Testimony of Michael I. Shamos
December 7, 2004
Chairman: My name is Michael Shamos. I
have been a faculty member in the
Before proceeding with my testimony, I want to express admiration and support for Linda Lamone, who conducted a successful election while having to defend herself against removal from office and at the same time against a meritless lawsuit alleging that the Board of Elections’ choice of a statewide voting system was illegal and unconstitutional. It is remarkable that she was able to survive both attacks and simultaneously lead the state through its election without untoward incident.
There has lately been a call from some computer scientists and advocacy groups to enhance the trustworthiness of elections by requiring electronic voting machines to produce a paper document that is capable of being viewed by the voter prior to leaving the voting booth, to assure herself that her vote has been properly understood by the machine. Further, this paper document is intended to be retained by election officials to be used in the event that a recount is conducted, the premise being that the paper would be the most reliable expression of the voter’s intent and furthermore was actually viewed by the voter during the act of voting.
It is true
that if the integrity of the paper record can be maintained for a suitable time
after the election, then the paper trail theoretically allows an accurate
recount to be conducted. However, no one
knows how to maintain that integrity.
Virtually all ballot frauds conducted in the United Stated during the
last 150 years have involved physical manipulation of paper ballots. These crimes are not things of the past but
occurred as recently as last month during the election in the
Since the New York Times began publishing in 1851, it has printed over 4700 articles on ballot fraud, representing over 800 separate incidents. That works out to an average of one article every 12 days for the last century and a half. Once a machine is outfitted with a paper trail, the paper itself becomes a target for tamperers and it is no longer necessary to mount a difficult assault on the voting equipment. How difficult is it to tamper undetectably with DRE machines? So difficult that not only has it never been done, but no one has even proposed a credible mechanism for doing it.
There are proposals before various state legislatures to require a paper trail on all electronic voting machines. That kind of requirement is very bad idea. For one thing, it is rarely correct to enact into legislation specific technical solutions to a problem that has not been studied by engineers and whose scope and dimensions remain unknown. Freezing a solution in statute not only removes any incentive for manufacturers to develop better systems but absolutely prevents that from happening. If an excellent but different solution cannot be certified because it lacks a paper trail, no manufacturer will waste money developing or attempting to market such a thing.
What we are really after is not paper as an end in itself, but voter verifiability, which is providing the voter with proof that her vote has been understood correctly, recorded correctly and will be counted correctly. The paper trail provides only the first kind of verifiability, namely that the vote was understood correctly by the machine. It provides no assurance that the vote was counted, ever will be counted, or will even survive intact in the event a recount is necessary.
By contrast, the VoteHere system provides all three kinds of verifiability and goes even further. It allows any person, once the election has been held but without inconvenience to election officials, to verify independently that all the votes have been tabulated properly.
Voter verifiability is a good thing. Paper trails are probably not. The point is that we don’t know because no one has ever conducted a study of paper trails. We have no idea whether they are more or less secure than DRE machines, so it is surely too early to enact a law requiring them.
be pointed out that HAVA requires all electronic voting machines to have the
capability of producing a permanent paper record of every vote cast. The machines currently used in
It is also useful to note that DRE
machines have been used in the
Even if the legislature were to mandate the use of retained paper trails, it would be impossible for election officials to comply. The first reason is that no voter-verifiable retained paper trail device has ever been manufactured. The paper trails produced by machines presently on the market are not voter-verifiable because they contain bar codes and cryptographic indicia that are unreadable by the voter and can be used to invalidate a ballot without the voter’s knowledge. Even the computer scientists who favor paper trails concede this to be true.
understand that some members of the Committee viewed the Sequoia paper trail
that was used this year in the primary and general elections in
There is no
reel-to-reel paper trail is not permitted under
certainly within the power of the Legislature to repeal the secrecy
requirement. However, among all the
I do urge the legislature to pass a bill requiring voter verifiability. It should not, however, impede progress by mandating the use of paper trails.
I thank you for the opportunity to appear before the Committee today.