democracy

elections

democratic control

italian electoral procedures

precautionary principle

security

what's wrong with ballot paper?

VVPAT

PCOS

For most of the human history the power to rule people has been given to who had certain requisite: being strong, being brave, having a special relationship with a god, being blue-blooded or being very rich. The transmission of the power from one person or from a social group to another has always been a matter of blood: sometimes the blood of noble families, more often the blood of murders and wars.

In the 18th century the people of a few western countries conquered Democracy as a bloodless way to gain and transmit the power as well as a way for the many to balance the power of the few. In democracy the ruling power is given only for a limited period of time and only to those who are preferred by the majority of the people.

Elections are the way by which Democracies use to "measure" people´s will and thus to assign political power. Therefore the electoral mechanism is of primary importance for any democracy since mistakes and fraud can give political power to those who should´nt have it. Our ancestors knew that very well and thus pretended counting procedures to be open to the public and verifiable.

In the 21th century we, the people, still need counting procedures to be open to the public and verifiable. Infact this is the only way we can hope to have honest results even in case elections are dishonestly managed by incumbent governments or fraudulently attacked by politicians, economic lobbies, criminal organizations, terroristic groups or foreign countries.

For Democracy to exist it is absolutely necessary that the electoral mechanism simultaneously:

1. allows to vote only those having the rigth to vote,
2. ensures a verifiable correspondence between results and electors´ will,
3. ensures that each vote is kept secret from everybody.

The adjective verifiable (point 2) is extremely important: it doesn´t mean we trust the way ballots are colleced and results counted, but that we can precisely verify electoral results. No matter how perfect the electoral mechanism might be, if results were not verifiable we should rely on any figure provided to us: nobody would call "democracy" such situation.

Secrecy (point 3) is an absolute necessity since the existence of records that could be used to identify the voters and their vote means the end of political freedom. Infact, if there is a risk of voting preferences becoming known to interested parties, voters will inevitably be influenced: they could undergo illecit pressure to vote as somebody else likes. This is not a theoretical problem, but a real one in many parts of the world where criminals (and/or governments and/or politicians) have enough power to compell people to vote in a certain way. Any form of vote disclosure could even be used to discriminate people in giving or denying promotions, jobs, contracts, etc.

Electors can't be given any "receipt" stating the content of the vote since:

• people could be encouraged to sell their own vote because they could demonstrate whom they actually voted for.
• such a "receipt", whichever media could be made of, could be used as a way to verify if the threatened elector really obeyed: gangsters can compell electors to show the "receipt" in order to verify such obedience!

The electoral mechanism, far from being a technical detail, is the heart of any democracy and thus we all MUST know and accept it

As an example of very good democratic control on elections´ procedures and results, please have a look at the way paper ballot elections are done in Italy.

All democratic Constitutions explicitly states or imply that the power belongs to the people. They also state that the people delegate their power to some representatives which temporarily rule the country in their behalf. People's temporary representatives are choosen by means of elections.

Democratic control is the monitoring and checking that the people exercise over their representatives and institutions to verify how they get and use the power. Without democratic control democracy may easily degenerate into oligarchy or dictatorship. All citizens MUST be allowed to exercise their democratic control over public institutions, therefore such right can't rely on any specific knowledge or competence.

Democratic control of elections is extremely important because elections are the very heart of any Democracy.

no democratic control is possible over electronic election because e-votes are invisible and electronic procedures unverifible to humans.

because everybody can verify ballot papers which are tangible and human-readable objects.

