Accuracy and Integrity of
Computerized Vote-Counting:
Answers to Three Fundamental Questions
Posed by Election Administrators

by

Roy G. Saltman
Computer Scientist
National Institute of Standards and Technology
Gaithersburg, MD 20899

Presented to:
Annual Conference of
International Association of Clerks, Recorders,
Election Officials and Treasurers (IACREOT)

at

San Diego, CA
June 26, 1989

Roy Saltman of the National Institute of Standards and Technology was invited to speak at the June,1989 annual conference of the International Association of Clerks, Recorders, Election Officials and Treasurers (IACREOT), held in San Diego, CA.  Mr. Saltman was asked to respond to three specific questions about accuracy and integrity of vote-counting.  His answers are provided below. 

Question 1:  

What ways are there that would make it possible to "rig" an election, using computers, i.e., Voting Machines, Direct Electronic Voting, Punchcard and Optical Scan Equipment?

Answer to Question 1:  

Election administration is a system that consists of four elements:  (1) people, (2) established procedures, (3) devices and machines, and (4) activities actually carried out.  Activities should be undertaken according to the established procedures, by people using the devices and machines.  Before there were computers, there were other devices and machines used in election administration, and consequently, some procedures were different.

However, the election process was a system then; it remains a system now.  The use of computers has not changed that.  The process remains a system that is managed and carried out by people, that is, election administrators.  The administrators, not vendors, not manufacturers, not other contractors, are responsible for the accuracy of the results produced.  Accuracy must assure that, in the words of the Declaration of Independence, the Government's "just powers" are derived from the "consent of the governed."

The reason that I have stressed that election administration is a system is that it is not possible to separate the question of manipulation of computers for election "rigging" from considerations of the system of which the computer is a part.  If a computer has been used to "rig" an election, either the procedures used to carry out the election were inadequate, or the people managing and carrying out the activities did not follow the established procedures.  Thus, instead of telling you what ways there are to use a computer to "rig" an election, I must tell you what proper and effective procedures there are, to be used by you, the election administrators, to assure accurate results that correctly reveal the choices of the voters.

These proper and effective procedures need to include that used to (1) acquire hardware and software according to performance specifications that cost-effectively maximize security and integrity protections, (2) check out hardware and software for logical correctness, integrity, and reliability, (3) protect acquired hardware and software against unauthorized access, and (4) effectively employ hardware and software in election operations.

It is essential that procedures to assure accurate election results concern the acquisition of hardware and software.  The procedures should include testing of vote-tallying software at the State level, through the use of a State-approved testing laboratory, to assure logical correctness and the absence of hidden code.  After the software has been certified, the software must be protected to assure that the working copies used are identical to the software tested and approved.  A copy of the tested software should be escrowed so as to be available should a question arise.

For hardware, the most essential function is data entry.  The voter registers his or her choices through the data entry function.  It is fundamentally important that this function be as accurate as possible.  For ballot systems, data entry is through the ballot reader.  Readers, as well as the ballots themselves, including the marking or punching process, must meet accuracy requirements.  For non-ballot systems, data entry is through touchscreens, pushbuttons, levers, or other voter-operated devices.  Due to the absence of ballots, a situation that makes a real recount impossible, data entry hardware of direct-recording electronic (DRE) systems should be certified like software.

When recounts are undertaken, if the vote count has changed, public confidence is eroded.  An accusation of fraud is, after all, an extreme manifestation of lack of confidence.  If election administrators have effective procedures in place to assure confidence by disinterested but highly computer-knowledgeable observers, they will easily be able to counter accusations of fraud.

Effective procedures for operational activities contribute also to fraud prevention.  Pre-election checkout, to verify setup parameters, is essential.  Dedicated computer operation, i.e., not running vote-tallying operations simultaneously with non-election applications, helps maintain a cordon around the approved system.  Physical security, i.e., the control of the premises in which operations are carried out, similarly contributes.  All ballots, blank, used, and spoiled, must be accounted for.  Reconciliations of votes cast against voters signed in, by the recording of overvotes and undervotes, must be shown.  

Audit trails of computer operations must be obtained, and retained as part of the records.  For ballot systems, a partial manual recount of one to five percent of the precincts, with precincts selected by losing candidates or parties, should overcome much concern by the public about computer operations.

