Monday, January 15, 2001

City to get high-tech voting machines

By Jeff Gelles

City officials hope to replace Philadelphia's mechanical-lever voting machines by signing a contract this month for a new $18.5 million touch-screen electronic voting system.

 The new system - which officials plan to have in place by November - provides near-instant results and computerized reliability, with none of the myriad problems made familiar by the dispute presidential election in Florida.

 But some outside computer experts, whose concerns are discounted by city officials, say Philadelphia may be making a mistake by buying a system with 15-year-old technology and drawbacks of its own.

 Warnings about such systems have gotten more attention elsewhere. During the summer, New York City backed out of a deal to purchase a system much like the one Philadelphia plans to buy, after spending $17 million and seven years on testing and evaluation.

 Philadelphia officials say the easily portable machines are necessary to replace aging 900-pound voting booths that are increasingly hard to use and maintain and that rely on error-prone manual tabulation of votes.

 "These machines are going to be a godsend for us," said Robert Lee, head of voter registration and a member of the committee that proposed their purchase. Lee called the machines "probably the most safe and accurate devices on the market."

 The machines' critics say the main problem is a potential improvement they lack: an auditable paper trail that enables a voter to verify the accuracy of his or her own vote and allows a meaningful recount in a contested race.

 "I actually think that they should suspend [the purchase], and I am not alone in my belief," said Rebecca Mercuri, a Bryn Mawr College computer scientist whose research has focused on problems with computerized voting systems. She said Philadelphia would be better off doing nothing for the time being, or even turning to optically scanned ballots, a newer paper-ballot system that eliminates the most glaring faults of punchcards.

 Among those who share her view is Peter G. Neumann, principal computer scientist at SRI International, a nonprofit research institute in Menlo Park, Calif., and a nationally prominent expert on computer security and computer-associated risks.

 On touch-screen systems, Neumann said, "there is absolutely no assurance that your vote is recorded in the way you intended it. That's a fundamental flaw that has to be overcome."

 After the national furor over the disputed presidential vote in Florida, there have been widespread calls for inquiries into voting systems and new national standards. The Massachusetts Institute of Technology and the California Institute of Technology recently announced a joint initiative "to develop an easy-to-use, reliable, affordable and secure United States voting machine."

Big business has also responded. Five of the best-known names in technology - Dell, Compaq, Cisco Systems, Microsoft and Unisys - each recently announced a foray into the voting-machine business.

 Mercuri said the new attention might highlight the flaws not just of punchcard ballots, used by about one-third of U.S. voters, but also of the newer electronic systems that Philadelphia is planning to buy.

 "If we as a nation are looking at voting systems, and the City of Philadelphia goes and buys a new voting system, they're going to have a potentially obsolete voting system when the new standards come out," Mercuri said.

 Those behind Philadelphia's decision say they see no reason to veer from a course set years ago.

 The current negotiations to purchase 3,526 Direct Recording Electronic (DRE) voting machines from Danaher Corp., of Washington, D.C., cap a process dating to 1995, when a city task force appointed after an absentee-voting scandal in the Second State Senatorial District recommended their purchase. City voters endorsed the decision in 1998.

 "We came to a conclusion that this makes sense for now. Whether it makes sense 15 years from now is another question," said Fred Voigt, executive director of the Committee of Seventy, who has long urged the city to upgrade its system.

 In one sense, disagreement over the new machines highlights a philosophical divide.

 To computer scientists such as Mercuri and Neumann, any proposal that lacks a paper trail risks putting too much faith in computer systems. Even some highly secure systems have shown themselves vulnerable to misprogramming or hacking, they say.

 "If we did have a way of designing a software product that was perfect, we would never have bugs, we would never have a computer crashing," Mercuri said.

 But to Voigt and city officials, any system that involves paper ballots carries a lasting stigma, recalling an unsavory history of stuffed ballot boxes and damaged ballots.

 "Cities such as Philadelphia switched to voting machines precisely to eliminate the nuisance and potential for fraud that existed under paper balloting systems," the 1995 task force said.

