class: blueBack ## Sometimes a Paper Trail Isn't Worth the Paper It's Written On ### Philip B. Stark #### Department of Statistics, University of California, Berkeley #### http://www.stat.berkeley.edu/~stark @philipbstark ### .white[Workshop on Advances in Secure Electronic Voting Schemes] ### Malta, 3--7 April 2017 --- .huge.blue.center[No look, no see.] --- In the last decade, election integrity efforts have focused on requiring voting systems to have a voter-verifiable paper trail, arguing correctly that extant electronic-only voting systems cannot be trusted. A paper trail is necessary, but not sufficient: Election integrity also demands the paper trail to be secured adequately and to receive adequate scrutiny to check the results--e.g., through recounts or well-designed post-election audits that have a large chance of leading to a full manual tabulation when reported results are wrong. The 2016 US Presidential election demonstrated that lax rules regarding caring for the paper trail, the absence of laws that ensure adequate scrutiny of the paper trail, and the existence of laws that allow candidates and third parties to thwart attempts to examine the paper trail can render a paper trail worthless. To be trustworthy, elections should be "evidence-based": election officials should provide convincing evidence that reported outcomes are correct. Currently, such evidence in turn involves the "3 C's" of voter-verifiable paper trials: create, conserve, and check. --- ## Who won the 2016 U.S. Presidential election? -- > .red.large[Donald Trump] -- > .large[**How do we know?**] -- > .large.red[He was sworn in.] -- > .large[**Did he win the electoral college?**] -- > .red.large[Maybe.] --- .center[
] ---  ---  ---  ---  ---  --- ## Trump post-election http://edition.cnn.com/2017/01/24/politics/wh-trump-believes-millions-voted-illegally/ .center[
] --- ## US Intelligence before the election + Podesta's email hacked + DNC hacked + Illinois, Arizona voter registration databases hacked + Probes of others --- ## EAC before the election  --- ## EAC after the election  ---  ---  ---  --- ## Safe because ... Not connected to Internet? -- + Stuxnet, anyone? + Ballot "programming" for each election + Software/firmware updates + Uploading results + Removable media -- + Zip drives! --- http://itknowledgeexchange.techtarget.com/storage-disaster-recovery/remember-zip-disks-election-departments/ .center[
] --- ## Safe because ... Too decentralized --- http://ccelections.com/election-services  --- .center[
] --- ## Safe because ... Logic and accuracy testing? -- + Machine-marked ballots -- + Not all patterns -- + Cryptic knock: VW diesel, anyone? --- ## Maybe not safe, but + "There's risk in everything" -- - True, but the risk of getting hit by a car if you walk across a highway is not the same as the risk of getting hit by a car if you cross a minor road using a crosswalk -- + Crucial that public trust elections---whether trustworthy or not - EAC, LEO, and POTUS misrepresentations --- .center[
] --- https://www.eac.gov/election-officials/elections-critical-infrastructure/  ---  ---  ---  --- ## Ballots, not bombs  ---  --- https://www.intelligence.senate.gov/sites/default/files/documents/ICA_2017_01.pdf  --- .large.center[Trump: 304 electoral votes] -- .large.center.blue[270 to win] -- .center.large.red[304-270 = 35] -- |State | Margin (votes) | margin (%) | paper? | electoral votes | |---------|-------------|------------|--------|-----------------| | Florida | 112,911 | 1.20% | mixed | 29 | | Michigan | 10,704 | 0.23% | yes | 16 | | Pennsylvania | 44,292 | 0.72% | mostly no | 20 | | Wisconsin | 22,748 | 0.77% | yes | 10 | -- .center.red[Errors in a few dozen precincts in MI and PA could alter outcome] --- ## Surprising aspects of the election -- + Trump's electoral win, contrary to pollsters -- + Anomalous undervote rates: - Michigan (75,000 ballots) - Pennsylvania (4,000 in one county) --- ## Paper or plastic?  --- .center.large.blue[Risk-limiting Audits] -- Examine paper trail (assumed intact) -- while (!(full handcount) && !(strong evidence outcome is correct)) { audit more } -- if (full handcount) { handcount result is final } -- If the result is incorrect, chance the audit fails to correct it is at most α, where α is the pre-selected risk limit. -- .center.large[Evidence-Based Elections] .center.large.blue[Require convincing evidence that outcome is right] --- .center[
] --- .center[
] ---  --- ## Legal status of audits + About 25% of US voters use equipment that doesn't create a paper trail + In places with paper trail, often no provision for examining the trail (& lax rules for taking care of the trail) + As of 2016, state audit laws didn't mandate effective audits. Cf CO 2017 + Recount laws are broken too. ---  https://www.verifiedvoting.org/resources/post-election-audits/ --- ## Political status of audits + any candidate that challenges the results likely to be characterized as "sore loser" - Exacerbated by pressure to concede on election night, when large fraction of votes have not been counted + No legal basis to call for an audit if the state doesn't have audit law + Hoped to put pressure on Governors, State & Local election officials --- ## Pennsylvania recount + Not much paper to recount + Required affidavits from 3 people who voted _in each precinct_ + Huge bond required + Tried, but judge rejected before it really started --- ## Wisconsin recount: background + Recount law gave Stein standing to request recount + Recount law allows re-scanning or manual tally - re-scanning is like asking same doctor for 2nd opinion + Stein sued to compel manual tally + Judge agreed manual is preferable, but law says jurisdictions can choose ---  --- http://www.jill2016.com/recount_2016_releases_preliminary_report_for_wisconsin .center[
] ---  ---  ---  ---  ---  ---  ---  ---  ---  ---  ---  ---  ---  --- https://newrepublic.com/article/140254/inside-story-trump-clinton-stein-presidential-election-recount  ---  ---  ---  ---  ---  ---  ---  ---  ---  --- ## This happened yesterday  ---  --- .center.blue[.large[_Trustworthiness before trust._]
--Baroness Onora O'Neill] --- ## What you can do: .center.large.blue[Don't Trust. Vilify!]