Testimony of Michael I. Shamos

Before the Maryland General Assembly House Ways & Means Committee

December 7, 2004

Madame Chairman: My name is Michael Shamos. I have been a faculty member in the School of Computer Science at Carnegie Mellon University in Pittsburgh since 1975. I am also an attorney admitted to practice in Pennsylvania and before the United States Patent and Trademark Office. From 1980-2000 I was statutory examiner of electronic voting systems for both Pennsylvania and Texas and participated in every voting system examination held in those states during those 20 years. In all, I have examined over 100 different electronic voting systems, which I believe to be the largest number ever inspected by one person in the United States. I am teaching a course in Electronic Voting at Carnegie Mellon University this semester and recently participated in a review conducted by the Commonwealth of Pennsylvania on the security of voting systems in all 67 Pennsylvania counties.

Before proceeding with my testimony, I want to express admiration and support for Linda Lamone, who conducted a successful election while having to defend herself against removal from office and at the same time against a meritless lawsuit alleging that the Board of Elections’ choice of a statewide voting system was illegal and unconstitutional. It is remarkable that she was able to survive both attacks and simultaneously lead the state through its election without untoward incident.

There has lately been a call from some computer scientists and advocacy groups to enhance the trustworthiness of elections by requiring electronic voting machines to produce a paper document that is capable of being viewed by the voter prior to leaving the voting booth, to assure herself that her vote has been properly understood by the machine. Further, this paper document is intended to be retained by election officials to be used in the event that a recount is conducted, the premise being that the paper would be the most reliable expression of the voter’s intent and furthermore was actually viewed by the voter during the act of voting.

It is true that if the integrity of the paper record can be maintained for a suitable time after the election, then the paper trail theoretically allows an accurate recount to be conducted. However, no one knows how to maintain that integrity. Virtually all ballot frauds conducted in the United Stated during the last 150 years have involved physical manipulation of paper ballots. These crimes are not things of the past but occurred as recently as last month during the election in the Ukraine, in which ballot boxes were stuffed with bogus votes. Voting machines were not used in that election. If DRE machines had been used, that country would not now be on the verge of revolution.

Since the New York Times began publishing in 1851, it has printed over 4700 articles on ballot fraud, representing over 800 separate incidents. That works out to an average of one article every 12 days for the last century and a half. Once a machine is outfitted with a paper trail, the paper itself becomes a target for tamperers and it is no longer necessary to mount a difficult assault on the voting equipment. How difficult is it to tamper undetectably with DRE machines? So difficult that not only has it never been done, but no one has even proposed a credible mechanism for doing it.

Maryland owns over 16,000 voting machines. If each of them produced a paper trail, we would be faced with protecting 16,000 rolls of paper, which is a problem equivalent to protecting ballot boxes, something that history has shown not to be realistic.

There are proposals before various state legislatures to require a paper trail on all electronic voting machines. That kind of requirement is very bad idea. For one thing, it is rarely correct to enact into legislation specific technical solutions to a problem that has not been studied by engineers and whose scope and dimensions remain unknown. Freezing a solution in statute not only removes any incentive for manufacturers to develop better systems but absolutely prevents that from happening. If an excellent but different solution cannot be certified because it lacks a paper trail, no manufacturer will waste money developing or attempting to market such a thing.

What we are really after is not paper as an end in itself, but voter verifiability, which is providing the voter with proof that her vote has been understood correctly, recorded correctly and will be counted correctly. The paper trail provides only the first kind of verifiability, namely that the vote was understood correctly by the machine. It provides no assurance that the vote was counted, ever will be counted, or will even survive intact in the event a recount is necessary.

By contrast, the VoteHere system provides all three kinds of verifiability and goes even further. It allows any person, once the election has been held but without inconvenience to election officials, to verify independently that all the votes have been tabulated properly.

Voter verifiability is a good thing. Paper trails are probably not. The point is that we don’t know because no one has ever conducted a study of paper trails. We have no idea whether they are more or less secure than DRE machines, so it is surely too early to enact a law requiring them.

It should be pointed out that HAVA requires all electronic voting machines to have the capability of producing a permanent paper record of every vote cast. The machines currently used in Maryland already have this capability. There is no requirement that the paper record be shown to the voter or that it become the official ballot.

It is also useful to note that DRE machines have been used in the United States for 25 years without a single verified incident of tampering. This calls into question the very need for a paper trail.

Even if the legislature were to mandate the use of retained paper trails, it would be impossible for election officials to comply. The first reason is that no voter-verifiable retained paper trail device has ever been manufactured. The paper trails produced by machines presently on the market are not voter-verifiable because they contain bar codes and cryptographic indicia that are unreadable by the voter and can be used to invalidate a ballot without the voter’s knowledge. Even the computer scientists who favor paper trails concede this to be true.

I understand that some members of the Committee viewed the Sequoia paper trail that was used this year in the primary and general elections in Nevada. In Nevada’s haste to bow to popular pressure, it adopted a system that violated its own law. The Nevada Revised Statutes, §293B.065, requires that “A mechanical voting system must secure to the voter privacy and independence in the act of voting.” The Sequoia paper trail, as well as the paper trail used by Avante and the one proposed by Diebold, are referred to as reel-to-reel paper trails. That is, the voters’ ballots are maintained on a continuous roll of paper tape that is fed from one reel and taken up by another inside the machine. The first ballot on the tape was cast by the first person who voted on the machine. The last ballot belongs to the last voter, and all the others are maintained in sequential order in between. A simple comparison of the paper trail with the poll list reveals the complete contents of every voter’s ballot – a 100% violation of ballot secrecy.

There is no law in Maryland that would prevent any citizen from obtaining the poll list, nor from remaining in a polling place and writing down the order in which the voters appeared and which machine they voted on. If a recount were ever conducted, it would be possible to publish a list of how every voter in the jurisdiction voted. Even the computers scientists who favor paper trails condemn reel-to-reel paper trails as violating voter privacy.

A reel-to-reel paper trail is not permitted under Maryland law. Section 9-102(c) of the Maryland Election Law provides that “The State Board may not certify a voting system unless the State Board determines that: (1) the voting system will: (i) protect the secrecy of the ballot.” The reel-to-reel paper trail does not do that. There is some suggestion that if a paper trail is adopted then the paper record would become the official ballot in preference to the electronic one. That is also illegal in this state. Section 9-203 of the Election Law, relating to ballot standards, requires that “Each ballot shall: … (4) protect the secrecy of each voter's choices.”

It is certainly within the power of the Legislature to repeal the secrecy requirement. However, among all the states, Maryland already has among the weakest of ballot secrecy provisions. Secrecy is not mandated by the state constitution, and it does not even appear to be a crime in Maryland to learn how a voter voted, to spy on a voter or to reveal a voter’s ballot to a third person. Ballot secrecy needs to be strengthened in this state, not eviscerated.

I do urge the legislature to pass a bill requiring voter verifiability. It should not, however, impede progress by mandating the use of paper trails.

I thank you for the opportunity to appear before the Committee today.