Secrecy of Voting Machines Ballots At Risk

JimBobJoe writes "On Monday, Cnet published the findings I made as an Ohio poll worker regarding a major oversight in my state's election's system: Using a combination of public records, plus the voting machine paper trails, you can figure out how people voted. Though most agree that voting machine paper trails are a necessity, they can cause privacy problems which aren't easily mitigated. 'It's an especially pointed concern in Ohio, a traditional swing state in presidential elections that awarded George Bush a narrow victory over John Kerry three years ago. Ohio law permits anyone to walk into a county election office and obtain two crucial documents: a list of voters in the order they voted, and a time-stamped list of the actual votes. "We simply take the two pieces of paper together, merge them, and then we have which voter voted and in which way," said James Moyer, a longtime privacy activist and poll worker who lives in Columbus, Ohio.'"

Comments

Re:How long

[pipatron]

obviously I do understand the tensions it can create if everybody in your line of work votes republican, or in your family

And still you don't understand why people are so afraid of saying who they voted for?

Keeping votes secret is one very important way to make sure any democracy works, since humans can easily be forced to vote for something they do not want to vote for, either by threat of violence to your own person or someone in your family, or by money. Secret votes makes sure that someone can vote how they want, not how peer pressure wants.

Hah

[tttonyyy]

That's why I'm changing my name by deed poll to a mysql injection attack string.

Try and combine my vote and a date together in a database you b*****rds! ;)

Re:How long

[Aladrin]

Because there's a bajillion ways to use that information against you, and people are paranoid. (Probably rightly so, most of the time.)

So, you voted against (candidate that won), huh? Well, you must be evil.

So, you voted independent, eh? You must be a communist, trying to subvert our system.

So, you voted for a known communist, eh? You must be a spy.

Yes, there's not a whole lot of logic there. There doesn't NEED to be, because the people that would put those lists together to see who voted what aren't USING a lot of logic.

Anonymous voted should mean that, not 'temporarily anonymous' or 'anonymous unless we want it not to be'.

Re:How long

[alzoron]

I believe you'll find an answer to your question somewhere in a history book. I suggest starting with 15th and 16th century Europe, then move onto American history.

Just because you happen to live in a local and era where you don't have to fear for your life when you voice your support for one person over another doesn't mean it's always been like that or will continue to be like that indefinately.

Why timestamps

[Bananenrepublik]

Can somebody explain to me why votes need to be timestamped? The only purpose I can think of is that this allows cross-correlation with the actual votes. You don't even need the info on the order in which people voted, as you could just stand in front of the election place with a watch. This sounds like a definite failure at maintaining basic democratic principles.

Re:Trivial solution

[CokeBear]

You could also sell your coupon to whichever candidate was willing to pay you more for it...
Or your boss could demand your coupon as a condition of keeping your job...
Or your union leader could hint that it was in your best interests to turn over your coupon to the shop steward...

I don't think you've thought your plan all the way through.

Re:In the UK, polls aren't really secret either

[Harold Halloway]

In the 1980s (and probably subsequently) it was normal practice for Special Branch to inspect the ballot papers of those who voted for parties which were considered potentially subversive (Communists, BNP, National Front.) They could then match those voting papers to the voters (by dint of the fact that the voter's name was written on a list next to the voting paper number) and keep a handy database of undesirables.

Old Problem

[Anonymous Coward]

The risks of combining two pieces of information go back a long way.
A bishop was celebrating a major aniversary with society friends. He was at one end of the table and was asked what was the first sin he ever had confessed to him, to which he replied "Adultery". A lady at the other end of the table said "I was the first person ever to confess to him".
The people in the middle of the table, who could hear both conversations, put the two snippets of information together ...

I don't think so.

[argStyopa]

At least in MN, you're not registered in the order you vote - you're registered in the order you ARRIVE. Then you stand in line, and take the next available booth.

Then, you stand at the booth, mull over your unknown, least-hated, or no-competition candidates. It's actually quite rare that people walk away from the voting booths in the exact same order that they went into them.

So yeah, you can use the timestamps + registration to determine who voted how....+/- maybe a half dozen voters, which makes a great deal of difference.

Now, if the voting station turnout is slow when you voted? Then yeah, you are probably identifiable. But this isn't nearly the story it's made out to be, and would be less of a story if more people voted.

Re:Why do you need a list in the order they voted?

[ThosLives]

This was my thought as well; I suppose it depends on how the system determines "order in which you vote". I've never personally used anything but a paper ballot that is read by a scanner (yay for "backwards" states), but the way it works everywhere I've been is:

1. You come in, they simply highlight your name in the Big Book of Names and give you a ballot. I don't even think they write down the ballot number next to your name in the book.
2. You go fill out the ballot and stick it in the machine.

That's it. No timestamps, nothing.

Re:Other states

[sumdumass]

Several time in the past, how you voted could have meant your job and sometimes your life. History has this thing where it tends to repeat itself.

Imagine somethings like this that could happen if people knew how you voted.

Lets say your landlord found that you voted for the property tax increase to fund the schools. So he raises your rent and only the rent of people who voted for it. (or raises your rent 6 months in advance of everyone else's because of it)

What about you boss finding out that you voted from someone who was going to raise taxes on them and increase regulation in the field your job covers. So now you are the first to be let go when business slows down because of it.

How about a problem with crime in your neighborhood and nothing is getting done about it because no one in your neighborhood voted for the current mayor. But other neighborhoods seem to have extra patrols and so on.

