A Study of Vote Verification Technologies …

                  A Study of Vote Verification Technologies
                          Part I: Technical Study

                   Prepared for the Maryland State Board of Elections

              By the Maryland Institute for Policy Analysis and Research
                      University of Maryland, Baltimore County

                                 Executive Summary

        Scholars at UMBC, working through the National Center for the Study of
Elections of the Maryland Institute for Policy Analysis and Research, conducted a
technical review of vote verification systems for the Maryland State Board of Elections
(SBE). Initially, the review was supposed to include up to seven systems from the
following organizations and individuals: VoteHere (Sentinel); SCYTL (Pnyx.DRE); Prof.
Ted Selker, MIT (VVAATT); Diebold's VVPAT; Democracy Systems, Inc.
(VoteGuard); IP.Com; and Avante. We determined that IP.Com did not represent a true
vote verification technology, and Avante and Democracy Systems, Inc., declined to
participate in the study. We also examined the SBE's procedures for "parallel testing" of
the Diebold AccuVote-TS (touch screen) voting system in use in Maryland and used this
as a baseline against which to evaluate the vote verification systems.

        In conducting our analysis, we received demonstrations from the vendors, and we
examined the vendors' hardware, software, and documentation to determine if their
products did what their vendors claim that they do. That is, do they enable voters who
use the touch screen voting system in use in the State of Maryland to verify that their
votes were cast as intended, recorded as cast, and reported as recorded, and do they
permit post-election auditing? We examined such issues as:

           implementation
           impact on current state voting processes and procedures
           impact on voting
           functional completeness
           security against fraud, attack and failure
           privacy
           reliability
           accessibility

       We also compared these systems to one another and to the state's current voting
system and procedures, which includes the SBE's use of parallel testing around that
system.

       We note several specific concerns about these products, including the following:

       1. Only one of these products, the Diebold VVPAT, provides for a pure paper
          solution.
       2. All of these products would impose significant one-time implementation and
          on-going management burdens (cost, effort, security, etc.) on the SBE and the
          state's 24 Local Boards of Elections.
       3. All would increase the complexity of the act of voting.
       4. All would increase the amount of time required to vote.
       5. All would at least double the amount of effort required to administer elections.
       6. All would adversely affect voter privacy.
       7. These products would have both potentially positive and potentially negative
          impacts on security and election integrity.
       8. None can be considered as fully accessible to persons with disabilities and
          none of them fully meets the accessibility standards of Section 508 of the
          Rehabilitation Act.
       9. Integration of these systems will require the cooperation of Diebold to
          develop and/or ensure the viability of a working interface between the
          vendors' products and the Diebold system.

       Our principal findings are, first, that each of the systems we examined may at
some point provide a degree of vote verification beyond what is available through the
Diebold System as currently implemented. But this is true only if the system were fully
developed, fully integrated with the Diebold DREs and effectively implemented.

        Our second principal finding is that none of these systems is yet a fully
developed, commercially ready product. None of these products had been used in an
election in the U.S. (SCYTL has been used outside the U.S. and a different version of the
Diebold VVPAT has been used in the U.S.).

       Were the State of Maryland to decide to acquire any of these products, the vendor
would have to invest additional money and effort to produce an actual product and make
the product ready for use in actual elections. Indeed, nearly all of these vendors are
looking for some level of external support to fully develop and commercialize their
products.

        In our expert opinion, it is a bad idea for governments to buy products that are not
functionally complete and that either do not have positive records in the market place or
that cannot be fully and effectively tested in simulated elections to ascertain their
performance characteristics.

        Therefore, based on the evidence from this study, we cannot recommend that the
State of Maryland adopt any of the vote verification products that we examined at this
time.

        We would note that no election system ­ regardless of the technology involved ­
is foolproof nor is any election system completely immune or secure from fraud and
attack. Indeed, there is a long and inglorious history of election fraud in the U.S. that
involves nearly all methods and technologies of voting, especially paper voting systems.
Moreover, it would be prohibitively costly to make any election totally secure.
        Finally, regardless of what the State of Maryland does in the near term with
regard to vote verification and vote verification systems, in future elections, it should
expand the use of parallel testing. The state should also undertake a full-scale assessment
of the security procedures and practices around its current voting system. We say this
even with the knowledge that current security procedures are reasonable and prudent and
that the SBE's system of parallel testing, as currently implemented, reduces considerably
the possibility of fraud and attack on the system.