 Critics of electronic voting say it trades one set of problems for another that is more worrisome because it is less visible.

 "If you had a paper-ballot system, you would not hand 10 million votes to two computer programmers, tell them to go into a private room, count the ballots, and then tell us what the results were. But that's exactly what happens with an electronic voting machine," said Douglas Kellner, a New York City elections commissioner who argued against the city's purchase of a Sequoia Pacific DRE system similar to one used - and widely praised - in Montgomery County since 1996.

 Although there is also no paper trail on Philadelphia's mechanical machines, Mercuri said the simplicity of the machines' levers, gears and counters makes tampering easy to recognize.

 By contrast, she said, electronic machines rely on complex computer code that even outside experts could have a hard time deciphering. And the code is considered proprietary, so outsiders would have limited opportunities to test it.

 Philadelphia officials dismiss concerns about problems with DRE machines, as do their manufacturers.

 "I have complete, unwavering confidence that the voters' choices are being recorded accurately," said Matt Lilly, director of voting-machine sales for Danaher.

 Lilly said the model that Philadelphia plans to purchase had been thoroughly tested, certified by Pennsylvania and other states, and marketed since 1986.It is used by more than 200 jurisdictions in 13 states and the U.S. Virgin Islands, he said.

 "The final result has never been overturned," said Lilly.

 Lee said he searched widely on the Internet for news accounts of challenges to electronically recorded votes and found nothing worrisome.

 "Most of them are minor problems," Lee said. "I have not found any instances where, during a recount, any vote totals have changed."

 To critics of the DRE machines, praise such as that of Lilly and Lee underscores their central objection to systems that rely exclusively on electronic recording of votes.

 Elections officials like the systems, the critics say, because they produce tidy results that are rarely challenged. But the critics say the reason the machines escape challenge is not that they are inherently reliable, but that there is simply no way to question them.

 Not that there is no evidence of problems. Sequoia Pacific, for instance, acknowledges that one of its machines failed Nov. 7 in Middlesex County, N.J. And Mercuri has a copy of a videotape, made on behalf of a candidate during a post-election test in 1995 in Louisiana, that appears to show several Sequoia Pacific machines misallocating votes to candidates on adjacent ballot lines.

 Sequoia Pacific officials first branded the tape a fraud, and it was rejected as evidence in a court challenge. In a recent interview, Andrew Wynham, Sequoia Pacific's national customer support manager, said the tape was misleading but added, "I don't think that anybody did it on purpose."

 Wynham said the alleged malfunction was impossible on the machine. "That's one thing you can't do with those machines. You can't vote in one position and have it record in another," he said.

 Neumann, whose 1995 book, Computer-Related Risks, details numerous instances in which computer systems failed because of software or hardware errors or hidden rigging of code, calls such confidence unwarranted. Not only are mistaken or manipulated results possible, but without a paper trail, they might never be noticed.

 "One of the simplest ways of rigging the election would be to hire the programmer who is writing the code for the election software," Neumann said. "You could pay him five years' salary and buy him a house somewhere, and it would still be a lot cheaper than all the money you'd have to spend on advertising" to win an election legally.

 Neumann said that oft-touted safeguards in the machines, such as electronic audit trails and multiple memory locations, might only be confirming and preserving erroneous information. And he scoffed at manufacturers' notion of a "randomized audit trail," in which the machine stores a printable record of each "ballot," but in random order to protect each voter's privacy.

 Mercuri said a better system would marry computer technology to paper, suggesting a touch-screen machine that records a voter's choices electronically and also creates a machine-readable paper ballot. The voter could see the ballot through a window in the machine and approve it before it was dropped into a sealed ballot bin.

 Louis Applebaum, the city's procurement commissioner, said the city was confident in its choice and uninterested in waiting for something that doesn't yet exist and that would presumably be more expensive to buy and operate.

 "There has to be a balance," Applebaum said. "The City of Philadelphia is comfortable that the system we are going to bring into Philadelphia will take us as close to perfection as humanly possible."


Jeff Gelles' e-mail address is © 2000 Philadelphia Newspapers Inc.