To start with, voters cast votes using optical-scan paper ballots. For disabled voters who cannot cast such ballots directly, have available a machine which will allow a voter to select candidates from a spoken recording, but which will then produce for the candidate a filled out paper ballot which is processed like any other.

When a ballot is inserted into the counting machine, it would be assigned a random unique ID, which would be marked on the paper ballot itself in machine-readable form, and would also be recorded electronically along with the votes cast.

After the close of polls, election officials would publish in machine readable form (e.g. on the web) a list of all the votes cast, sorted by ballot ID. Anybody with access to a computer would be able to download the list and confirm that the reported election totals actually match the votes recorded.

Following this, some number of ballot ID's would be selected at random from among those cast; the paper ballots for those particular ID's would then be examined to confirm that they in fact match the computer record. If any mismatches are found, the counting equipment and ballots should be inspected and, once any problems have been solved, a random sample twice as large as the original random sample should be taken and checked. If mismatches are found this time, find and fix the problem and redouble the sample size.

Using this protocol, checking 100 ballots total for a race would confirm with 85% certainty that at least 98% of the ballots were counted correctly and with 98% certainty that at least 96% were counted correctly; checking 1,000 ballots would confirm with 85% certainty that at least 99.8% of the ballots were counted correctly and with 98% certainty that at least 99.6% were counted correctly. Even if there are 1,000,000 ballots cast in a race, inspection of 1,000 that are selected at random will still be sufficient to confirm with 85% certainty that 99.8% were counted correctly.

The one problem with this approach is that it would make public the combinations of candidates for which people voted (e.g. voters would be able to tell that someone voted for Ralph Nader for President, Jesse Helms for Senate, and Fred Quimby for Assistant Water Commissioner). If desired, this could be alleviated by assigning a different unique ID for each race on each ballot (so if there are ten races, each ballot would be assigned ten IDs). This could get unwieldy, but there are some approaches which could reduce the amount of data to something quite reasonable.
-- supercat, Mar 08 2004

In the worst possible case the one that declares himself to be the winner will also have the ballots destroyed. A public list prevents that.

Still there needs to be careful monitoring of the software; that too should be public. It needn’t be complicated and there are plenty of people who can examine it, for that matter write it, long before it goes into use. Each box could easily have it’s own recorder with no network to be compromised.

The call goes out to public domain coders. Whose vote it is anyway.
-- Fussass, Mar 08 2004


What they don't want to encourage: "Okay, I'm finished with it, here, just copy that onto your ballot and pass it on."
-- dpsyplc, Mar 08 2004


//Still there needs to be careful monitoring of the software; that too should be public. It needn’t be complicated and there are plenty of people who can examine it, for that matter write it, long before it goes into use. Each box could easily have it’s own recorder with no network to be compromised.//

Although it's important that the software be verified beforehand so as to prevent someone who's going to lose from trashing the election, I believe that if interested parties are allowed to select an arbitrary sampling of ballots of their choice, my proposal will be immune to any type of chicanery on the part of those conducting the election except for physical alteration of the paper ballots. And if some supervision is in place between the time the ballots are requested until they are inspected, it will be as immune to that as would be an election conducted entirely with hand-counted paper ballots.
-- supercat, Mar 08 2004


//What they don't want to encourage: "Okay, I'm finished with it, here, just copy that onto your ballot and pass it on."//

There are a number of different techniques that are used to cheat in elections. And my proposal won't do much of anything to stop the dead from voting. But it would at least require the dead to fill out a ballot for each vote they want counted; under today's "electronic" voting systems, all someone would have to do is punch in the result they wanted and that would be it.

One key feature of a good voting system is that it should not require an observer to trust any part of the voting or tabulation process that they cannot see or physically verify. Under a proposal like mine, someone who wrote dishonest software could arrange to trash the election by having the software print ballot ID's that don't match up with the reported lists and print bogus validation data [one detail I forgot to mention in my proposal: after scanning the ballot, the scanner should print in machine-readable form what it read, to protect the ballot against future alteration]. But if someone did that, it would be obvious to everyone that the election was tainted; it wouldn't necessarily be clear whether it was accidental or deliberate, but it would be clear that something was wrong. I don't think, though, that were is any way anyone could forge any significant number of votes on my system, other than by creating fictitious voters and physically creating fraudulent ballots for them.

The key difference between my system and current recount protocols is that recounts really don't prove anything; if one performs three counts and takes a median-of-three, one can minimize the effects of random variation, but one can't eliminate systemic errors, whether accidental or deliberate. If a vote counter were set up to count one out of every ten Buchanan votes as a Nader vote, all the machine-recounts in the world wouldn't catch it. And if the hand count yielded results different from a machine count, there would still be no way of knowing which figures were actually correct.