As an example of a very strong democratic control over elections, please have a look at the italian paper elctions' procedure

In almost 70 years of post-WW2 democracy in Italy there have NEVER been any problems with the vote counts or declaration of the election results. Even in the 1950s and 1960s, which were years of strong contrasts between the two main political parties (Communist and Christian Democrats), NO-ONE ever questioned the legitimacy of the electoral results. How is this possible? Through the use of tangible ballot papers and public procedures open to democratic control: hand-written ballot-papers publicly counted (in the same room where they were voted) by randomly selected citizens

in fact up to now (2024) in Italy:

1. The vote is considered the right and duty of each adult citizen.
2. Every citizen is automatically included on the Electoral Register of the place in which he/she resides. No effort or procedure is required of the citizen.
3. Voting takes place in polling stations organized by the local authorities (usually in schools)
   Polling stations are composed of several polling rooms ("seggio"), which are the electoral units where the voting actually happens. Each polling room is usualy a classroom. There are about 50000 polling rooms over the whole country.
4. Local authorities enrol each voter on the list of the polling station nearest to his/her home. To help lazy voters do their duty. About 500 electors are enrolled in each polling room list.
5. Each citizen is issued with an Election Card stating his/her enrolment in the Electoral Register of the assigned polling room. This card is valid for 18 elections.
6. Elections usually last two consecutive days: Sunday and Monday to facilitate voting of people who work.
7. Special categories of electors (soldiers, sailors at sea...) are allowed to vote in any polling room of the city they are in for service reasons. To allow people working for the Nation to vote.
8. Special polling rooms are set up in hospitals and prisons. To allow the ill and the imprisoned to vote.
9. All voting operations are public and any voter can be present throughout the entire activity of his/her polling room. Obviously they can also be present when their votes are counted.
10. In each polling room one finds the following people at work:
    • A president (nominated by the Court of Appeal)
    • A secretary (chosen by the president)
    • Four assistants (scrutineers), appointed by the local authority.
      Up to the end of 2005 they were not appointed, but drawn by lot from all the electors by the local authoriry. The fact that four of the six persons involved were selected at random significantly reduced the possibility of illicit agreements between them.
    The work carried out at the polling room is paid for by the State and, except for serious personal reasons, is obligatory. Citizens selected for these electoral duties have the legal right to be absent from work to do their duty at the polling room. To help citizens in doing their duty in favour of democracy.
11. A minimum of three of the six persons working at any polling room must ALWAYS be present. In this way, the possibility of illicit behaviour is reduced, given the need for a larger number of accomplices.
12. People working in the polling room are allowed to vote there instead of where they are enrolled. So as not to interrupt their verification of the electoral procedures.
13. All the operations of the polling room and the results of the count are reported in the official statement (two copies) and approved and signed by all the workers of the polling room; Official statements are also stamped on each page with the official polling room stamp. One copy of the official statement is sent to the Town Hall and the other to the Court together with all the ballot papers (voted or not voted).
14. Each political party has the right to have a representative present in every polling room. This representative can check all the activities of the polling room but he/she cannot take part directly. They are even allowed to stand in the polling station (outside the polling room) during the night closure. So as not to leave the police forces unguarded!
15. Members of the police forces are present in each polling station all the time (night & day). They physically protect the polling station and thus the reliability of the results.
16. The police forces MAY NOT enter any polling room, unless specifically requested to do so by the president for reasons of public order. This is to avoid any possible intimidation of the voters and any influence on their voting (oppressive police presence actually occurred in Italy during the fascist period).
17. At night, polling rooms are locked and doors and windows are sealed with paper tape which is signed by the polling station workers. In this way, any intrusion in the polling rooms would be noticed the following morning.

The procedures for the elections are as follows:

