Ensuring validity is a big concern in electronic voting
 Monday, August 19, 2002
 By A.J. RENNER Repository staff writer

 Palm Beach County was the epicenter of the presidential recount
 battle two years ago. Supervisor of Elections Theresa LePore came
 under fire for a "butterfly ballot" that voters said was confusing
 and led to miscast votes.

 Dimpled, pregnant, hanging and swinging chads shook the nation's
 trust in the punch-card system.

 Recently, the county spent $14 million on electronic machines to
 replace its punch cards, part of a statewide update of the system.

 But a lawsuit against the county says the machines malfunctioned in a
 recent primary, and changed the results of a city council election.

 The plaintiff asked to examine the computer chips inside the
 machines. LePore argued that that would void the warranty and reveal
 information proprietary to their manufacturer, Sequoia Voting
 Systems.

 As Congress considers a massive federal grant for states to update
 their voting equipment, it's worthwhile to keep an eye on the issues
 raised by this case.

 __No perfect system__

 No voting system is perfect.

 Take the optical scan system, where voters are supposed to fill in
 bubbles. "People circled the oval, or circled the name, or checked
 it," said Tom McCabe, the deputy director of the Mahoning County
 Board of Elections.

 Mahoning will move to a countywide electronic system this November.

 In 1996, a close county commissioner race in Lake County was
 overturned because employees had tallied the votes - from the old
 lever voting system - incorrectly.

 "We had four different sets of two people - one of each party - that
 added a precinct, and every one of them added them incorrectly - the
 same way incorrectly," said Jan Clair, director of the Lake County
 Board of Elections. Lake now uses an electronic system.

 But skeptics believe that problems with electronic machines run
 deeper than those with paper ballots.

 There are several requirements for voting machines. They must:

 * Count the votes cast accurately.

 * Protect the privacy of the voter.

 * Be easily used by a broad spectrum of the population, including the
   uneducated and handicapped.

 * Leave an audit trail.

 With paper ballots, the trail is a recount of the ballots. With
 electronic machines, it's a printout of the results.

 For skeptics, that's the electronic system's biggest weakness.

 "Any programmer can write code that displays one thing on a screen,
 records something else, and prints yet another result. There is no
 known way to ensure that this is not happening inside of a voting
 system," argues Rebecca Mercuri on her Web site:

 http://mainline.brynmawr.edu/~rmercuri/html/

 Mercuri is no Luddite. She's an assistant professor of computer
 science at Pennsylvania's Bryn Mawr College.

 But she has been a vocal critic of electronic voting for about 10
 years - in fact, her doctoral dissertation was titled "Electronic
 Vote Tabulation Checks & Balances."

 One of her first assignments for incoming Bryn Mawr freshmen is to
 design a computerized voting system that displays one vote count and
 records another.

 It is disturbingly easy, she said.

 The audit trail is not the only problem Mercuri has with electronic
 voting. But having such a trail would address many of the
 technological and cryptographic problems that concern her and others.

 "The voter has to get some sort of paper that comes out at the time
 that they vote, and they look at it and say, 'Yup, that's the way
 that I voted,' '' said Mercuri.

 The paper would go in the ballot box, not the voter's pocket. That
 way, a board of elections - or any other interested observer - could
 do a recount to verify the computerized count.

 Benjamin B. Bederson, a professor of computer science at the
 University of Maryland, and director of that university's
 Human-Computer Interaction Lab, shares some of Mercuri's
 concerns. Lack of audit isn't just a concern because of the potential
 of fraud, he said. Human error or a simple bug could derail an
 election, damaging public trust in the process

 "Rockets crash, airplanes crash, missiles are fired incorrectly"
 because of bugs, he said. "Who's to say there won't be some bizarre
 bug that throws off an election?"

 ___Trust, but verify___

 Not everybody shares Mercuri's skepticism.

 "She's wrong," said Ohio Secretary of State Kenneth Blackwell
 bluntly. Blackwell says that in four or five years, his office will
 decertify machines that don't protect against an overvote, count at a
 precinct level, and provide a paper trail.

 A printout of results, he maintains, would meet the last criterion.

 Mercuri says electronic machines don't provide a true paper trail -
 just a printout of whatever the machine says the votes were. (Many
 machines scramble the order of the votes to protect voter privacy.)

 But manufacturers say that the machines are tested by Federal
 Election Commission-certified independent testing authorities, by
 state testing boards, and sometimes, by county elections boards.  The
 FEC-certified testers check software and hardware, making sure the
 machines can stand up to physical abuse and internal probing.

 Mercuri counters that the independent testing authorities, on which
 the National Association of State Election Directors and states base
 their certification, are paid by the manufacturer.

 "From what we've seen, Wiley Labs (a testing laboratory) and all the
FEC independent laboratories test their material very thoroughly,"
Mark Radke, director of voting industry for Diebold Election
Systems. "We're very confident of the storage of data and also the
transmission of data."

 But without a paper trail, something could happen to the machine
 between testing and an election, and even beyond, Bederson said. An
 employee of the manufacturer, or an election worker could reprogram
 the machines to switch just 3 percent of the vote, for
 example. Someone could swap the memory cards, or steal them after the
 election, preventing a recount.

 "There's a lot of money to be made throwing elections," Bederson
 said. "Just imagine if you were a company that had a billion-dollar
 law at stake that was going to affect your income."

 A voter-verified paper trail would go a long way toward addressing
 fraud, error, and confidence issues, Bederson said.

 A "digital fingerprint" - a string of code voters could enter into
 the voting device before voting to verify that the program had not
 been tampered with, also could be effective, he suggested.

 Radke says that Diebold, an ATM manufacturer, could add a paper
 ballot to its system. He doesn't know what it would cost but
 speculated that it would not be cost-prohibitive. "We've been working
 with receipt printing for 30, 35 years."

 But Diebold caters to the marketplace, and so far, he said, "the
 demand has not been there."

 ___Hold back?___

 Mercuri advises counties not to buy voting devices immediately. She
 expects Congress to establish federal standards for voting machines
 as part of the election reform they are considering. The National
 Institute of Standards and Technology might be enlisted to certify
 the machines, she said.

 Bederson believes electronic voting machine manufacturers should
 improve usability of their products first and foremost.

 A properly audited electronic system could offer benefits mechanical
 systems don't have, Mercuri acknowledged. A paper ballot could be
 optically scanned, saving election workers the time it takes to
 recount every one. Voters could even get a cryptographic card to
 verify that their vote was entered into the system, although it would
 not tell them how they voted.

 Envisioning an electronic system with a voter-verified paper audit
 trail, Mercuri allows herself a moment of enthusiasm.

 "It's no worse (than the punch-card system), but it can be made to be
 extraordinarily better."

 The Associated Press contributed to this report.

 You can reach Repository writer A.J. Renner at (330) 580-8312 or e-mail:

 aj.renner@cantonrep.com