To be sure, finding and pulling out 1,000 ballots selected at random from locations throughout the state of California would entail more work than counting 100,000 ballots from a single location, but one could spend much more time actually examining the ballots. If 1,000 ballots are selected at random, every individual one should match the vote recorded for it. Any ballot which doesn't match should be cause for concern. By contrast, if a hand-recount yields something different from a machine count, it would be impossible to know where in the count the human made, or might have made, a mistake.
-- supercat, Mar 08 2004


//Or where in the code the machine counter has been directed to deliberately count, or accidentally count, ballots in a way that confers a bias within acceptable, statistically irrelevant error margins//

If the cheating is done in the counting, it would be blatantly obvious to anyone with a computer and a little bit of programming experience, since anyone could read in the list of ballots cast and write a simple program to count them.

If the cheating is done in the electronic recording of the ballots, the sampling I described would have a high likelihood of catching it if it went beyond the specified amounts. By performing sampling suitable for the margin of victory, it could be quite well confirmed that the correct person was deemed the winner.

For example, suppose the election result is 52%-48%. The only way the wrong person would be declared victorious would be if 4% of ballots were misrecorded. If exactly 4% of the ballots are misrecorded, there is a 98.3% chance that one will be discovered. One bad ballot may not indicate something sinister--certainly not grounds for tossing out the election--but it would be grounds for checking the scanning equipment and doing a run of 200. If the run of 200 comes up clean, then all is good (the odds of getting a clean sample of 200 when 4% of the ballots are bad are less than 1 in 3500). If another bad ballot turns up in that run of 200, then things start to look fishy.

For closer races, more ballots would have to be verified for accuracy. A race with a 0.4% margin of victory would require about 1,000 ballots to be randomly sampled to ensure a 98% chance of detecting a 0.4% error rate. And a race with a 0.04% margin would require checking 10,000 ballots.

Even so, the level of confidence produced by such sampling is far beyond anything that could be produced by recounts. And even if the election were sufficiently close as to require hand tabulation and inspection of all the ballots (e.g. a candidate won by 1 vote) being able to individually check each ballot against its computer record could yield much more accurate results than doing a recount without such checking.
-- supercat, Mar 09 2004


Another thing: if the ballot-accepting machine is set to reject any ballot which has any ovals that are filled in more than 10% but less than 90%, and if the recounting machines are set to kick out for hand inspection any ballots with ovals that are filled in between 20% and 80%, there should be zero errors on ballots which are not flagged for hand inspection. Any error should be taken as a sign that something may be amiss justifying, at minimum, the taking of a larger sample.
-- supercat, Mar 09 2004


this seems like a lot of work... I think I'll go watch survivor.
-- ato_de, Mar 09 2004


//this seems like a lot of work... I think I'll go watch survivor.//

The amount of work required is pretty trivial compared with the amount of work that would be required using existing tabulation methods to provide equal confidence.
-- supercat, Mar 09 2004


It doesn't matter how secure or foolproof your plan is, if no one gets off their ass and votes.
-- ato_de, Mar 10 2004


I heard somewhere that if you let people vote by phone, many more will do it.

Not sure if you can solve all the issues surrounding it, though :)
-- theircompetitor, Mar 10 2004


//It doesn't matter how secure or foolproof your plan is, if no one gets off their ass and votes//

How about making voting compulsary, adding a don't care box, giving a proof of voting slip and then adding a large apathy tax to all tax returns without the slip attached.

As for the actual idea, great. The current machines (US election gear) may or may not be crooked but the mere fact the Diebald et al refuse to prove their soundness is grounds for suspicion. I doubt the makers of the old mechanical devices would have been allowed to seal the boxes to outsiders so why should the new manufacturers be allowed to? Hefty campaign contributions to the right people shouldn't qualify.
-- stilgar, Dec 06 2004


I would like access to the ID so I can, check online, my vote is tallied how I cast it. This would mean population would also be doing some vote verification. Currently I am casting my vote into a black box of electoral componentry.
-- wjt, Dec 05 2014


[wjt] I'd vote for that idea if it was a separate idea.

Of course you could still have an issue where the ballot machine fouls up and prints an illegible ballot ID.

Maybe ballots should come pre-printed with a unique ballot ID. The ballot should have a tear-off receipt with matching number. Voters are encouraged to photograph their ballots before submitting. When scanned, the machine can also record which box it is being stored in (and approximate position in the box), so if a ballot does need to be verified, it can be found with minimal effort.
-- scad mientist, Dec 05 2014



random, halfbakery