A better ballot?

When voters head to the polls Tuesday, those using punch-card ballots - notorious for their role in the 2000 presidential election recount - may do so with a lingering unease that their votes could go uncounted. Others will enter sleek new electronic voting booths bought at great price by a patchwork of states and counties trying to guard against butterfly ballots and hanging chads.

But a growing number of computer scientists are now warning that the new technology, far from solving America's voting problems, may actually make things worse. Electronic ballots can be miscounted too, they say - or the machines that tally them tampered with and traces of sabotage erased.

"If you look at the consequences for democracy, it's terrifying," says David Dill, a Stanford University computer-science professor who has led the charge to raise awareness about the machines' potential security flaws. "If we had a way to make [computerized voting] safe, believe me, we would. There's no way to run a reliable election without a verifiable paper trail - that's what these machines don't have."

Others, including makers of the electronic systems and politicians who tout them, argue that democracy always has been a messy process and that no technology is foolproof. As long as there's been a vote, they say, there have been ballots destroyed, misread, and counterfeited; machines worn out or sabotaged; officials bribed; voters bullied or denied their rights. Some disabled citizens have been unable to vote privately, illiterates have been unable to vote knowingly, and voters with limited English have not understood how to cast ballots that count. Electronic voting is the latest in a long line of imperfect solutions, its proponents say, but it's the best option there is.

Voting was a matter of assessing shouts and shows of hands back in Colonial days. In the 1770s, these unverifiable counts were replaced by ballots written longhand, which left a paper trail but took a long time to tally. In 1892, self-tallying lever machines sped up the process, but again left no paper record. When punch-card ballots hit the scene in the 1960s, jurisdictions began to replace the old lever machines. But the punch-card system had its own weaknesses. Even before the 2000 Florida fiasco, some states had switched to the mark-sense or optical-scan ballots, which are much like fill-in-the-bubble standardized tests.

After the recount debacle, officials scrambled to ensure that no future chads would be left hanging. Congress passed the Help America Vote Act of 2002 (HAVA), but has so far supplied only $664.5 million to fund it. So solutions have come in fits and starts, with counties adopting a hodgepodge of systems (see map). Last November, Georgia became the first state to install touch-screen machines at all its polling stations, under a $54 million contract with Diebold Election Systems, a supplier of Direct Recording Electronic voting systems (DREs).

Many Georgia voters were impressed. Kim Hullett, who used a new model in Fayette County's latest election, says the machines - which work much like automatic teller machines - were easy to understand, kept lines moving, and meant she and her husband could track election results on the Web as they heard about them on the TV news.

But Professor Dill, at Stanford, had doubts. A concerned activist had sent him a copy of the Diebold system's source code - the road map to its computer voting software - which the company had been storing on a publicly accessible server. Diebold says this code was partial and outdated. Dill gave the code to a team of computer security experts led by Avi Rubin, technical director of the Information Security Institute at Johns Hopkins University.

The team's report, released in July, marked the first time any company's voting-system software has been publicly evaluated by an academic team. Over 24 pages, it details what Dr. Rubin describes as system-security flaws the average teenager today would be computer-savvy enough to exploit.

Two big flaws, Rubin says, could give rise to any number of nightmare scenarios. The first: The machines' software is encrypted in only the most basic ways, so people with access to a machine before Election Day could easily get into it and, for instance, change the program so that all votes for one candidate go to an opponent. The second: Diebold machines, like comparable machines sold by Sequoia Voting Systems and Election Systems & Software, produce no paper record of a vote, making recounts impossible. A computer science professor, Rubin says he's all in favor of computerizing needless paperwork - but sometimes, in the interest of democracy, you need to kill a few trees.

Diebold rebutted the team's report, arguing it failed to take into account all the checks and balances that ensure election security. Rubin's team argued back that poll workers cannot be expected to make up for security flaws in election machines.

Caught in the crossfire, Maryland put on hold a $55.6 million contract with Diebold to outfit the entire state, and asked Scientific Applications International Corp., an independent research firm, to investigate. Though the firm's report cautiously confirmed some of the Rubin team's findings, it said many flaws could be corrected, and Maryland decided to go ahead with the purchase. Last month, two lawmakers requested a further review of the matter by an independent state agency.

Meanwhile, states are in limbo - awaiting word on the security of DRE machines before spending more on them, as well as late-arriving HAVA funding. The 2002 act mandates numerous state and county reforms, such as establishing reliable voter rolls (many African-Americans were mistakenly cut from Florida's 2000 eligible-voter lists, and in Denver last month, nearly 200 deceased voters were invited to cast absentee ballots).

The law does not require states to install electronic systems, but the technology holds appeal because of its flexibility, says Roy Saltman, a private election- technology consultant. DREs can give instructions in many languages, and can be adapted for visually impaired voters. HAVA requires that all new systems and safeguards be in place by January 2006, a deadline many states expect to miss.

Critics and some proponents of DREs agree on one thing: the need for a paper audit trail so votes can be recounted. A bill now before Congress would add that requirement.

1770s Balloting replaces a show of hands or voice votes. Voters write out names of their candidates in longhand, and give their ballots to an election judge.

1850s Political parties disperse preprinted lists of candidates, enabling the illiterate to vote. The ballot becomes a long strip of paper, like a railroad ticket.

1869 Thomas Edison receives a patent for his invention of the voting machine, intended for counting congressional votes.

1888 Massachusetts prints a ballot, at public expense, listing names of all candidates nominated and their party affiliation. Most states adopt this landmark improvement within eight years.

1892 A lever-operated voting machine is first used at a Lockport, N.Y., town meeting. Similar machines are still in use today.

1964 A punch-card ballot is introduced in two counties in Georgia. Almost 4 in 10 voters used punch cards in the 1996 presidential election.

1990s Michigan is the first to switch to optical scanning, used for decades in standardized testing. One-quarter of voters used the technology in the 1996 election.

2000 A storm erupts over Florida's punch-card ballots and Palm Beach County's "butterfly ballot" in the presidential election.

2002 New federal law authorizes $3.9 billion over three years to help states upgrade voting technologies and phase out punch cards and lever machines. Georgia is the first state to use DRE touch-screen technology exclusively.

Sources: Federal Elections Commission; "Elections A to Z," CQ, 2003; International Encyclopedia of Elections, CQ Press, 2000; League of Women Voters