Open Voting System Explained
What is the Open Voting system?
The Open Voting system is very much like a traditional system in which the voter enters the voting place, marks his or her choices onto a paper ballot, and inserts the ballot into a ballot box except the voter marks the ballot using a computerized voting station rather than a pencil or colored marker. The Open Voting system preserves the paper ballot. However, which is printed in plain text that the voter can read. Voters have the opportunity to inspect the ballot to ensure that it properly reflects their choices. Poll workers then scan the ballot to count your votes and deposit it into a secure ballot box. The Open Voting system ballots contain a bar code in addition to the plain text. This bar code provides a system of accountability for recounts and prevents voters from voting more than once, although it provides confidentiality for the voter. Open Voting systems can be engineered to accommodate the special needs of those who who have physical impairments and can be operated with touch-screen features and provides audio playback for sight impaired.
How Will Open Voting Work?
Voters using an Open Voting system will be given a smart card (like a credit card) that will activate a voting station or a poll worker may simply enable the voting station for one use. The voter would close the curtain on the voting station machine and would see a touch screen computer display, much like that on an automatic teller machine (ATM) or current touch-screen voting machine. The screen would show the voter the various contests (including the candidates plus space for a write-in) and the various questions. The voter would make his or her choices. The voter would then indicate that he or she is finished at which time the voting station would print the paper ballot showing the voter’s choices. The voter would be able to visually inspect his or her yet uncast ballot. People with vision impairments would use a machine equipped with headphones and an audio response capability. If the voter is happy with the printed ballot, the voter brings the ballot to a poll worker who helps the voter place the folder containing the ballot into the ballot box, thus casting the ballot. If the ballot is in error, the voter brings the ballot to a poll worker who places it into a special container for spoiled ballots. The voter is given a new smart card and goes back to the voting station machine to again make his or her choices.
How could the Open Voting System help improve the publics ability to see eloection results?
With open source election software, results from elections will be available to the public on the night of the election on the Internet. The Open Voting system inlcudes ballot reconciliation and a database for accountability and security at every level of the election system from precinct workers to election officials in charge of oversight.
How does the Open Voting system deal with write-in votes?
The user interfaces on the Open Voting system give the voter the opportunity to indicate that he or she desires to make a write-in. The voter is then presented with a screen (or audio menu if appropriate) that may be used to enter the write-in name. The user interface is designed so that the voter can spell-out the write-in name by selecting characters from the screen; keyboard skills are not necessary.
What sort of training will voting place workers need?
The OVC does not anticipate that the cost of this training or the overhead of the procedures will be significantly different than for any other system of electronic voting. The OVC intends to maintain a dialog with public officials who run elections in order to ensure that Open Voting systems mesh well with existing training and procedures. It is expected, of course, that some changes in training and procedures will be necessary.
How do you prevent a ballot from being counted more than once?
Since the bar code on Open Voting ballot includes the ballot number, the bar code reader used to count the ballots can detect if a ballot is scanned more than once, and prohibit the ballot from being counted again.
Will the Open Voting software be compatible with innovations such rank choice voting in future elections?
The open source software being developed by the Open Voting Consortium would be fully capable of handling different types of elections, such as proportional representation, instant runoff voting and rank choice voting.
Open Voting System Equipment Questions
Are commodity PCs adequately reliable or powerful to use as voting machines?
Yes. Modern commodity personal computers, even ones that are a few years old, are enormously powerful once unburdened from all of the ancillary tasks that we typically load onto a personal computer.
The primary difference between a typical personal computer and one used as a voting machine is that the computers used for voting must be physically protected from tampering. This is easily done by putting them into a locked container (with adequate ventilation.) Many DREs do exactly this.
In addition, in the Open Voting system, there will be several types of voting machines. There will be multiple types of voting stations in order to accommodate the needs of physically impaired voters. And there will be ballot readers so that voters can verify the accuracy of their ballots. Each of these different machines will have some peripheral hardware not found on the typical personal computer. For example, voting stations may have touch screens. And ballot readers may have bar code readers. Many machines will have headphones for use by visually impaired voters.
Does a voting station contain a hard disk?
Not necessarily. It is possible to construct a voting station so that it boots and runs from a CD-ROM that has been certified by the authority in charge of the election. Such CD-ROM based systems are quite common – for example take a look at the Knoppix version of Linux.
