Short summary: Computer devices that enable voters with disabilities to mark paper ballots are indispensable–for those voters. BMD use by all voters puts everyone’s votes and entire elections at risk. Here’s why.
For the next few paragraphs, imagine yourself to be a municipal elections clerk–a particularly conscientious one who understands that “trust” is one thing a manager cannot do with computers. You know the cybersecurity mantra: Protect; detect; correct. After you do everything you can to protect the system, you routinely audit its business-day performance so that you can quickly correct any fraud or malfunctions that got through despite your efforts.
You are responsible for two pieces of computerized election equipment in each polling place. The first is a tabulator that reads paper ballots and counts votes. You have little problem verifying the tabulator’s Election-Day accuracy. You do a quick audit, and if that reveals a possibility that the wrong winner was identified on Election Night, you will do a full hand count to correct that error before you declare the election results final.
The second is a machine that was developed for voters who cannot hand-mark their ballots, called a ballot-marking device, or BMD. With a BMD, a voter can touch a screen, speak, or puff a tube to indicate their choices, and the computer prints a ballot for them.
Most BMD users cast the printed ballots without reading them. This bothers you because if they don’t, you have no way to verify the machines’ accuracy. For you, the paper ballot is evidence only of what the computer printed, not what the voter touched on the computer monitor.
You cannot watch over voters’ shoulders while they vote. You could ask poll workers to stand between the BMDs and the tabulator to remind each voter to read the printed ballots carefully and tell you if anything is wrong. But even if the voters look at their ballots, you don’t know whether they are actually reading them or just pretending to while thinking “I came here to vote and leave, not to get nagged. I just want to get home to supper.”
You cannot abolish the BMDs. If you do, voters who need them will have to ask a trusted friend to mark their ballots. Besides, federal law requires them.
So there’s only one thing you can do to protect your city’s election results: Get as many voters as possible to mark their paper ballots with a pen. Then, even if the machines are hacked, it won’t ruin enough ballots to change the outcome.
End of fantasy. You can stop imagining you’re a clerk now. You were not very typical anyway. In the real world, most clerks don’t worry much about computer security, and nowhere is this more obvious than in their growing love affair with BMDs.
Why is anyone pushing these machines on all voters?
At the manufacturers’ urging, election officials nationwide are purchasing more of these machines and urging–or even forcing– all voters to use them. It’s obvious why vendors are pushing $5,000 machines that come with annual service contracts to replace twenty-cent pens. But why are election officials buying?
In other states, election-security advocates suspect vendors are making campaign contributions or appointing clerks to corporate “advisory committees” that meet in Florida or Vegas. I don’t suspect that in Wisconsin. Here, local officials make the purchasing decisions, and vendors don’t need to spend any money to manipulate them. Sample quotes from real-life Wisconsin clerks who are still on the job:
- “We must not inspect the equipment for unauthorized remote-access capability, because that would void the manufacturer’s warranty.”
- “If the voting machines could be hacked, the State wouldn’t let us use them.”
- “I’ll believe there is a problem when I see actual evidence of a hacked election.” (In other words: Every system gets one freebie stolen election before this clerk will audit its performance.)
The City of Madison, Wisconsin, says it needs BMDs for everyone because early voting sites like libraries need to serve voters from wards all over the city. With a BMD, a library poll worker needs only to enter a code for each voter to get the computer to display and print the correct ballot for a voter’s ward. With regular paper ballots, the library would need to stock potentially dozens of different versions of the ballot.
That would be a good reason for using BMDs, if not for another fact. Manufacturers also offer machines that print blank ballots on demand. If Madison bought these, early voters could be allowed to mark their own ballots instead of having the computer do it.
Disability advocates sometimes argue that BMD users lose privacy when most ballots are marked by hand. In this, they are being cynically manipulated by the vendors. Companies could make BMDs that print ballots nearly indistinguishable from hand-marked paper ballots, even down to marking the ovals in ways that mimic the work of the human hand. Some companies do. But other companies’ BMDs print ballots that look nothing like hand-marked ballots. They create the privacy problem and then want election officials to solve it by buying enough machines for everyone. See how that works?
Another argument is that voters with disabilities are ‘segregated‘ when other voters are allowed to mark their ballots by hand. But this, too, seems to be more of an excuse than a reason. Accessible voting machines do not create segregated elections any more than accessible parking stalls create segregated parking lots or accessible stalls create segregated public restrooms. They enable everyone to participate in the same election.
