The image “” cannot be displayed, because it contains errors.


The nation's clearinghouse for election audit information!


Eminent Computer Scientist Criticizes ES&S "Real Time Audit Log" PDF  | Print |  Email
By Warren Stewart, VoteTrustUSA   
June 21, 2006

“The Real time Audit Log places high cognitive burdens on the voter, is extraordinarily error prone for the auditor, and is possibly illegal in states that are strict about voting privacy."


At a recent North Carolina State Board of Election symposium in NewBern, it was disclosed that ES&S will be making changes to the way the iVotronic Touchscreen paper voter verified audit trail is printed. Currently the iVotronics fulfill state requirements for a voter verieid paper record through the use of a “Real Time Audit Log" (RTAL), a printout that records every action that the voter performs but does provide the voter with a summary to review before casting the vote.

In his comments to the State Board of Elections David Jefferson (pictured at right) of Lawrence Livermore National Laboratory, who serves on the California Voting System Techology Assessment and Advisory Board, described (RTAL) as a terrible design for a voter-verified paper audit trail (VVPAT), that should never have been seriously considered for certification. His full commentary follows.

For the voter, the problem is distraction all during the voting process by a printer that prints a line whenever the voter makes even a tentative voting selection, or changes the selection.  At each such point the voter is expected to take attention away from the screen to verify what the printer has printed. But much of this verification effort is unnecessary, since it is only the final selections that the voter really needs to verify, not the tentative ones. Still, voters are unlikely to know this; and if they have been properly counseled that they are supposed to conscientiously verify that what is printed is a true reflection of their intent, then they have no choice but to turn their attention back and forth frequently between the printer and the screen because once a particular race scrolls up out of the print window there is no going back. The proper way to design a VVPAT is to have the printer print nothing at all until a voter is finished making tentative choices, and then to print a summary of all of the tentative choices at once for the voter to verify.
For the auditor the problem with the RTAL is that in order to determine how a voter voted on a particular race, he must read each voter session on the paper audit log *backwards* in order to find the *last* recorded event for each office to know who was finally voted for. Earlier audit lines printed for the same office represent tentative choices the voter changed during the voting process.  This RTAL design is certain to lead to a very high audit error rate, as auditors mistakenly record a tentative voter choice instead of the final choice as representing the voter's true intent.  The only way to reduce such errors with the RTAL design is to further slow down the already slow audit process.

The RTAL design also has a deleterious effect on voter privacy because it allows voters to "mark" their ballots, deliberately or inadvertantly, opening the door to coercion and vote selling abuses that the secret ballot is supposed to protect against. With the RTAL, voters can deliberately mark their ballots for later identification by recording on the audit log a prespecified pattern of tentative choices before recording their final choices. This is akin to the classic method of marking a paper ballot by voting according to a specific pattern in downballot races; but with the RTAL ballot marking is even easier to accomplish because the voter does not even have to waste his vote on the downballot races, but only needs to record a particular pattern of *tentative* votes.  For this reason, in states that have strong statutes or constitutional provisions requiring a voting system to protect voter privacy, I would argue that the RTAL design is illegal.
In my opinion there is no reason why this RTAL design should ever have been contemplated for public elections, and I do not understand how it could have been certified. I personally told ES&S about these problems almost two years ago in a public hearing in California. I think ES&S should be asked to change their RTAL design to a more conventional vote summary VVPAT."
Comment on This Article
You must login to leave comments...
Other Visitors Comments
You must login to see comments...
< Prev   Next >