How Future Deliberative Democracy Can Be Sure Its E-Vote Is Trustworthy

By Vincent Campbell

The nation’s founders resorted to representative democracy because there was no practical way for large numbers of citizens to participate directly in governmental decisions. That barrier no longer exists. Computers and communications technology now make it possible to involve ordinary people in the process of making policy, and to integrate the judgments of small groups, large groups, states and whole nations.

Since the 1960’s various scientists and advocates have demonstrated that technology can be used to support deliberative democracy in which citizens examine an issue in some depth then give their considered judgments on it. In 1973 a San Jose school district used Televotes (Campbell, 1974) to inform people of policy options with supporting arguments pro and con, then collect their electronic votes on the policy choice of that week. Becker and Slaton (2000) expanded Televoting to include live in-depth discussion of the issues by participants.

The Jefferson Center (see www.jefferson-center.org) assembled numerous Citizens Juries to examine a public policy issue in depth, query experts, and arrive at a recommendation. Fishkin’s (2006) Deliberative Polls use electronic technology to support in-depth citizen analysis of issues, and have been applied in several countries. He has found that, as a result of participating, citizens tend to become more informed about both sides of an issue, lending weight to the contention that quality of citizen input can be high if the situation is arranged for this purpose. We found this same benefit from participation in San Jose.  America Speaks has also involved large numbers of citizens in public policy analysis, including social security policy (see www.americaspeaks.org).

An important feature of many of the above efforts is the integration of the informed judgments of many citizens into policy recommendations. Electronic means are essential to this integration, whether used directly by all the citizens, or to organize the deliberations of many small face-to-face groups. And the larger the scale of citizen participation, the more vital electronics will be to the process in the future.

But there are many ways the integration process can be subverted by those who seek to distort the process toward their own ends. These include non-electronic subversions such as facilitators and writers who slant recommendations toward one side, but the focus here is on vulnerabilities to electronic fraud in voting, whether such votes are to choose among policy options in deliberative democracy, or to choose among candidates for office.

Many computer scientists assert that electronic voting systems cannot be trusted (e.g. Feldman et al., 2006). Computer processes may be altered secretly, either directly or with the aid of a virus. Such computer fraud could produce vote counts that are plausible, but changed just enough to throw the election in a close contest. We might not even be able to detect the fraud if, after cheating on the count, the virus is clever at restoring the proper code and removing its own traces.  

 Defenders of electronic voting describe various ways that such fraud can be made more difficult. These include making the voting software open for all to see, inspecting the machines, auditing electronic counts, and having a paper trail. But if hackers are diligent these safeguards may not suffice. And even these safeguards are not in place now in most states that use voting machines.  It is odd that we demand fool-proof ATM’s at out banks, but allow sloppy voting systems that can throw elections.

 There has in fact been a growing demand for electoral reform in the last five years. Perhaps the one reform getting the most attention is to require voting machines to produce on paper the votes cast by a given voter. The paper votes can then be recounted if results are challenged. However, even an electronic system with a paper trail is quite vulnerable to cheating unless the voter herself checks the paper result and then places it in the vote box.  

For example, suppose the computer records an electronic vote and spits out two copies of  the vote on paper--one going into the ballot box in case a paper recount is needed and one going to the voter. A dishonest computer could show the voter on screen and on his paper ballot that he voted “Yes” while recording a “No” on both the paper ballot in the ballot box and in the electronic file that is used to count votes. The fraud would succeed in both the electronic results and the paper recount.

Today, to prevent this kind of fraud we have to labor through the same slow procedure used for centuries: The voter has to get herself to a voting station, have her registration verified, cast a vote, check the result on paper to see if it is correct, and put it in the ballot box. The only gain from the computers has been rapid counting, and if the result is challenged, even the count must remain uncertain until a very slow manual count of paper votes is conducted. Voting by mail is somewhat less cumbersome but still fairly labor intensive.

But it is premature to give up on using computers for efficient, reliable voting. Simple information technology can be used to allow the public to verify the voting results without laborious paper printing and manual counting, and this can be done in a way that preserves the privacy of how each person voted.

Vote and Voter Verification Lists

Three kinds of error and corruption relate to trust in electronic voting:

(1) Unqualified voters cast votes (dead voters, fictional voters, vote stealing)

(2) Qualified votes are recorded wrongly or not recorded

(3) Vote totals are counted wrongly.

 In 1993 Evan Ravitz proposed a system for dealing with the second error above: a published list of all votes, except that instead of identifying each voter by name, the voter is identified by a serial number indicating the time order in which votes were cast, a number the voter retains so he can use it to inspect the published list and see if his vote was recorded correctly. Only the voter knows his serial number.

Ravitz proposed the list as part of an automated telephone voting system, but it is equally applicable to any electronic voting system. The number need not be a printed serial number, but could be any unique personal identification number (PIN) known only to the voter and the secure computer system.

The table below illustrates a published vote list. Such a list can be updated daily or hourly during a pre-set voting period and displayed for the public on a web site. Newspapers might publish the final list when voting closes.

                                                            Vote List

Note that the list is in order of PIN to make it easy for each voter to find his vote. Also, each precinct (or other defined group of modest size) has a separate list to keep the lists reasonably short.  A vote for an elected office shows the candidate names instead of Yes or No. Votes on other issues or candidates can be shown in the same list by adding columns to the right. 