Voting stations do maintain log files that record certain administrative and trouble-detection information – such as the number of voters who have used the machine and the number of ballot pages sent to the printer. The amount of data in such logs is small enough that they would easily fit onto a commodity USB flash memory (“thumb drive”) device.
What kind of printers can be used?
Any reasonable quality laser printer can be used. Ink jet printers may also be acceptable. The primary issue regarding printers is reliability, particularly with regard to paper handling. Lesser, but still important, concerns include accuracy of the registration, i.e. the placement of the printing on the paper.
Is special paper necessary?
The Open Voting system does not require special paper. There are those who argue that the security of elections may be enhanced if ballots are printed on specially watermarked paper that is physically protected from use in any role but in elections or in a particular election. The counter-argument is that if such paper falls into the hands of a would-be penetrator, then its use would give a degree of credence to false ballots. The Open Voting system paper ballot contains a background image that is printed at the same time that the ballot is printed. The choice of image and its placement can be established shortly before the election, thus adding resistance to attempts to pre-print false ballots and bring them into the voting place.
What if the paper jams in the voting station or if the printer runs out of ink or toner?
Through procedural means it is possible to reduce the chance that a printer will jam or run out of ink or toner. For example, as part of the preparation for an election, each printer should be loaded with fresh ink or a fresh toner cartridge. (It is unlikely that any single election will consume an entire fresh load of ink or toner.) Similarly, the paper used should be stored under conditions of reasonable temperature and humidity, even if the voting place itself might have suboptimal temperature and humidity. The OVC believes that the best way to handle printer problems is for a poll worker to remove the printer from the voting station machine, place that printer into secure storage, and to install a replacement printer. The exact procedural steps for this are yet to be worked out. Of particular concern are the handling and privacy of any damaged ballot that might be in the printer as well as the disposition of any unused paper in the feed tray. This procedure suggests that every voting place have spare printers. Fortunately, printers, particularly ink-jet printers, are becoming very inexpensive, are compact, and can be set up very quickly. Most voting places will have a sufficient number of voting stations to accommodate peak demand. If a printer fails during off-peak hours then the voting station with the bad printer can be taken off-line until the voting administrators can bring a new printer to the voting place.
What about uninterruptible power supplies (UPS)?
The OVC believes that all electronic voting equipment, with the possible exception of high-current draw machines such as laser printers, should be protected by uninterruptible power supplies. Low cost uninterruptible power supplies will only be able to cover power outages of short duration, typically an hour or less. Good uninterruptible power supplies have means to indicate how much time is left before they go dark. Voting place workers should have procedures that instruct them what to do as the power goes out and as the time that the UPSs run out of power comes near. For example there may be instructions to turn off some of the machines (and unplug them) and only use the remaining machines until power is restored. If the running machines reach the end of their power then they can be turned off and the other machines activated. This has the effect of doubling resilience to a power failure. Uninterruptible power supplies of good design do more than simply provide power when the lights flicker or go out; a good UPS protects the computer equipment from failure or errors caused by power surges and spikes caused by storms or electrical utility problems.
What happens if the power or a UPS does fail?
The printed paper ballot is the core record created and used in the Open Voting system. Paper ballots are not affected by power failures. Should there be a power failure (or machine failure) during the voting, any yet-unprinted ballot will not be printed; the voter will have to wait until power is restored and once again make all of his or her choices. Any partially printed ballots are considered spoiled. Unlike a current electronic voting machine (DRE), a power failure in the Open Voting system introduces no ambiguity into the ballots. There are no hidden electronic counters that may or may not have been incremented as the power went out, and the voter can inspect the paper ballot before casting it into the ballot box.
What, exactly, constitutes “the ballot” in the Open Voting system?
In the Open Voting system, the ballot is a paper document that contains the voter’s choices. This paper is generated by a printer attached to an Open Voting ballot marking machine used by the voter to make his/her choices for each of the various contests that have been placed before the voter in the election.
