In brief: Vendors are promoting and officials are buying the idea that voters should give up their pens and mark ballots with computers known as ballot-marking devices, or BMDs. Why? How is that better than hand-marked paper ballots?
As with many election-administration issues, the debate features strong opinions and little objective data. Much of the relevant research is conducted by people with a financial or professional interest in promoting BMD technology. Little is conducted by independent unbiased researchers, and only local print shops have a financial interest in promoting hand-marked paper ballots.
In this blog post, I’ve tried to present the best arguments for BMDs and to cite unbiased data (I’ll edit it to add more as I find it.)
Bottom line up front: BMDs are necessary for voters with disabilities, but when used by a majority of voters, they address only insignificant problems while introducing serious risks for both security and voter confidence, plus additional cost.
Everyone knows how to fill in an oval. We’ve completed standardized-test ‘bubble sheets’ since we were kids. And most of us understand that computers tabulate the results by reading (techies say ‘interpreting’) the marked ovals. So we understand, basically, how hand-marked paper ballots work.
Ballot-marking computers are less familiar. Originally promoted in the early 21st-century to enable voters with disabilities to mark ballots privately, manufacturers have more recently promoted ballot-marking devices (BMDs) for all voters. They used to call these machines ‘accessible’ machines; now they call them ‘universal’ machines. Voters select their candidates on a computer touchscreen or other electronic input device, and the computer prints a marked ballot. They then insert the ballot into a tabulator, sometimes archaically called an ‘opscan,’ which reads and tabulates it. BMDs used in Wisconsin include the ES&S ExpressVote and the Dominion ICE.
Many of the BMDs’ drawbacks are obvious, so I’ll skim over them in just five paragraphs:.
1) More risks; more types of risks. Anytime you replace any manual task with a computer, you introduce possibilities for new types of error, malfunction, and manipulation–and the need for new security practices to address those risks. Misprogramming could cause the BMDs to print votes for candidates other than those the voter selected, or to print no vote even though the voter made a selection. As with other elections technology, risks include mistakes or corruption by any of the many people within voting-machine companies and local election offices who have authorized access. If any of their operations are compromised, unauthorized people might get access, too.
2) Longer lines. In addition to the risks of misprinted ballots, there’s no debate that voting takes more time when each voter has to scroll through several screens; review their selections once on the touchscreen; and review them again after the ballot is printed. Add that to the fact that election clerks cannot quickly or cheaply increase the number of ballot-marking stations during heavy turnout elections or times of day, and you have a recipe for longer Election-Day lines.
3) Voters do not, maybe cannot, verify that the right votes are marked on their ballots. But the most heated debate is over whether voters are able and willing to verify their computer-printed ballots. Elections must start with correctly marked ballots. With hand-marked ballots, voters reflexively verify the correct marks. As we lift our pen from the paper, it would take effort not to notice whether the pen made the mark we intended it to make. But when a computer marks our votes, verification requires the voters to make a separate, deliberate effort to check the computer’s output. BMDs place this critical security responsibility entirely on the voters: if the BMD starts misprinting votes, only voters—not poll workers, not auditors, not recounters—can notice.
4) Officials reflexively blame problems on voter error and do not investigate. Election officials must be prepared to act on voters’ reports of problems if the election is to be safe from misprinting BMDs. You cannot think of any other business or government function where managers rely solely on customers to report computer malfunctions, and then when customers do, the managers have no way to know whether the problem was with the computer or the customer. No one has yet demonstrated that voters can reliably verify computer-printed ballots in real-world elections, and several … studies … indicate … they cannot.
5) Less obvious but just as unalterable is the fact that BMD-printed ballots cannot be used in the most critical type of election audit — that is, one that seeks to verify which candidate was selected by most voters. BMD-printed ballots preserve no direct evidence of either the voters’ selections or their verification. (For a visual explanation of this point, see the image at the end of this post.) When BMD-printed ballots make up only a small proportion of the total ballots, an audit might still be able to confirm the correct winner. However, if a large proportion of the ballots provide no evidence of either the voters’ selections or their verification, anyone working to established professional audit standards must throw in the towel.
