Roy Saltman
Michael Shamos
Rebecca Mercuri Bio
Holt Vs. Zimmer

This article by Douglas Dixon was prepared for the November 15, 2000 edition of U.S. 1 Newspaper. All rights reserved.

Technology & the Polls: Rebecca Mercuri

The paper process can be slow and inaccurate, But the digital replacements also have problems

by Douglas Dixon

It's happening most dramatically right now in Florida, with the outcome of the presidential election at stake. And -- in the political equivalent of lightning striking twice -- it's happening simultaneously in our own backyard, New Jersey's 12th Congressional District, where the race between Rush Holt and Dick Zimmer is still undecided.

The November 7 election has demonstrated the difficulties of carrying out the fundamental democratic process of counting votes. Even though ballot problems like those in Florida were already well known, tabulating election results continues to be a clumsy process fraught with human error. In New Jersey the vote seems more accurate but counting all the ballots has proved to be a tedious and contentious process.

So it might seem that electronic or even an Internet-based voting might be a better solution, replacing slow manual processes with instantaneous computer results. On the other hand, recent experience suggests that relying on computer software can be problematical, from the recent break-in at Microsoft, to the rash of global E-mail viruses, and even the hacking of candidates' websites.

"People see Internet voting as a solution," says Rebecca Mercuri, an expert on voting security. "It's chilling. It will compromise voter anonymity and auditability. It would solve the recount problem, because we won't be able to do a recount."

Mercuri has written extensively and provided expert testimony and commentary on many electronic voting systems. Her Ph.D. thesis from the University of Pennsylvania's School of Engineering, "Electronic Vote Tabulation Checks & Balances," examines electronic voting within the larger context of computer security.

Mercuri will speak on "Why Computers Shouldn't Count Votes" at a meeting of the Princeton chapters of the ACM and IEEE Computer Society on Thursday, November 16, at 8 p.m. in the Sarnoff Corporation Auditorium. The meeting is free and open to the public. Call Dennis Mancl at 908-582-7086, or David Soll at 215-854-3461 (E-mail:,

A resident of Lawrenceville, Mercuri is a member of the computer science faculty at Bryn Mawr College and is quickly becoming a national media expert on the current Presidential election. She has been interviewed by the Associated Press, Newhouse news service, and Knight-Ritter, and on WHYY radio in Philadelphia. Her Sarnoff talk will review lessons from the recent Presidential election, prior contested Florida elections, and California's Internet Voting Task Force proposal. It will then present some of the technical issues and challenges for secure electronic voting.

Discussing the Presidential results in Florida, Mercuri focuses on the accuracy of the machines and the statistics of the results. "Every vote counts," she says, "but only within the margin of error, depending on the equipment, and how the precinct has set it up. If there are errors, which there always are, you want them to be evenly distributed." Error rates of up to 2 to 5 percent can be considered acceptable, as they are in other applications such as standardized testing. But statistically, there will be some "outliers," data that falls out of the normal range.

In Florida, the vote for Pat Buchanan in Palm Beach County is clearly such an outlier, significantly out of the range of the voting patterns across the state, and even in the neighboring counties. Analyses at various universities posted on the Web suggest that while Buchanan received 3,407 votes in Palm Beach County, the data from other countries suggest a more likely number would be under 1,000, even as low as 600 (see

"In Florida, they are trying to demonstrate that the outlier data was caused by the ballot," says Mercuri, "but it is very difficult to prove causality." The ballot has two rows of names down the sides, and arrows pointing to alternating holes down the middle. "The layout design, the butterfly ballot, is supposedly illegal," says Mercuri. "It's been known for long time to cause problems, and creates confusion in voters. When right-handed people punch out the holes using a stylus, they are holding their hand over the right side of the ballot and it covers up the little arrows."

Even if the voters thought they correctly punched out the desired hole for their candidate, other problems can occur when votes are tabulated on automated equipment. "A card reader may have a one in one million error rate," she says, "but that says nothing about the cards themselves." The ballot cards have perforated holes for voters to punch out with a stylus, but sometimes the paper does not fully detach, and remains as "chad," hanging down from the card, or even bends back to recover the hole. "The manufacturer says you need to run the cards through four times so the hanging chad drops out," says Mercuri.

In another 19,000 cases in Florida, ballots were rejected because the card was read as double-punched. "But that does not mean that people punched out two holes," says Mercuri. "The ballots are pre-perforated, and then you slide the card in under the faceplate. If the cards are misaligned when they slide in, they may not go in all the way; you could punch in between both holes and possibly have both come out." The machines are tested with a (well-used) test batch of cards, a week before the election, and again the day of the election, to check both that valid cards are counted and that invalid cards are rejected. But for the actual vote, "nobody analyzed the rejections, even though the misalignment problem is known."