18. The local authorities provide each polling room with:
    • an official polling room stamp identified by a unique (in the whole of Italy) code that, until the start of the voting, is only known to the Minister of Internal Affairs.
    • slightly more ballot papers than the polling room will actually need (based on the number of citizen enrolled).
      Each polling room validates the number of ballot papers it requires according to its the Electoral Register. The rest are left in reserve for unforeseen circumstances. The required number of ballot papers are validated by means of the official polling room stamp and the signature of two scruteneers.
19. Throughout voting, the ballot papers can only be touched by the six persons assigned to the polling room (apart from the voters, obviously). The representatives of the parties cannot touch any ballot paper. In this way the risk of sabotaging votes and rendering them invalid is minimized
20. During the count, ballot papers with any redundant writing, beyond the expression of a valid vote, are considered void. This ensures that the ballot paper can never be traced back to the individual voter, hence, the voter cannot be pressured into voting for any particular party or candidate.
21. Voters must present an Identity Document and their Election Card.
22. Once the documents have been checked (the number of the Identity Document is written against the elector's name on the Register) the voter is given;
    • an indelible pencil, so the vote cannot be easily changed. Any ballot papers marked with any other writing instrument are considered void.
    • a ballot paper which is given to the voter unfolded. Both the voter and the president can confirm that it is in perfect condition and free of any markings that could invalidate it later during the count.
23. The elector goes into a booth and, unseen by anyone, votes freely. No voter can be accompanied into a booth unless they are blind (with the appropriate medical certificate) or handless. This is to ensure that voters cannot be influenced by the person accompanying them.
24. After folding the ballot paper so the vote is hidden, the voter leaves the booth, inserts the paper into the ballot box, gives the pencil back and collects the previously presented Identity Document and Election Card. The Election Card is returned duly stamped and dated to demonstrate that the elector has voted.
25. As the electors vote, one of the polling station scruteeres signs against their names in the Electoral Register. This ensures that the same person cannot vote more than once.

The counting procedures are the following:

26. Ballot papers (voted and not voted) must remain, at all times, inside the polling room they started off in. The ballot boxes are visible to everybody at all times. Ballot papers are only taken to their final destination when the counting is over and the results of the polling room are made public.
27. Each ballot paper is checked by all six of the polling station workers and any of the parties representatives. In case of disagreement about who to assign the vote to, the president decides a temporary "position", but that ballot paper is sent to Court for a final decision. The counting is simultaneously managed by two scrutineers who both have their own paper record. Paper records have one page for each party and candidate, each page is made of small numbered squares: 1, 2, 3, 4 and so forth. As each vote is assigned to a party (and/or a candidate) scruteeners find its page on their own paper record, cross the next empty square and loudly read its number. All the time the two voices say the same number there are no problem, as soon as they differ everybody stops and check what has happened.
    The final result of each party (and/or candidate) is simply the number of the last crossed little square of its own paper record.

    At this point the 2006 electronic data collection was carried out: the name of the party/candidate voted on each ballot paper was put on a PC. At voting closure the electronic result was compared with the manual one and in case of discordance the official result was that of the manual count.

28. At the end of the count, each polling room sends all the ballot papers and the official stamp to the competent authorities along with one copy of the official statement, signed by all six workers of the polling room. These are kept for a number of years. The government calculates the official figures from the official reports of the polling rooms. The second copy of the statement is collected by the local authorities.

    The electronic data collection stated that same polling room would have send their results directely to the Ministry of Interiors using computers. Such data transmission was experimental.

29. Each local authority collects the results of its polling rooms and therefore calculates the results on a local level, independently of the national government.
30. Even parties calculate the results independently, since they have their representatives in each polling room. They can therefore compare their calculations with those of the government.

To help electors not to make errors:

31. Ballot papers are large (40cm x 25cm) and very simple because the shape, the colors and the quantity of printed text have a great impact on the readability of the ballot papers.
32. Electors are given a ballot paper for each election. For example when General Election and Town Council elections are run the same day, electors are given 3 ballot papers: one for the House, one for the Senate and one for the City Council.
33. Ballots papers are coloured according to the elections they are related to. Colours are widely publicized on TV and newspapers long before election day so that electors can prepare how to vote at home (e.g. decide to vote X on the green ballot paper and vote Y on the yellow one).

that's the way italians do it!

