Verification of voting-machine output is only prudent

By Karen McKim — If your bank credits your deposit to the wrong account, you can notice the error and get it fixed. If your voting machine credits your vote to the wrong candidate, who would notice?

No one. Under current Dane County election procedures, electronically miscounted vote totals are almost certain to go unnoticed.

On pre-election security, Dane County does a good job. Municipal clerks conduct pre-election tests, and poll workers make sure the voting machines counted the right number of ballots. But the Dane County Board of Canvass routinely declares election results final (“certifies” them) without checking whether the voting machines tabulated our votes correctly on Election Day.

The county board of canvass has legal authority to review the accuracy of voting-machine output during the canvass process; no statutory changes are needed. Recent advances in technology and statistical techniques endorsed by the President’s Commission on Elections Administration have provided them with all the tools they need to perform quick, inexpensive verification.

“I don’t see the need to verify voting-machine output. There’s never been a problem. Has there?”

Routinely checking the accuracy of computer output is standard practice everywhere except in elections administration. In fact, a manager in any business or government office other than elections administration would be fired or arrested if he or she refused to audit until serious fraud or error was proven.

And yes, there has been at one major problem that we know of. In November 2014, voting machines tabulated a defeat for a Stoughton referendum that the voters had overwhelmingly approved, by counting only 16 votes from more than 5,000 ballots cast. Stoughton’s machines had been accidentally programmed to look in the ballots’ white space for votes instead of looking where votes were correctly marked.

Had the mistake been slightly different (telling the machine to look for “no” votes at the “yes” spot and vice-versa), elections officials would have certified a defeat for the referendum without ever knowing the voters’ true verdict. No one could have contested it because the result would have been far outside the recount margin.

Other unintentional errors have likely happened in Dane County, considering that the voting machines are operated by a well-meaning but largely temporary workforce with little or no professional IT expertise. But no one knows, because no one checks.

Deliberate sabotage is another story: If our voting machines have ever been compromised by insiders or hacked, it’s certain the false results were not noticed. Hacks would never be designed to operate during pre-election tests, and because Dane County doesn’t check the accuracy of Election-Day output, thieves know they are safe from detection if they give their candidate a credible victory margin outside the recount limit.

“I saw a hand-counted recount once and it took all day. I don’t believe that hand-counted verification can be quick and inexpensive.”

First, how much would be too much to pay to protect our election results from electronic theft?

Now back to the question of efficiency: Verification is very different and much faster than a recount. Verification can use statistical methods (specifically, “risk-limiting auditing”) that cannot be used in full recounts. These methods allow election officials to answer the question �“Did the machines identify the correct winner?” with only a random sample of the ballots.

And votes can be counted from the digital images created by our new voting machines in less than a quarter of the time it would take to count the same number of paper ballots. The ballot images can be projected like a slide show, eliminating time-consuming paper-handling while allowing several people to count simultaneously and check each other’s work as they go. The digital images are only slightly less secure than the paper ballots as a true record of the votes.

“If we call attention to the fact that electronic tabulators can miscount, we’ll undermine trust in elections.”

In every other aspect of elections administration, we build trust by checking and verifying. We build trust that candidates got the right number of signatures on their nominating petitions by checking. We build trust that people live where they claim to live by checking.  We build trust that everyone who asks for a ballot is registered to vote by checking. If we want to build trust in the accuracy of election results, we need to do the same for the counting of our votes: we need to check.

“We should discard the machines and go with hand-counted paper ballots.“

Relying on a single method of counting votes, either exclusively electronic as we do now or exclusively human as we did in the past, is less secure than relying on both methods. Using both, we can get a quick preliminary count before anyone has a chance to tamper with the ballots; detect and correct electronic miscounts regardless of cause; and better deter fraud by forcing would-be thieves to manipulate both an electronic count and a human count.

For more information, explore