Most voting systems used in federal, state, and local elections in the United States rely on computers in some way. The most computerized is the direct recording electronic voting machine, in which votes are recorded directly onto computer memory devices. Questions about the security and reliability of DREs were a relatively minor issue until 2003. Two factors led to a sharp increase in public concerns about them: (1) the Help America Vote Act of 2002 (HAVA) requires at least one voting machine in each precinct to fully accommodate disabled voters and DREs are the only system that currently meets this requirement; and (2) the security vulnerabilities of DREs were widely publicized as the result of several studies released in 2003. However, others, including many election officials, believe that VVPAT is unnecessary or even counterproductive and that security issues are best addressed through other approaches. The public debate about DREs and VVPAT has led to some confusion about the problems and issues involved, and as a consequence, the options that might resolve them. Two significant problems were reported in 2006. In comparison, many problems have been associated with provisional and absentee ballots. Have DREs been thoroughly studied in the scientific community? Are there any unique security concerns with DREs? Have DRE security flaws compromised any elections? Malfunctions occur, but most problems that have occurred with DREs can be attributed to human mistakes or procedural errors, rather than security issues. Do security flaws in DREs pose the greatest threat to election integrity? While current DREs have unique security flaws, it has not been established that they pose a greater risk to the integrity of elections than other kinds of problems. However, the proportion of voters using DREs could continue to increase as a result of HAVA's accessibility requirements, since DREs are currently the only kind of voting system that is generally agreed to meet those requirements. There are many other potential threats to the integrity of elections. Do problems with DREs result from weaknesses in the technology itself? While it is not clear whether the certification testing of those systems identified any of the problems that were discovered in the studies, the process did not in any case prevent those systems from being certified and deployed with the vulnerabilities present. Unfortunately, none of these methods, including paper, have been sufficiently developed to compare efficacy, practicality, and cost in a meaningful way. Paper ballots used with DREs—usually called a voter-verified paper audit trail, or VVPAT—provide a permanent, independent record of votes that can be verified by the voter before casting the ballot. Some systems using this approach have been developed. However, paper also has several security weaknesses in comparison—for example, it is easy to manipulate by hand without specialized tools; it does not eliminate risk from Trojan horses or other malware if counting is done with the aid of computers; and, unlike electronic records, it cannot take full advantage of the protections afforded through the use of cryptographic techniques, although those techniques are not currently used in public elections in the United States. In particular, the following issues may be worth considering:
Lack of information. There remains considerable uncertainty about the relative security of DREs in comparison to other voting systems; how security measures such as VVPAT may impact other important goals such as accuracy, reliability, usability, and accessibility; and the effectiveness of those security measures. Potential conflicts with HAVA requirements. Voter Confidence. Impacts on Innovation.
Most voting systems used in U.S. elections rely on computers in some way. The most computerized is the direct recording electronic voting machine, or DRE. In this system, votes are recorded directly onto computer memory devices. While DREs have been in use since the early 1990s, questions about their security and reliability were previously a relatively minor issue, even following the November 2000 presidential election and the subsequent congressional deliberations leading to the enactment of the Help America Vote Act of 2002 (HAVA, P.L. 107-252).
However, at least two factors led to a sharp increase in public concerns about DREs, beginning in 2003. First, the voting accessibility provisions in HAVA promote the use of DREs, which have been the only kind of voting system that can meet the HAVA requirements to permit persons with disabilities, including blindness, to vote privately and independently. Second, potential security vulnerabilities with DREs were publicized as a result of several studies. Several bills were introduced in the 109th Congress that would address these issues in different ways; a number of similar bills have been introduced thus far in the 110th Congress.
In the public debate about DREs, there has been some confusion about what the problems and issues are, arising to a significant degree from the complexity of DREs and of elections in general. This confusion can lead to misperceptions about facts as well as issues and options for resolving them. Several points are worth noting:
DREs do have unique security concerns and have only recently been studied by the scientific community. However, most problems in recent elections were not associated with DREs. Security flaws in them are not known to have compromised any elections, and it is not clear how much of a threat those vulnerabilities pose to election integrity in practice, especially in comparison to other kinds of threats. The different models of DREs in current use vary substantially in design, and problems that one model exhibits may not occur in others. Many of the problems that have occurred are procedural, not weaknesses in the technology itself.
It is not clear whether the unique security problems posed by DREs are best addressed by requiring that they produce paper ballots or by other means. While paper has useful security properties and is well-known, other methods exist that might be superior. Furthermore, paper ballots used with DREs (called voter-verified paper audit trails, or VVPAT) are largely unproven and it is not clear how well they can meet HAVA requirements for accessibility or other goals such as usability.
As the 110th Congress considers proposals relating to DREs, salient issues might include the lack of information about DRE security, especially in relation to other systems and other components of election integrity; potential conflicts with HAVA requirements that might be associated with the proposals; how those proposals might impact voter confidence; and what impacts they might have on future innovation that could greatly improve the transparency and integrity of elections. This report will be updated in response to major developments.