In summary, running an election is a systems management problem.  Fraud is an invasion of the system, and can be countered with effective procedures developed and implemented by election administrators.  I have presented to you, very briefly, a few of the individual safeguards that can be applied.  In my answer to the third question, I will present these control procedures as a single concept, enabling you to address the problem in a unified, coherent manner.

Question 2:

Is any one method, by its basic nature, more "vulnerable" to computer fraud or manipulation methods than another, and why?

Answer to Question 2:

Vote-tallying systems may be divided into two classes:  ballot-tallying systems, and non-ballot systems.  Punch card and mark sense systems are ballot-tallying.  Lever machines and DRE systems are non-ballot.

In the use of ballot-tallying systems, an automatic audit trail of voting records is created through use of ballots.  A ballot is a voter-created document.  It does not depend on the vote-tallying system for its creation.  It is created independently of the vote-tallying system.  The availability of an independent, computer-readable ballot allows for two alternate methods of vote-tallying:  (1) by computer, and (2) manually.  This redundancy permits an effective check on the computerized vote-tallying system.  A portion of the ballots may be manually recounted to verify the computer-generated tally.  However, accuracy of a ballot-tallying system depends on the lack of ballot fraud and very tight control over quantities and handling procedures in the printing, distribution, precinct use, collection, and counting of the ballots.

In a non-ballot system, there is no voting record created independently of the vote-tallying system.  Thus, there is no redundancy, and the mechanical or electronic vote-tallying system must be totally accurate.  The accuracy of the tally depends wholly on the machine.  If the machine is wrong, there is no recourse to an independent record.  There is no independent record.  There can be no ballot fraud in a non-ballot system, but there are other methods through which fraud can be perpetrated, for example, software or hardware manipulation.  I note that with a lever machine, undervotes cannot be positively recorded.  Without a review of the internal workings of a lever machine, it is not possible to distinguish a voter's failure to vote from the lever machine's failure to record a vote.

In my 1988 report, Accuracy, Integrity, and Security in Computerized Vote-Tallying, I made the following statement:

"Each type of system has its own particular vulnerabilities.  A comparison of system types shows that each has its advantages and disadvantages.  It is possible to effectively utilize any of the computerized systems discussed (punch card, mark sense, or DRE) provided that, among other requirements, procurement specifications are well-written in accordance with needed performance, and factors of accuracy, reliability, and recommended design concepts are included in the specifications."

The recommended design concepts referred to in this statement include a concern for DRE system, to provide substitutes for the lack of a paper audit trail.  I make the following recommendations regarding design of DRE systems.  (1) Data entry logic for a DRE system should be certified to be correct, like vote-tallying software, and escrowed in case of a question.  (2) Data entry logic for should be particularly secure in each precinct-located machine to assure that it cannot be tampered with.  (3) Voters' choices should be individually retained in each machine on a removable storage unit (in randomized locations for privacy), and some fraction of machines used in an election should have their results recounted on a different system.  (4) Undervotes should be positively recorded for purposes of reconciliation.  One aspect of a correct DRE tally is that the sum of the number of votes cast plus undervotes is the same number for every voter of a single ballot style.

Another way of categorizing vote-tallying systems is by precinct count versus central count.  The use of one type or the other is, again, a trade-off in vulnerabilities.  Centralization may provide more opportunities for software fraud, because of the single point of attack.  In addition, the transportation of voted but uncounted ballots may provide opportunities for ballot switching or misapplication of header cards.  However, in precinct counting, the placement of small electronic machines (punch card, mark sense, or DRE) in relatively insecure precinct locations leaves these machines vulnerable to tampering during the night before an election.  These small machines receive their local computer programs from a centrally located setup program, so that decentralization does not totally eliminate the possibility of software fraud or error.  In precinct counting, telephone lines may be used to communicate results, and security precautions must be taken to prevent fraud.