In Italy, when the above procedures are used, electoral results are available within 6 or 8 hours. This very good speed is achieved by splitting the work into many small pieces (about 500 electors for each of the 50000 polling rooms). Voting ends usually at 3:00 p.m. and thus when Italians go to sleep the results are already known. Such results have mostly been final as vote verifications have rarely changed anything. Errors have been found in only a few polling rooms and an elected politician has never been replaced due to recounts.

Having at least 300000 ordinary people (six for each of the 50,000 polling rooms) involved in "producing" electoral results ensures that nobody can ever commit acts of wide-scale electoral fraud.

Of course, if the local administrations manage to "pilot" the choice of scrutineers, if most of the polling room workers are fraudster, if the instructions provided by the Ministry are not read, understood or put into practice, if the work at the polling room is done unwillingly, without seriousness, or without a sense of the importance of the event, if the parties representatives are absent or don't check, if electors don't care what's happening or don't take part during the count, then certainly some results at a few polling rooms might not correspond with the true result.

In electronic voting a few technicians can alter any result with a few clicks of their mouse, especially if they are allowed to access electoral hardware and software.

Here are some examples of italian ballot papers

ballot paper to elect the European Parliament

This is taken from the advertising of a political party and it shows how an elector can vote: by marking one symbol and/or writing no more than 3 names beside it .

ballot paper to elect the Regional Council

Electors can

• mark the name of one candidate President of the Regional Council
• mark the symbol of his/her coaliton
• or mark one of the symbols of the parties supporting his/her coalition
• in addition electors can chose a candidate to the Regional Council, writing his/her name beside the symbol of his/her party.

ballot paper to elect the President of the Provincial Council

This is taken from the advertising of a political party and shows how an elector can vote: marking one symbol or name. Nothing else should be written.

ballot paper to elect the City Council

The precautionary principle or precautionary approach to risk management states that if an action or policy has a suspected risk of causing harm to the public or to the environment, in the absence of scientific consensus that the action or policy is not harmful, the burden of proof that it is not harmful falls on those taking an action.
The principle is used by policy makers to justify discretionary decisions in situations where there is the possibility of harm from making a certain decision (e.g. taking a particular course of action) when extensive scientific knowledge on the matter is lacking. The principle implies that there is a social responsibility to protect the public from exposure to harm, when scientific investigation has found a plausible risk. These protections can be relaxed only if further scientific findings emerge that provide sound evidence that no harm will result. (from wikipedia)

The Precautionary Principle applied to elections means that even the smallest doubt about e-vote being really less risky than paper voting it's a good reason to use the traditional paper ballots! By the way, what's wrong with ballot papers?

The European Union applies the Principle in the following fields: Consumer protection, Environment, Food safety, Genetically modified organisms, Public health.
Thus EU should apply the Precautionary Principle to elections because

• when we vote we are "consumers" of democracy
• winners of elections are allowed to take decisions that greatly affect both the natural environment and the social environment (which for humans is often more important than the natural one!)

Winners of elections are allowed to take decisions which grately affect everyone, thus I think the Precautionary Principle should be applied to elections as well to ensure that elected politicians really represent the will of the electors' majority.

Electronic vote has three kind of problems:

1. Privacy problems.
   Votes must be kept forever absolutely anonymous.
2. Security problems.
   Related with the action of voting (votes must be taken only from people having the right to vote, vote must be granted to everybody having the right to vote, votes must be collected, transmitted, and stored without any fraud.
3. Reliability problems.
   Related to the way the votes are counted up and thus related to the question if we can trust the electoral results.

Let's assume we have already solved all the "privacy" and "security" problems. Even in this very optimistic case the "trustworthiness" problem still exists: we can't know if the announced results are correct. In other words who could ever certify the final tally of each candidate?

To address the "trustworthiness" problem ongoing studies and working prototypes propose to give the elector a way to check that his/her vote is properly recorded in the computer where votes are tallied up. This can be accomplished in various technical ways, but we should stop for a minute and ask ourself which is the purpose of verifying that our vote is recorded as we meant to.

