A PC-Based Open-Source Voting Machine with an Accessible Voter-Verifiable Paper Ballot 1. Introduction

Transcription

1 A PC-Based Open-Surce Vting Machine with an Accessible Vter-Verifiable Paper Ballt Arthur M. Keller, UC Santa Cruz and Open Vting Cnsrtium Alan Dechert, Open Vting Cnsrtium Karl Auerbach, InterWrking Labs David Mertz, Gnsis Sftware, Inc. Amy Pearl, Sftware Innvatins Jseph Lrenz Hall, UC Berkeley SIMS 1. Intrductin Vting is the fundatin f a demcratic system f gvernment, whether the system uses direct r representative gvernance. The heart f vting is trust that each vte is recrded and tallied with accuracy and impartiality. There is n shrtage f histrical examples f attempts t undermine the integrity f electral systems. The paper and mechanical systems we use tday, althugh far frm perfect, are built upn literally hundreds f years f actual experience. There is immense pressure t replace ur "dated" paper and mechanical systems with cmputerized systems. There are many reasns why such systems are attractive. These reasns include, cst, speed f vting and tabulatin, eliminatin f ambiguity frm things like "hanging chads," and a belated recgnitin that many f ur traditinal systems are nt well suited fr use by citizens with physical impairments. Hwever, electrnic vting brings a new set f risks and drawbacks as well as advantages. In respnse t the prblems and pprtunities f electrnic vting, the Open Vting Cnsrtium was established. The Open Vting Cnsrtium (OVC) is creating an pen surce, trustwrthy, cst effective, vter verifiable vting system using pen surce sftware cmpnents n industry standard cmputers. A primary element f this Open Vting system is the use f sftware thrugh which the vter creates a printed paper ballt cntaining his r her chices. Befre casting his r her ballt the vter may use ther, independently prgrammed, cmputers t verify that the ballt prperly reflects the vter's chices. The vter may als visually inspect the text printed n the paper ballt. The paper ballt is cast by placing it int a ballt bx. Once cast, that paper ballt is the authritative recrd f the vter's chices fr the electin and fr any recunt f that electin. Open Vting ballts are machine-readable and may be tabulated (and re-tabulated in the case f a recunt) either by cmputer r by hand. Open Vting systems can be engineered t accmmdate the special needs f thse wh have physical impairments, r limited reading ability. Many f us tday have cme t trust many f ur financial transactins t ATMs (autmatic teller machines). The push fr electrnic vting machines has benefited frm that faith in ATMs. Hwever, we are starting t learn that that faith is unwarranted. First, ATM machines d fail and are ften attacked. Thse wh perate ATMs usually cnsider the lss rate t be a prprietary secret. Banks are well versed in the actuarial arts and they build int their financial plans varius means t cver the lsses that d ccur. In mre crude terms, it's nly mney. Secnd, vting machines carry a mre precius burden there is n way t buy insurance r t set aside a cntingency fund t replace a brken r tampered electin. There are several areas f cncern regarding the new generatin f cmputerized vting machines: N means fr the vter t verify that his r her vtes have been tallied prperly. N means utside f the memries f the vting machines themselves t audit r recunt the vtes. Lack f ability t audit the quality f the sftware. Frtunately the widespread belief that "cmputers are always right" is fading. Our individual experiences with errr-ridden sftware n persnal cmputers and cnsumer prducts (e.g., the BMW 745i 1 ), sftware errrs

2 by even the best-f-the-best (e.g., NASA and the lss f the Mars Climate Orbiter 2 ), and the pssibility that intentinal sftware bugs can be hidden s deeply as t be virtually invisible (Ken Thmpsn's famus 1984 paper Reflectins n Trusting Trust 3 ) have all cmbined t teach us that we shuld nt trust sftware until that trust has been well earned. And even then, we ught nt t be surprised if unsuspected flaws arise. Vulnerability f the machines r f their supprting infrastructures t intentinal attack r inadvertent errrs. The cmpanies that prduce vting machines have pured gasline nt the smldering embers f cncern. Sme f these prducts are built n Micrsft perating systems perating systems that have a well-earned reputatin fr being penetrable and unsecure. 4 And mst f these cmpanies claim that their systems are full f trade secrets and prprietary infrmatin and that, as a cnsequence, their internal wrkings may nt be inspected by the public. In additin, these cmpanies have frequently displayed a degree f hstility (in sme cases, the hstility tk the frm f lawsuits 5 ) against thse wh are cncerned abut the integrity f these prducts. And finally, their systems have vulnerabilities [that] d shw incmpetence and were built by prgrammers [wh] simply dn t knw hw t design a secure system. 6 There is a widespread perceptin that these cmpanies are mre cncerned abut prfits than abut fair and trustwrthy electins. The Help America Vte Act f was passed int law t mdernize vting equipment as a result f the 2000 US Presidential electin and the prblems bserved in Flrida. 8 The Federal Electin Cmmissin (FEC) has issued a set f Vting System Standards (VSS) 9 that serve as a mdel f functinal requirements that electins systems must meet befre they can be certified fr use in an electin. The next sectin discusses the existing vting machines that meet thse standards. Sectin 3 cnsiders the ratinale fr an accessible vter-verifiable paper ballt. Sectin 4 is a descriptin f the Open Vting Cnsrtium architecture fr the plling place. Sectin 5 mentins the current state f the system and next steps fr its develpment. Cnclusin, acknwledgements, and references fllw. 2. OVC System Descriptin The OVC system will be very much like a traditinal system in which the vter enters the plling place, marks his r her chices nt a paper ballt, and inserts the ballt int a ballt bx. Our design applies cmputer technlgy t that traditinal system. Hwever, unlike sme f the ther cmputerized vting systems that change the basic nature f the traditinal system, ur design applies cmputer technlgy nly in a limited and cnservative way. The OVC design preserves the paper ballt. Hwever, under the OVC design the vter marks the ballt using a cmputerized vting statin rather than a pencil r clred marker. The ballt is printed in plain text that the vter can read. Vters have the pprtunity t inspect the ballt t ensure that it prperly reflects their chices. The OVC design will preserve the ballt bx. Vters must insert their paper ballts int the ballt bx. The OVC ballts will cntain a barcde in additin t the plain text. This barcde makes it easy fr the pll wrkers t cunt the ballts 10 when the ballt bx is pened. The OVC design will be a vter-verified vting system. The cre difference between this and ther systems, such as DRE equipped with printers, is that in the OVC design the paper ballt is the actual ballt; infrmatin that might be recrded in cmputer memries r n cmputer media is used nly fr security, errrdetectin, fraud detectin/preventin, and auditing. 