Top Of Page
Roy Saltman

Many of the issues with computer vote-counting systems were addressed in a comprehensive 1988 study by Roy Saltman, under the National Bureau of Standards, now the National Institute of Standards and Technology ( His 130-page report, "Accuracy, integrity and security in computerized vote-tallying," reviewed problems with vote-tallying around the country, and provided specific recommendations for voting controls, operational procedures, and balloting hardware and software systems.

"The NIST report found various problems with balloting," says Mercuri, "and focused on the punch cards because of problems with hanging chad. The more you move to electronic voting, the more hidden the tabulation, you remove checks and balances, the visual checking by the voter. And the more we remove them, the fewer people we are turning the election over to."

As we saw in Florida, says Mercuri, "exit polls are checks and balances, too; they gave the state of Florida to Gore. You assume the people are not lying, and within its own margin for error, the exit polls capture the intention of the voters. You can statistically measure the outcome of the election."

After all, she says, "an election is just a sophisticated kind of polling. People go to a `polling' place, come in and express their intention."

"The Constitution says Congress oversees the federal elections," says Mercuri, "but the federal government has delegated it to the states: how the voting is administered, what machines they use, how the machines are set up, how the votes are tabulated, and how they are checked. And some states yield it to municipalities, like New York City."

But is electronic voting a better answer?

Proponents of electronic and web-based voting systems are quick to criticize punch cards and lever machines as being slow and antiquated. But even punch-card and mark-sense (like SAT tests) ballots are counted automatically using mechanical and optical readers. And new DRE (Direct Recording Electronic) machines bypass physical ballots or mechanical interlocks entirely to carry out the entire process of recording and tallying votes in software.

Top Of Page
Michael Shamos

Michael Shamos, a long-time voting examiner and a computer science professor and co-director of the E-Commerce Institute at Carnegie-Mellon in Pittsburgh, proposed a set of fundamental requirements for electronic voting machines in a paper at the 1993 conference on Computers, Freedom & Privacy ( Shamos, a 1968 Princeton University alumnus, proposed these requirements in the form of commandments listed in decreasing order of importance. The "Shamos commandments:"
I. Thou shalt keep each voter's choices an inviolable secret.
II. Thou shalt allow each eligible voter to vote only once, and only for those offices for which the voter is authorized to cast a vote.
III. Thou shalt not permit tampering with thy voting system, nor the exchange of gold for votes.
IV. Thou shalt report all votes accurately.
V. Thy voting system shall remain operable throughout each election.
VI. Thou shalt keep an audit trail to detect sins against Commandments II-IV, but thy audit trail shall not violate Commandment I.
"Note that having every vote counted is number four on his list," says Mercuri. "Number one is that the privacy of the ballot must be maintained. Paying for votes is higher. As we are seeing with vote auction websites, using the Internet involves giving up the checks and balances when people come to the polling place."



"All of the voting systems have inherent flaws, some worse than others," Mercuri says. "You could improve all the systems. The majority of voters are unaware of this. Examiners and election officials are aware of this hierarchy, and inherent problems in voting systems."

Mercuri knows the voting booths inside out. "I've worked the polls for five years in New Jersey," she says, "and for a decade before in Pennsylvania. The poll workers have been there for years, and come to know who the voters are; it's their neighbors."

On the Internet, it's not only easier to sell your vote, but also to coerce your vote. "It's no longer done in a private place," she says. "Imagine voting at a community kiosk with people standing behind you, or in a religious place, or at home in a domestic abuse situation, or at work, with your vote passing through your employer's firewall."

"If we loosen up the controls," she says, "we lose the integrity of the way we vote: privacy, voting for a single candidate, and verification that the ballot is correct."

"If you have a paper ballot, the evidence is there, you can see the intention of the voter," she says. "With a mechanical system you can see your vote, and confirm that you have only voted once, for one candidate. Vendors of electronic voting systems say the audit trail is in the machine. But if you want a full trail, you need to register every vote, and you lose anonymity."

Mercuri first became involved with the social issues of electronic voting in 1989, when she was serving as a volunteer worker in a local election in Bucks County. "One county commissioner mentioned new electronic machines being purchased for Bucks County, and I became concerned," she says.

Her then husband referred her to an article in the New Yorker magazine on the dangers of computerized voting. That lead her to the Computer Professionals for Social Responsibility (C.P.S.R.) in Washington, D.C., and to the Election Watch group. As a result of help from those organizations, "we were able to convince Bucks County not to use the electronic machines," says Mercuri.

