Introduction
Technological change impacts politics as well as business. The recent
United States Presidential election sheds light on problems that can arise
from the use of punch card ballots, an obsolete technology. Some observers
are suggesting high-tech alternatives such as the Internet, while others
viscerally distrust computer technology and would eschew it altogether.
These
issues are similar to the ones that businesses confront every day when
dealing with technological change. It is therefore instructive to examine
voting technology issues in the way that most businesses would approach
an important information technology decision.
Evolution
of Punch Card Technology
Punch card technology predates digital computing by at least 60 years.
Planners of the 1890 United States Census knew that by tallying marks
on paper from some 62 million questionnaires and then adding up the marks
by hand, there was no hope of tabulating the data into useful form until
well after the next Census of 1900. Their solution came during the 1880s
from inventor Herman Hollerith, whose idea was to encode Census data on
punch cards and to read and tabulate the data using an automatic machine.
Hollerith's Tabulating Machine Company would eventually become International
Business Machines (IBM) in 1924, and "Hollerith encoding" survives today
as the prevailing way to represent data on punch cards.
Punch cards became a popular medium for data storage with the proliferation
of digital computing. Today's universal practice of storing data on disk
was costly technology, and prone to breakdown, well into the 1970s. Punch
cards were much cheaper and often more reliable, especially when entering
data by keypunch machine. It isn't necessary to score or perforate blank
cards before punching them mechanically, and the mechanism doesn't leave
dents, dimples, "swinging" chad or "hanging" chad behind.
Still,
punch card systems have their limitations. They are agonizingly slow by
today's standards, and downright horrific for anyone who accidentally
loses or drops a full deck or box of cards. Also, mechanical card feeders
wear down quickly with heavy use, introducing the possibility of tabulation
errors. For these reasons, very few punch card systems were sold since
the 1970s after cheap, fast and reliable disk storage technology became
widely available.
Existing
Punch Card Systems
Voting systems vary widely in the United States and include punch cards
(36%), lever machines (27%), optical scanning (22%), mixed electronic
and mechanical systems (8%), direct computer recording including touch-screen
and the Internet (4%) and the original paper ballot (3%).
Punch
card balloting systems made their debut in 1964. With this form of balloting,
voters use a stylus to dislodge tiny pieces of card stock ("chad") from
perforations that line up with the ballot, creating holes that a card
reader detects during the tabulation process. Punch card balloting systems
like "Votomatic" and "Datavote" found widespread acceptance over the years
owing to their low cost, portability and the ease of tabulating votes
automatically.
Despite
recent technology advances, replacement costs deter many jurisdictions
from upgrading their systems. Los Angeles County, the largest election
jurisdiction in the United States with 3.8 million voter registrations,
continues to rely on its punch card voting system and has only recently
begun to experiment with touch-screen technology.
Problems
with Existing Systems
The drawbacks of punch card systems, and punch card balloting systems
in particular, are dramatically evident in the unfolding 2000 Presidential
election. These drawbacks fall into four categories: what technologists
would call lack of a proper "user interface;" improper punches; machine
tabulation errors; and discerning voter intent during a manual recount.
Controversy
surrounds Palm Beach County's now infamous "butterfly" ballot. Some voters
may have unwittingly chosen the wrong candidate because of the ballot's
allegedly confusing layout. Others, realizing their mistake before leaving
the voting booth, may have cast a second vote without obtaining a fresh
ballot, thus "overvoting" and invalidating their vote. Or, they may have
written a candidate's name on their ballot in hopes this would correct
their error. They did this, perhaps, to avoid the embarrassment of having
to ask a poll worker for a new ballot.
Unfortunately,
as with any batch processing method, punch card balloting systems lack
the ability of modern user interfaces to validate and confirm a voter's
choices at the moment of truth - in the voting booth. Validation logic
could quickly determine illegal vote combinations, for instance, and warn
the voter accordingly. Confirmation logic could display voters' choices
for review, and give them a chance to start over in privacy.
Next
come improper punches, or failures to dislodge chad well enough to permit
machine detection. These manifest themselves as dents, dimples or partial
detachments of chad and might result from a worn stylus, card stock with
defective scores or perforations, worn equipment that allows ballots to
give way rather than hold taut against the stylus, or a voter's unsteady
stroke. Partial punches may create a false "undervote" that punch card
balloting systems, lacking confirmation logic, cannot detect in the voting
booth.
