[E-voting] random-sampling VVPB inadequate to prevent fraud

Michael McMahon michael at hexmedia.com
Tue Sep 20 11:53:28 IST 2005

Catherine Ansbro wrote:

> But random sampling of VVPB is not adequate to detect fraud.
> See Bob Fleischer's paper.  (link at BBV)

I meant to reply to this before now, but here goes anyway.

I think Bob Fleischer's paper is well written, and is a good summary of
the issues surrounding electronic voting, but I don't completely
agree with his conclusions (with respect to VVAT).

You have to compare the risks of electronic voting with the equivalent 
risks in the existing systems.
You also have weigh up any new risks introduced by an electronic system 
against the possible
benefits it may bring. The results of these comparisons vary, depending 
on many factors,
such as the election system itself. Manual counting in Ireland's PR STV 
system is time-consuming,
complicated, and therefore costly. It is well suited to being done 
The same advantage might not be gained with other systems like first 
past the post.

I think there are three basic arguments which Bob makes against VVAT

1) What he calls "innocent" tampering which would never be detected by
    VVAT. For example, deliberately making machines in certain areas crash
    or just run slowly in order to frustrate the voters in that district.

    It is true that VVAT would not detect this, but it would be very obvious
    to anyone looking on, in much the same way as if the election staff 
    were frustrating the voters, by working too slowly or whatever.

    Basically, I argue that the most you can expect from any election system
    is that threats are exposed rather than hidden. It is also 
unreasonable to
    only criticise e-voting systems for problems which manual systems 
also suffer.

2) The second point is that machines could be maliciously programmed to 
only generate a small number
    of errors, which will hopefully be dismissed as transient glitches 
or similar.

    This is an important issue. In my opinion, the policy for dealing 
with detected
    errors has to be absolutely clear. There must be a distinction between
    errors which could have resulted from human error (for which there 
may have
    to be some tolerance) and errors which could only have resulted from 
a computer
    error (for which there is zero tolerance). For example, if there is 
a discrepancy between
    the record of the number of voters who voted, and the number of 
ballot papers which turn
    up at a count centre, then this could have been caused by a voting 
machine recording a few
    extra votes of its own, but it could also be caused by a (human) 
counting or recording error.
    (Note, this kind of discrepancy is also possible in a manual paper 
based election).
    On the other hand, if there is a discrepancy between the contents of 
an authentic printed
    ballot paper and the equivalent electronic record, then this is a 
red-flag and calls into
    question the entire output of the voting machine in question, which 
would have to be
    checked manually.

3) Last. If voters do not actually verify their votes at the voting 
machines, then any
    audit of this data is "a sham".

    It is true, that VVAT depends on most voters actually checking their 
votes at the machines
    and this is a small added burden for voters (compared to marking a 
ballot paper directly)
    but it would not be true to say that 100% of voters have to verify 
their votes. The voting
    machines do not know which voters will check and which will not, so 
they would be taking a chance
    by not printing out the correct vote. The situation is similar
    to bank-statements. Not everyone has to check their bank-statement 
each month in order
    to be protected from the bank stealing your money. Just like the 
voting machines, the banks
    do not know who checks their statement, and who does not.  It is 
true, that the size of
    samples may need to be adjusted to deal with this issue but I think 
it is pessimistic to argue that
    VVAT is flawed for this reason.

On balance, I would say that there needs to be a realistic appraisal of 
the benefits
as well as the costs and risks associated with verifiable electronic 
voting before
you can really know whether it is worth pursuing.

I mentioned one potential benefit arising from electronic voting in the 
Irish context,
but having said that, there are still questions to be answered (in 
Ireland) relating to
the running costs, and if an electronic system ends up costing more (or 
insufficient benefits) when compared to the old system,
then there is not much point in using it.

- Michael.

More information about the E-voting mailing list