Anonymous, Verifiable Voting

Very often I agree with Vincent Carroll. But not this time. In his December 27 column for the Rocky Mountain News, Carroll claims that paper ballots are “18th century technology.” He points out that mail ballots are also problematic, as “[e]very unwanted ballot is an invitation to attempted fraud.” He concludes the section:

The point is not that mail balloting or paper ballots are rife with fraud and error (although mail balloting is clearly the sloppiest system of all), but that we should weigh relative risks before stampeding out of the electronic arena. After all, if I can buy stock electronically without worry, why should I still have to use a pencil on Election Day?

I agree with Carroll’s criticisms of voting by mail, which is why I oppose the practice. Of course, nobody is arguing that we must “use a pencil” to vote; that’s just a straw man. The issue is whether the vote should be recorded and counted purely digitally, or whether the vote should be recorded and counted via physical records, such as printed or punched paper. (See my earlier post.)

Following is a quick e-mail that I sent to Carroll:

“After all, if I can buy stock electronically without worry, why should I still have to use a pencil on Election Day?”

The answer to your question is simple. When you buy stock electronically, you can verify the transaction online. You can verify the transaction by phone and by regular mail, if you need to. If somebody steals your stock, you will become aware of this, and you will be prompted to take corrective action.

When I vote electronically with no paper record, I have absolutely no way to know whether my vote was counted at all. Nor do I have any way to know whether my vote was counted as I cast it. What if one or more machines malfunctioned? What if somebody tampered with one or more machines? It’s quite possible that absolutely no physical evidence would exist regarding such problems.

True, paper ballots can be “lost,” miscounted, or altered. But at least there’s a much better chance that such problems will yield physical evidence. Assuming that multiple parties always watch the paper ballots, it’s much harder for a single person to change or destroy some of them.

I’m all for modern, mechanical, computerized voting systems. But I also want reliable, verifiable results. And that requires a physical record.

The problem is that voting must be anonymous. Sure, if each voter could cast a digital vote that recorded the identity of the voter, these records could be verified. But nobody doubts the logic behind anonymous voting: it is required to prevent coercion. We don’t want union bosses, gang leaders, employers, politicians, or bureaucrats to know how people voted. Yet voting totals must be made public. (On the other hand, Vincent Carroll’s stock transactions need not be made public.)

So how do we verify vote totals when each vote must be anonymous? The only way to do it is to allow voters to generate a physical record. It’s totally fine for a computer to assist in the process. But, ultimately, the output must be something more tangible than a magnetized blip of a hard drive (or the equivalent). (Has Carroll never suffered a computer error, failure, or virus?) Then, the physical records must be carefully monitored by multiple parties, transported to counting centers (again while monitored and protected), and then counted. Machines can do the counting, so long as the process and the results may be verified by human beings. These physical records must be accessible to legitimately interested parties, subject to proper security.

No form of voting is absolutely fail-safe. But a system of protected and monitored physical records is difficult to abuse, and the magnitude of abuse is bound to be minimized. A purely digital system, on the other hand, allows no method of verifying the vote. Such a system will prove a constant temptation for those clever with machines. Abuse of such a system is virtually guaranteed. And we are unlikely even to learn of abuse when it happens.