The benefits of BMDs are quickly evident only to those who have better-than-average knowledge of elections administration. Cynics say the manufacturers’ motive is simple. As states replace paperless machines, vendors see a revenue-enhancing opportunity of the sort that other companies might brag about in their annual stockholders’ reports. (“We’ve found a way to sell $5,000 computers instead of pens!“) But America’s major voting-machine companies are privately owned and have no stockholders, so even if this is their strategy, we can’t confirm it.
In public, BMD proponents usually point to a few legitimate problems they believe BMDs solve: Badly hand-marked ballots; the need to store multiple ballot versions at some polling places; and the needs of voters with disabilities. Officials and voters need to ask: “How serious are these problems, and do BMDs solve them better than less risky or less costly solutions?”
Arguments in favor of BMDs, Round 1:
MESSY VOTERS
BMD proponents will tell you that messy hand-marked ballots are intolerable. My own county clerk is outspoken on this point. I don’t have a ready quote but if you ask him to share his thoughts on voters’ oval-marking abilities, his answer will make you ashamed that you ever imagined your careless, stupid, sloppy fellow voters were capable of such a task.
Pen-wielding voters do get messy. They write random comments on their ballots and mark Xs over ovals instead of filling them in. Others get confused and mark too many candidates in one race. That’s called an overvote and if not caught, it disenfranchises the voter in that race. Hand-marking voters might accidentally skip a race, particularly if ballot design is poor. Finally, I’ve had a BMD proponent tell me that voters sometimes accidentally fill in the wrong oval, but I have no idea what sort of evidence could prove that or why that problem wouldn’t also occur with touchscreens.
I’ll come back to ballot design, but individual voters’ sloppiness does not threaten election outcomes. Only a tiny number of hand-marked votes are ruined in a way that could be prevented by using BMDs, and those errors affect all candidates randomly.
Yes, individual voters can be sloppy, but the truth is that tabulator technology (not BMDs) has already reduced this problem to insignificance. When a voter casts an overvoted ballot, the tabulator identifies the problem and gives the in-person voter a chance to correct it or cast it. (Mail-in voters are not present to fix overvoted ballots rejected by the tabulators, but BMDs can’t help them anyway.)
The tabulators’ ability to interpret idiosyncratically marked ovals has also become impressive in recent years. (There’s data on this; I’ll add it when I locate it.) Modern machines have no trouble reading any color or composition of ink. Professor Douglas Jones of the University of Iowa Computer Science Department told me he tests machines with everything up to and including glitter pens, and they perform well.
But most importantly, the problem of ambiguously or incorrectly marked ballots is very small to start with. Anyone who has participated in a hand count can tell you that probably only one hand-marked ballot in every 250 or so is oddly marked. Of those, only a tiny fraction are marked so badly as to render the vote uncountable. The Dane County Clerk (the one who so disdains voters’ ability to mark ovals) posts digital images of the ballots online, so if you have the storage space on your computer and the time, you can examine thousands of real ballots yourself. Try it: how many hand-marked ballots (on those linked files, the individual files ending in “i” for ‘image’) do you need to examine before you find one that is overvoted or mismarked in any way? Preventing that small a number of errors cannot possibly be worth the cost and risk of making everyone use a computer to mark their ballots.
Recount data are objective and can help us quantify the problem. In 2008, the state of Minnesota performed a recount of a US Senate race in which 2.9 million ballots were hand-counted. Advocates for both major candidates aggressively looked to find votes they could challenge. They found plenty of officials’ errors—misplaced ballots, mishandled absentee ballots, and more. But by the time they were done, they could find only 14 marked ovals that had to be adjudicated by the state elections board. That’s one fatally mismarked vote in every 206,111 votes, or 0.000485%. That is nowhere near enough to justify taking on the risks of computer-marked ballots.
Wisconsin’s 2016 recounters found many of the same problems. They did not record their findings as thoroughly as Minnesotans did, but not one of the 72 counties’ recount reports noted encountering even one ambiguously marked oval. The WEI hand count of 4,580 ballots in Racine County found no fatally mismarked ballots, either (other than carbonless ink, which is not a problem for modern tabulators.) So whatever Wisconsin voters’ error rate is, it is less than 0.022% (22 thousandths of one percent)–again, not enough to justify the risk of universal BMDs.
