Brief on Accessible, Verifiable Voting **Gregg Vanderheiden Ph.D. January 15, 2007 (rev Feb 11, 2007)**


## Introduction

Much has been written about both accessible voting and verifiable voting technologies 
  and procedures. Some of these documents seem to say or imply that we much choose 
  between accessible voting and verifiable voting. This submission is made to 
  refute this assertion or implication and to provide one model for voting that 
  maximizes both accessibility and verification.

Specifically his document demonstrates that accessibility and verifiability 
  need not conflict with each other. Although particular access or verification 
  techniques might not be compatible, both access and verification can be achieved 
  together if the proper techniques are used.

## Importance of trust

It is important that any solution proposed must not only be trustworthy and 
  secure but it must look trustworthy and incorruptible, even by those who are 
  non-technical and who distrust technology Since "everyone"; includes 
  people with all levels of technical prowess, and because the fear of vote-fixing 
  is of most concern with regard to software, it is unlikely that any means of 
  verifying the vote or securing the vote through software will allay all people's 
  concerns. Any cost savings in a paperless system will be lost in additional 
  costs resulting from lack of confidence in the voting system.

## Recommended Approach

The approach recommended provides a mechanism that combines the accessibility 
  of electronic voting with the verifiability of paper ballots. In addition it 
  reduces errors in tabulation by using the machine to fill out the ballot so 
  that the result is much clearer and unambiguous.

The approach is based on the following propositions.

- The voter will have most confidence that their vote has been recorded properly 
  when they can read the result on paper which is then counted.
- The voter(s) will have most confidence in a recount if the individual votes 
  can be recounted by humans in order to check the machine count.
- Voters are less concerned about people in every precinct being corrupt in 
  the same way (e.g. all losing or changing paper votes the same way) than they 
  are with the possibility of central software based corruption where there is 
  no paper trail.
- OCR can be essentially perfect (99.9999+% accurate) when the task is not 
  to recognize unknown text but just to find the best fit of what 
  is on the printed ballot and what the candidates name for each office are (as 
  they would be printed on the ballot).

### Description

The following are the steps in the actual ballot casting process.

1. The voter enters the voting place, is confirmed as eligible to vote, and 
    is directed to a voting station. (if they are unfamiliar, a training 
    station can be used).
2. The voter uses a voting device with electronic display to present the race 
    and referenda choices and fill out the ballot.
3. The electronic voting device prints out a small card (ballot) that lists 
    only the names of the people and referenda that the person voted for. This 
    printout would be in the persons native tongue but may have two languages 
    (one on front and one on the back) if necessary to avoid language patterning.
4. The voter takes the card from the machine and is able to read the names 
    of the races (and referenda) and the choice they made for each.
5. The voter carries the ballot over to the "ballot submission" 
    area where they insert the ballot into the ballot scanning and counting machine.
6. The actual printed text (that was read by the voter) is read using Optical 
    Character Recognition (OCR) and matched against the possible choices for each 
    race or referenda.
7. The ballot card is then captured in a secure container for later spot checking 
    of machines or for use in recounts.