3. Existing Electrnic Vting Machines Existing DRE (Direct Recrding Electrnic) vting machines have cme under increasing scrutiny with widespread reprts f malfunctins, missins and user interface prblems during electins. 3.1 Diebld AccuVte TS and TS-X A grup led by Avi Rubin and Dan Wallach analyzed the Diebld AccuVte TS DRE vting machine and fund numerus flaws. 11 SAIC was cmmissined by the state f Maryland t analyze the Diebld vting system and fund [t]he system, as implemented in plicy, prcedure, and technlgy, is at high risk f cmprmise. 12 Based n these reprts, the Califrnia Secretary f State s ffice established security prcedures fr DRE vting machines. 13 Diebld was then fund t have used uncertified sftware in 17 cunties in Califrnia. 14 The Califrnia Secretary f State then decertified the Diebld and all ther DREs n April 30, Electrnic Systems and Sftware ivtrnic ES&S ivtrnic is a pll-wrker-activated, multilingual tuch screen system that recrds vtes n internal flash memry. A pll wrker uses a cartridge-

3 like device called a Persnal Electrnic Ballt (PEB) t turn the machine n and enable vting. Vters first chse their ballt language and then make their selectins via a tuch screen. When the plls clse, pll wrkers read summary data frm each machine nt the PEB via infrared. The PEBs are then transprted t electin headquarters r their cntents transmitted via a cmputer netwrk. In September 2002 in Flrida, a spt check f ivtrnic machines revealed several precincts where hundreds f vters had nly ne r even n selectins chsen the their ballts cast n Electin Day and vte ttals prduced by the main and backup system did nt agree. 16 In Octber 2002 in Texas, several peple reprted that their vtes registered fr a different candidate n screen and, in fact, sme vtes cast fr Republicans were cunted fr Demcrats. 17 In Nvember 2002, tw early-vting lcatins in Wake Cunty, Nrth Carlina (Raleigh) failed t recrd 436 ballts due t a prblem in the ivtrnics firmware Hart InterCivic eslate Hart s eslate is a vter-activated multilingual vting system where the vter turns a selectr wheel and set f buttns t indicate their vtes. The eslate terminals are cnnected via daisy-chained serial cable t a central cntrller, the Judges Bth Cntrller (JBC), which prvides pwer, vte activatin, and vte strage fr up t twelve eslate terminals. A pll wrker issues a 4- digit PIN t the vter using the JBC. The vter enters this PIN n an eslate and vtes using its selectr wheel and buttns. Once the vte is cast, the vte is transmitted via a cable t the JBC and stred in flash memry n the JBC s Mbile Ballt Bx (MBB). The MBB is then either physically transprted t electin headquarters r its cntents transmitted via cmputer netwrk. In Nvember 2003, pll wrkers in Harris Cunty, Texas, cnfused by the system s cmplexity, culd nt get the machines t wrk prperly and had been assigning the wrng ballts t vters using the JBC. 19 In February 2004 in Virginia, vters had t cast paper ballts when the JBC used at ne precinct fried, rendering all the eslate machines unusable. 20 In March 2004 in Orange Cunty, Califrnia, hundreds f vters were turned away when ne eslate machine brke dwn. 21 At the same time in Califrnia, pll wrkers incrrectly assigned ballts frm different precincts t their vters and apprximately 7000 vters cast ballts fr the incrrect precinct Sequia Vting Systems AVC Edge The Sequia AVC Edge is a vter-activated multilingual tuch screen system that recrds vtes n flash memry. Its peratin is very similar t the Diebld AccuVte-TS described abve. In March 2002 in Palm Beach Cunty, Flrida, the Edge machines frze up when vters selected their ballt language and ther reprts indicate vtes cunted fr the wrng candidate. 23 As well, 15 PCMCIA cards were temprarily lst and the central system wuld nt reprt the results and in a very clse race many ballts were blank. 24 In April 2002, in Hillsbrugh Cunty, Flrida, ne precinct culd nt transfer data n 24 ut f 26 PCMCIA cards; results were faxed and entered in by hand. 25 In March 2003, a similar prblem plagued PCMCIA cards. 26 In Nvember 2002, in Bernalill Cunty, New Mexic, 48,000 peple vted early, but n race shwed mre than 36,000 vtes due t a sftware bug. 27 In June 2004, in Mrris Cunty New Jersey, the central tabulatin system read nly zers frm the PCMCIA cards Other DRE Vting Machines Other DRE vendrs are prpsing t add printers t their DREs. 29 AccuPll has an Electrnic Vting System with a vter-verified paper audit trail 30 and Sequia Vting Systems is marketing ptinal vterverified paper recrd printers fr their DREs. 31 The state f Nevada used these VeriVte printers in the 2004 primary and presidential electins. 32 Althugh sme predicted that the printers wuld fail r cause lng lines, [t]he primary electin was free f serius prblems that have embarrassed registrars in Flrida, Califrnia, Maryland and ther states with tuchscreen machines. 33 The Avante Vte-Trakker is a DRE with a vter-verified paper audit trail. 34 Hwever, nne f these systems are in wide use, and sme have nt even been certified. Nne f them meet the current Califrnia AVVPAT standards. 3.6 Paper Ballts with Optical Scan Machines There are several prblems with the use f paper ballts that are ptically scanned with mark/sense-type tabulatin systems. The paper ballt is nt accessible t the visually impaired r reading impaired. And the paper ballt must be available in multiple languages as required by the jurisdictin. The use f paper des enable recunts, but ptentially suffers frm the prblems f vervtes, undervtes, and imprper changes t ballts (including extraneus marks, which wuld vid the ballt).