Third
is the machine tabulation itself. There is little evidence to suggest
that punch card reading mechanisms themselves are a significant source
of error. Most punch card readers use light-emitting diodes (LED) and
sensors that activate only when light passes through a card. Because it
is electronic rather than mechanical, this technology has proven highly
reliable over the years.
By
far the greatest opportunity for machine tabulation error occurs before
punch card ballots are actually fed into the reader. On Election Day,
workers at each polling place lock the ballots in boxes and ship them
to a central data processing facility. No matter what precautions are
taken, security and control lapses are inevitable and invite many opportunities
for tampering or unintentional error. Ballots or boxes could be mislaid,
damaged or sent to the wrong location at any stage of the process.
Although
LED technology is electronic, card-feeding mechanisms are not. Keypunch
cards frequently jam when they are fed into the reader, even with minimal
human handling. Because punch card ballots receive much more human handling
than keypunch cards, and may have imperfections such as "swinging," "hanging"
or loose chad that keypunch cards do not, they are likelier to exceed
a feeding mechanism's tolerances. Moreover, aging card processing equipment
is getting difficult to maintain and even harder to replace; many of the
original manufacturers have gone out of business, and most others no longer
sell or even maintain their equipment because there is virtually no market
for it. For these reasons, card jams and consequential ballot damage are
practically inevitable while the vote is being tabulated.
And,
of course, that "swinging," "hanging" or loose chad can produce false
tabulations even when everything else is in perfect working order. Were
it to inadvertently cover a hole in the ballot, a sensor won't activate.
This will create a false "undervote." Alternatively, an invalid "overvote"
could escape detection if the chad is concealing part of an illegal vote
combination.
Should
a recount become necessary, it becomes very difficult to discern a voter's
intent when only dents or dimples appear on a punch card ballot, unless
of course the voter has also written a choice on the card.
New
System Requirements
The scope of this evaluation includes the marking, casting, tallying and
verification of election ballots. It does not include voter registration
or any of the procedures for preventing someone from circumventing registration
requirements or casting multiple ballots. Neither does it include certifying
an election after the final tally.
Whatever
technology it employs, any new system must meet the following essential
requirements:
- The system
must be readily accessible to all legitimate voters within each precinct.
It must be capable of receiving ballots at polling places that are set
up in each precinct on Election Day. Alternatively, the system must
provide means for absentee voting that comply with the applicable election
laws.
- Ballots
must not reveal a voter's identity.
- The system
must be capable of presenting the ballot in a clear and straightforward
manner, in compliance with all applicable election laws. Methods for
presenting the ballot must be certifiable in advance and remain tamper-proof,
after certification, until the polls close.
- The system
must prevent any delays, other than unforeseeable natural disasters,
that might obstruct or discourage legitimate voters from voluntarily
casting their ballots before the polls close. It must also prevent anyone
from voting before the polls open or after they close.
- Before
casting their ballots, voters must be able to correct errors, or void
their ballots and start over completely. Errors and void ballots must
not count towards the final tally. Audit and control mechanisms must
be available to ensure that void ballots, if any, don't count.
- The system
must secure each ballot against loss, misplacement, theft, damage and
tampering from the moment it is cast until final verification of the
vote. Audit and control mechanisms must exist to account for all ballots
cast, and reconcile this accounting against a subsequent tally of ballots
that either fail verification, or pass verification and count towards
the total vote.
- The system
must be capable of accurately verifying all ballots cast at polling
places, and accurately tallying and reporting the valid ballots, within
a few hours after the polls close. Methods for verifying and tallying
ballots must be certifiable in advance and remain tamper-proof, after
certification, until final verification of the vote.
- The system
must preserve all cast ballots in their original form, to permit visual
inspection and confirmation of the final tally. The original form of
cast ballots must maximize an inspector's ability to discern the voter's
intent at the time the ballot was cast.
- The system
must be affordable to each electoral jurisdiction.
In addition,
the new system should be capable of validating each ballot for legality
before it is cast, to prevent voters from casting invalid ballots. Methods
for validating ballots must be certifiable in advance and remain tamper-proof,
after certification, until the polls close.
Possible
Balloting Technologies
A variety of electronic technologies are available for casting ballots.
These include interactive entry systems, interactive touch-screen systems,
mark-sense systems and scanning systems, all set up at polling places
and capable of validating each ballot for legality before it is cast.