What little data BMD proponents have offered me to quantify the hand-mismarking rate has been irrelevant. David Becker, Executive Director of the Center for Election Innovation and Research (CEIR, a voting-equipment company) tweeted me a list of recounts he claimed had found decisive rates of voter error. I looked into each. None found even minor levels of ballot-marking errors. As in the Minnesota and Wisconsin recounts, the significant causes of miscounts were officials’ errors, not voters’. When I gave him one more chance to provide data showing that voter errors have affected outcomes, he replied: “Facts are stubborn things … but still, there are many, many elections where ambiguous (hand-marked votes) exceeded the margin. Not even arguable. I think we’ve reached the end of the constructiveness of this convo.”
That’s not the reply of a man who has evidence to prove his point.
If anyone were to compile data about hand-marking error rates to inform this debate, they would need to exclude mail-in ballots. Any poll worker knows mail-in ballots are prone to mishaps like soaking up coffee stains and getting fouled with envelope glue. But that’s not relevant to the advantages of BMDs because BMDs cannot help at-home voters anyway. I’ve also had BMD proponents refer me to data about error rates on standardized tests’ bubble answer sheets. But I see no reason to assume the error rate in marking ballots (where ovals are directly beside candidates’ names) is similar to the error rate in taking standardized tests (where ovals and questions are on separate documents.)
Aside: Speaking of an analogy with standardized testing, imagine that the ACT and SAT companies switched to having students select their answers from a touchscreen; printing out the answer sheets with bubbles already marked, and telling the students they must verify the printed answers because managers have no way to tell if the machines accurately recorded their selections. On what planet do you think that might be acceptable?
In contrast to individual errors, poorly designed ballots are a more serious problem. Poor design can systematically disadvantage one candidate or favor another for every voter — not just the careless ones. It is, therefore, more likely to affect an outcome.
But poor design is a problem for both printed ballots and those displayed on a computer screen. Officials have designed printed ballots that ‘hid’ a race under a column of multilingual instructions, and have also designed BMD displays that forced voters to scroll onto additional screens to see the entire list of candidates. Printed ballots arguably have a small advantage because they can be printed in newspapers before the election, a practice that has, on occasion, enabled voters or candidates to identify design errors officials had overlooked. Either way, officials must learn and follow established guidance on ballot design.
Score so far: Preventing voter error gives a microscopically detectable advantage to BMDs. Mismarked ballots have been mostly resolved by tabulator technology except for some of the problems with mail-in ballots, which BMDs cannot help with anyway. Poor ballot design can be a serious threat but gives hand-marked paper ballots only a microscopic advantage, from the increased opportunity to detect problems before Election Day.
Arguments in favor of BMDs, Round 2:
MULTIPLE BALLOT STYLES
For better or worse, both officials and voters have begun to embrace early offsite voting. Election officials want to set up voting sites several weeks before each election in places like libraries, to which voters can come from all over the city to cast their ballots. These are called ‘multi-ward sites.’
In any city, in any election, it’s possible that several different ‘ballot styles’ will be needed. Different areas of the city might be voting on different city council races. In gerrymandered states like Wisconsin, congressional district boundaries can cut through even the smallest municipality. When those municipalities set up multi-ward voting sites, each site must stock several different ballot styles. This creates more work for the poll workers at those sites, both in handing out the correct ballots and in keeping track of the ballot inventory (an important security practice.)
BMDs address that problem by electronically storing several different ballot styles. When the poll worker enters the voter’s ward number, a correctly programmed BMD will display the correct ballot for that voter.
However, every BMD manufacturer also sells blank-ballot-on-demand printers. These cheaper computers store multiple ballot styles, but they don’t mark the votes before they print the ballot.
Score for this round: No advantage for either. Multi-ward voting sites are a challenge with pre-printed blank ballots. But there’s a solution that doesn’t force us to accept the risks and cost of universal BMD use.
Arguments in favor of BMDs, Round 3:
VOTERS WITH DISABILITIES
Spoiler: BMDs win this round, for people with disabilities. No other solution, even on the horizon, enables voters with vision or movement impairments to mark their ballots privately at the polling place. For this reason, BMDs are as indispensable as accessible parking spaces and public restroom stalls.
