Why computer scientists prefer paper ballots

By Wenke Lee, Ph.D.

Today, Georgia’s “Secure, Accessible, and Fair Elections (SAFE) Commission” delivered to the state legislature a final recommendation for new, more reliable election equipment. I was honored to serve as a cybersecurity expert for the SAFE Commission to help improve a process at the very core of democracy – secure elections and the right to a private vote. However, I ultimately chose to vote against the Commission's final report even though we agreed on many points. Below is a summary of everything I believe Georgia must consider going forward.

The SAFE Commission was charged with studying options for Georgia’s next voting system, and our discussions focused heavily on which type of voting equipment to use at physical polling places, risks to election security and hacking methods, concerns for voter accessibility at physical polls, and intergovernmental coordination. State legislators next will review and ultimately determine which new election system to adopt, which new processes to enact or change, and how best to appropriate funds for purchase, maintenance, staffing, training, and voter education.

Toward Better Security: A voting system must provide a voter-verifiable paper audit trail that clearly shows all votes cast by each voter. The best solution is to use paper ballots that are hand-marked (so that the voter casts and verifies their selection in a single act), optically scanned for tabulation, and dropped into a safe box for physical audit before certification of election results.

The current generation of ballot-marking devices (BMDs) rely on technology to capture voter choice, then give the voter a post-record receipt that is scanned for tabulation. These do not meet the requirements of a voter-verifiable paper audit trail. First, a vulnerability remains that the device may not accurately record a vote or provide a correct receipt back to the voter. Second, there has been no rigorous study to demonstrate that voters are willing or able to verify printouts match their votes. Quite to the contrary, studies and observations at polling stations have shown that many voters do not spend time to verify a receipt, or even if they do, they don’t have sufficient memory to recall all votes cast and spot errors. That is, many voters are not able to verify the validity of their BMD printouts. In short, we cannot use BMDs with paper receipts because the printouts are not guaranteed to be valid and therefore are insufficient for a post-election audit.

The cybersecurity community – including computer scientists from premier universities and Fortune 10 companies, as well as the nonpartisan group, Verified Voting – has been clear that any method other than hand-marked paper ballots raises too many cybersecurity vulnerabilities. Numerous studies by nonpartisan, academic and scientific organizations conclude that risks to election systems are real and concerns about nation-state threats are valid. No system is ever fully cybersecure, and many will argue that only zero risk is acceptable to election integrity.

The public, too, has been clear. Citizens expressed a nearly unanimous point of view to SAFE Commissioners, which was a plea that lawmakers follow the guidance from cyber experts and embrace hand-marked paper ballots. If the state Legislature chooses another option, it owes the public a thorough explanation of why – a point I twice expressed to the Commission.

Maintaining Accessibility: Accessibility experts attest that voters with disabilities are more confident they have a private vote when they can use the same ballot or voting machinery as other voters at large. Georgia state law currently requires at least one ballot-marking device (BMD) or direct-recording electronic (DRE) voting machine per precinct. Should the state adopt hand-marked paper ballots, disabled voters may opt for an assistant who helps them complete their ballot or continue to use the BMD or DRE option. Security under this scenario should entail new BMD or DRE equipment, annual cybersecurity examinations, pre-election equipment testing of every device, and overall IT management at every county and state election office in accordance with the National Institute of Standards and Technology (NIST) guidelines.

Ensuring Fairness and Accuracy: Georgia should establish a process to uniformly audit elections across all counties and do so prior to certification of election results (“pre-certification audit”). No such process exists in Georgia today but does in a majority of other states. Pre-certification audits will improve election security, integrity, and public trust in outcomes.

Other Recommendations:

• We need to hold voting system vendors to a very high standard. In particular, they should be required to provide evidence based on rigorous, scientific studies that their products meet the requirements of providing a voter-verifiable audit trail of all votes cast. Pharmaceutical companies are required to show proof through very rigorous, large-scale scientific studies that their new drugs are sufficiently effective and that side effects are well-understood before they are allowed to enter the marketplace. Why are we not holding the election/voting system vendors to similarly high standards? Is election security/integrity not important enough?
• Georgia can save money and avoid the cyber risks of aging voting machines by leasing rather than owning election equipment. It is a worthwhile “burden” to re-examine the cyber threat landscape and available solutions every few years. If we must use computerized systems, then we should always use the latest, most effective technologies.
• Print-on-demand ballots at a polling place will help reduce costs and the logistical burden of heavy volumes of paper. Newer systems such as ClearDesign by ClearCast provide intuitive graphic interfaces and tools that allow election officials to design ballots and visually verify the designs.
• The State must appropriate adequate funding to the Secretary of State’s Office for competitive IT talent and responsible maintenance of election equipment. Those responsible for this function must follow the best practices for security such as the guidelines published by NIST.
• The State must appropriate adequate funding across all 159 counties in Georgia to ensure that election integrity is uniform for both urban and rural voters.
• A new voting method of any kind requires the State to appropriate funding to train and educate both voters, poll workers, and county election officials.
• Overall, greater public education about cybersecurity risk is urgently needed. It was clear to me by participating in this process that gross misunderstandings about cyber risk are widespread among otherwise educated adults (such as the persistent misbelief that machines are not under the threat of cyberattack if they are not directly connected to the Internet). Universities, government and industry all have a responsibility to collaboratively educate the public about known risks behind technology products and behaviors.

The nation is watching Georgia, and Georgia has waited too long to act. Yet, I am encouraged by the healthy discussion organized by and brought to the SAFE Commission. Although not native by birth, I am proud today to be an American and living in a country that listens openly to the needs of so many diverse groups. It was especially powerful to see that groups not personally affected or inconvenienced by current voting equipment came to express concerns on behalf others, such as those who advocated for the disabled although not disabled themselves. I am hopeful that Georgia’s state Legislature and newly elected Secretary of State will address the needs of all voters, will consider the widespread advice that paper ballots can restore election integrity and make the best choice to improve election security.

For more about the SAFE Commission's cybersecurity discussions, view my August 2018 presentation to the group and prior memos to Commissioners.

Memo #1: Basic Security Requirements for Voting Systems: https://drive.google.com/file/d/1Qx4iLQc2qT618EVddUE2r9xDnP2mDEAG/view?usp=sharing

Memo #2: Addendum: Security Requirements: https://drive.google.com/file/d/1n0PLtN5rDSOTCBr2TtIFcjDfj_oE6sVC/view?usp=sharing