Professor of Computer Science, Stanford University and Founder of the Verified Voting Foundation and VerifiedVoting.org

Before the Commission on Federal Election Reform (Carter-Baker Commission), April 18, 2005 Hearing, American University, Washington D.C.

President Carter, Secretary Baker, members of the commission, and guests: I am grateful for this opportunity to address the crucial issue of electronic voting in American elections. The debate about electronic voting should not be about whether election fraud has occurred, is occurring, or even will occur; it should be about the transparency of our elections. By ``transparency,'' I mean the ability to do independent checks on the conduct and results of the election. Ultimately, this debate is about public confidence in our democratic system.

The real job of an election is not to convince the winners that they won, but to convince the losers that they lost. So, it is not sufficient that election results be accurate; the public must know that the results are accurate. That can only be achieved by making election processes as transparent as possible.

Unfortunately, paperless e-voting technology is almost totally opaque. No one can scrutinize critical processes of the election, such as the collection of ballots and counting of votes, because those processes occur invisibly in electronic circuits. Voters have no means to confirm that the machines have recorded their votes correctly, nor will they have any assurance that their votes won't be changed later.

The basic problem of e-voting can be understood without an in-depth knowledge of computer technology. Here is a helpful analogy: Suppose voters dictated their votes, privately and anonymously, to human scribes, and that the voters were prevented from inspecting the work of the scribes. Few would accept such a system, on simple common-sense grounds. Obviously, the scribes could accidentally or intentionally mis-record the votes with no consequences. Without accountability, a system is simply not trustworthy, whether or not computers are involved.

The technological problem with computerized voting is simple. You don't need a Ph.D. in computer science to understand it. Computer systems are so complex that no one really knows what goes on inside them. We don't know how to find all the errors in a computer system; we don't know how to make sure that a system is secure or that it hasn't been corrupted (possibly even by its designers); and we don't know how to ensure that the systems in use are running the software they are supposed to be running. Technologists have not been able to solve these problems even with measures that are far more sophisticated (and costly) than those in the design and certification of voting equipment.

There is strong agreement among computer technologists that what I just said is true. For example, the Association for Computing Machinery, the largest professional organization of computer technologists, adopted a position against paperless electronic voting after an internal poll showed that 95 percent of their membership agreed with the position.

What can we do about this problem? Returning to the analogy with the scribe, that system can be made trustworthy by having the voter fill out his own ballot, or by allowing each voter to check the ballot filled out by the scribe. We can have a trustworthy voting system if, instead of a futile effort to ensure that the voting equipment is error-free by design, we empower each voter to verify that his vote has been accurately recorded. In other words, we need voter-verified paper ballots.

The call for paper ballots is not based on nostalgia. Paper has specific properties as a technology that are difficult to replicate in electronic media. For example, most voters can verify the contents of a paper ballot without computer mediation; paper can be written indelibly; and the procedures for handling critical paper documents are easily understood by ordinary poll workers and voters.

Paper is not a magical solution to our election problems, but, at least, understandable procedures exist for ensuring the accuracy of an election conducted with paper ballots. In particular, the ballots must be protected, and the processes for storing, transporting, handling, and counting them must transparent. Ideally, members of the public and non-governmental organizations as well as political party representatives should be able to observe all of the steps of an election, including machine testing, polling place operations, counting of votes, auditing and recounting.

One of the most important practices that could be adopted is the routine auditing of elections by choosing a small random sample of the ballots and manually counting them. This practice would make a valuable distinction between ``audits,'' which are routine checks on the quality of elections, and ``recounts,'' which have become increasingly politicized. Routine random audits would often catch procedural, equipment, and personnel problems in uncontroversial elections, so that those problems can be fixed before they potentially affect an election outcome.

Abandoning paperless e-voting would not be a major sacrifice. Precinct-count optical scan voting, in which a voter marks a paper ballot that is counted by a machine in the polling place, is widely used, highly accurate, and much less costly than touch-screen voting. Furthermore, computerized ballot-marking devices are becoming available that can make these systems fully accessible to voters with disabilities, or non-speakers of English.

In summary, paperless electronic voting is a technology that is fundamentally hostile to election transparency. No one can tell what is going on inside the machines, and there are no procedural changes that can remedy that flaw. Instead of seeking a technological quick fix to our election problems, we should return to paper ballot systems, and focus our energy on making our elections more trustworthy by improving election practices. This can be done at reasonable (perhaps reduced) cost, and without reducing accessibility to voters with disabilities.

The November 2004 election went more smoothly than the 2000 election only because the margin of victory was greater than the ``margin of litigation.'' Electronic voting could have been at the core of a dispute. In addition to local disasters because of flaky electronic voting machines, we collected hundreds of reports from all over the country of odd voting machine behavior, including machines that selected the wrong candidate and machines that sporadically left candidates off of the ballots. The vast majority of these problems have been left uninvestigated and unresolved.

Our democracy is too precious to entrust to an ill-conceived and flawed technology. I hope you will recommend that we avoid doing so. Thank you.

Click here for the PDF

Longer version of the testimony