Skip to content

Voting Machines and the Paper Trail

Abstract

Voting machines were sold for a century as protection against fraud: first mechanical lever machines, then punched cards, then touchscreen computers. The touchscreen generation ran into a problem that no engineering fixed: a paperless machine asks voters to trust a count that neither they nor the poll workers can see. After Florida’s punched-card recount in 2000, the United States bought computers that security researchers broke within a few years. The Netherlands withdrew its voting computers in 2007 after activists made one play chess, Germany’s Federal Constitutional Court ruled their use unconstitutional in 2009, and Ireland sold its unused fleet for scrap in 2012. Brazil and India kept their machines, and India added a paper slip. The answer most democracies settled on is paper that a human can read, checked by a statistical audit.

Nedap ESD1 Voting Computer
Nedap ESD1 voting computer, photographed in 2017. Image: Raimond Spekking, CC BY-SA 4.0, via Wikimedia Commons.

Levers and Punched Cards

Votomatic III Open
Votomatic III vote recorder, opened. Image: Computer Election Systems, Inc. via Smithsonian, CC0, via Wikimedia Commons.

American inventors began filing patents for voting machines in 1875. The first machine used in a real election was Jacob Myers’s Automatic Booth, a lever machine installed in Lockport, New York, in 1892. Myers promised that it would “protect mechanically the voter from rascaldom, and make the process of casting the ballot perfectly plain, simple and secret.” Each lever turned a counter; there was no ballot to stuff, lose, or misread. The U.S. Standard Voting Machine Company, founded in 1900, built machines with rows of small levers behind a curtain, and by the presidential elections of the 1930s they were used in a sixth of American districts.

The lever machine also had no record of individual votes. If a counter jammed, nothing could be recounted, because nothing existed except the counter.

The punched card arrived from the computing side. Herman Hollerith’s cards had counted the 1890 census, and in the early 1960s Joseph P. Harris, a Berkeley political scientist who had written the standard reference Election Administration in the United States (1934), had the idea of letting voters punch their own. With William Rouverol of Berkeley’s mechanical engineering department he built the Votomatic: the voter slid a card into a holder and pushed a stylus through holes beside the candidates’ names, and a card reader tallied the ballots. IBM bought Harris Votomatic, Inc. in 1965 and left the business again in 1969. The design had a weakness that only mattered in a close race: on the 228-position Votomatic ballot, twelve punch positions sat over internal braces, where the small rectangles of card (the chads) tended not to come out cleanly.

Two other lines started in the same years. Mark-sense ballots, where the voter fills in an oval that a scanner reads, were first used in Kern City, California, in 1962. In 1975 the Video Voter, used in Streamwood and Woodstock, Illinois, was probably the first direct-recording electronic (DRE) machine in a real election: the voter pressed buttons and the machine stored the vote itself, with no ballot at all.

Florida, 2000

The presidential election of 7 November 2000 came down to Florida. The official count gave George W. Bush 2,912,790 votes and Al Gore 2,912,253, a margin of 537. In Palm Beach County the ballot was a “butterfly” punched-card layout with candidates on both sides of a single column of holes. A 2001 study in the American Political Science Review concluded that it caused more than 2,000 Democratic voters to vote by mistake for the Reform candidate Pat Buchanan, a number larger than Bush’s margin. Elsewhere, election officials held punched cards up to the light to judge whether a chad that was hanging by one corner, or only dimpled, counted as a vote.

On 8 December the Florida Supreme Court ordered a manual recount of all “under-votes” statewide, ballots that showed no vote for president. The U.S. Supreme Court stayed the recount the next day and on 12 December 2000, in Bush v. Gore, ended it: different counties had applied different standards to the same kind of ballot, and the Court held that no constitutional recount could be completed in the time left.

The Caltech/MIT Voting Technology Project reported in July 2001 that between four and six million votes had been lost nationwide in 2000, about 1.5 million of them through voting equipment. Its recommendation was to replace punched cards and lever machines with optical scanners. Congress passed the Help America Vote Act in October 2002, which created the Election Assistance Commission and authorized $325 million specifically to replace punched-card and lever systems. Counties replaced them with optical scanners, touchscreen DREs, or both.

