Electronic Voting
The modern conservative movement is skeptical of electronic voting. Electronic
voting systems sacrifice transparency for ease of counting; they can be "less secure"
in that sense, although they can be beneficial, in particular for complex votes such
as ranked ballots and multiple ballot questions or when addressing issues like cost
or voting distance.
To better understand the pros and cons of electronic voting it is useful to first
describe ideal paper ballot systems, then identify the unique benefits and challenges
that come with transitioning to electronic voting.
Voting systems based on a secret ballot generally try to ensure:
- votes are cast anonymously (i.e., a given ballot can't be traced back to the person)
- only legitimate voters can cast votes
- legitimate voters aren't unduly burdened when casting a ballot
When we talk about "secure" voting we are generally concerned about the first two
points but I think it's important to also include the third point. Mathematically
speaking, every vote that can't be cast is equal in value to a vote that was
improperly cast.
For paper ballots we have a really good set of mechanisms that work together to
maximize addressing all three of these above requirements.
The foundation of our ability to trust that an election's votes were counted
properly rests on the idea of scrutineers. Elections are typically run between
candidates, each with a vested interest in winning. Each candidate has a campaign
team with people they trust who are allowed to observe the vote and make sure
everything is done fairly. Because everyone with a vested interest in an election
gets to have a person or persons on-site to watch all aspects of the vote, it's simply not
possible to sneak in or remove ballots illegally - the candidates' scrutineers
are paying too much attention for things to slip past them.
For an election to be properly secured, the different moving parts need to be
visible from start to finish. In an ideal (from the perspective of security)
paper ballot system, this works as follows:
- Voting happens at dedicated polling places.
- Each voter is assigned to a polling place. The full list of voters is available at the polling place.
- When the polling place opens, scrutineers are able to look at the ballot boxes and ensure that they are truly empty (i.e. that no one snuck pre-filled ballots into the box). The box is sealed and left in a place clearly visible to the scrutineers.
- For a voter to be allowed to vote, their name must already be on the voter list.
- Voters are required to show sufficient ID for poll workers to know that they are the person they say they are and that they live in the polling place's area.
- Once a voter has been verified against the voter list, they are given a ballot and their name is crossed off of the voter list so they can't vote more than once.
- Ballot in hand, the voter goes behind a screen or inside a booth, marks their ballot, folds it or otherwise secures it, then puts the ballot in the ballot box.
- At the end of the voting period, the ballot box is sealed until the count begins.
- Once counting begins, the ballot box is opened (again, with scrutineers having full access to observe).
- The ballots are counted. The number of cast ballots will equal the number of distributed ballots. Ideally, all of the unused ballots and any spoiled ballots are also counted and the total number should equal the number of ballots available at the start of the election (e.g. if a polling place has 100 ballots, and 40 are cast, there should be 60 unused and spoiled ballots remaining).
- All cast ballots, unused ballots, and spoiled ballots are sealed and stored in case of recount. They are only destroyed once the results have been accepted by whatever legal process governs the election.
Scrutineers are allowed to observe the entire process from start to finish to ensure no
ballots are incorrectly cast. At the end of this process the scrutineers will know exactly
how many people were given ballots to cast.
Throughout this process there can be various minor challenges - a lost ballot, voters with
less-than-optimal ID, contentious spoiled or ambiguously filled in ballots, and so forth.
Details of how these problems are solved are beyond the scope of this response but suffice
it to say that campaign teams have ways of legally addressing issues and the number of
contentious ballots is generally very, very low. Again, security isn't the only
consideration; it's as important to avoid disenfranchising legitimate voters as it
is to prevent illegitimate voters.
Long story short, if you follow this process you ensure that votes are anonymous and that
scrutineers can verify the fairness of the vote without affecting voter anonymity.
The main purpose of electronic voting allows the counting process to be done more
efficiently. The downside ends up being that electronic mechanisms make scrutineering
harder. It's not currently possible for scrutineers to see inside electronic counting
hardware so there needs to be some way to ascertain that the hardware is doing what
it's supposed to.
While it may seem like counting paper ballots is simple enough for this to not be a
huge concern, ranked ballots and ballots with multiple questions can make it more
valuable to add an electronic component.
For example, a few years back my city had an election where there were four ballot
initiative questions, two full sets of school board trustees with a dozen candidates
each (public and separate school system - voter picks which one to vote for), six
councillors out of a possible 30 candidates and a mayor with four candidates. (I'm
going from memory here so forgive a few inaccuracies but that's a reasonable rough
description.) It may be possible to count all of these manually but it's certainly
a lot of work; having a machine do the brunt of the effort is a real benefit.
While it will always be easier to validate a purely paper voting process there are
ways to be reasonably certain that electronic ballots were properly counted. For
example, if you are using an electronically counted paper ballot, the simplest
would be to allow all candidates to pick a small number of polls for manual recounts;
if the recounts match the machine count for those polls, you can be fairly certain
that the machine is doing the job it should do (while it's possible that the chosen
polls might not be ones that are tampered with, it would be incredibly risky to
attempt such a tampering when you don't know which poll will be chosen).
Another mechanism is using an electronic technology provider that is trusted because
of effective third party review. This is a bit tricky but it comes down to all of the
candidates having general faith that the electronic systems being used are inherently
secure. While this seems like unreasonable faith, we actually use it all the time;
for example, we expect our food supply is generally safe because a third party is
validating its safety.
Ultimately the security gap between electronic and paper ballots comes down to
implementation details; so the real answer depends on the jurisdiction and how
they plan to implement the ballot. That being said, in my view there are circumstances
where complex ballot questions might justify any perceived or real loss of
security.
Take, for example, our current plenary voting system. This is a great example of how
a very inexpensive and secure voting system winds up costing the voters in terms of both
real travel costs as well as the cost of disenfranchisement.
At a UCP AGM the policy and governance updates are traditionally voted on in-person
with everyone having a green or red "yes/no" card; when a vote is called you hold up the
card associated with your position. Close votes are hand-counted but most votes are
carried with enough of a margin to tell the winner or loser by simple visual inspection.
From a security perspective this system has pros and cons. We completely miss out on
anonymity (we can all see each other's votes, which carries the threat of social pressure
to vote one way or another) but we also can be completely confident in the result because
we see every vote in real time (and in living colour, given the flashy red/green cards
handed out to plenary participants).
Unfortunately, this comes at a cost of hundreds of dollars per participant, as well
as potentially multiple days' worth of time once you accommodate cross-province travel.
The security of this voting process has a very real cost to the members.
Compare this with an electronic system - what would we gain and what would we lose if we
allowed members to vote remotely via computer?
One significant problem might be that one would have to essentially trust the electronic
system as there is no natural scrutineer in a plenary vote. In theory, one could argue
that the proponents of resolutions might want to ensure that their resolution got a fair
hearing. However, it's also reasonable to suggest that there's no significant incentive
to prevent a resolution from passing. Who would be willing to defraud plenary voters
by fixing the electronic voting system, especially when MLAs have no obligation to act
on problematic or controversial parts of the policy handbook?
Of course, this is a judgment call like any other, and ultimately we have to decide
whether we are willing to expand what tools we use to allow voting. In the context of
electronic voting the question becomes clear: are we willing to allow mechanisms that
are less verifiable but that allow everyone to participate at far less personal cost?