If the voter finds his vote is in error, or is not listed even though he voted, he notifies an election official or an anti-fraud website. The voter can then correct or change his vote after authentication of his identity. He can check again after the next update of the list to be sure the change was made correctly.  

The procedure can keep a running tally of the number of claimed errors in votes for each candidate or position, and this tally can be displayed for the public on a website and reported in other media. These tallies will give the public a sense of the magnitude of the error/fraud problem. (A small percentage of the claimed errors will be caused by the voter having a poor memory or engaging in mischief.).  

The list can also be used to verify that the total number of votes for each position or candidate has been counted correctly.  Downloading the list as a spreadsheet would make the counting easy, and precincts or groups could be pooled to give total results by county or state.

In addition to the vote list above, a second list is needed to verify that only qualified voters have voted. This is a list the same length as the one above, showing the names of all persons in the precinct or group who have voted in this election, but not how they voted. An example is shown below. Note that the voter

Voter list for Precinct 23

list is in alphabetical order by last name, rather than in PIN order, to make it easy for any voter to find her name, but more importantly so that no one can compare the two lists and learn how someone voted.

The type of fraud to be prevented by the voter list is stuffing a ballot box with fictional or unqualified voters. Anyone can check the voter list against the registered voter rolls to see if a listed voter was not registered. Registered voter rolls maintained by counties and states contain errors, of course, mainly people who have died or moved. A committee of local volunteers who are familiar with the precinct could identify questionable names on the voter list and submit them to election officials for review and update of registration rolls, as well as for validating the current vote.  

All challenged votes, whether corrected or not, are considered provisional until validation is completed, which might delay final results by a few days in an official election if the outcome hinges on the provisional votes.

Errors can still occur through neglect if people do not bother to check the lists. But when the stakes are high or there is reason to suspect fraud, voters will be more inclined to check the results. The opportunity to keep the system honest is there, if people wish to use it. Whether the voting period is a day or a week, if error claims suddenly appear in sizable numbers, this will arouse the suspicion of other voters and many more will immediately check their own votes. To avoid last-minute fraud, it would be wise to have a probation period after the vote officially ends during which fraud claims can be examined and resolved.

Security and Privacy

Many people will be concerned that a computer somewhere has information that can link their names to how they voted. As a protection against an intrusion on voter privacy, the file that links names to PINs can be a highly secure file that can only be opened by the simultaneous access of a panel of trusted persons representing all major interests. This is analogous to traditional vote counting in which competing parties must be there together for the count. In this way privacy of votes can be preserved. Also, after any given election is completed, all information linking votes to voters could be destroyed.

Some may object that the names of people who voted are publicized, even though currently voters must verify who they are at a polling place, or submit a mail ballot with their name on it. Nearly all citizens take pride in having voted, so this objection is weaker.

Conclusions

Using vote and voter verification lists as a system for checking validity of electronic vote results is potentially valuable for several reasons. First, it does not require trusting the accuracy of any computer hardware or software, so when computer errors occur or computer fraud is attempted, it can be detected and corrected. Anyone can merge results from all precincts and check the accuracy of the total results claimed by election officials, because the lists are the results. What you see is what you get.

Second, it is just as valid for remote voting (televoting) as for use of voting machines in voting stations. This means a large saving in election expense since votes could be cast from home, greatly reducing the need for voting machines. Most Americans now have computers and use the Internet. Those that do not could either go to an Internet voting station (e.g. at a library or school) or mail in their votes. Automated telephone voting would also be an option.

Third, since voting from home would be possible, initiatives could be spread throughout the year, rather than asking people to read 100 pages and vote on twenty issues in one day every other November.  If there were only one initiative in a given week, with supporting information pro and con appearing on a web site, perhaps preceded by a week of citizen deliberation and querying of experts, many more voters would be willing to study the initiative carefully and cast a better informed vote.

Finally, the heart of this plan is that ordinary citizens can check the accuracy and honesty of elections. History proves that neither public officials nor voting machine companies can always be trusted when careers and big money are at stake (see BlackBoxVoting.org). As the founding fathers recognized, ultimately it is the people who must ensure that government serves the public interest. And what could be more important for people to safeguard than elections. If elections are broken, democracy is broken. 

In America, community spirit and social capital have been diminishing throughout the late decades of the 20th century (Putnam, 2000), but there are signs of revival in the 21st century. Youth are participating more, both in elections and on the Internet. Deliberative democracy may be on the rise. It is more likely to succeed and endure if ways can be found to maximize the quality of citizen thinking on issues, and if electronic processes can be checked for accuracy.

REFERENCES

Becker, Theodore L and Slaton, Christa. The Future of Teledemocracy. Westport, Conn.: Praeger, 2000.

Campbell, Vincent.  The televote system for civic communication:  First demonstration and evaluation.  Palo Alto:  American Institutes for Research, 1974. (NSF Grant No. GI-37183).  Available from ERIC: Documents ED095896, ED095897, and ED107300.

Feldman, A.J., Halderman, J.A. and Felton, E.W. Security analysis of the Diebold AccuVote-TS voting machine. September 13, 2006. See http://itpolicy.princeton.edu/voting.

Fishkin, James S. The nation in a room: turning public opinion into policy. Boston Review, Vol. 31, No. 2. March-April 2006.

Putnam, Robert D. Bowling Alone. NewYork: Simon & Schuster, 2000