4 3.6.1 AutMark The AutMark 35 system is an Electrnic Ballt Marker (EBM) that addresses accessibility prblems by using an interface cmparable t a Direct Recrding Electrnic vting machine. Similarly, it can prvide supprt fr multiple languages and limit vervtes and undervtes thrugh its user interface. AutMark uses ballts identical t thse als used fr manually-marked ptical-scan systems. AutMark effectively replaces the pen in such systems with a marking device that supprts multiple languages and detects vervtes and undervtes. S there is the questin f whether the printed ballts are in each required language, s that a nn-english-speaking vter can still verify his r her ballt. It is pssible t have a device with accessible utput mdes that reads the vter s marked chices (like that f OVC system described in Sectin 5.1.7), s that the vter may verify that the ballt is marked crrectly, but that is nt currently part f the AutMark system. A key benefit f the AutMark system is that the same ptical scan tabulatin system can be used fr ballts cast in plling places, absentee ballts, and prvisinal ballts. But they neither maintain an electrnic audit trail nr use digital signatures t detect ballt stuffing. Hwever, the ptical scan tabulating systems are als ptential surces f errr. They must be calibrated t prperly distinguish the ballt markings. Fr example, during the March 2004 primary electin in Napa Cunty, Califrnia, ptical scan machines frm Sequia Vting Systems failed t recrd vters ballt marks n the paper cpy. Apparently, the ptical scan machines can read carbn-based ink but nt gel pens. 36 There is als the ptential that the vte tabulatin sftware culd have errrs r have been fraudulently mdified Ppulex The Ppulex 37 system is an Electrnic Ballt Printer (EBP) that als addresses accessibility by using an interface cmparable t a Direct Recrding Electrnic Vting Machine. The utput is a small printed ballt with a barcde that cntains the vter s ballt selectins. Numbers are printed n the bttm f the ballt s that the vter can read the chices, but these numbers must be matched t a chart (e.g., n the wall) in the precinct. Because the ballts are paper, a prvisinal ballt culd be placed in an envelpe fr subsequently determining whether the ballt shuld be cunted. Hwever, absentee ballts must be cunted using a different technlgy, unless the absentee vter uses a Ppulex system. 3.7 DREs used internatinally Varius cuntries arund the wrld have chsen t use DRE systems. The Dutch-based NEDAP 38 system is used in the Netherlands, France, Germany, the United Kingdm and Ireland but has been criticized fr its flaws. 39 The vting machine develped and used recently in India 40 is very simple and lacks features like disabled and multilingual access. Venezuela chse VVPAT-enabled Smartmatic 41 DREs n which t cnduct its recent referendum n the President; there were allegatins f fraud, but the audit cncluded the vting machines did accurately reflect the intent f the vters, as evidenced by a recunt f the paper ballts in a sample f the machines Why an Accessible Vter-Verifiable Paper Ballt Many cmputer and ther experts have jined VerifiedVting.rg s call fr the use f vter-verified paper ballts (VVPBs) fr all electins in the United States, s vters can inspect individual permanent recrds f their ballts befre they are cast and s meaningful recunts may be cnducted. We als insist that electrnic vting equipment and sftware be pen t public scrutiny and that randm, surprise recunts be cnducted n a regular basis t audit electin equipment Paper Receipts vs. Paper Ballts We speak f OVC creating a paper ballt, nt a receipt, nr simply a "paper trail." That is, fr OVC machines, the printut frm a vting statin is the primary and fficial recrd f vtes cast by a vter. Electrnic recrds may be used fr generating preliminary results mre rapidly r fr auditing purpses, but the paper ballt is the actual fficial vte dcument cunted. 44 Sme writers discuss prducing a paper receipt, which a vter might carry hme with them, as they d an ATM receipt. There are tw significant prblems with this apprach. In the first place, if we suppse that a vting statin might have been tampered with and/r simply cntain a prgramming errr, it is nt a great jump t imagine that it may print ut a recrd that differs frm what it recrds electrnically. A receipt is a "feel gd" apprach that fails t crrect the underlying flaws f DREs. But the secnd prblem with receipts is even mre fundamental. A vting receipt that can be carried away by a vter enables vte buying and vte cercin. An interested third party even smene as seemingly inncuus as an verbearing family member culd