How about when you get pulled over for something minor like a tail light being out or something. The deputy find you voted for the current sheriff or mayor or whatever and gives you a warning but when he finds out you didn't vote for his guy gives you an $90 ticket.

If some people who have a little bit of power over you knew who you voted for or against, they could use that for other then honorable reasons.

Re:How long

[FLEB]

If you have paper-trails that are shown to the voter-- even unmarked and nonsequential paper-trails-- there is a physical record that the voter can verify and "throw a flag" on if it comes out incorrect. That, and pre-testing and examination of the process can make voting secure enough that anonymity need not be given up.

This is an Ohio Problem

[DeanFox]

The privacy issue he's discussing could possibly be limited only to Ohio. I've voted in Ohio and they're checking ID and manually writing down on a sheet of paper who votes in the order they walk in the door. The machine spits out vote results in the same order. Duh.

This "problem" has nothing to do with a "machine paper trail". It's not even related. I hope this argument isn't used to stall the progress we're making in fixing the vote system.

In Georgia where I'm at now a list of voters, in the order they vote, doesn't exist. In my county they check your ID then line through your name on a print-out. Who voted in what order cannot be determined. A machine paper trail wouldn't change that.

This is an Ohio problem not a voting machine paper trail problem.

-[d]-

Re:Why are these records even KEPT AT ALL in Ohio?

[JimBobJoe]

For that matter why should anyone have access to the records of who voted at all?

The reason that data is public is because it's useful for politicians and their campaigns. For instance, if only 20% of registered voters show up to vote for the odd-year city council races, then the data of which 20% show up is invaluable. The city council candidates only need to send out campaign materials to those voters who reliably vote at those elections and can ignore people who only show up for the presidential elections.

Another example is that the poll workers (at least here in Ohio) maintain several lists of voters who voted during the day (it's a slight pain in the ass actually because someone has to be assigned to the boring job of checking off on two or three lists who came in to vote.)

Those lists are posted periodically during the day...I want to say the first one is posted at 11am.

So at 11am, a list of all the registered voters in the precinct is posted, with check marks next to the names of the voters who voted.

During the presidential election, people working for the campaigns come down and look at the lists. If they know that John Smith is a registered Republican voter (party registration is another public record) and they see he hasn't voted by 11am, they might give him a call to make sure he comes by. If he hasn't voted by 4pm (which I believe is the posting of the last list) then they might send someone over to his house because they know he is an older gentlemen who has voted consistently Republican for decades now and his vote will be invaluable.

I find those voter lists postings a terrible pain, particularly because they're an obligation of the poll workers but their purpose is to help the candidates themselves, not the integrity of the voting process itself.

We don't want voting machines. We want nice pens.

[raehl]

We want paper ballots, and very advanced pens.

Here's the way modern voting should work:

1) Show up, 'prove' (in the definition of whatever state you're in) you're an eligible voter, receive ballot.
2) Go to electronic voting machine. Place ballot in machine.
3) Enter your votes in the touch screen.
4) Once you are satisfied with your votes, press the 'Print Ballot!' button.
5) Machine prints your votes on the ballot in human-readable and machine-readable form.
6) Take ballot. Review your votes on the ballot. If your votes are correct, place ballot in ballot box. If not, take your ballot to an election worker, where it is marked void and you get a new ballot and try again.

If you want to be REALLY cool, make it so that each ballot can be filled out by hand as well, so if you have a technical failure in the voting machines, or an insufficient number of voting machines, you can continue the voting the old-fashioned way.

At the end of the election day, feed the ballots through your vote counting machines. In case of doubt, count the ballots by hand.

See, that wasn't that hard, was it?

Re:We don't want voting machines. We want nice pen

[raehl]

I hope you can read Barcode or whatever gets printed as machine-readable on the ballot? How else would you know what the machine printed on it, never mind what the human-readable part says.

Why would you hope that? It doesn't matter.

Think of it this way. What if we recorded your vote in English and German (assuming for a moment that an average American can read the english vote record and not the german vote record), and then we had Germans count the German vote record.

So we run our election, give the ballots to the Germans in groups of 1000, and the Germans give us a count of votes for each group.

Now we want to check that the count the Germans gave us is accurate. So what do we do? We pick a few of those groups of 1,000 and we count the English records on those ballots and make sure they match the count the Germans gave us. Setting aside the issue of whether what's written on the ballots in German matches what is written in English, this audit is the only way to make sure the Germans aren't lying when they give us the final count. And looking at the issue of the German votes matching the English votes, while each voter can't check this, it would be pretty obvious to someone who knows English and German that the ballots were wrong with casual observation.

Now, lets say that instead of having Germans count German vote records, we just had Americans count the votes? Then what would we do to make sure the vote count was accurate? The same thing: We'd give the votes to the counters in groups of 1,000, then pick a couple groups and recount them to make sure they match.

In this analogy, the bar code (or whatever) is the vote record in German, and the Germans are the vote counting machines. It doesn't matter that the voter can't verify that the German written on their ballot is accurate, because the voter can't verify that the Germans themselves are accurate either, just like the voter can't verify that the vote counting machines are accurate. The only way to verify that is to do an audit and make sure that the totals of hand-counted English voting records match the totals of machine-counted machine-coded voting records.

So, it doesn't matter if every voter can verify that the machine-readable record matches their human-readable record, as long as both are on the ballot. A quick check by someone who can read the human and machine readable portions of the ballots will make it obvious if they don't match, and separate from that, you have to do other checking to verify that the counting machines are accurate anyway, and that check will also detect any ballots where the machine records don't match the human-readable records as well.