And there’s no disagreement that we need to make BMDs available to everyone even when we don’t encourage their use. Impairments can be temporary so it wouldn’t work to force BMD users to prove a disability, as we do with accessible parking spots. I once left my reading glasses behind when I went to vote and appreciated the opportunity to be able to enlarge the ballot so I could read it more confidently.
Some disability groups argue for universal BMD use out of a concern for what they call segregation. That argument falls apart when we consider how we handle all other public accommodations. We don’t rip out curbs and stairs when we accommodate wheelchair users with curb cuts, ramps, and elevators. Ripping out all the smaller stalls to give everyone an accessible stall would increase cost and lengthen lines, just as it does with BMDs. If we handle polling-place accommodation the same way we handle other public accommodations, we can protect disability rights without degrading election security.
Another complaint, however, is confirmed when we compare it with other types of accommodations: Unreliable set-up of the BMDs. As with the occasional unshoveled accessible parking spot or curb cut, voters sometimes discover that the BMD hasn’t yet been turned on when they arrive at the polling place. But again, the problem could be addressed with less extreme measures, such as improving poll workers’ training and oversight. The League of Women Voters incorporates BMD set-up into their observation program (volunteer here!), as do disability groups. Voters who don’t use the BMD can help. If you have an extra five minutes to spend at the polling place, look to see whether the BMD is set up and ready to go. If not, ask to use it. It’ll take a few extra minutes of your time, but you will strike a blow for disability awareness.
BMD promoters also argue that users have more privacy when everyone uses the BMDs. Privacy is a genuine issue when only one or two voters use the BMD and the BMD prints ballots that contain only the voter’s selections, rather than full ballots with marked ovals. But some BMDs print ballots that are nearly indistinguishable from hand-marked paper ballots. Anyone trying to identify the sole BMD user’s ballot after poll closing would have to carefully examine every ballot cast that day, and even then could not be sure of finding the printed ballot.
On the other hand, BMD users’ ballots are more secure when there are only a few. When only one or two people in each polling place use the BMD, malicious actors could neither swing an election nor create chaos by tampering with the lightly used equipment. In contrast, widespread use makes BMDs a more attractive target for mischief.
Score for this round: BMDs must be preserved to accommodate people with disabilities. To preserve users’ privacy, only BMDs that print full ballots should be used. But for universal use, the advantage goes to hand-marked paper ballots. To bolster BMD security, their use should not exceed a small percentage of the voters.
RELATED ISSUES: ENCODED VOTES AND HYBRID MACHINES
I hope I’ve demonstrated that when discussing BMDs in general, we can logically examine actual problems, seek relevant evidence, and assess the costs and benefits of possible solutions. But for two specific types of BMDs—hybrid machines and encoding BMDs —there is no well-reasoned pro-and-con debate.
Proponents identify no consequential problems that justify the existence of these machines, even if they added no risk. But they do create new, and serious, risks.
Hybrid machines combine ballot-marking devices and tabulators in one machine. Only their manufacturers are comfortable with the fact the machines are able to print votes on the ballots after the voter has cast them. Neither voters nor officials have any way under any circumstance to detect the alterations or to recover the true votes if they could detect the altered ballots. That’s unacceptable. Full stop.
As of August 2018 (WEC’s most recently updated inventory), hybrid machines (Dominion’s ImageCast Evolution) were in use in Door, Fond du Lac, Green, Ozaukee, Racine, Trempealeau, Vilas, Walworth, Washington, Waupaca, and Winnebago Counties.
Encoding BMDs record each vote twice on each ballot, once in barcode or QR code, and separately in a list of names for the voter to review. The tabulators count only the encoded votes, while voters can verify only the text. Encoding gives voters no choice but to trust that the countable votes were recorded correctly.
Encoding BMDs are in use in the counties listed above, plus those that use the ES&S ExpressVote: Columbia, Dane, Dodge, Douglas, Eau Claire, Jefferson, Kenosha, Lafayette, Milwaukee, Outagamie, Pierce, Sauk, St. Croix, and Waukesha, and perhaps more. Because the City of Madison encourages BMD use by early offsite voters, it is likely that more than 30% of Madison’s votes are now encoded.
