
- Electronic VotingElectronic votingElectronic voting is a term encompassing several different types of voting, embracing both electronic means of casting a vote and electronic means of counting votes....
- End-to-end auditable voting systemsEnd-to-end auditable voting systemsEnd-to-end auditable or end-to-end voter verifiable systems are voting systems with stringent integrity properties and strong tamper-resistance. E2E systems often employ cryptographic methods to craft receipts that allow voters to verify that their votes were not modified, without revealing which...
- Help America Vote ActHelp America Vote ActThe Help America Vote Act , or HAVA, is a United States federal law which passed in the House 357-48 and 92-2 in the Senate and was signed into law by President Bush on October 29, 2002. Drafted in reaction to the controversy surrounding the 2000 U.S...
- Vote counting systemVote counting systemThere exist various methods through which the ballots cast at an election may be counted, prior to applying a voting system to obtain one or more winners.-Manual counting:Manual counting requires a physical ballot that represents voter intent...
- Voting machineVoting machineVoting machines are the total combination of mechanical, electromechanical, or electronic equipment , that is used to define ballots; to cast and count votes; to report or display election results; and to maintain and produce any audit trail information...
Research
- Independent Verification: Essential Action to Assure Integrity in the Voting Process, Roy G. Saltman, August 22, 2006
- Brennan Center Voting Technology Initiative
- Secret-Ballot Receipts: True Voter-Verifiable Elections (mirror) by David ChaumDavid ChaumDavid Chaum is the inventor of many cryptographic protocols, including blind signature schemes, commitment schemes, and digital cash. In 1982, Chaum founded the International Association for Cryptologic Research , which currently organizes academic conferences in cryptography research...