Many of these Open Voting ballot marking machines will use touch screen technology, as is found on Automated Teller Machines (ATMs) and other kinds of voting machines. Some of these Open Voting ballot marking machines will be designed for use by voters with physical impairments. In all cases, each Open Voting ballot marking machine will contain a printer that produces the actual paper ballot that contains the voter’s choices. The voter will take the ballot from the Open Voting ballot marking machine’s printer. The voter may visually inspect the ballot and may also carry the ballot to a separate machine that will read-back the bar-code on the ballot. This read-back machine is present both to assist sight impaired voters and also to give voters the assurance that the bar-code on the ballot properly mirrors the human-readable text on the ballot. The choices printed on this ballot do not constitute countable votes until the ballot is “cast” by placing it into a ballot box.
What does a ballot look like?
When a printer is added to a DRE, the printout is sometimes called a “voter verified paper trail” (in California law, SB1438 and the standards set by the Secretary of State in 2004 it’s called a “paper record copy”). Others have called it a contemporaneous paper record (CPR). The legal status of the CPR is unclear. They used the Sequoia Veri-Vote system in Nevada in NOV 2004 but the paper was not used in tabulating or checking. It was there just in case. In these cases, the vote is electronic with a paper audit trail that may or may not be used. The system like OVC is proposing is a ballot marking device. The printout is the ballot, and represents the authentic vote. The act of voting with the OVC system involves the voter placing the ballot in the ballot box (witnessed by pollworkers). With the OVC ballot marking system, the vote is on the paper ballot while the electronic record provides the audit trail. To avoid confusion with other ballot systems, we refer to the ballot in the OVC system as a “Summary Paper Ballot.”
What’s the difference between a voter verified ballot and other voter-verified paper trails?
The ballot is a single sheet of paper (link to ballot.pdf). Note that only the choices made by the voter are shown; a single sheet of paper can accommodate an election containing a large number of contests and questions, including the names of write-in candidates. It is important to remember that the printed ballot is the summary of the choices that the voter entered via a voting station. It is the voting stations that will present the full menu of potential choices and will do so through various user interfaces. This sample shows how the Open Voting system ballot handles contests in which the voter selects a single candidate, no choice (i.e. the “Treasurer” contest and the “Health care initiative” question), contests in which the voter chooses multiple candidates (i.e. the “Cat Catcher” contest), contests in which the voter chooses a panel of candidates (i.e. the “President/Vice President” contest), and multiple candidates with ranking (i.e. the “County Commissioner” contest.)
Also note that the ballot contains bar codes that reflect these choices as well as various background and other markings that identify this as an official ballot and discourage forged ballots.
What is the “privacy folder”?
The ballot contains the voters choices in two forms: a form that can be read by people and a a bar code that expresses those choices in a machine readable form. The voting place workers may come in contact with the ballot should they be asked to assist a voter or if the ballot is spoiled. In order to protect voter privacy it is desirable to minimize the chance that a voting place worker might observe the voter’s ballot choices. A privacy folder is just a standard file folder with an edge trimmed back so that it reveals only the bar code part of a ballot. The voter is expected to take his/her ballot from the printer and place it into a privacy folder before leaving the voting booth. The ballot will be cast by placing it, still in its privacy folder, into the ballot box.
Open Source Software and Implementation Questions:
Is the source code open source?
Yes. The Open Voting System will be distributed under an extended form of the GPL. That extension is to simply require that the change history be maintained. This extension is intended to facilitate certification of the software by voting authorities by ensuring that the development history of the code is explicit and visible.
Is the source code available?
Yes. All source code will be made available. At the present time much of the code is on Sourceforge at http://sourceforge.net/projects/evm2003.
Is a database used?
At the present time no formal database is being used. Databases tend to be complex and big. The data represented by a ballot is relatively small and simple. The Open Voting Consortium implementers felt that overall system reliability and maintainability, not to mention auditability and integrity, would be enhanced by avoiding the complexity of a full database and instead using simple XML based data files.
How will the Open Voting System be implemented?
The software is primarily written in the Python language (version 2.3.). The underlying operating system is Linux. (Presently we are using the Fedora and Suse distributions.) It is expected that there will be at least two generations of software. The demonstration software has been developed to convey the concepts and to improve understanding of how the final software should be structured. We are now seeking funding for programming and testing the production software.
What is Linux?