From this work and her contacts, Mercuri began to write position papers and regularly testify on voting security. Her main project was during the prolonged controversy over New York City's $60 million procurement of electronic machines. "I gave expert testimony extensively on the New York City procurement process through most of the '90s," she says. Mercuri also has spoken and written on voting at Computer Security and Privacy conferences and for the Association for Computing Machinery (ACM). She has consulted and testified in Pennsylvania, Nevada, Hawaii -- and Florida, where she served as a consultant in a 1993 court case involving an election where enough procedural anomalies were found in the tallying equipment to require a manual recount

Out of her work on electronic voting, Mercuri also developed a business in computer forensics -- reconstructing and developing computer-related evidence. "In the early 1990s there were not many people who had done sworn testimony about computer systems," she says. "So I started advertising as an expert witness for lawyers." She has worked as an expert witnesses for civil, criminal, and municipal investigations and other related legal matters involving computer technology. "The evidence prevails," she says.

Top Of Page
Rebecca Mercuri Bio

Mercuri has a rich background, combining computers and music, science and the arts, business and education. "I've always been interested in arts and science," she says. "It was an early split in my brain; I am ambidextrous, so it's a left brain -- right brain kind of thing, the math side and the arts side. My mom was more of an arts person; she was an English professor at Drexel. My dad was a science teacher in the Philadelphia school district, and he also had a very good singing voice."

"All us kids started music early," she says. "I started piano at age four, the clarinet in second-grade, and the guitar in 7th grade. My brother Sam grew up to be an audio engineer, and works as an engineer and programmer. My sister Adrienne went in reverse: she got a degree in law, and then went back to get a degree in music. She teaches at Indiana University."

Her parents also encouraged the sciences. "Dad was bringing home NASA stuff that they were sending to high schools," she says. "I also did CB radio with my brother. Our dad also got us chemistry sets, and we did our own experiments after going through the ones in the book. We kept needing to move around the furniture in my brother's room to hide the mishaps on his wallpaper."

But this background still did not mean that high school was easy for Mercuri. At Abington High School near Philadelphia, she had "a lot of difficulty with math. I was wired differently, and I had troubles until graduate school when you could do math your own way. At one point I was flunking 11th grade math, but I was in the advanced math class, doing trigonometry. But all my free periods I was programming Wang desktop calculators. These machines had card readers, and you program them by punching holes out. Each card could hold only 80 instructions, and most machines could only read one card."

The conflict between music and computers continued into college, where Mercuri ended up earning degrees in both computer science and guitar concurrently at two different colleges. She started at Penn State in Abington working on a degree in music education, but kept taking computer courses. "I eventually changed my major to computer science," she says, "even though I had to take all those calculus courses."

She did her first computer music program when a computer professor suggested she do a class project on music. She wrote a program to do musical exercises in four-part harmony, where you start with a chord and melody, and develop the four-part harmony according to mathematical rules. "I followed the rules, but it still sounded bad," she says. "It turned out other people were doing the same kind of project, and discovered that musicians impose another 40 to 50 rules intuitively, rules that had never been codified."

Mercuri graduated from Penn State in 1979 with a bachelor of science in Computer Science, after also earning a bachelor's in Classical Guitar from the Philadelphia College of the Performing Arts (now the University of the Performing Arts). "At one point, I took 30 credits between the two schools, or a year's worth in one semester," she says, "which was a lot like when I was finishing my Ph.D. thesis."

After college, Mercuri joined the then David Sarnoff Research Center to work on computer music on a home computer project. She did engineering and programming on the RCA VideoDisc system. While there, she also co-developed several educational music games for the Apple II computer. After the home computer project died, RCA was no longer interested in the programs, so in 1981 Mercuri set up her company, Notable Software, to distribute them. "The lawyers let us take over the programs," she says, "and we set up our own company to sell them while we were still at Sarnoff."

Mercuri, who left Sarnoff in 1985, has served as president of Notable Software since its founding ( The firm has developed educational software that is designed to be played by persons having little or no musical training, at least at the easier levels. In "Note Trespassing," you match and learn notes as they are displayed on the staff and played with the correct pitch. Notable Software has extended the line with geography and history games, including "Flags of the World" and "Geography Scramble."

Mercuri also expanded into training. "I started to get calls from schools about using computers in schools," she says. "So I set up educational computer programming seminars, to help teach the teachers." She also worked with recording studios to help them with computer music equipment.

"The big lesson for me in the mid '80s, which some dot-coms are still learning now, was that I held the company too closely," says Mercuri. "I didn't rely on the expertise of others on how to run a business, for accounting, marketing, and negotiating. People think they know everything, and have to reinvent it all."