Interactive computer entry systems would also permit voting over the Internet.
Interactive
entry systems require voters to select their candidates using a keyboard
and, possibly, an electronic pen or a mouse. Voting instructions, the
ballot, and voter choices appear on a monitor, and the equipment can provide
Braille impressions and sound for voters with visual or reading disabilities.
Interactive
touch-screen systems work just like automatic teller machines (ATMs).
Instead of using a keyboard or mouse, voters make their choices by touching
a monitor where voting instructions and the ballot appear. This equipment
can also provide Braille impressions and sound.
Mark-sense
systems require voters to mark paper ballots, which in addition to text
can have Braille impressions for voters with visual disabilities. The
ballots are fed through an optical scanner that reads and possibly validates
the ballots. Scanning could occur before a ballot is actually cast, allowing
voters to obtain and mark a fresh ballot if they make a mistake. The scanning
devices should imprint cancellation marks to ensure that void ballots
don't count.
Scanning
systems work like handheld retail bar code scanners. They require voters
to aim a character or bar code scanner at their choices, which appear
on a placard showing voting instructions and the ballot. Though fast and
accurate, these systems aren't especially user-friendly for voters with
disabilities.
After
validating ballots and obtaining the voter confirmation, all these systems
are capable of printing paper receipts evidencing the actual ballots cast.
Just as they now do with punch cards and paper ballots, voters can inspect
their receipts for accuracy, then leave them with a poll worker as evidence
of their vote.
Technology
Drawbacks
Enticing as these possibilities may be, none are without drawbacks. For
instance, all electronic solutions require a power supply. Provision must
be made for a portable backup power supply at each polling place in the
event of a power failure. Paper balloting procedures must be in place
as a backup in case this equipment fails.
Choosing
the right client/server architecture presents a second issue. Three basic
architectural approaches are available, each having its own advantages
and drawbacks.
One
approach uses "rich" or fully functional clients: freestanding devices
that run their own applications, and store ballots electronically in their
own database. Periodically, or after the polls close, each device transmits
the contents of its database to a central server via modem.
A
second "three tier" approach connects all the devices at a polling place
to a server computer at the polling place, using local area networks (LANs)
made up of cable connections or radio frequency (RF) transmitters. Interactive
voting and printing applications could run on each client device, on the
server computer, or be distributed between the client and server. The
server tallies the votes and accumulates them in a local database. Periodically,
or after the polls close, the local server transmits its local database
to a central server via modem.
Yet
another "lightweight client" approach connects all the devices at every
polling place to a central server, via modem and the Internet. The devices
could connect via browsers to interactive applications running on the
central server. Alternatively, the interactive applications could be distributed
between the clients and the central server. The server tallies the votes
and accumulates them in its central database.
Tradeoffs:
Economy Versus Integrity
These
approaches represent varying tradeoffs between economy versus integrity.
For example, the rich client approach requires fitting thousands of devices
in each electoral jurisdiction with the right software, certifying each
device, and distributing devices to the right polling places before Election
Day. The three-tier approach requires assembling, configuring and certifying
LANs and their components at hundreds of polling places in each electoral
jurisdiction before Election Day. Either way, the cost of technician labor
for setting up and supporting each election could easily exceed the equipment's
original acquisition cost. Yet for the same reason it becomes difficult
to systematically tamper with all this equipment after it is set up.
Architectures
that rely on lightweight client devices and the Internet require substantially
less setup effort, but anyone with the right credentials could "hack"
into the central server and perform all kinds of mischief. There are also
issues like providing sufficient telecommunications bandwidth to each
polling place, keeping these connections constantly available during Election
Day, and ensuring that the central server stays up and running at all
times. And even when these issues are overcome, the central server must
have sufficient capacity to handle thousands of clients at a time without
driving response cycles too high. This is especially problematic in large,
urban jurisdictions where many people vote during peak hours, just before
or just after work.
Internet
Voting
The Internet
is also seen as a way for people to bypass polling places altogether,
and vote at their convenience from home, work, or for that matter anywhere.
Some jurisdictions in the United States are already experimenting with
Internet voting.
Apart from
issues of central server integrity, Internet voting has two important
drawbacks that virtually preclude it from replacing the traditional polling
place anytime in the near future.