Still another way of categorizing voting systems is to note that ballots may be informative, i.e., have contest and candidate names on them, or may be uninformative, like "votomatic" ballots.  The latter do not have candidate names on them; they have only numbers identifying the holes.  The required use of a "votomatic" vote recorder or similar device for an uninformative ballot provides additional opportunities for fraud or error that are not present with an informative ballot or DRE display.  Alertness by administrators to defacement or interchange of ballot pages, and appropriate  training of voters in properly inserting, viewing (to avoid parallax errors), and punching the ballot, are antidotes to these possibilities.

In summary, I note again that effective procedures used by election administrators, for acquiring, protecting, and employing hardware and software, are the keys to fraud prevention and to results that accurately report voters' choices.

Question 3:

How do we, as election officials, detect and prevent vote manipulation from happening?

Answer to Question 3:

I have made many recommendations on this subject in my 1975 and 1988 reports, and I have reiterated quite a few of these recommendations in my answers to Questions 1 and 2.  At this point, I will concentrate on a single important institutional recommendation, rather than on specific proposals for operational change.

The procedures that I have spoken about - those that election administrators must use in order to assure that accurate election results are produced - are known collectively by the name "internal control" (IC).  IC is a set of systematic procedures used to guard against errors, waste, and fraud.  IC is nearly universally used as a business management technique to safeguard assets and to protect operations that result in the sale or purchase of goods or services.  Voting services are not priced to the voters, and the discipline of IC has not been systematically applied.

Applicability of the concept of IC to vote-tallying requires only a slightly broader definition of the concept of a "transaction."  A transaction is defined, for priced goods and services, as a business event that is measured in money and that is entered into accounting records.  An expanded definition would permit a transaction to include a step in the implementation of an entitlement, such as voting, that is not measured in money.  It seems eminently reasonable and appropriate that well-established and well-utilized techniques used to protect and accurately count dollars should be used, similarly, to protect and accurately count votes.

The US General Accounting Office, the agency of Congress that audits US Government activities, has stated that the ultimate responsibility for good IC rests with the using organization.  The implication of this statement is that persons knowledgeable in the professional field of IC, and who can apply the broader definition of a transaction, should be utilized by election administrators to assist in the establishment and implementation of sound procedures for election preparations and operations.  To the extent that procured computer hardware and software must have capabilities that support the IC function, applicable requirements should be included in procurement specifications.

Internal control is a professional activity.  Trained persons, texts, and a community of practitioners are available.  Practitioners may be also called EDP auditors, internal auditors, or computer security specialists.  These persons may be found in financial management, where IC is essential, or at accounting firms that have an experienced management consulting practice.

Expertise in IC (which includes computer security) should be added to the personnel complement in election administration.  In addition, an internal auditor should be available to independently review the implementation of IC and report to the chief election administrator on its effectiveness.  IC expertise may be shared among local government agencies or provided at the State level if individual agency resources are insufficient for additional staff.

An important function of IC is to identify system vulnerabilities and convert them into a set of realistic threats.  Responses to these threats must be devised that are consistent with available or obtainable resources, based on a risk analysis determining the likelihood and cost of actual exploitation of each individual vulnerability.  A risk analysis would consider, for example, the possibility that "computers can be manipulated remotely, by wire or radio" or that "the software can be set to await the receipt of a special card whose presence will cause all the election counters to be altered."  These specific threats were identified in public testimony by knowledgeable persons.
The result of a risk analysis and its follow-on activities would satisfy two needs.  These needs are, first, for actual system protection plans, and second, for assurances to administrators and the public that the potential threats are understood, have been prioritized for significance, and are being countered with available measures consistent with resources.  IC personnel would be extremely valuable in responding to questions about accuracy, integrity, and security raised by supporters of defeated candidates or by technically trained members of the general public.

The presence of an IC officer on staff should relieve election administrators from having to be personally knowledgeable about specific technical matters best left to an individual professionally qualified in the field.  Expertise within the organization, as opposed to an outside consultant, provides the ability to deal with problems on a day-to-day basis, to evaluate outside recommendations for feasibility and cost, and to implement realistic solutions based on local conditions and the immediate situation.

With the addition of needed technical expertise, election administrators would be to more easily retain management control.  Administrators would not have to abdicate control to outsiders, such as vendors or data processors.  Election administrators would be able to retain the capability of directing the process of assuring accuracy, integrity, and security in computerized vote-tallying, and they should have considerably more confidence in their office's ability to effectively carry out that function.