The Touchscreen Years

Diebold, the Ohio safe and ATM maker, also sold voting machines, and its AccuVote-TS touchscreen became the machine of every county in Maryland and Georgia. The activist Bev Harris found that Diebold had left source code for its voting software on an anonymous FTP server. Tadayoshi Kohno, Adam Stubblefield, Aviel Rubin, and Dan Wallach read it and published their analysis as a Johns Hopkins technical report on 23 July 2003, later at the IEEE Symposium on Security and Privacy in May 2004. They described incorrect use of cryptography, unauthorized privilege escalation, and poor software development practice, and found that a voter could “cast unlimited votes without being detected.”

The same year the New York Times reported a fundraising letter by Diebold’s chief executive, Walden O’Dell: “I am committed to helping Ohio deliver its electoral votes to the president next year.” The letter proved nothing about the machines, but it turned the question of who wrote and controlled their software into a political one.

In September 2006 Ariel Feldman, J. Alex Halderman, and Edward Felten at Princeton published a study of a real AccuVote-TS, obtained from a private party. An attacker with one minute of access to the machine or its memory card could install software that changed votes, and they wrote a demonstration virus that spread from machine to machine through the memory cards poll workers use to load ballots and carry results, with no network needed. The panel protecting the card could be opened with a key of a model also used for office furniture, jukeboxes, and hotel minibars. More than 33,000 AccuVote-TS machines were in service; in the November 2006 election the TS and its successor TSx were used in 385 counties with more than 10 percent of registered American voters.

In 2007 California’s Secretary of State commissioned a review of the electronic voting systems of three vendors, decertified all three, and recertified them only under new conditions (see Matt Blaze, who led the source-code team for one of them).

Nedap in the Netherlands

The Nederlandsche Apparatenfabriek (Nedap) of Groenlo, a Dutch maker of electronic equipment, sold the most widely used European voting computer. By 2006 about 90 percent of Dutch votes were cast on its machines, most of them on the ES3B. It was a DRE: votes existed only in its memory.

The foundation Wij vertrouwen stemcomputers niet (“We do not trust voting computers”), formed around the activist Rop Gonggrijp, took up the question in 2006. When Nedap challenged critics to show that its software could be altered, they replaced the machine’s program by swapping two EPROM chips on the circuit board, which took less than five minutes, and loaded software that played chess. On 4 October 2006, a month before the national election, they showed on live television on Nederland 1 that a modified machine could shift votes. They also showed that radio emanations from an unmodified machine could be received several meters away and could reveal how someone voted.

The responsible minister, Atzo Nicolaï, barred the other Dutch voting computer, made by Sdu, from the November 2006 and March 2007 elections because of the same kind of emissions; voters in the 35 municipalities that used it went back to pencil and paper. In 2007 a government commission chaired by Frits Korthals Altes published its report Stemmen met vertrouwen (“Voting with confidence”), and the government decided that voting computers would no longer be used. Gonggrijp and Willem-Jan Hengeveld published the full analysis at the USENIX Electronic Voting Technology Workshop in Boston on 6 August 2007 and concluded that the ES3B was unsuitable for elections.

Germany and the Constitutional Court

The German Federal Electoral Act of 7 May 1956 prescribed official ballot papers in official envelopes but allowed the interior minister to approve “officially licensed vote-counting devices” instead. Devices with mechanical and electromechanical counters were approved under it, but they found no wider use, because they cost too much for the little time they saved. Nedap applied for German approval in 1997 and received it; its machines were first used in Cologne for the 1999 European election, in 29 municipalities for the 2002 federal election, and in 2005 more than 1,800 of them, mostly in North Rhine-Westphalia, served some two million voters in the federal election.

After the 2005 election a physicist from Frankfurt and his father, a retired political scientist, objected that the electronic count could not be checked. The Bundestag rejected the objection, and they took it to the Federal Constitutional Court. On 3 March 2009 the court ruled (2 BvC 3/07) that the principle of the public nature of elections, which it derived from the Basic Law, requires “that all essential steps of the election are subject to public scrutiny,” unless other constitutional interests justify an exception. The voting machines stored votes only electronically, so neither voters nor the election boards could verify that votes were recorded and counted correctly. The court declared the federal ordinance on voting machines unconstitutional because it did not ensure that only machines meeting those requirements were approved; the Electoral Act itself was not at fault. A printout or a display of the final result was not enough.

The 2005 election stood. There was no indication that any machine had malfunctioned, and the court ruled that protecting the elected parliament outweighed the error. Germany has voted on paper since.