Of course if we find out that our vote being improperly recorded, then we can "call the police" (will "police" trust us or the computer?), but if our vote is properly recorded should we be satisfied and therefore accept the results as good? Not at all since we still miss the prove that our vote (and those of each elector) is properly accouted in the final tally. Its a joke to program any computer to show electors their true vote and declare whichever result!

To certify the correctness of the final tally, we need all the following conditions:

1. the accounting software is honest, faithful and secure
   This condition to be met needs the entire organization holding the election being honest, faithful and secure. We know that in real word this rarely happens, but we have been optimistic from the beginning (assuming we solved any "security" problem), so we can assume such a condition to be true.
2. each vote has recorded a link to its elector to allow vote verification by their electors
   This poses big problems concerning vote anonimity
3. all the electors verify their vote simultaneusly, at the precise moment when votes are counted up.
   obviously we'll never be able to accomplish such condition

We will never solve the "trustworthiness" problem of the electronic vote.

It means that electronic vote is a beautiful (and expensive) toy which symply it's not suitable for its purpose which is (supposed to be) the election of our representatives according to the popular will.

P.S. We would have only a few of the "privacy" and "security" problems and no "trustworthiness" problem at all if we could have the certainty that the whole organization which helds the elections is honest, faithful and secure. But, since people throughout history has done the worst action to get the power, we can't have such a blind faith regardless of the kind of the electoral organization (public or private, governmental or local) and regardless of the country we live in.

After a couple of centuries in which we have been voting with ballot-papers and absolutely transparent counting procedures, nowadays we are starting to use the electronic vote. The debacle of the USA 2000 Presidential Election is presented to the public opinion as a reason to lead to electronic vote, but

• We should not change the way we vote only because we had problems once in a couple of centuries.
• Things went wrong in USA 2000 only because of the unnecessary technology (do you remember the machines that badly punched votes?).

Did all the past elections have problems? Do you really suspect Roosevelt, Truman, Eisenhower, JF Kennedy, Johnson, Ford, Carter, Reagan, G Bush and Clinton, have all been elected thanks to errors or fraud?

To date (2024) the great majority of democracies of the world elect their Parliaments and Governments using hand counted ballot papers without any serious problem (small, very localized doubts are always solved recounting ballot-papers). Only Latvia, Brazil, India and USA use electronic voting for nation-wide political elections.

A very good example of paper elections which to date (2024) never had any problem are the Italian paper elections

On March 14th 2004, Spain has elected its new Parliament using the traditional ballot-papers system. Ballot boxes were beautiful transparent plastic boxes, not invisible and unverifiable memories of computers! Soon after the closing of the election, the first projections showed who the winner was and the morning after the final results were available. Those results, being manually counted and checked (and verifiable again), were not only official, but even without a shadow of a doubt. Why should all this be left aside? Nothing better can be expected from electronic vote!

The concept of Voter Verified Balloting was created by Rebecca Mercuri.

VVPAT is the acronym of "Voter Verified Paper Audit Trail" and VVBP is the acronym of "voter verified paper ballot". The terms are equivalent and refer to a kind of "vote receipt" printed by an electronic voting machine that shows the elector his/her vote as it is being entered into the electoral system. The voter must be required to perform an action that confirms that their choices have been recorded correctly on the paper, hence making it a verified (rather than just "verifiable") ballot in a legal sense. The VVPAT/VVBP is kept by the election official, as the record of votes cast, for audit and recount purposes. Verification of a small percentage of VVPAT should to be activated when elections are close.