The Open Voting system is constructed on Linux, or to be more accurate, it is constructed on one of the widely available Linux distributions. The Linux kernel and the components of these distributions are open source. This means not only can they be inspected, but they can also be repaired if found to be flawed. Linux distributions have become highly stable platforms; it is now quite common for Linux-based servers to run for years on end without intervention or fault. Linux software, particularly the code in the kernel, is inspected by many people and tested by many more people, before it is released. The people who write, inspect, and test Linux code are people who have risen to these roles through a process of peer-selection. The brains, eyes, and hands that construct the Linux kernel are among the best in the industry. Linux is free to use. This substantially reduces the cost of the components of the Open Voting system. There are those who argue that Linux has higher life cycle costs than certain proprietary systems. While there may be some merit in those arguments in some limited cases, the experience of many of the members of the OVC has been to the contrary.
How does the Open Voting System deal with issues of security, resiliency, integrity, and reliability?
The Open Voting System is designed to deal with both intentional and accidental abuse from the outside and also to try to minimize or eliminate the effects of internal failures or errors. The paper ballot produced by the Open Voting System is one of the core elements. The paper ballot, because it can be read by the voter represents a solid backstop against undetectable tampering of the machines through which the voter makes his or her selections. Similarly, the paper ballot is an archival quality document that can be examined at a later date to validate that the vote counting mechanisms performed accurately.
The Open Voting System, because it is based on open source software, can be inspected and tested by those who are skeptical by nature or those who are empowered to certify the system. Moreover, because the system is open source, third parties or voters who might be suspicious of tampering are able to independently validate ballots and vote tallies. For example, one of the types of machine in the Open Voting System is one that allows a voter, particularly sight-impaired voters, to scan their yet-uncast ballot and have its contents read back (via headphones). A skeptical voter could, if allowed by the local law, bring a small portable implementation of this software with him or her into the voting place and scan his or her ballot for validity.
Do you anticipate using diskless computers?
It is a goal of the Open Voting System to run on diskless computers. The system would boot from verifiable CD-ROMs in much the same way as Knoppix. Results would be accumulated on a redundant set of USB memory devices and CD-ROM burners.
This approach not only reduces the possibility of tampering or hardware failure, but it also gives county election officials the ability to prepare boot disks specifically tailored for each voting place. In addition it would reduce the technical expertise required of the voting place staff.
How much do current electronic voting terminals cost?
Direct Recording Electronic voting equipment is being sold for between $3,000 and $7,000(US) depending on the manufacturer and options which may be offered. Printer options for voter verification are in the range of $500(US) to $1,200(US). Several DRE products are based on Microsoft operating systems and may use Microsoft or other proprietary applications in the DREs and in the tabulation systems. There will almost certainly be a degree of labor cost associated with keeping that software up to date with security and other patches, there also may be licensing costs to maintain the licenses for that software and to remain supported by the vendor.
How much do Open Voting systems cost?
Programming open source software and having it certified are anticipated to cost approximately $1.5 million mto make a system that works for California, but then software will be in the public domain and available for use free of charge in the rest of the United States. Because Open Voting systems are constructed using industry standard platforms (i.e. PC’s), and because the computing demands placed on those platforms are low, a jurisdiction can deploy Open Voting systems using computers that are obsolete for office or educational use. This can greatly reduce system cost, vastly expand the pool of replacement units, and help reduce the cost of disposal of those otherwise obsolete computers.
Support costs: Open Voting systems will run on open source operating systems and use open source applications. Open source software will, like all software, require some labor to track and apply security and other patches. However there is no licensing cost to maintain licenses. There may be a hidden cost insofar as unless a contractual support relationship is established with a third party, there is no vendor contract that may be leveraged to coerce the resolution of problems or correction of software flaws. That cost may be mitigated, however, by the open source nature of the software that allows voting administrators across a variety of jurisdictions to mutually support one another.
What is the effect of local laws on Open Voting?
In the United States, elections are governed by a combination of Federal and State (and local) law. The OVC is pleased to have among its founders people who have a great deal of expertise regarding the nuances and variations in election laws. The OVC hopes that the Open Voting system that it proposes so closely models traditional paper ballot procedures that it will smoothly mesh with most voting laws and regulations. Because Open Voting systems are new, the OVC will not be surprised if there should occasionally be some issues that require localized adaptations.