### Potential accessibility accommodations for each step

1. Users who need to, can practice prior to voting
2. The voting device can have flexible interface options that accomodate a 
    wide range of user abilities: 
    "Voice confirm" feature that announces (in the headphones) the user's 
        choice each time they make a selection on screen.
      "Touch and hear" feature that reads any text aloud when it is touched 
        onscreen.
      Voice output through headphones as voter moves from race to race and 
        choice to choice.
      A simple 8 button interface 
        (2) Fwd and Backward through races
          (2) Up and Down through choices in a race
          Mark or unmark a choice
          Jump to end for summary and closeout
          Go back to Start
          Help
          NOTE 1: This interface could be on a cord to allow positioning in 
            the lap or other location to facilitate operation.
          NOTE 2: This 8 button interface approach is compatible with most 
            all voting machine formats including tablets, full page ballots, touch 
            screen and other formats.
      Ability to use alternate input devices through isolated input port. 
        Users can connect personal switches/controls but the switches are constrained 
        to acting as substitutes for the controls on the voting machine. 
        Secure input can be done through simple single switch jacks and 
            through other special ports that are isolated from all system buses 
            and only allow parallel activation of the user voting controls.
          This can allow a greater number of individuals to vote independently. 
            A standard mapping of switches can be created to facilitate this or 
            a hybrid 'standard or user specific" mapping technique such as 
            will be used on the new Library of Congress Digital Talking Books 
            could be used.
3. "Voice confirm" feature that announces (in the headphones) the user's 
        choice each time they make a selection on screen.
4. "Touch and hear" feature that reads any text aloud when it is touched 
        onscreen.
5. Voice output through headphones as voter moves from race to race and 
        choice to choice.
6. A simple 8 button interface 
        (2) Fwd and Backward through races
          (2) Up and Down through choices in a race
          Mark or unmark a choice
          Jump to end for summary and closeout
          Go back to Start
          Help
          NOTE 1: This interface could be on a cord to allow positioning in 
            the lap or other location to facilitate operation.
          NOTE 2: This 8 button interface approach is compatible with most 
            all voting machine formats including tablets, full page ballots, touch 
            screen and other formats.
7. (2) Fwd and Backward through races
8. (2) Up and Down through choices in a race
9. Mark or unmark a choice
10. Jump to end for summary and closeout
11. Go back to Start
12. Help
13. NOTE 1: This interface could be on a cord to allow positioning in 
            the lap or other location to facilitate operation.
14. NOTE 2: This 8 button interface approach is compatible with most 
            all voting machine formats including tablets, full page ballots, touch 
            screen and other formats.
15. Ability to use alternate input devices through isolated input port. 
        Users can connect personal switches/controls but the switches are constrained 
        to acting as substitutes for the controls on the voting machine. 
        Secure input can be done through simple single switch jacks and 
            through other special ports that are isolated from all system buses 
            and only allow parallel activation of the user voting controls.
          This can allow a greater number of individuals to vote independently. 
            A standard mapping of switches can be created to facilitate this or 
            a hybrid 'standard or user specific" mapping technique such as 
            will be used on the new Library of Congress Digital Talking Books 
            could be used.
16. Secure input can be done through simple single switch jacks and 
            through other special ports that are isolated from all system buses 
            and only allow parallel activation of the user voting controls.
17. This can allow a greater number of individuals to vote independently. 
            A standard mapping of switches can be created to facilitate this or 
            a hybrid 'standard or user specific" mapping technique such as 
            will be used on the new Library of Congress Digital Talking Books 
            could be used.
18. For those unable to physically handle a ballot, a poll worker can use a 
    sleeve to remove the ballot and carry it to the ballot submission station 
    for the person and insert it.
19. For those who cannot read the ballot, a reading station that is an extension 
    of (but at a short distance from) the ballot scanning and counting machine 
    can be available. At this reading station: 
    A simple lighted magnifier can provide access for those with low vision.
      An accessory on the counting machine (connected by a cord) can provide 
        the ability to have the ballot read to the user on headphones using the 
        same OCR that will read and count their final ballot. Simple controls 
        can allow them to step through the races and listen to their choices. 
        Using the counting machine electronics for reading the ballot reduces 
        cost and lets the person know exactly what the counting machine will read 
        (and count).
20. A simple lighted magnifier can provide access for those with low vision.
21. An accessory on the counting machine (connected by a cord) can provide 
        the ability to have the ballot read to the user on headphones using the 
        same OCR that will read and count their final ballot. Simple controls 
        can allow them to step through the races and listen to their choices. 
        Using the counting machine electronics for reading the ballot reduces 
        cost and lets the person know exactly what the counting machine will read 
        (and count).
22. The vote card has a corner clipped which makes it easy for the person to 
    hold it face down. The scanner however will accept the card in any orientation. 
    It also has a funnel like input to allow easy insertion with minimal physical 
    control.

## Summary

This implementation is not the only possible implementation but is illustrative 
  of how the key features can be implemented. The key factors for any solution 
  however are

1. The ballot choices are presented to the user by a voting machine with flexible 
    display capabilities and flexible input options that can meet the needs of 
    people with the largest possible range of abilities.
2. This voting machine gathers the users choices and prints a clear unambiguous 
    ballot.
3. The ballot is printed on paper (or other similar medium) where the user 
    can read exactly who they voted for in a permanent form.
4. The printed text that they user reads and confirms is what is counted. 
    Not some other representation.
5. The printed ballot that the user confirms and that is counted is kept for 
    spot checking and recounts- both of which CAN be done by human to check machines 
    on either a sampling or on a comprehensive basis as needed.
6. There is a ballot reading station that allow users whose disabilities would 
    prevent them from reading the printed ballot directly, to read the ballot 
    using a device that allows alternate presentations.

Following this model it is possible to create a voting system that is completely 
  verifiable yet accessible. No system currently provides these features. Several 
  could be readily updated to do so and most could evolve into a format that would 
  support the key features of this approach.

## About the author

Gregg Vanderheiden Ph.D. is a Professor in the Industrial and Systems Engineering 
  Department (Human Factors Program) and the Biomedical Engineering Department 
  and is the Director of the Trace Research & Development Center at the University 
  of Wisconsin-Madison. He is the PI for the Rehabilitation Engineering Research 
  Center on Information Technology Access, and co-PI for the RERC on Telecommunication 
  Access. He served on the IEEE and HFES Voting Standard Accessibility working 
  group, and has provided input to the Federal Elections Commission voting standards. 
  Dr. Vanderheiden has been engaged in R& D on accessible voting since 1998, 
  and demonstrated the first cross-disability accessible voting system in a plenary 
  presentation at FOSE in April 2000. He also served on the FCC's Technological 
  Advisory Council, was a member of the Telecommunications Access Advisory Committee, 
  the Electronic Information Technology Access Advisory Committee, and the Telecommunications 
  and Electronic and Information Technology Advisory Committee of the US Access 
  Board, and served on the steering committee for the National Research Council's 
  Planning Group on "Every Citizen Interfaces," co-authoring the NRC's 
  More Than Screen Deep report. Recent achievements include co-authoring of the 
  W3C's Web Content Accessibility Guidelines, Development of the Accessibility 
  Features in Windows and Macintosh control panels, development of the EZ (R) 
  Access techniques for providing cross-disability access in electronic products 
  of all types (kiosks, ATMs, cell phones, USPS automated postal stations and 
  voting systems).

For other Trace Center work on voting see www.trace.wisc.edu/voting

Link 
  to the NIST HAVA Website

Privacy 
  policy / security notice / accessibility statementDisclaimer / FOIA
  NIST is an agency of the U.S. Commerce Department

Last updated: July 24, 2007
  Web site point of contact