I see the following points about VVPAT:

• the winner of the election is decided in the first count (probably the only count) which is based on electronic votes. Infact VVPATs are counted in the second count (recount or audit), but this rarely happens thus VVPATs will most likely not be used or counted. You are able to view the Paper Audit Trail, and make sure it is correct. You have no way of knowing what your electronic ballot says. You can feel relatively certain that if there is a hand recount, your vote will be counted properly. But since hand recounts are very rare, when you look at that piece of paper, you are not actually verifying your vote. There is still nothing to verify that your actual vote was correct.
• VVPAT recounts shouldn't occur only when elections are very close.
  Infact where deliberate fraud does take place, the magnitude of the fraud may not be small. And also the magnitude of accidental errors may not necessarily be small. Thus fraud and errors can produce very different results. Unfortunately many people, and state laws, only want recounts to be conducted when elections are very close. It seems that people are willing to do recounts in the case of small accidental errors but not to detect fraud or large errors!
• it is not possible to make a statistical "recount" of VVPATs by manually counting a small percentage of them and seeing if the result is more or less the same as the electronic one. Infact, as candidates of USA-2000 election well remember, elections can be very close and so a precise count of all the VVPATs could be necessary. Some legislations require a little 1% recount to validate electronic results!

Thus VVPAT can't be used to verify electronic electoral results unless they are all counted. But if we really print and count VVPAT for each casted vote then we simply run a paper election which ballots are printed by machines instead of being hand written by electors!

• we double the efforts of each election, which is now made of an electronic one and a paper one
• we greately increase the election cost (try to imagine how it costs to buy and maintain a PC in each voting boot, plus the software, plus the network apparatus and lines, plus the high-tech skill involved, ... and compare it with the cost of ballot papers and pencils!)
• we know from the beginning that the official result will always be the one coming from the counting of VVPATs. Infact we use them to confirm electronic results, thus in case of discepancies they surely win. Thus, what for do we also run an electronic election?

Optical scanners in the polling place ("precinct-count optical scanners") are often proposed as a faster way to count ballot papers, but they are not at all a proper solution.

Optical scanners can check paper ballots for correct marking. If a ballot is marked correctly, the optical scanner can count the votes and then drop the ballot into a sealed ballot box. Proper security at the end of the election day means that a tally sheet printout from the optical scanner must be signed by the poll workers and posted publicly. Also each poll worker and observer must receive a duplicate signed printout. For each optical scanner, all ballots and another signed tally sheet printout must be stored together in a sealed bag so that recounts can be done scanner by scanner. The sealed bag of ballots and other records must be observed (guarded) at all times until the election is certified. The contents of each bag should not be mixed with the contents of any other bag.

Beware: PCOS hardware & software can be hacked as well!It already happened as you can read in Optical scan machines hacked in Florida

To ensure there are no mistakes/fraud we absolutely need that:

1. scanners are not connected to any other equipment to avoid any chanceof their "remote control". They should act just like the banknote counters usually used by bank cashers
2. after the end of the electronic counting are done a large number of manual count verifications
3. electronic (and manual) results of each precints are soon made public
4. independent bodies compute general results to verify those given by the electoral service (ususally the Government)

Obviously manual recount of the ballot papers of a precint takes time, the same time it would normally take their manual count,thus the manual recount zeroes any time gained by the electronic counting.

Furthermore, not to be fooled, the sampling precints which are to be manually recounted must be choosen after the electronic results are made public and their choice must be absolutely unpredictable.This constraint adds a further overhead thus Any trustworthy PCOS electronic counting takes longer than the manual count

what about costs?

We need a PCOS apparatus in each precint, that is at least a PC and a scanner plus a skilled technician which takes care of them.In five years time (or four according to period of office of the legislature) things we'll be so much changedthat the PCOS will surely be obsolete since there will be new security problems, newdisk technologies, new kind of memories and, of course, new operating systems and network protocols.We'll need to buy new PCOS apparatus (hardware and software) at each election!

Hardware and software vendors will be very pleased, but what about tax payers? Do we all agree on spending our moneyto solve an unexisting problem?

PCOS are a trojan horse to introduce electronic voting!

It will probably happen that any PCOS system working properly for a couple of elections will be used as a pretext topersuade people to vote electronically. In this way the people will loose any democratic monitoring over elections.