5 demand t see a receipt fr vting in a manner desired. With OVC systems, ballts must be placed int a sealed ballt bx t cunt as vtes. If a vter leaves with an uncast ballt, even if she went thrugh the mtins f printing it at a vte statin, that simply des nt represent a vte that may be "prven" t a third party. What sme vendrs refer t as a paper trail suffers frm a weakness similar t the first prblem paper receipts suffer. Under sme such mdels, a DRE vting statin might print ut a summary f vtes cast at the end f the day (r at sme ther interval). But such a printut is als just a "feel gd" measure. If a machine sftware r hardware can be flawed ut f malice r errr, it can very well print a tally that fails t accurately reflect the vtes cast n it. It is nt paper that is crucial, but vter-verifiability. 4.2 Paper Audit Trail Under Glass vs. Paper Ballt While "paper audit trail under glass" des indeed d a pretty gd jb f preventing ballt bx stuffing with frged physical ballts, this apprach is nt the nly nr even the best technique t accmplish this gal. We plan fr OVC systems t incrprate cryptgraphic signatures and precinct-level custmizatin f ballts that can cnvincingly prve a ballt is prduced n authrized machines, at the plling place, rather than frged elsewhere. Fr example, a simple custmizatin f ballts is a variatin f the page psitin f ur ballt watermarks in a manner that a tamperer cannt prduce in advance. Surprisingly much infrmatin can be subtly cded by mving tw backgrund images a few millimeters in varius directins. Anther ptin is t encde a cryptgraphic signature within the barcde n a ballt in a manner that can be mathematically prven nt t disclse anything abut the individual vter wh cast that vte, but simultaneusly that cannt be frged withut knwledge f a secret key, which is knwn nly t that electrnic vting machine. There are several narrwly technical prblems with paper audit trail under glass systems. A paper audit trail under glass system has sme extra mechanical prblems with allwing rejectin f incrrect paper recrd; sme srt f mechanism fr identifying the paper recrd as spiled, perhaps thrugh an ink mark. This apprach increases the ptential f physical failure, such as paper jams. A mre significant issue fr "paper audit trail under glass" systems is their failure t prvide the quality f accessibility t visin- r reading-impaired vters that OVC's design des. Sighted vters wh happen t need reading glasses, r wh can read nly large print r clsely held print, are likely t find paper audit trail under glass systems mre difficult t check than printed ballts they can physically hld. Even if these machines add prvisins fr audi feedback n final ballts, users are dependent n the very same machine t prvide such audi feedback. Ptentially, a tampered-with machine culd bias vtes, but nly fr blind vters (still perhaps enugh t change clse electins). In cntrast, OVC psitively encurages third parties t develp sftware t assure the barcde encding f vtes matches the visibly printed vtes every vter is treated equally, and all can verify ballts. Frm a mre sphisticated cryptlgy perspective, paper audit trail under glass systems are likely t cmprmise vter annymity in subtle ways. One f the issues the wrld-class security researchers assciated with ur design have cnsidered is the pssibility that sequential r time-stamp infrmatin n ballts culd be crrelated with the activity f individual vters. Even cvert videtaping f the rder in which vters enter a plling place might be used fr such a cmprmise. This prblem is mre serius in thse systems in which the vter-verified paper audit trail is maintained n a cntinuus paper tape fed nt a takeup spl. Hwever, n systems that cut the audit trail int pieces, ne fr each vter, that ballts that fell t the bttm f the glass bin may be visible t subsequent vters. Such ptential visibility als cmprmises annymity. This analysis is just part f the threat analysis study that we will perfrm in rder t create a reliable, secure, and trustwrthy electin system. A far mre serius prblem with a vter-verified paper audit trail is the difficulty f autmated tabulatin f the audit trail. This prblem is especially acute when the vter-verified paper audit trail is cut int pieces, ne fr each vter. The glass bin is likely t be a mass f ciled paper strips. While the cntinuus spl apprach t the paper audit trail is neater, it suffers frm an annymity prblem as identified abve. When the paper audit trail can nly be used in a manual tabulatin prcess, there will be enrmus pressure t minimize its use, thereby reducing its effectiveness. In cntrast, the OVC design facilitates autmated tabulatin f the paper ballts while enabling manual cunting and vter-verificatin als. Hwever, even when there is an autmated tabulatin prcess f the paper ballts, it is critical fr a randm sample f precincts t be manually tabulated, as a further check n the system.