But most importantly, disability advocates need to realize–in their own interest–that the best way to secure the BMD machines is to keep the number of users small. Officials cannot check the BMD machines’ accuracy regardless of how many voters use them, but hackers are less interested when they can mess with only relatively few ballots.
Other arguments in favor of BMDs-for-all have even less basis in reason or fact.
Some clerks claim voters cannot be trusted to mark ovals unambiguously, but this argument has several problems. It’s simply wrong–slanderous, even–to accuse voters of being unable reliably to mark pen-and-ink ballots. Every recount or audit confirms they can, with only an insignificant error rate. In addition, modern scanner/tabulators are very good at interpreting marks and returning ballots with overvotes and other ‘fatal’ flaws to the voter for correction.
Finally, when comparing BMDs with hand-marked paper ballots, we have to keep in mind that a very small number of voters will find a way to mess up a BMD ballot, too. One Wisconsin municipal clerk recently told me he had to instruct poll workers to watch for voters walking away with the BMD ballots, thinking them to be receipts.
Why universal BMD use puts entire elections at risk
But personally, my biggest concern is that when BMDs are used by a significant number of voters, the election results overall cannot be verified. The risk of chaos increases dramatically. Let’s walk it through…
BMD advocates point out that individual voters can, if they choose, take the time to review the printed ballot before they cast it. This might make those individual voters feel okay about their own ballot, but voter-verifiability cannot effectively secure elections.
The problem getting most attention is voters’ inability and unwillingness to verify their printed ballots. I won’t summarize the research, but basically it backs up what we all suspect: Voters don’t like to take the time to review the printed ballot carefully, and even when they do try to review it, are unreliable in noticing incorrect or missing votes.
But the problem I consider to be even worse is much less discussed: Even if voters do notice misprinted ballots, the poll worker are not going to be able to do anything about it. Think it through: What would happen on a real Election Day with real voters and real poll workers?
For the sake of easy arithmetic, let’s assume that half the voters want Adams and half want Baker, and that half choose to hand-mark their ballots and half mark their ballots by hand. Finally, assume it’s a very clumsy, obvious hack and that every second Adams vote is printed on the paper ballot for Baker.
Only one in every eight ballots are affected. Let’s generously assume that one in four of them will notice–or one in every 32 voters.
The first several voters who report the problem will be told to re-make their ballots, because poll workers have no way to distinguish voter error from machine malfunction. When they remake their ballots, the BMD will print their votes correctly.
The poll workers cannot know that the problem is affecting only Adams’ voters, because they cannot ask or look at the ballots. All they can see is that 31 in every 32 BMD users seem to be having no problem at all.
But how long do you think the poll workers would let this go on before they suspect the machine? How many votes will be cast before they take the machine out of service? How long before word gets out on social media that the machines are “flipping votes?”
Whatever happens, the hackers will win. In one scenario, their hack gets dismissed as voter error, and Baker ends up getting three-quarters of Adams’ votes. In another scenario, chaos breaks out because something is wrong with the machines; no one knows how to fix it; and no one knows how many ballots were affected.
Generally accepted auditing standards require auditors to use “competent” evidence–that is, evidence that they can know to be a true record of whatever it is the auditor is looking to know.
A hand-marked oval is pretty much a definitive illustration of competent evidence of voter intent. When a voter indicates a choice by touching pen to paper, he creates a durable physical record of that action. If the elections clerk looks at the ballot later during an audit or a recount, she can see exactly what the voter saw as he touched the ballot; she can see the same marked oval that the voter saw as he lifted the pen.
But how do you check whether the BMD worked accurately? You cannot see what the voter saw as he touched the screen. You cannot know whether the voter took the time carefully to read the printer ballot and to report the problem if she saw one.
Further, you cannot know if, when a voter reported a problem, the poll worker did anything other than help the voter cast another ballot. Poll workers cannot watch over voters’ shoulders as they touch the screen. When voters report misprinted ballots, poll workers can do nothing but tell the voter how to print another one. (Remember that hackers would not flip every vote. Even a hacked machine might print the second ballot correctly.)
But manufacturers, too, see an enormous benefit in replacing each 20-cent ballot-marking pen with a $5,000 computerized ballot marking device that comes with an annual service contract costing a few more thousands.
In every state, America’s process for selecting elections equipment is pretty much a closed-loop discussion between the vendors and the election officials. So no one with any power to influence these decisions seems to have noticed their stunning choices.
Election officials like to demand that voters should trust the voting machines. One of these days, if they stop defending the machines long enough to give it a minute’s sensible thought, they will realize: Voters would trust the machines a lot more if the election officials trusted them a lot less.