This is a brief treatise written from the perspective of a skilled computer scientist and computer programmer who has also worked for Elections Canada as Deputy Returning Officer (myself, Calvin French.) I care about this issue, so permission is hereby granted to distribute, publish, with or without credit to the author as long as no material modification or omission below this preface is made.

@p Electronic Voting Machines cannot, by their nature, be made either fair or verifiable, and so should be rejected by the free world.

The exercise of judgement in and perception of the world is a complex philosphical problem. If you see something, do you know it's really there? We've all probably at one time or another thought we saw something, and had it turned out to not be what we thought it was at first.

@p However, if another person sees what we see, too, we should more readily accept it as fact.

@p Likewise if we produce evidence of something, this evidence must be observable in some way before it will persuade us. We might well disagree on the interpretation of a piece of evidence, of course, but we shouldn't generally doubt it's tangible content. "This knife was used by the murderer" is an interpretation that we may take some convincing of, for example by using yet other evidence. But held in front of us, we would agree it is in fact a knife, with a black handle, and so forth. We may even wish to hold it, to see that it is made of metal.

@p The bottom line is: although our senses are fallable, we should not readily believe something unless we can, in fact, ascertain it with our own senses. Likewise, if many inviduals can agree on some tangible, observable fact, we would have very little reason to doubt that it exists.

The operation of any electronic device cannot be observed by the senses of any person, and so it cannot be reasonably verified to have actually operated as expected.

@p When your computer shows you a webpage, for instance, you certainly can and most people will form a reasonable belief that it's working as expected. But what you can never really know for sure are the processes that underly it. Fortunately, as long as it produces the right output, it usually doesn't matter.

@p In this way, the computer is really a black box to us from a philosophical standpoint. We construct them and program them; we have underlying theory about them, and that theory does of course play itself out as being wondrously correct in most cases.

@p But they are only useful and trustworthy to us because we only care about their output. They are like a black box that reliably produces correct answers, that has been built to do so, and for which we shouldn't have any reason to doubt so long as they seem to be working.

The problem of seeing how they operate is simply a question of scale. The working parts of a computer are too small and operate far too quickly for any person to observe, in any case.

The results of an election must generally be trusted for us to have democracy. Philosophically, we understand that a rigged election is worthless except as an excuse for those in power to remain there. So it is of the utmost important that we confirm, collectively, that what an election result says has taken place-- so-and-so was elected-- has really taken place.

@p Now this isn't a simple problem, but it does come down to two things: verifiability, and distribution of power.

@p With respect to distribution, we should agree that if only one or few persons are responsible for the handling or counting of votes, we might well doubt that person's performance and so the result. So verifiability will involve many separate people confirming, more or less, the same result.

@p The easiest argument against most conspiracy theories is that the number of people who would have to conspire without letting slip their secret is too large. So it is here: if the vote-counting and vote-taking procedure is distributed widely, we should feel confident that if any massive fraud were taking place, at least somebody would have spilled the beans.

@p In Canada, this job is distributed to many thousands of people whose role is called Deputy Returning Officer. Almost anyone can become one, it's really a two-day job (one day of training, and election day) that pays reasonably well. This DRO also has an assitant, but the key authority rests with them.

@p Explaining Elections Canada procedures in detail is outside the scope of this article, but some key points help to illustrate this:

• Except for the voter, only the DRO may ever touch a ballot.
• Although others can and must observe the counting of the ballots, and may likewise lodge complaints, the DRO is the one whose word is taken for the count.
• Only a federal judge may override the DRO's count of the ballots.
• The DRO (and assistant) must always be present when any votes are cast.
• The DRO is responsible for sealing each ballot box, and ballots are re-sealed after the count in case they need to be recounted.

This means, essentially, the keys to the castle are in the hands of many, many people. It's possible that a single DRO might commit fraud; although this is extremely unlikely given the transparency of the entire process. But even with this, because of the sheer number of DROs assigned, affecting even a local election would require massive collusion.

@p Second, observability:

• Every ballot is printed with a serial number. The DRO will observe this serial number when giving the ballot to the voter, and check it when they return.
• The DRO and their assistant will observe every voter, as well as their name on the voter list and/or their ID or sworn testimony.
• The DRO will observe the voter carry the ballot to the voting station, and observe them return with it.
• The DRO will observe the ballot being placed into the box.
• At the opening of the election, the DRO will show the empty ballot box so it can be observed by them and anyone else. Likewise the DRO will then seal the ballot box in view of everyone present.
• The ballot box will be observed by either the DRO or the assistant at all times during the period of the election, and will remain sealed this entire time.
• The ballot counting procedure, breaking of the seals, and opening of the ballot box are observed at the end of the voting period.
• After all ballots are counted, they are reported up the chain of command and posted publicly both in aggregation and for each polling station. This means any DRO or other observer can verify the count they observed at the end of the voting-period for their station with the officially posted count used to determine the winner.
• Finally, and crucially, any outside observer (a scrutineer) can observe anything the DRO can observe and all procedures undertaken by the DRO in distributing, collecting, and counting ballots.

The only things not observed are those things to guarantee a voter cannot be coerced into making one choice or another:

• The selection made by the voter cannot be observed either by the DRO or by anyone else, as the voting station is set up with a cardboard screen behind which they make their selection.
• The selection on the ballot itself can likewise not be seen once the ballot is returned to the DRO to be placed in the ballot box. Ballots are folded in such a way as to make verifying the serial number possible but without seeing the actual selection made.
• The ballots are uniform, thick paper. This reduces the possibility for identifiable creases or other incidental marks to form that might allow an individual voter to be identified later on when the ballots are counted.

The operation of a Canadian election is completely transparent. It is like a machine that all parts can, at all times, be observed working. We may disagree with the process-- for instance on voter eligibility-- but we know, collectively, that the result produced was in fact produced by this process. We know this because the process itself is distributed widely, minimizing the chance for collusion or fraud, and we know this because it can be observed and so verified at literally all stages of operation.

The operation of an Electronic Voting Machine is at all times completely unobservable. Electrons fire in immensely complex patterns through a device that is, literally, a black box.

@p The output of this device can be observed: a vote chosen is shown to the voter. A receipt may be printed. A final tally is given.

@p But these do not need to agree. We do not and cannot verify the process by which they were arrived at.

@p It doesn't matter if they have been tampered with or not. It doesn't matter whether a particular glitch was a simple malfunction or something more sinister. The user interface design, likewise, does not matter at all. They simply cannot be observed operating, no matter what their user interface shows they may produce a final count any way at all.

@p Worse, even if they are not tampered with they already lie to us, because they give us the impression that we know how they work, and take away our ability of ever being able to ever verify it.

@p Because we are all used to trusting computers, we assume we know how they work. We form a mental model that is incorrect, even for those computers we use every day (just ask any computer programmer whether this is true or not.) But because we cannot and will never be able to personally observe their actual operation, we don't now.

@p Finally, the manufacture of Electronic Voting Machines is not and cannot be adequately distributed. A person working an election does not build the voting machine themselves-- even the idea sounds preposterous. But because they can never be observed working, it's very possible to rig them. And because only a few individuals would ever need be involved in this process, such a conspiracy could very well succeed.

@p For these reasons we thus cannot and must never trust or allow Electronic Voting Machines as a tool for democracy in the free world.

2012-11-06

◀ Back