6 4.3 Accessible Vting One f the key benefits f electrnic vting machines is t allw disabled vters t vte unassisted. 45 Hwever, as the mvement fr a vter-verifiable paper audit trail grws, 46 there is a need fr the paper audit trail t be accessible as well. 47 The Open Vting Cnsrtium s vting system is designed t be accessible fr bth entering the vtes and verifying the paper ballt prduced. 5. OVC System Overview The Open Vting Cnsrtium (OVC) is develping a PC-based pen surce vting machine with an accessible vter-verified paper ballt. We intend t use an pen surce perating system fr the PC, such as Knppix, a variant f Linux that bts ff f a CD. The plling place system cnsists f a Vter Sign-in Statin, an Electrnic Vting Statin, an Electrnic Vting Statin with a Reading-Impaired Interface, a Ballt Verificatin Statin, and a Ballt Recnciliatin Statin. See Figure 1 (at end f paper). In additin, there are cmpnents at the cunty canvassing site that are discussed nly briefly in this paper. 5.1 Precinct/Plling Place Element The OVC Precinct/Plling Place Element is intended t prvide all f the systems and prcedures required fr a plling place except fr vter rlls, sign-in bks and the like. The OVC system will be flexible s that it will be adaptable t applicable laws as well as lcal preferences. The OVC design will accmmdate plling places in which different classes f vters, fr example vters f different parties, may be accmmdated with ballts apprpriate fr that particular vter. Overall design and peratin f the OVC system is simplified because the paper ballt prduced by it will be the legal ballt. Fr example, in the OVC design equipment failures will nt be handled at the plling place except t the extent necessary t discnnect the failed unit, seal it, and deply a backup unit. The OVC design is very cncerned that vters with physical disabilities and limited reading ability are accmmdated. It is anticipated that the OVC design will cntain variatins f the Vting Statin and Ballt Verificatin Statin that will be designed with user interfaces tailred t the needs f vters with certain types f physical impairments. The OVC design will nt require substantial changes t the wrkflw f a typical plling place; vters and pll wrkers will find that prcedures are cmparable t thse used in existing American plling places Vter Sign-in Statin The Vter Sign-In Statin is used by the pll wrker when the vter signs in and invlves giving the vter a "tken." It is a requirement that each vter cast nly ne vte and that the vte cast be f the right precinct and party fr the vter. The "tken" authrizes the vter t cast a ballt using ne f these techniques. Pre-printed ballt stck Optin fr scanning ballt type by EVM Pll wrker activatin Per-vter PIN (including party/precinct identifier) Per-party/precinct tken Smart cards The tken is then used by the Electrnic Vting Statin and the Electrnic Vting Statin with the Reading Impaired Interface t ensure that each vter vtes nly nce and nly using the crrect ballt type. If the vter spils a ballt, the ballt is marked spiled and kept fr recnciliatin at the Ballt Recnciliatin Statin, and the vter is given a new tken fr vting. In the case f a per-vter PINs r smart cards, it is imperative that these d nt persnally identify the vter Electrnic Vting Statin The Vting Statin is the vter s primary pint f cntact with the OVC system. After the vter signs-in, a pll wrker will direct the vter t a Vting Statin. The physical appearance f the vting statin will be that f a lightweight bth with privacy curtains r walls. There will be an integrated device an Electrnic Vting Statin cntaining cmputer, printer, battery, and flat screen display. The display will allw tuch-screen use and will be munted s that it may be adapted fr use by vters wh stand and vters wh are in wheel chairs. The Vting Statin will be designed s that setup and teardwn are easy; it is anticipated that installatin will be largely an unfld-and-plug-in peratin. The Vting Statin will be tamperprf and be engineered t endure physical abuse during shipping, deplyment, and use. The Vting Statin will be designed s that it may be sealed against unauthrized access with lcks and lead/wire seals. We are develping prcedures that ensure that the crrect certified sftware is perating n the vting machines, frm bting frm a CD rather than the hard

7 drive, verifying checksums and hardware cnfiguratins, as well as ther means. The Electrnic Vting Statin cnsists f these cmpnents: A cmputer, preferably stck cmmdity hardware, with these features: A mnitr, preferably LCD, pssibly 15 r 17" tuch-screen measured diagnally. One r mre input devices, such as: Tuch-screen interface n LCD screen Muse Keybard Buttns surrunding the screen, like n an ATM Numeric keypad Symblic keypad Pssibly a smart card reader/writer A CD-R drive. The CD-R will cntain: The perating system, e.g., a Linux system withut unnecessary cmpnents The EVM sftware Ballt Definitin files and public keys f varius external cmpnents Optinally, sund files fr the ballt (included fr the Electrnic Vting Statin with the Reading Impaired Interface) Persnalizatin, ptentially including public/private key pairs 48 fr this vting statin Startup recrd, pssibly including generated public key f this vting statin Electrnic Ballt Images (EBIs), in XML frmat (and pssibly in Pstscript frmat), written at end f day in ascending rder by (randmly generated) ballt ID The CD-R is used subsequently by the Ballt Recnciliatin System and pssibly during cunty canvassing. A printer with these specificatins: Inkjet r laser Preferably utput page is bscured frm view (either by appearing face dwn, r by a cver) Feedback t the user (auditry r visual) that the ballt is printing and will cme ut sn Prints a test dcument at the