First is
the issue of the secret ballot. Polling places actually perform two critical
processes. One is authorizing people to vote, including same-day voter
registration in some jurisdictions. The other is balloting. Today, these
processes take place at the same location but they are separate and distinct
from one another. First, prospective voters identify themselves and sign
the roll, in order to authenticate their credentials and ensure that they
vote only once. This process entitles each legitimate voter to receive
an official ballot.
Next, voters
with official ballots make their decisions in privacy. Although many jurisdictions
assign a unique serial number to each ballot, and print that number on
the voter's receipt, the number is never written in the voter roll. This
makes it impossible to trace a ballot back to an individual voter.
On the Internet,
voters have to identify and authenticate themselves when they log on to
cast their ballots. Stringent authentication might require a digital signature.
Without this precaution, there is no way to prevent an illegitimate voter
from casting a ballot, nor is there any way to prevent someone from voting
more than once. This requirement may cause many voters to worry about
secrecy, no matter what assurances are given the voting public prior to
an election. They might opt for a polling place, instead.
Second is
the issue of accessibility. Many voters don't own a computer, don't have
access to one, or don't have Internet access. They too will opt for polling
places.
As long as
these issues exist, Internet voting can never completely replace voting
at polling places. And therein lies a dilemma. How will workers at a polling
place know whether or not a prospective voter has already cast a ballot
elsewhere, over the Internet? Conversely, what would prevent someone from
casting a duplicate ballot over the Internet, after they cast their first
ballot at a polling place?
Technologists
will reply that interactive, on-line voter registration and tracking systems
are the answer. Poll workers can instantly determine if a prospective
voter has already cast their ballot, as can the Internet system. But even
if this solution were available today, it does not overcome a fundamental
flaw. Internet systems are in practice capable of requiring a digital
signature before allowing someone to vote anywhere outside of a polling
place, while poll workers can at best insist upon a hand signature. No
technology exists today to compare digital and hand signatures, and conclusively
verify that the two signatures match.
Of course,
technology is available to record hand signatures digitally. But few if
any people use this technology at home and only a small number might be
able to do so at work. It's unlikely they would invest in this technology
for the sole purpose of bypassing a polling place once every two years.
This would largely defeat the purpose of Internet voting. If the Internet
system requires digital hand signatures to assure the integrity of the
balloting process, one can predict that very few people would vote over
the Internet.
Conclusions
Taking all
these factors into consideration, rich client/server architecture using
mark-sense technology appears to be the best way to replace obsolete voting
systems.
The pros
and cons of various client/server architectures seem to suggest that rich
client systems offer the greatest potential benefits of integrity and
reliability in relation to cost. Rich client systems could incorporate
any of the available balloting technologies, each having its own advantages
and drawbacks.
Touch-screen
systems are probably the easiest for the average voter to use, and are
just as accessible to voters with disabilities as any other alternative.
However, they are more expensive than the other available technologies.
Interactive
entry systems are cheaper than touch-screen systems, but they could befuddle
some voters who are not computer-literate. And scanning systems would
be difficult for voters with disabilities to use.
Mark-sense
systems come closest to paper balloting, thus overcoming objections from
voters who are afraid of, or distrust computer systems. Concerns persist,
however, over the reliability of optical scanning equipment, particularly
when voters don't completely darken their choice. These concerns can be
put to rest if the scanning occurs before ballots are actually cast, allowing
voters to confirm their vote, or void their ballot and obtain a replacement
if their initial vote is illegal or doesn't properly register. And should
a hand recount become necessary, voters could clearly indicate their actual
intention in writing on their ballots.
Any decision
to adopt mark-sense technology must also consider the additional complexity
of controlling, accounting for and possibly reconciling void as well as
valid ballots.
About
the Author
Nelson M.
Nones CPIM is the Director of Global Marketing for CIM Vision International,
Inc. in Long Beach, California, USA. Mr. Nones has over 25 years' professional
and managerial experience as both a developer and implementer of Manufacturing
Execution (MES), Warehouse Management (WMS), Enterprise Resources Planning
(ERP), logistics, Manufacturing Resources Planning (MRP-II) and general
business accounting software. He has lived and worked in the United States,
Asia and Europe, pursued advanced studies in Economics and Geography,
and was a market research consultant for the first 8 years of his career.
He was Certified in Production and Inventory Management (CPIM) in 1986
by the American Production and Inventory Control Society.
You can contact
Mr. Nones through the CIM Vision website:
www.cimvision.com