The critical risk is obvious: How do either voters or officials know that the BMDs correctly encoded the voters’ Election-Day selections? The machines’ proponents will cavalierly tell you officials can detect any incorrectly encoded vote in an audit or recount (assuming the text vote was not also mis-recorded). Yes, they can. But they won’t. In this state, election officials do not routinely audit, and recounts are conducted mostly by running the ballots back through the tabulators.
Keep going with this train of thought, and envision what would happen if a post-election audit did detect that some encoded votes were different than the text-readable votes. Aside from the chaos that could have been avoided had voters been able to detect and report the misprints on Election Day, who is going — legally — to determine which of the two conflicting votes is valid?
Encoded-vote proponents naively assume lawyers, judges, and combative candidates will passively agree the text votes should be counted. But Wisconsin’s law explicitly allows ‘recounting’ by machine, and contains nothing that provides for counting one set of votes (the encoded ones) on Election Day and a different set (the ones in text) in a later audit or recount. I doubt any other state’s law does, either.
And if there was such a law, what would it say? Perhaps: “Only votes printed in voter-verifiable text may be counted in post-election reviews because audits and recounts must be convincing and decisive.” But encoded votes are good enough for Election Day because … ?
In my experience with encoding proponents (emails, Twitter, and at WEC meetings), I’ve encountered none who could both describe and quantify any problem that encoded votes are designed to solve. Without that information, neither they nor we can assess whether the added risk is justified.
I shredded the vendors’ arguments put forth at WEC meetings in an earlier post. Since then I’ve had several discussions with encoded-vote advocates who put forth better arguments.
Ben Adida, Executive Director of VotingWorks, a nonprofit voting-equipment company, explained two reasons for encoding votes. First, it is “easier to get to a high level of reliability” in the tabulators’ interpretation of the marks when they are recorded in QR. In the context of our discussion, I understood him to mean that it’s easier for developers, and that he is speaking about QR codes in comparison to machine-printed ovals.
To assess whether this additional ease or reliability is worth sacrificing voter verification, we would need to compare data on tabulators’ error rate with marked ovals to their error rate with encoded votes. QR codes reduce the error rate from what to what? My sense, however, is such information is not worth digging for. If the tabulators were making any noticeable level of oval-reading errors, any real-world recount of marked-oval ballots would have detected it. None has. It is not a problem.
Adida’s second reason was: “More importantly … (if you) want voters to check (a BMD-printed ballot), a summary ballot is going to be much easier to check than a multi-page bubble ballot. And we really want voters to check their BMD ballot.”
In my opinion, that’s the best argument for ballot slips I’ve encountered (once you’ve accepted universal BMD use, that is.) However, we still need evidence before acting on it. I’ll keep an open mind, but my sense is that objective study would show that, regardless of the length of the ballot, voters’ reviews are more accurate when they can see the names of both the candidates they did and did not vote for. In particular, voters need to see the whole question to review their referendum votes.
Adida added that developers are working on the possibility that BMDs could print votes only once, in human-readable text, for tabulators that can reliably use optical character recognition (OCR) to count the same votes that voters are able to verify. When that technology is ready, in my opinion, the question of ballot slips’ safety could be revisited–though it still would not establish a need for ballot slips in place of full ballots.
Aside from Adida, encoding proponents with whom I’ve engaged rely heavily on motivated reasoning. For example, proponents often reflexively deflect discussion of BMDs’ undeniable flaws (e.g., voters cannot verify encoded votes) by tossing out irrelevant facts. For example, many have pointed out that voters cannot read the timing marks at the edges of printed paper ballots, either. That’s true but irrelevant: the timing marks are not the input that voters need to verify; that’s something that officials can do. And if the tabulator misreads the timing marks, that’s a problem with the tabulator, not the ballot.
Also irrelevant is the fact that just as BMDs could be misprogrammed to print the wrong votes, paper ballots can be misprinted to put candidates’ names in different spots than the tabulators are programmed to find them. Again, true, but the risks are far from comparable. A misprinted-ballot fraud would have to involve or originate with the local printing company and involve several layers of conspirators to avoid detection during pre-election testing and distributing the misprinted ballots to polling places. It would, therefore, be limited to individual counties or municipalities. It is not comparable to a BMD hack that could originate in Omaha or Pyongyang and affect up to 55% of the BMDs in Wisconsin (the market share of the most popular model.)