Her training business expanded. "I was starting to teach more," she says, "developing course materials, helping people to learn how to program." In 1987 Mercuri created a training division, Knowledge Concepts, to offer courses in computer basics, productivity tools, programming languages, and software engineering. "I was getting big contracts for training," she says, "through the Chamber of Commerce of Greater Philadelphia, and with the United States Army and the Federal Aviation Administration."

But consulting is often a game of credentials. "I have always had leanings toward education," she says, "but I didn't have a master's degree, and I really needed it has an independent consultant." She enrolled at Drexel University and earned a Master of Science in Computer Science in 1989.

As Mercuri worked through graduate school, she began teaching as an adjunct professor for area colleges. Keeping with her ambidextrous background, she taught subjects including computer science at Penn State, statistics and music theory at Immaculata College, and music at Eastern College. "But I wanted to go the full route," she says, "and needed to get my Ph.D." So she enrolled in the doctoral program at the School of Engineering of the University of Pennsylvania, earning her Master of Science in Engineering along the way in 1990.

As a doctoral candidate, she held full-time teaching positions at Mercer County College and the College of New Jersey (formerly Trenton State College), among others. She has taught courses in business, computer science, engineering, mathematics, and ethics and social values. This fall she joined the computer science faculty at Bryn Mawr. And she finally completed her thesis -- "Electronic Vote Tabulation Checks & Balances" -- and successfully defended it in October.

That title one month ago might have seemed fairly academic -- but not now. "All voting systems are flawed," says Mercuri, "this is not new knowledge. And some are more flawed than others. The flaws we need to look at are the ones that violate the Shamos commandants." The two major concerns are privacy and recount, is the person's vote private, and can the count be audited. "But privacy and auditability conflict," she says, "you can't have them simultaneously in a computer system. We have an inner conflict. We need to retain the checks and balances and give them back to humans."

But can't technology ultimately be the solution, rather than part of the problem? Michael Shamos seems more optimistic than Mercuri. "Direct recording electronic systems are fundamentally safer than any system in which humans get to put their fingers on the ballots. You remove the county official from the process." And with ballots such as those in Florida, it's virtually impossible to obtain the exact same count twice, says Shamos. The act of passing them through so many human hands inevitably causes some shifts in those infamous shreds of evidence -- the chads.

"When properly implemented," Shamos says, electronic systems "can have real time accountability. But this will take years and years to implement," he concedes. Such all-digital systems probably won't be cheap. "One thing the public doesn't like is spending a lot of money on elections," Shamos notes.

And the system will be tested by increasing media pressures to deliver results quicker and quicker. "The technology has been skewed toward speed rather than voter convenience or accuracy," says Shamos. "We get away with it because most elections aren't close."

Adds Mercuri: "There's a strong drive to get the results out by the 11 o'clock news. But we want to still be able to have a recount. We need to find the true will of the voter." But without a mechanical or paper system, the voter can't see the ballot recorded as intended. "For example," she suggests, "we could add a paper output as an independent check and verification, and then we could have a better system. It would have speed and expediency for the first result, but also save the possibility of a recount."

"This is not unique to voting," says Mercuri, "there are a variety of other areas where the issue arises as well, such as private banking, and AIDS test reporting. My thesis is really about computer security, and voting machines is just a test case of it."

For more on making sense of computer and consumer electronics technology, visit

Top Of Page
Holt Vs. Zimmer

On Sunday, November 12, five days after the election, a member of Congressman Rush Holt's staff was calling newspaper offices. The call had nothing to do with Holt's ongoing, see-saw battle in the vote count with his challenger, former Congressman Dick Zimmer. The Holt staffer simply wanted the media to know that the next day Holt would be visiting a sixth grade science class in Plainsboro.

The Holt staff apparently had decided to get back on track with the business of being a congressman. By the end of the day Monday, November 13, Holt appeared to have a slight lead over Zimmer, around 180 votes out of 290,000 cast. The final outcome of the election could turn on "provisional ballots," votes cast by people who have moved within a county or changed names and who attach affidavits to their ballots attesting to their authenticity. But the Zimmer camp has challenged some of provisional ballots, on the basis that some affidavits were attached to the ballot by paper clips or were sealed inside the envelope containing the ballot.

Holt sidestepped questions about the vote counting process. But he did issue a statement: "We have consistently said that the bipartisan election boards ought to be allowed to finish their job without partisan interference. My campaign will work with the election boards to provide an accurate, reliable result."

This page is published by -- the web site for U.S. 1 Newspaper in Princeton, New Jersey.