Usable Security

This continues the previous post about the voting system demonstrations in Oakland on Monday.

Vendor B (ES & S)

The paper scanner from ES & S, shown above, has a four-line LCD over the entry slot, as well as a paper tape printer on the left.  The compartment on the left can be opened to reveal a keyhole; a pollworker inserts the key and turns it from “Off” to “Open/Close Polls” at the beginning of the day, which causes the machine to start up and print a complete paper tape of all the contests with zero counts for all votes.  Then the pollworker turns the key to “On” and the machine is ready to accept ballots.  At the end of the day, the pollworker turns the key back to “Open/Close Polls”, causing the machine to print out a paper tape with all of its vote totals.  The pollworker then turns the key to “Off” and posts the paper tape in a publicly visible place.

The paper ballot aligns the choices in a grid, with bubbles to the left of each choice.  Blanks for write-ins are provided and labelled “Write-in”.  Each ballot comes printed with two tearable strips at the bottom of the page, printed with matching serial numbers.  The bottom strip is affixed to the pad of ballots, so the pollworker tears it off to hand the ballot to the voter, leaving behind one copy of the serial number.  The voter tears off the second strip before putting the page into the scanner.  For an election with a ballot on multiple pages, each page is printed on a separate pad and the pads have synchronized serial numbers.  The pollworker is supposed to tear off one sheet from each pad and hand the voter a matching set all with the same serial number.  A special rectangle printed in a different ink appears at the top-left and bottom-right corners of the ballot, changed from election to election as a safeguard against voters printing their own ballots for use in a subsequent election.

If there is an overvote on any contest, the scanning machine will hold the ballot without dropping it into the box and display a warning message on the LCD.  The ballot is held inside the machine so that the voter can call a pollworker over for assistance without exposing the ballot to the pollworker.  If the voter presses the “Return” button, the ballot is ejected back to the voter, who can then take it away and request a new ballot.

The ballot scanner records not just the vote counts but also the images of the marks made by the voter.  The rectangular regions of the ballot located in the rows and columns identified by the registration marks along the left and top edges of the ballot can be reprinted, arranged together on a paper tape.

Questions:

• The ability to hold the paper ballot without dropping it into the box is nice, but does it actually help?  Since the voter has to show the ballot to a pollworker anyway in order to get another ballot, why not simply eject the overvoted ballot back to the voter immediately?
• Is the message along the bottom of the ballot enough to let voters know that they should turn it over and fill in the back?

The ES&S iVotronic offers a large portrait-format display like the other machines and a long window on the left for a printed paper tape.  There are three hardware buttons under the screen — up, down, and select — and a “VOTE” button that can light up at the top of the screen.  There is also a headphone jack, but i didn’t have time to try out the audio interface.

For each voter, the pollworker activates the machine by momentarily placing a small box into the slot on the left (between the paper tape and the display screen).  The box appears to have an infra-red transmitter on it that it uses to tell the machine to wake up.  Removing the box starts the voting session.

The voting session begins with a help screen (thanks to Joe Hall for the picture).  The ballot is divided up into pages, with possibly more than one contest per page, and the bottom of the screen shows the page number.  The candidate’s names are shown in all capitals in what appears to be about 13-point Arial.  The “?” button is always visible at the bottom of the screen and can be pressed at any time to redisplay the help screen.

If the voter tries to overvote, the machine displays a message explaining that another option must be deselected first.  Selecting a “Write-in” option brings up an on-screen keyboard for entering the write-in name.

As the voter makes selections, the paper tape printer records a log of every user action.  Each time the user selects or deselects an option, the paper tape rolls down to meet the print head, the printer prints the name of the contest and the selection, and the paper tape rolls back up to bring the printed lines into view.  The paper tape also records any attempted overvotes and the transition to the review screen.  The photograph on the right, above, shows the beginning of a voting session where the Spanish audio interface was selected (thanks to Joe Hall for the photo).

The voter presses “Next” to get from page to page, and upon moving past the last page of the ballot, arrives at the review screen.  While the review screen is being shown, the “VOTE” button lights up and flashes red.  The voter presses either the flashing VOTE button or the big check mark on the screen to cast the ballot.  If the ballot contains an undervote, a warning message interrupts at this point, giving the voter a chance to go back and fix the undervote.  The paper tape continues to record every user action, and when the ballot is cast, a barcode is printed on the tape, which immediately rolls up until only blank paper is showing.

There is also an audio interface that i didn’t try, but Joe Hall reports that the Spanish audio ballot was an “amazing train wreck” that was so difficult to use that the person testing it could not complete the ballot.

Questions:

• Is the text of the ballot options too small for some voters to read, and can it be enlarged?
• Since the person reading the paper tape has to reconstruct the ballot selections from the recorded sequence of user actions, does that make recounts infeasibly difficult?
• What happens when there is more than one screenful of review information?
• Can voters reasonably be expected to keep an eye on the paper tape and verify that it is correctly printing a record of every action?
• How does the voter know that the paper tape is supposed to print something with each selection?  The voter is probably not going to notice if the printer fails to print anything for a particular selection.
• Since the paper tape is rolling backwards and forwards all the time, how can we be sure that the printer never overwrites any previously printed lines or prints lines out of order? 

More to follow.

This entry was posted on Thursday, November 17, 2005 at 02:05 under General. You can leave a comment here or trackback from your own site. Use the comment feed to follow comments on this entry.