People argue by tossing irrelevancies into the discussion only when they have no truly solid points to make. It’s not earnest problem-solving discourse.
SO WHY DO OTHERWISE SENSIBLE PEOPLE SUPPORT THESE THINGS?
I’m not ready to say all, or even any, encoding proponents have corrupt motives. My most charitable guess is that the technology developers are like the proverbial children with hammers who perceive everything needs pounding. Where you and I see only minor blemishes, geeks perceive possibilities for major fun and profit. Intensely focused on bringing cutting-edge technology to the election-equipment market, they don’t pause to think about real-world issues such as the chaos that will blossom when litigious parties to a recount realize they can fight over which vote to count on each ballot.
I also suspect that developers, accustomed to working with private-sector businesses, overestimate the likelihood that local election officials will implement security practices the developers consider obvious and necessary. Elections are run by a small army of lightly trained, minimally supervised, part-time, temporary employees who get no more than four days on-the-job-experience every year. The officials who manage that army often exhibit a child-like trust in voting equipment that, in their own words, makes them reluctant to implement recommended security measures. The following are real quotes from real Wisconsin county clerks, which I’ve collected from newspaper articles, emails, and phone conversations over the past two years:
- “I don’t need to audit to be very confident the results are accurate.”
- “Honestly, I am not concerned about any kind of hacks into our system. Everything is hardwired.”
- It’s an “irrational belief that Wisconsin’s highly decentralized and secure elections infrastructure is vulnerable to the kind of meddling that might overturn the will of the voters. All our software and hardware has been federally certified.”
- “Why pay $8000 and more for a voting machine if you have to (check its accuracy)?”
- Auditing “would defeat the purpose of having the voting machines.”
- “Why should we audit? Things work well and when something works well, you don’t mess with it.”
Accustomed to working with private-sector executives who might lose their jobs if they did not implement manufacturer-recommended security measures, it’s quite possible that developers don’t understand they are selling equipment to officials who genuinely perceive no need to manage it professionally.
And why do election officials buy and promote the encoding BMDs and hybrid machines? As I write this, Pennsylvania officials are in court defending their decision to force encoding BMDs on all voters there. If I can get a copy of their briefs, I’ll know definitively what they put forth as their best arguments.
Based on what I already know — for both this and other issues — my most charitable guess is that election officials rely exclusively, even mindlessly, on vendors for information about the products’ risks and benefits. With little IT expertise of their own, they cannot ask sophisticated questions or notice what the salesperson is not saying. Example: for years, vendors were telling them the equipment was not connected to the internet, and election officials believed them, even as they instructed poll workers on how to wirelessly transmit election-night results to the county elections-management computer. Local election officials have no relationships with unbiased elections-technology professionals and no Consumer Reports-type counsel to inform voting machine purchases — pr at least none that the election officials accept as authoritative. Finally, they are too pressured by time and money do much other than grab the hand of the friendly voting-machine vendors and follow where they lead. The problem is exacerbated by the nature of the voting-machine market.
WHAT VOTERS CAN DO.
- Encourage your local clerk to purchase only the minimum number of BMDs needed to ensure accessible polling places and to refrain from encouraging voters to use BMDs in situations like early voting.
- Pressure your local clerk to adopt policies that: 1) enable poll workers to take voters’ report of misprinted ballots seriously; and 2) describe an effective response when voters report malfunctioning BMDs. The policies must be in writing and must be specific. They won’t help if all they say is: “if poll workers receive more than a few reports of misprinted ballots, they should report to the municipal clerk.” How many is more than a few? What will the municipal clerk to determine the nature and extent of the problem, and what will the clerk do if the BMDs are misprinting?
- Mark your own ballot with a pen whenever you can. If you must use a BMD, be prepared to spend extra time at the polls to review it carefully. Ask for a copy of a regular paper ballot against which to check your BMD-printed ballot. (That will help you remember all the races and candidates.) If you find an error, don’t just assume you did something wrong. Insist the poll worker report it to the municipal clerk.
- Join with others to get encoding and hybrid BMDs out of Wisconsin entirely. Email info@wisconsinelectionintegrity.org, and I’ll contact you when we get enough people interested to start action through formal complaints or a lawsuit.
