My Experience Judging an Election
Matthew Green

I volunteered to be an election judge in the city of Baltimore because I'd been following the presidential race so closely all year, and I wanted to make some kind of contribution to the process.  As one of Avi Rubin's students, I also had an ulterior motive: I wanted to see firsthand how people felt about electronic voting.  Perhaps there were a lot of people who felt as I did, or maybe it was the promise of the $125 paycheck, but workers at the election board told me they'd never seen as many volunteers as they did this year.  In fact, the board was so overwhelmed that they were unable to find assignments for many judges.  I received a posting due to a fluke, when a precinct in the Brooklyn neighborhood experienced an unexpected run of no-shows.  Later on I learned why so many people had failed to show up, but at the time it just seemed like good luck.

In my precinct, three out of five judges (including myself) were young people new to the process, which was gratifying, but also resulted in a certain amount of on-the-job learning.  Because so many judges had failed to appear, the polls opened late and we were faced with a line of people who had been waiting for a half an hour.  Our two Sequoia voting machines had been delivered the evening before the election, and spent the night unguarded in the polling place (an elementary school) before we got there.  To activate them, a police officer ceremoniously handed over two sets of keys of the sort used to unlock file cabinets, one of which opened the machine case, and another began polling.

The Sequoia AVC Advantage machines we used were not touch-screen graphical systems.  Voters selected their candidates by pressing buttons on a large printed ballot board equipped with lights to indicate voter choices.  To handle write-ins, the machine provided a row of alphabetical keys and a small LCD display.  Unlike Diebold systems, our voting system did not require us to program smartcards for individual voters.  Instead, Baltimore City takes a more old-fashioned approach, which has the machine operator collect a paper slip from each voter before manually activating the booth.  I imagine this low-tech approach is less impressive to election boards than the smartcard technique, but from a security point of view it seems much more prudent than allowing voters to insert a data storage device into an active voting machine.

Aside from these differences, the Sequoia is much like other electronic voting machines.  It’s a “black box” running proprietary software, with no voter receipt, and no real paper trail.  Although each machine is equipped with a thermal printer, printouts are only generated at the beginning and end of each voting session.  For the remainder of the day, the printer is inactive, locked inside the machine’s case. 

My overall impression was that voters reacted positively to the machine.  Only two people expressed concerns about the electronic system—one who was genuinely upset and felt that the machine would eat her vote, and another who joked that she was “being set up” after a button became sticky and she was unable to select a candidate.  Unfortunately, city regulations expressly prohibit us from offering provisional paper ballots to “protesters” who don’t trust the voting machine, so we had to talk the first objector into using the machine, which she did with some reluctance.  We never did find a solution to the sticky button other than advising voters to “push harder”; this was a recurring problem throughout the day, and we hope it didn’t prevent anyone from casting their vote.  Fortunately, we only fielded only one accusation of fraud, and it was completely unrelated to voting machines: in the afternoon, a voter came to us with a concern that his deceased neighbor might be attempting to vote in the election.  On closer examination, this turned out to be nothing more than an old registration that hadn't been purged from the records-- the dead did not rise from the grave, at least not in my precinct.

One thing that did confuse us slightly was the initial configuration of the voting machine when a voter entered the booth.  When a poll worker pressed the "Activate" button to enable voting, we expected that the selection lights would all go out, allowing the voter to begin with a clean slate.  Instead, a number of lights appeared in places that did not correspond to actual voting options, usually above the list of candidate names.  From what we could tell, these lights were a normal feature of the machine, and simply indicated that the voter had not yet made a selection in that particular race.   This was not something we had been told about during our training the day before, but after examining the configuration, we came to the conclusion that this was a normal default configuration, that the lights were never located at actual voting positions, and that they went out as soon as a voter made a choice in a particular race.

Although voting in our precinct was smooth throughout the day, relations between the poll workers weren’t.  It took us a while to notice, but the two more experienced Republican judges were not on good terms.  This animosity was buried in the beginning of the day as we were all rushing to get voting started.  Things started to get ugly later in the afternoon, when the chief judge began arguing about minor procedural issues, such as whether the maximum age for children allowed in the polling booth was 10 years or 12 years.  When the other judge made it clear that he didn't think it was a big deal, some strong words were exchanged.  Eventually, the chief judge called the attorney general in an attempt to have his counterpart removed.  A harried representative of the election board was dispatched, and very nearly fired both judges on the spot, despite the fact that this would have shut down our polling place.  During the hour or so that this went on, we ran the polls without their assistance, and finally appreciated why so many judges had skipped work that morning.

Besides the rigmarole with machine keys, the main anti-tampering procedure we undertook on the machines was the “zero count”, a printout that shows the total number of votes, and the votes for each candidate—all of which should read zero at the start of polling.  Obviously this does not protect against a very sophisticated tampering job, which could easily modify the way the machine works without upsetting the initial count.  A less sophisticated job—for instance, a criminal picking the locks during the night and simply voting ballots—would have no affect on the vote totals, as the results cartridges are not inserted until voting begins on election machine.  So while these mechanisms offer a sense of security, on closer examination they are of limited value. 

Each machine also has a “protective counter” showing the total number of votes cast on that machine over the course of its lifetime.  According to news reports, some election watchers in Pennsylvania misunderstood the protective counter value as indicating that votes had already been cast, which led to several false accusations of voter fraud.  Quite frankly, I’m extremely skeptical of the competence of the watchers who allowed this misunderstanding to become national news; the meaning of the counter is clearly explained in every handbook, and to everyone involved with the election—at worst, a simple call to the elections board could have cleared the matter up.

Having spent a day observing the public’s reaction to electronic voting, my conclusion is that it’s going to be very difficult to educate people on the security weaknesses of these systems.  The machines are generally easy for voters to use, and they greatly simplify the work of tallying and returning the results.  Most people are accustomed to simply trusting technology, and it’s hard to explain why they need a voter-verified paper trail.  Worse yet will be convincing election boards, who will almost certainly put up a huge fight to avoid the comparative hassle of using paper ballots.

Nonetheless, despite all of our procedures and the precautions we took, we were all aware that there was little we could do had there been a problem with the voting machine itself.  Once a ballot is cast, the only record of the ballot is a digital image inside of the results cartridge, and the correctness of that image is entirely up to the manufacturer (or anyone with physical access to the machine, and the ability to reprogram it.)  A machine failure, a mistake, fraud—these are things that are outside of our control.  This worries me, and unfortunately we may never know whether or not such concerns are misplaced.

As I write this, the outcome of Ohio's electors is still up in the air.  With thousands of precincts, and many provisional ballots uncounted, this election could be decided by a small handful of votes on each voting machine throughout the state.  While I believe that it's unlikely that fraud will determine this presidential election, we simply have no way to recount these ballots should one side make the accusation.  The end result may be a general lessening in voter's confidence in the integrity of elections, and that would be a great loss for our democracy.