Electronic voting cannot be secured

A while back I argued that governments should adopt only electronic voting systems that run on open-source software.

I have to take back that advice.

“You simply can’t construct a trusted paper trail,” [Georgia Tech professor Richard] DeMillo says, “if you let a machine make a ballot for you.”

...

... some of the nation’s leading experts on computer science and elections concluded that there is no “technical mechanism currently available that can ensure that a computer application—such as one used to record or count votes—will produce accurate results.” One reason the authors noted: Malicious software “can be introduced at any point in the electronic path of a vote—from the software behind the vote-casting interface to the software tabulating votes—to prevent a voter’s vote from being recorded as intended.”

Translation: wherever computers are involved in the voting process, bad actors could corrupt the software. Whether that means some votes are ignored or altered, whether it happens at the polling place or a county central facility, the vote will have been subverted.

The problem with my original recommendation is that there is no way for people to know what the software on a given computer is actually doing. In general we cannot even know with certainty whether a computer is running the software the vendor intended.

You might object that we all use computers every day in spite of this concern, and that things pretty much work out as expected. Why, therefore, should electronic voting machines be any different?

The answer is, electronic voting machines carry out a task that is hugely important to the country, a task whose consequences affect millions. That gives bad actors a tremendous incentive to penetrate and to subvert such systems, far more incentive than they have to break into your computer or mine.

If you take the problem of subverted computers seriously you can make such subversion a lot harder. The trouble is that elected officials don't take the problem seriously. They're too ignorant of computers and software to grasp the problem's potential scope. Or worse, they're too concerned with fighting the bad press from past elections. Such seems to be the case with Georgia state senator William T. Ligon, Jr. He is not familiar with the fatal vulnerabilities of software systems, nor does he comprehend exactly how they work.

... Instead, Ligon cites the testimony of former Georgia Secretary of State Cathy Cox as one of the reasons he chose to back a system based on touch-screen voting machines that print out a paper ballot.

Cox told the legislature about “under votes, over votes, and stray votes. They all come with hand-marked paper ballots,” Ligon says. It is clear to him that printed ballots bring more certainty. When asked about research demonstrating that voters don’t or can’t verify their ballots when printed, Ligon said, “Voters have to take some responsibility for verifying their ballots.”

Ligon's familiar with all the fiascos that embarrassed Florida in the 2000 election but he has no clue about the ones that will engulf him and his colleagues if Georgia's electronic voting systems are cracked. All he understands is a PR nightmare from two decades ago. Talk about fighting the last war.

By ignoring voters' predictable behavior, Ligon demonstrates contempt for voting itself. Worse, the supposed verification he cites as the safeguard for election security is absolutely meaningless. The votes that will be counted are the digital ones, not the ones on the paper record. (If you were going to count paper ballots you wouldn't need software at the polling place at all: you'd make people mark their ballots the old-fashioned way.) Subverted software could print a faithful representation of the voter's choices while altering or ignoring the digital record. And again, it's the digital record of the vote that will be counted (or not).

These are not hard problems to understand, but you have to be willing to learn from experts. Ligon is not willing to learn. And he likely has a lot of company. Between willful ignorance (whether from anti-intellectualism or simply finding the concepts difficult to grasp) and a thirst for campaign contributions (electronic voting companies throw a lot of money around to entice officials to buy their products), we can expect that too many jurisdictions will make the foreseeably harmful choice to adopt vulnerable electronic voting systems.

Guys like Ligon have to be held accountable: their feet have to be held to the fire until they listen to the experts who understand these things.

In the meantime, voters must demand paper ballots, no matter how cumbersome and primitive they seem.