start f a vting day that includes recrds f the public keys fr the EVM fr this day. Depending n vter tken, EVM takes blank ballt stck given t vter upn sign-in; alternatively, EVM includes strage fr blank ballt stck fr printing. Blank ballt stck may be specially printed paper, pssibly preprinted n reverse side (with please turn ver message). Prints ballt in printed ballt frmat ptentially using special printed ballt stck. The ballt can be read by the Ballt Verificatin Statin and includes text in OCR frmat, plus a barcde fr mre flprf reading. A persistent EBI strage device, such as a USB memry dngle (i.e., a USB flash memry device) fr persistently string the EBIs until the end f the day, when the EBIs are transferred nt the CD-R. The USB memry dngle is kept fr audit purpses. Device shuld be large enugh nt t be easily lst Device shuld be lckable and tamper prf when lcked Ptentially, device culd lck in the pen psitin nt cabinet and PC and lck in the clsed psitin sealed and ready fr remval. Device culd be set t be pen nly nce, and n subsequent penings the device wuld be read nly. May als have hardware private key fr digitally signing the ballt. Security enclsure that prevents tinkering with the device Electrnic Vting Statin with Reading Impaired Interface The Electrnic Vting Statin with Reading Impaired Interface is a cmputer similar t the Electrnic Vting Statin described abve that includes auditry utput f the ballt chices and selectins made and als includes additinal mdes f making selectins suitable fr the blind r reading impaired. Whether these features are integrated t a cmmn vting machine with all functinality, r whether there is a separate cnfiguratin fr the disabled, is an pen questin. Fr example, additinal mdes f input may be useful fr thse wh can read printed materials, but have physical limitatins. The ideal is a universal design that accmmdates all vters. The electrnic vting statin fr the reading impaired prduces a printed ballt that can be prcessed by the Ballt Verificatin Statin Paper Ballt The paper ballt is generated by the Electrnic Vting Statin r the Electrnic Vting Statin with Reading Impaired Interface. It is the paper n which the vter s chices are recrded. It must be cast in rder t be tallied during canvassing, testing, r a manual recunt. The paper ballt can easily be read by the vter s that the vter may verify that his r her chices have been prperly marked. It als cntains security markings and

8 a barcde. The barcde encdes the user s chices, as expressed in the human readable prtin f the ballt. The human readable text shuld be in an OCR-friendly fnt s it is cmputer-readable as well. The vter may use the Ballt Verificatin Statin t verify that the barcde accurately reflects their chices. The Ballt Verificatin Statin nt nly assists sight-impaired and reading-impaired vters in verifying their ballts, but als t give any vter the assurance that the barcde n the ballt prperly mirrrs their chices, as represented in the human-readable text n the ballt. Ideally, the Ballt Recnciliatin System reads the OCR text f the ballt was well, nt just the barcde. The barcde cnsists f several things: Identifiers, such as the date (but nt time), electin, precinct, type f ballt, plling machine, and randm ballt ID fr recnciliatin against the electrnic recrd made by the Electrnic Vting Statin r the Electrnic Vting Statin with Reading Impaired Interface. N infrmatin that can identify the vter is included n the ballt. The selectins made by the vter. Checksums t detect prcessing errrs. Additinal padding data t bscure the barcde s that pll wrkers, wh will be able t see the barcde (but nt the textual part f the ballt) will nt be readily able t ascertain by eye what selectins the vter made. The barcde is designed s that nne f the infrmatin in the barcde can be used t identify any vter persnally. Spiled paper ballts are kept by the Ballt Recnciliatin System t be recnciled against Electrnic Ballt Images (EBIs) prduced by the Electrnic Vting Statin r the Electrnic Vting Statin with Reading Impaired Interface Privacy Flder The paper ballt cntains the vter s chices in tw frms: a frm that can be read by peple and a barcde that expresses thse chices in a machine-readable frm. Pll wrkers may cme in cntact with the ballt shuld they be asked t assist a vter r t cast the ballt int the ballt bx. In rder t prtect vter privacy it is desirable t minimize the chance that a pll wrker might bserve the vter's ballt chices. A privacy flder is just a standard file flder with an edge trimmed back s that it reveals nly the barcde part f a ballt. The vter is expected t take his/her ballt frm the printer f the Electrnic Vting Statin r the Electrnic Vting Statin with Reading Impaired Interface and place it int a privacy flder befre leaving the vting bth. The privacy flder is designed s that the vter may place the ballt still in its flder against the scanning statin f Ballt Verificatin Statin t hear the vter's ballt's chices spken. When handed the ballt by the vter, the pll wrker casts the ballt by turning the privacy flder s the ballt is face dwn, and then sliding the paper ballt int the ballt bx Ballt Bx This is a physically secure cntainer, int which vters have their paper ballts placed, in rder t "cast" their vtes. The mechanical aspects f the vting bx will vary frm jurisdictin t jurisdictin, depending n lcal laws and custms Ballt Verificatin Statin The Ballt Verificatin Statin reads the ballt prduced by the Electrnic Vting Statin r the Electrnic Vting Statin with Reading Impaired Interface and speaks (auditrily) the selectins n the vter's ballt. A cunt is kept f usage, including cunts f cnsecutive usage fr the same ballt, but n permanent recrd is kept f which ballts are verified. The cmputer bts ff the CD-R, which includes the fllwing: The perating system The BVS sftware Ballt Definitin files and public keys f varius Electrnic Vting Statins Sund files fr the ballt Persnalizatin Startup recrd Nn-ballt identifying statistics n usage It is pssible fr the Ballt Verificatin Statin t have a screen and t display the selectins n the screen at the vter's ptin. Such an ptin (enabled by the vter upn her request) wuld enable a vter wh can read t verify that her ballt will be read crrectly fr autmated tallying. The Ballt Verificatin Statin reads the same prtin f the paper ballt read by the Ballt Recnciliatin Statin, including the barcde and, ideally, the text via OCR Ballt Recnciliatin Statin The Ballt Recnciliatin Statin reads the paper ballts and recnciles them against the Electrnic Ballt Images (EBIs) n the CD-Rs frm the Electrnic

