The future of voting probably still requires a paper backup
The week on our Vergecast interview series, cybersecurity journalist Kim Zetter talks with The Verge’s Nilay Patel and Russell Brandom about the state of election security in the United States.
The circumstances of a pandemic in an election year has complicated the voting process. In an analysis by NPR, it was found that thousands of mail-in ballots for the 2020 primaries were rejected because of late arrival, even in cases where the voter sent it in on time. In the 2020 Iowa caucus, paper backups of ballets needed to be relied upon after an app that was created to tally the votes started giving error messages.
Zetter says if we’re going to use computers and software to count votes in an election, there also needs to be another system in parallel to secure the outcome.
“You need to have the paper backup,” she says. “You need to have an auditing mechanism in place and an auditing law in place. And then you need the resources given to election officials for this process to succeed by November.”
In the interview, Nilay, Russell, and Kim discuss what methods are being proposed to stop potential interference in the voting process; the complications with mail-in voting during a pandemic; and how voting machines, blockchain technology, or just plain paper are not the single solutions to uphold our democracy this election.
Below is a lightly edited excerpt from the conversation.
Nilay Patel: A thing we talk about on the show all that time is that computers are generally well-understood. You add a computer to something, and you kind of know what problems it comes with. And so here, it seems like computers are very good at counting, so it seems like you should just glue a computer onto this process that is fundamentally counting very fast and reliably. But then there’s the set of computer problems of security, network security, you need a chief security officer, you need multiple rounds of audits. And no one has really addressed that set of problems in a holistic or countrywide way. Is that a good frame to think about it?
Kim Zetter: Yeah, so any time you introduce computers into the mix here, you have the potential for problems, whether or not it’s someone hacking or just a software glitch or some kind of thing that goes wrong with it. So you have a problem of relying on that system.
Now, it’s not a bad thing to use a computer to count ballots, to count votes for rapid counting. And there are some studies that indicate that computers are more accurate than people manually counting. But you need to have a checks-and-balance, and that’s the point of the audits that you mentioned.
First of all, you need that paper trail. You need a paper backup, a ballot that was hand-marked by the voter so we know the voter’s intent. And you have that as a backup. That auditing part is critical that you mention because if no one ever actually looks at that paper backup, then it doesn’t mean anything. And the problem that we have right now is that there are only, I believe, two states that actually do the type of audit that is designed to detect if there’s been a problem with the software. Many states have audits in place. They have to do some kind of audit legally. But the way that they do the audit won’t actually necessarily catch problems.
And so we’ve got sort of these false assurances. We spent the last two decades, many states moving back to machines that produce a paper backup, but then they don’t ever actually even look at the paper backup so it doesn’t mean anything. But then we had laws come in that said, “Okay, now you have to, in some cases, look at that paper backup.” But the way that the law is written, the audit is so badly done that it doesn’t actually mean anything. So that’s really where we are right now that we need to fix.
If we’re talking about widespread vote by mail, shouldn’t everyone just mail a slip of paper in and have that hand-counted? And it’s probably the same amount of complexity without the same amount of attack surface?
So there are other issues with vote-by-mail ballots. And a lot of the opponents of vote by mail will tell you that this creates a better opportunity for fraud. So not hacking, but this is the way that elections used to be thrown, right? Someone who has access to those ballots either replaces a bin of ballots or loses a bit of ballots or changes marks on the ballots or things like that.
So that’s a different problem. But it’s a smaller-scale problem. You’re talking about someone who has access to ballots, and that’s different than someone who can get into a voting machine vendor and change the software on thousands of machines.
So it’s not without its own risks — that issue of someone stealing ballots or replacing ballots. But that’s not the primary problem that we’re looking at in terms of moving to the vote-by-mail ballots. The vote-by-mail ballots involve a lot more processing and a lot more people. It’s a really, really complicated process. When you fill out a ballot at home, you put it in an envelope that is specially designed, it usually has a legal statement on the outside of the envelope, and you sign it. When that ballot arrives to the election office, they first have to verify that signature against a signature that you have on file with them in your voter registration or in your DMV registration.
And sometimes they do that with software that match, and sometimes they do it simply with a visible match. And there are all kinds of problems there if they don’t actually match. Does your signature remain the same 20 years down the line? Who knows. But anyways, there are states that don’t require — when there’s a mismatch — for them to actually even tell you that there’s been a mismatch. So you may not ever even know that they rejected your ballot based on your signature and then you have no chance of correcting that.
In other cases, the law gives them a minimal amount of time to notify you and for you to then rectify that. And again, if you’re unable to rectify that or you don’t respond, then again, your ballot gets thrown out. So what we have here is a situation where we create a lot more opportunities for voters to get disenfranchised because the processes in place for processing those vote-by-mail ballots is problematic.
The week on our Vergecast interview series, cybersecurity journalist Kim Zetter talks with The Verge’s Nilay Patel and Russell Brandom about the state of election security in the United States. The circumstances of a pandemic in an election year has complicated the voting process. In an analysis by NPR, it…
