In the aftermath of the 2016 election cycle, interest in securing American elections from tampering or hacking has intensified. Given that 99% of our votes are counted by computers, and that computers are used in every aspect of the electoral process, election security is a top priority. For over a decade, Verified Voting has advocated for the widespread adoption of post-election risk-limiting audits (RLAs) alongside other best practices to facilitate a trustworthy and auditable record of votes cast.
A post-election risk-limiting audit (RLA) is one of the pillars of cyber security. In this day and age of nation state attacks on our election systems, it is very important for election systems to be resilient and provide a way for jurisdictions to identify problems and to recover from them. Security experts agree that the best method is voter-marked paper ballots (which voters choose to mark by hand or with a ballot marking device), having a deliberate and intentional step for voters to verify their ballot selections, providing a strong chain of custody of the ballots, and checking that the computers counted them correctly (RLAs).
Evidence-Based Election Ecosystem
Risk-limiting audits are one piece of the larger ecosystem of evidence-based elections that depend upon a trustworthy record to give confidence to election outcomes. There are some things that risk-limiting audits do not do. They do not tell us whether the voting system has been hacked. They do not and cannot determine whether voters actually verified their ballots. But they can detect and correct tabulation errors that could alter election outcomes — or provide strong evidence that a full hand count would yield the same outcomes.
However, several different aspects of election administration must come together to create an auditable, trustworthy record of voter intent:
Robust chain of custody procedures to safeguard the paper ballots and other artifacts of the election from beginning to end. These processes are not new: we use robust chain of custody procedures in the criminal justice system all the time. As outlined in Principle 4 of Principles and Best Practices for Post-election Audits, “paper ballots and electronic records of the results… [must be] fully secured from the time the ballots are received by election authorities until all audit or recount activity is completed.”
A paper ballot marked and verified by the voter while maintaining the voter’s privacy. The paper ballot can be marked by hand (using a pen or pencil) or with a computerized ballot marking device for voters who would like to use one. Regardless of how a ballot is marked, an essential step in the process is the ability for voters to intentionally and deliberately verify that the paper ballot correctly records their choices, especially when voters only have ballot marking devices at their precinct. Without such a deliberate and intentional process, it is harder to deem the paper ballot a trustworthy record of voter intent. Relatedly, it is equally important that polling place layouts preserve ballot secrecy and poll workers take care to ensure that the secrecy of a voter’s ballot is preserved. Poll workers should also be trained on procedures for handling voters’ complaints that the paper record produced by a ballot marking device does not reflect the voters’ choice. Poll workers must be provided with clear instructions for escalating complaints and removing equipment from service when problems are identified.
A risk-limiting audit (RLA) is a post-election process that is designed to check one thing: whether the voting system tabulated the paper ballots accurately enough that a full hand count would produce the same outcome. RLAs do this by applying statistical principles and gathering evidence from the voter-marked paper ballots. Risk-limiting audits have more value when all of the characteristics of generating a trustworthy record are met. A risk-limiting audit standing alone is not enough; nevertheless, the process of examining a sample of voter-marked paper ballots to assess tabulation accuracy is still a risk-limiting audit if it follows scientifically sound statistical principles. The RLA will still limit the chance of certifying an outcome if a full hand count of the paper ballots would correct it.
Conducting a risk-limiting audit pilot, even in a jurisdiction that uses all ballot marking devices, is an opportunity to identify weaknesses in the process and then work to correct them. Election officials using a variety of voting systems have said that conducting audit pilots gave insight into how to improve ballot handling, custody, and accounting – as well as encouragement that they can execute RLAs in larger elections with more at stake.
A risk-limiting audit pilot is not a reflection of whether the other pillars of the election ecosystem (paper ballots, verification, chain of custody) exist, and Verified Voting’s participation in audits and audit pilots in no way endorses any particular type of voting system. Verified Voting provides technical support to election officials on the specific method of conducting risk-limiting audits, as was the case in the recent pilots conducted in Mercer and Philadelphia counties in Pennsylvania as part of the statewide audit advisory group.
Verified Voting’s work in jurisdictions that have purchased all ballot marking devices for all voters provides those jurisdictions with insights into the steps necessary to change workflow to ensure a trustworthy record. Verified Voting advocates for choice in the polling place, including a system for voters to mark a ballot by hand using a pen and to confirm the selections before casting them. Ballot marking devices must be provided alongside handmarked paper ballots to provide options for those who cannot use a pen and those who prefer to use a computer. Both ways result in a “voter-marked” paper ballot that can be audited, but both ways must also provide the voter with an opportunity to verify the ballot before casting it.
Some commercially available systems will never meet the standard of generating a trustworthy record. Examples include, but are not limited to:
- A system that is incapable of tabulating votes accurately
- A system that does not encourage easy verification of the paper ballots produced by the ballot marking device. This happens when a voter cannot touch or handle the ballot, it is obscured by a cover, or the print is too tiny for a voter to read
- A system in which ballots travel over the printhead after voters cast them, increasing the risk of alteration or defacement
Verified Voting believes that it is not impossible for voters to verify the human-readable text on ballots printed by ballot marking devices, and we advocate for election officials to incorporate a deliberate step into the voting process. Because currently used ballot marking devices are relatively new, more research into their usability and how reliably and consistently voters check that the paper ballots are correct is critical.
We are not willing to abandon efforts to introduce better polling place procedures, as outlined above, for ballot verification at this juncture as we continue to advocate for choices for marking ballots in the polling place. We are hopeful that next-generation devices will solve these issues and produce a truly trustworthy record.