9 Vting Statin r the Electrnic Vting Statin with Reading Impaired Interface. The purpse f recnciling the paper ballts with the electrnic ballt images is t prevent ballt stuffing as well as an audit check n the canvassing prcess. The prcess als prduces the vte ttals fr that precinct. The Ballt Recnciliatin Statin includes the fllwing cmpnents: Scanner, preferably page fed PC Mnitr Input devices: keybard, muse Printer Prints vte ttals fr psting CD-R Like the ther CD-R; includes cumulative cpy f EBIs as well as vte ttals by precinct. CD drive (nt writeable) Fr lading the CD-R s frm the Vting Statins. The Ballt Recnciliatin System runs the Ballt Recnciliatin Prcedure, which is beynd the scpe f this paper Bx fr Spiled Ballts When a vter spils a ballt, perhaps because the ballt des nt accurately reflect her preferences, the ballt is marked spiled and placed in a bx fr spiled ballts fr later recnciliatin Bx fr Prvisinal Ballts When a vter shws up at a plling place and des nt appear n the vting rll r the vting rll shws that the vter was sent an absentee ballt, then the vter is allwed t vte by being given a tken fr a prvisinal ballt. A distinctive smart card r a prvisinal blank ballt r even a distinctive privacy flder is given t the vter. When the vter has printed the prvisinal ballt and hands it t the pll wrker, the pll wrker seals the prvisinal ballt in an envelpe alng with the details necessary t determine whether the ballt shuld be cunted and places the prvisinal ballt in a bx fr prvisinal ballts fr later recnciliatin. 5.2 Absentee Ballts and Manual Plling-Place Ballts Paper ptical-scan ballts will be used fr absentee ballts and als fr the manually cast plling-place ballts Frmat and Marking The frmat and marking f the absentee ballts will be similar t thse f existing ptical scan ballt systems Acceptance at Plling Place When an absentee ballt is received at a plling place, a pll wrker checks the identificatin f the persn delivering it, places n the envelpe a sticker frm the absentee ballt audit sheet, and places it in the absentee ballt bx. Manual plling-place ballts are placed in the manual ballt bx Acceptance by Mail r In-Persn at Cunty When an absentee ballt is received by mail, a cunty pll wrker places n the envelpe a sticker frm the absentee ballt audit sheet, and places it in the absentee ballt bx. When an absentee ballt is hand delivered at the cunty canvassing site, a cunty pll wrker checks the identificatin f the persn delivering it, places n the envelpe a sticker frm the absentee ballt audit sheet, and places it in the absentee ballt bx Validatin The prcess fr validating absentee ballts is cmparable t the current prcess, with the ntable exceptin that the sticker must be present n the envelpe. The database recrd fr the vter needs t be marked t indicate an absentee ballt was cast. When a vter casts an absentee ballt als casts a prvisinal ballt, the prvisinal ballt will nt be cunted. The ballt is separated frm the envelpe fr canvassing Canvassing A canvassing system fr absentee and prvisinal ballts will be develped that reads in each ptically scanned ballt t create an electrnic ballt image. These electrnic ballt images are aggregated with the scanned r recnciled versins f the electrnic vting machine-printed paper ballts Reprting Reprts are made available by precinct fr the vte ttals fr the cmbinatin f absentee and prvisinal ballts. The number f absentee and f prvisinal ballts is als made available by precinct. 6. Current Status and Next Steps A demnstratin system was shwn at the Santa Clara Cunty Gvernment Building in San Jse, Califrnia n April 1, This demnstratin was featured n

10 KGO-TV and KCBS and KGO radi later that day and described in the San Jse Mercury News that mrning. 49 On April 8, 2004, the San Jse Mercury News referred t ur system in an editrial as a Tuch Screen Hly Grail. 50 Further demnstratins were given at the Cmputers, Freedm, and Privacy cnference in Berkeley, Califrnia n April 23, Anther demnstratin was given at the PlaNetwrk cnference in San Francisc, Califrnia n June 6, The privacy aspects f ur system were presented at the Wrkshp n Privacy in the Electrnic Sciety 53 and will appear in a bk. 54 The pen surce f the demnstratin system can be fund n Surce Frge prject EVM Several state clleges and the Open Vting Cnsrtium are currently in discussins with their respective Secretaries f States t btain HAVA funding t build prductin-quality reference versins f this system. 7. Cnclusins The Open Vting Cnsrtium has demnstrated a vting system based n a PC-based electrnic vting machine with vter-verifiable accessible paper ballt. We have described the design fr the prductin system we prpse t build, based n the prttype we have built and the lessns learned in the prcess. In the develpment f this system, we expect t enhance the state f the art in building reliable and trustwrthy cmputerized systems. Hwever, it is nt merely the sftware and hardware cmpnents that are f cncern; the vting prcesses and prcedures are als key t the develpment f a reliable, secure, trustwrthy and accessible system. 