Ireland

Ireland bought 7,500 Nedap Powervote machines and trialled them in three constituencies at the 2002 general election. A nationwide rollout planned for the 2004 European and local elections was put on hold after security concerns, and the Commission on Electronic Voting reported that it could not satisfy itself of the system’s accuracy. It called the system “effectively self-auditing,” and its experts found the electronic security easy to bypass. The commission’s conditions for further use included a voter-verified paper audit trail; retrofitting one was estimated at up to €27 million.

On 23 April 2009 the environment minister, John Gormley, scrapped the system, citing the cost of making it usable “at a time of more challenging economic conditions.” By then the machines had cost about €51 million, and storing them had cost more than €3 million. In 2012 the government sold the entire lot as scrap for about €70,000. The machines had never been used in an election after 2002.

Brazil and India

Urna Eletronica UE2020
Brazilian electronic ballot box, model UE2020. Image: TSE (Tribunal Superior Eleitoral), public domain, via Wikimedia Commons.

Two of the largest democracies went electronic and stayed. Brazil’s electoral court, the Tribunal Superior Eleitoral, set up a commission in 1995 to specify a national voting machine, the urna eletrônica. It was first used in the municipal elections of 1996, in municipalities with more than 200,000 voters, about 30 percent of the electorate, and in 2000 it reached every municipality. Brazil tried adding paper: a 2002 law required the machine to print each vote, and more than seven million voters in 150 municipalities used printers that year. The electoral court reported longer queues, delays, and printer failures, and a 2003 law dropped the requirement. A 2009 law reinstated printed votes from 2014; the Supreme Federal Court suspended it in 2011 and later struck it down.

India’s Chief Election Commissioner S. L. Shakdhar proposed a voting machine in 1977, and two state-owned firms, Electronics Corporation of India in Hyderabad and Bharat Electronics in Bangalore, built prototypes. In May 1982, 50 machines were used in a by-election in Paravur, Kerala. The losing candidate went to court, and on 5 March 1984 the Supreme Court nullified the result because the election law made no provision for machines. Parliament added one in March 1989. After limited use in 1998, India used electronic voting machines in all 543 parliamentary constituencies for the first time in the 2004 general election.

India then moved toward paper. On 8 October 2013 the Supreme Court, in Subramanian Swamy v. Election Commission of India, called a paper trail “an indispensable requirement of free and fair elections.” The voter-verifiable paper audit trail (VVPAT) prints a slip that the voter sees behind a window before it drops into a sealed box; it was first used that year in 21 polling stations of the Noksen constituency in Nagaland.

Estonia took a different route in 2005, with voting over the internet rather than on machines in polling stations.

Paper and Statistics

Paper alone did not solve the problem of counting: recounting every ballot by hand is slow, and counting none of them means trusting the scanner. Philip Stark, a statistician at Berkeley, designed an audit that hand-counts a random sample of paper ballots and keeps sampling until the evidence is strong enough or the count turns into a full hand recount. It was first tested in Marin County and two other California counties at the primary of 5 February 2008, and his paper “Conservative Statistical Post-Election Audits” appeared in the Annals of Applied Statistics the same year. Such procedures became known as risk-limiting audits: if the reported winner is wrong, the audit has a known, high chance of finding out.

In 2018 the U.S. National Academies of Sciences, Engineering, and Medicine recommended that all American elections be conducted with human-readable paper ballots by the 2020 presidential election. How that system held up against the fraud claims after the 2020 election is told in Tech and Democracy / Elections.

Dead End: The Paperless Voting Computer

The DRE failed for a reason that had little to do with any particular bug. An election has to be secret and verifiable at once: no one may learn how a voter voted, yet everyone must be able to check that the votes were counted as cast. A paper ballot does both, because the voter sees the mark and the ballot itself, without a name on it, can be counted again by anyone. A paperless machine keeps the secret and gives up the check. Its count can only be audited by the machine that made it.

The vendors pointed to certification; the testing laboratories, a Diebold executive told the New York Times in 2003, “go through every line of code.” The researchers answered that one minute with a memory card, two EPROMs, or a key from a hotel minibar was enough, and that a voter would see nothing either way. Courts and governments in the Netherlands, Germany, and Ireland concluded that a count the public cannot inspect fails even if it happens to be correct. India and the United States kept the electronics and added paper the voter can see. Brazil, which still counts without it, relies on trust in its electoral court, on digitally sealed software, and on letting the parties examine the programs before each election.

📚 Sources