Policy Documents: Making the Voting Process More Transparent

Introduction:

There seem to be three major potentials for vote mis-counts or fraud:

• votes being improperly recorded or tallied,
• vote buying or voter coercion, and
• ballot box stuffing or ballot shredding.

Unless every voter watch every other voter and every public official at every step, it’s impossible to be truly certain that some form of mis-count or fraud did not occur, no matter what the system.

Right now, voters have two primary concerns:

• Were my votes accurately recorded?
• Were everyone’s votes totaled up accurately?

Current “trust me” systems, whether paper or machine based, do not allow ordinary citizens to allay these concerns. But both these concerns can be simply addressed by allowing voters to independently check the County Clerk’s records of the votes in a way that still preserves the anonymity of the voting process.

Summary of Proposal:

Every individual citizen’s votes would be anonymously recorded as a single record in a database that would be made public immediately after the election. This record would not have the voter's name attached. Instead, each voter would anonymously receive a randomized access number tied to their individual ballot and made a part of that ballot’s record. This would allow the voter to check their record in that election’s database. Also, citizens would be allowed to download the whole database (in read only form) and check the totals. With these two systems in place, everyone could be sure that both their own votes and the totals are accurate without compromising the secrecy of the voting process.

The Voting Process:

With paper ballots, providing a random access number could be done by sequentially printing a machine-readable number on the ballot with a matching number on a tear-off receipt on the ballot corner itself, which the voter would tear off by hand, and the tear-off matched to the ballot if needed.

By shuffling the ballots or allowing voters to pick their ballots from a number of piles at the polling place, no one but the voter would know their individual access number.

For mail ballots, after the voter tears off the corner, the ballot itself with the access number printed on it would be enclosed in a sealed envelope inside the normal mailer with security sleeve and return envelope. Voters who don’t trust the County Clerk to not track their ballot access code number could simply trade ballots with others, so no one would know who has which number after multiple such swaps.

For machine voting, a voter could simply pick a machine at random, so no one would know who voted on which machine. And the machine would print out their votes with the access number on it.

Scanning the Ballots and Recording the Votes:

After voting is completed, all the ballots would be scanned using off-the-shelf scanners that would include an “endorser” that prints numbers on the ballots sequentially as it scans and stacks them. These endorsement numbers would be recorded in the database along with the voter’s machine-readable random access number and votes.

This way the actual ballot would be able to be located in case of a voter challenge to what was in the data base. The voter would supply the tear off tab, and the database would then match it to the endorser number, which would locate the ballot in the pile. And then the Clerk would check to see whether the ballot matched the data base, with the voter observing the whole process.

Voting machines’ output files would have to include a complete record of all the various votes for each ballot cast, and filed by the access number.

Assembling the Database:

The next step would be to combine all the voter records into a single database, with each record containing the voter’s random access number, the endorsement number printed on the ballot during the scanning process, and all the votes (for both candidates and issues) cast by that voter. This database would be assembled in a form accessible to standard database programs and posted on the Web, so that any citizen with computer skills could download it and run the totals. Or they could check their own votes against the data base’s record by looking them up using their access number.

Making the Vote Data Base Accessible:

The County Clerk’s office and trusted third parties would be set up so that even computer illiterate citizen could check their own votes in private; they would view the database like a spreadsheet so that even if someone were secretly observing, they could not know exactly which record is being inspected.

And since any citizen could download the whole file immediately after the counting process was complete, the Clerk’s and third parties’ sites would be prevented from making changes to the records post facto.

Issues:

If a particular voter was afraid that having their access number could put them at risk of coercion, they could always discard their receipt inside the voting area, tearing it up first to prevent it being used by someone else.

As to vote buying, this system is no more vulnerable than current vote-by-mail elections.

Could the Clerk’s office or a third party somehow record the access numbers on the ballot and the voter’s name in a secret database, like with hidden cameras in the ceiling? It seems implausible that any clerk or other person would take such a risk, and in any case it is no more an issue than attempting to secretly watch votes being cast under the current system.

No system, including our current one, can completely eliminate the potential for ballot box stuffing, since both paper and machine ballots can easily be generated. But current security procedures, including voter counts, can minimize this concern. And at least this system allows the voter to discover if their ballot has been shredded, deleted or altered.

Making the vote database public would allow political consultants to statistically correlate voters’ choices between races better than they can through exit polling. But it’s not clear that this is a major issue.

If making the database publicly available becomes a problem, it could just be shared with trusted third parties, who would make it viewable under the same conditions as above. This would make verification of the totals more difficult, but it still could be accomplished.

Conclusion:

There are, no doubt, more sophisticated and complicated ways to allow transparency. But this approach is really quite simple and uses off the shelf hardware. It would probably take an action of the Legislature to allow such a system to be used, but perhaps not. And of course, ultimately it’s up to the citizens whether such a voting process is preferable to the one we have now. But given current levels of concern, perhaps it’s worth a try.