8. Acknwledgements We acknwledge the effrts f the vlunteers f the Open Vting Cnsrtium wh cntributed t the design we describe. In particular, Alan Dechert develped much f the design and Dug Jnes prvided significant insights int vting issues. Arthur Keller rganized the develpment f the sftware and arranged fr the demnstratins. The demnstratin sftware was largely develped by Jan Kärrman, Jhn- Paul Gignac, Anand Pillai, Ern Llyd, David Mertz, Laird Ppkin, and Fred McLain. Karl Auerbach wrte an FAQ n which parts f this paper is based. Amy Pearl als cntributed t the system descriptin. Jseph Lrenz Hall cntributed useful backgrund. Rn Crane gave useful feedback. Our wrk was inspired by Curtis Gans, Ry Saltman, Henry Brady, Rnnie Dugger, Irwin Mann, and thers wh have spken ut n the need fr auditable, cnsistent, secure and pen electin administratin. In the last tw years, David Dill and Bev Harris have been especially helpful. David Dill referred several peple t the OVC, and he and Bev Harris have helped the public recgnize the need fr a vter-verified paper audit trail. 9. References 1 Drian Miller, BMW 745 Bug, September 22, 2002, fund at academics/cmp290test/bmw745bug.html 2 Greg Clark, Staff Writer and Alex Canizares, Navigatin Team Was Unfamiliar with Mars Climate Orbiter, psted Nvember 10, 1999, fund at 3 Ken Thmpsn, Reflectins n Trusting Trust, Cmmunicatin f the ACM, Vl. 27, N. 8, August 1984, pp , fund nline at 4 In cntrast, we prpse t use a variant f Linux called Knppix that can bt directly ff a CD. 5 See 0,2645,65173,00.html 6 See 0,2645,65031,00.html 7 The Help America Vte Act f 2002 (HAVA), 42 U.S.C.A (West 2004). See 8 Lrrie Faith Cranr, Vting After Flrida: N Easy Answers, March 19, 2001, available frm 9 Federal Electin Cmmissin, Vting System Standards, Vls. 1 & 2 (2002), available at (Micrsft Wrd DOC frmat) r fec_vss_2002_pdf/ (Adbe PDF frmat). 10 We prpse that each plling place include a Ballt Recnciliatin System (BRS) (described belw) that has a sheet fed scanner fr reading the barcde. The BRS has ther benefits in supprt f auditing the system, als described belw. 11 Tadayshi Khn, Adam Stubblefield, Aviel D. Rubin, and Dan S. Wallach, Analysis f an Electrnic Vting System, Prc. IEEE Sympsium n Security and Privacy (May, 2004), fund at 12 Risk Assessment Reprt: Diebld Accuvte-TS Vting System and Prcesses (redacted), Science Applicatins Internatinal Crpratin SAIC , Sept. 2, See: 13 Secretary f State Kevin Shelley Annunces Directives T Ensure Vter Cnfidence in Electrnic Systems, Nv. 21, See electins/ks_dre_papers/ks_ts_press_release.pdf

11 14 E-Vting Undermined by Slppiness, Wired News, December 17, See evte/0,2645,61637,00.html?tw=wn_tphead_2 15 Secretary f State Kevin Shelley Bans Diebld TSx fr Use in Nvember 2004 General Electin, April 30, See press_releases/2004/04_030.pdf 16 Leahy: Unskilled wrkers t blame, Miami Herald, September 12, Area Demcrats say early vtes miscunted, The Dallas Mrning News, Octber 22, Electrnic Ballts Fail t Win Over Wake Vters, Electin Officials, Machines Prvide Imprper Vte Cunt at Tw Lcatins, WRAL-TV Raleigh-Durham, Nvember 2, ESlate vting prves smth, nt flawless, Hustn Chrnicle, Nvember 5, Plling places reprt light turnut here, Richmnd Times-Dispatch, February 11, Vters Decide Recrd Bnd Issue; Edwards Quits, NBC4TV, March 2, ,000 Orange Cunty Vters Were Given Bad Ballts. Ls Angeles Times, March 8, Human gfs, nt machines, drag vte tally int next day. Palm Beach Pst, March 14, Out f Tuch: Yu press the screen. The machine tells yu that yur vte has been cunted. But hw can yu be sure? New Times, April 24, Officials still searching fr electin glitch: The new system culd nt send the tabulatins t the electins ffice. St. Petersburg Times, April 6, Electins Chief Sees Nearly Flawless Vte. St. Petersburg Times, March 5, Electin results certified after sftware blamed. Albuquerque Tribune, Nvember 19, Mntville and Chatham mayrs usted. New Jersey Star-Ledger, June 9, See 0,1367,58738,00.html 30 See html 31 See 32 See 33 See htm 34 See evc308.html 35 These systems are prvided by ES&S ( autmark.html ) and Vgue Electin Prducts and Services ( prducts_autmark.html ). 36 See articleid= See 38 See 39 Margaret Anne McGaley. Electrnic Vting: A Safety Critical System. See ~afrdite/e-vting/reprt/nde18.html 40 Electin Cmmissin f India, Electrnic Vting Machine (EVM) descriptin. See 41 See electinsvenezuela2004.htm 42 See &submenu=news and dcuments/2020.pdf (page 22). 43 See 44 The OVC prpses t audit every vte by cmparing each paper ballt with its electrnic cpy. 45 See electinrefrmlegis.html 46 See 47 See avvpat_standards_6_15_04.pdf and press_release_avvpat_06_15_04.pdf 48 Each ballt s barcde will be digitally signed. We use the private key fr signing each ballt and the public key verifying the signature. The key pair culd be generated by the vting machine, with the public key recrded n the CD-R and n the test sheet printed at the start f a vting day and the private key never released utside the vting machine itself. 49 See htm 50 See news/pinin/ htm 51 See 52 See 53 Arthur M. Keller, David Mertz, Jseph Lrenz Hall, and Arnld Urken, "Privacy Issues in an Electrnic Vting Machine," (Extended Abstract) in Wrkshp n Privacy in the Electrnic Sciety WPES 2004, Octber 28, 2004, Washingtn DC. 54 Arthur M. Keller, David Mertz, Jseph Lrenz Hall, and Arnld Urken, "Privacy Issues in an Electrnic Vting Machine," in Privacy and Identity: The Prmise and Perils f a Technlgical Age. Katherine J. Strandburg and Daniela Raicu, eds., Kluwer Academic Publishing, t appear. 55 See

12