Many innovations that have become familiar features of modern elections originated at leastin part as a way to reduce election fraud such as tampering with ballots to change the vote count fora candidate or party. For example, in much of nineteenth century America, a voter typically wouldpick up a paper ballot preprinted with the names of candidates for one party and simply drop theform into the ballot box. There was no need to actively choose individual candidates. (3) This ticketor prox ballot was subject to fraud in at least two ways. First, the number and sequence of ballotsprinted was not controlled, so it could be difficult to determine if a ballot box had been stuffed withextra ballots or if ballots had been substituted after votes were cast. Second, an observer coulddetermine which party a voter had chosen by watching what ballot the voter picked up and depositedin the ballot box -- votes could therefore be bought or coerced with comparative ease. Australian Secret Ballot. After a series of scandals involving vote-buying in the 1880s, calls for reform led to widespread adoption of theAustralian or mark-choice ballot. (4) Such ballots listthe names of all candidates, and the voter marksthe ballot to choose among them. The ballots are commonly printed with unique, consecutive serialnumbers, facilitating ballot control and thereby helping to prevent ballot stuffing and substitution. All printed ballots are otherwise identical, and voters typically fill them out in the privacy of a votingbooth. This ballot secrecy makes it difficult for anyone else to know with certainty what choices avoter has made. While providing improved security, the Australian secret ballot did not eliminatetampering. Ballots could still be removed, spoiled, or altered by corrupt pollworkers, or evensubstituted or stuffed, although with greater difficulty than with prox ballots. It also did noteliminate the possibility of vote-buying or coercion, but it made them more difficult. (5) Mechanical Lever Machine. One way to eliminate some means of ballot tampering is to eliminate document ballots. That became possiblewith the introduction of the lever voting machine in 1892. With this system, a voter enters the votingbooth and sees a posted ballot with a small lever near the name of each candidate or other ballotchoice. The voter chooses a candidate by moving the appropriate lever. Mechanical interlocksprevent voters from choosing more candidates than permitted for an office (such as two candidatesfor President). After completing all choices, the voter pulls a large lever to cast the ballot, and thevotes are recorded by advances in mechanical counters in the machine. The lever machine thereforeeliminates the need to count ballots manually. Instead, pollworkers read the numbers recorded bythe counters. Because there is no document ballot, recounts and audits are limited to review of totalsrecorded by each machine. Of course, tampering is also possible with lever machines. For example,the mechanisms could be adjusted so that the counter does not always advance when a particularcandidate is chosen. Computer-Assisted Counting (Punchcard and Optical Scan). Another major technological advance in voting -- the first use of computersto count votes -- came with the introduction of the punchcard system, first used in 1964. Theoptical-scan voting system, which also uses computers for vote-counting, was first used in the 1980s. In both kinds of voting system, document ballots are fed into an electronic reader and the talliesstored in computer memory and media. Tallying can be done at either the precinct or a centrallocation. Computer-assisted counting of document ballots can be done very rapidly, thus speedingthe reporting of election results. It is much more efficient for counting large numbers of ballots thanmanual tallying. It makes some kinds of tampering more difficult than with manual counting, butit does not eliminate them, and it creates possibilities for tampering with the counting software andhardware. Electronic Voting Machine. DREs (direct recording electronic systems) are the first completely computerized voting systems. They wereintroduced in the 1970s. DREs are somewhat analogous to (although more sophisticated than) levermachines. The voter chooses candidates from a posted ballot. Depending on the equipment used, theballot may be printed and posted on the DRE, as it is with a lever machine, or it may be displayedon a computer screen. Voters make their choices by pushing buttons, touching the screen, or usingother devices. The voter submits the choices made before leaving the booth, for example by pushinga "vote" button, and the votes are then recorded electronically. There is considerable variability in the design of DREs, but they can be classified into three basic types. The oldest design essentially mimics the interface of a lever machine. The entire postedballot is visible at once. Instead of moving levers to make choices, the voter pushes a button nextto a candidate's name, or pushes on the name itself, triggering an underlying electronic microswitchand turning on a small light next to the choice. With the second type, a ballot page is displayed ona computer screen, and the voter uses mechanical devices such as arrow keys and buttons to makechoices on a page and to change ballot pages. The third type is similar to the second except that ithas a touchscreen display, where the voter makes a choice by touching the name of the candidate onthe computer screen and casts the ballot by pressing a separate button after all choices have beenmade. In all kinds of DREs, when a ballot is cast, the votes are directly stored in a computer memorydevice such as a removable memory card or nonvolatile memory circuit. As with lever machines,there is no document ballot, although with a DRE each cast ballot may also be separately recorded. Touchscreen and other DREs using computer-style displays are arguably the most versatile anduser-friendly of any current voting system. Each machine can easily be programmed to displayballots in different languages and for different offices, depending on voters' needs. It can also beprogrammed to display a voter's ballot choices on a single page for review before casting the vote. It can be made fully accessible for persons with disabilities, including visual impairment. (6) Like levermachines, it can prevent overvotes and ambiguous choices or spoilage of the ballot from extraneousmarks, since there is no document ballot; but it can also notify voters of undervotes. (7) No other kindof voting system possesses all of these features. DREs and HAVA. The popularity of DREs, particularly the touchscreen variety, has grown in recent years, (8) and their use is expected to increasesubstantially under provisions of HAVA. Three provisions in the Act are likely to provide such animpetus. First, HAVA authorized $3.65 billion over four years for replacing punchcard and levermachines and for making other election administration improvements, including meeting therequirements of the Act. In FY2003, Congress appropriated $1.48 billion for these purposes ( P.L.108-7 ), and the Administration requested $500 million for FY2004. Second, beginning in 2006,HAVA requires that voting systems notify voters of overvotes and permit them to review theirballots and correct errors before casting their votes. (9) Third, the Act requires, also beginning in 2006,that each polling place used in a federal election have at least one voting machine that is fullyaccessible for persons with disabilities. DREs are the only machines at present that can fulfill theaccessibility requirement. They can also easily meet the requirements for error prevention andcorrection. Security Concerns about DREs. One thing that distinguishes DREs from document ballot systems is that with DREs, the voter does not see theactual ballot, but rather a representation of it on the face of the machine. With few exceptions,current DREs do not provide a truly independent record of each individual ballot that can be usedin a recount to check for machine error or tampering. The ballot itself consists of redundantelectronic records in the machine's computer memory banks, which the voter cannot see. This isanalogous to the situation with mechanical lever voting machines, where casting the ballot movescounters that are out of view of the voter. In a lever machine, if the appropriate counters do notmove correctly when a voter casts the ballot, the voter will not know, nor would an observer. Similarly, with a DRE, if the machine recorded a result in its memory that was different from whatthe voter chose, neither the voter nor an observer would know. (10) The same is true with a computerized counting system when it reads punchcards or optical scan ballots. Even if the ballot is tabulated in the precinct and fed into the reading device in the presenceof the voter, neither the voter nor the pollworker manning the reader can see what it is recording inits memory. However, with such a reader, the ballot documents could be counted on anothermachine or by hand if there were any question about the results. Lever machines also do not have an independent document ballot. That has led some observers to distrust those machines, but most who use them appear confident that tests and other proceduralsafeguards render them sufficiently safe from tampering. Is the same true for DREs? Somecomputer experts think not, arguing that the software could be modified in ways that could alter theresults of an election and that would be very difficult to detect. This concern appears to stem largelyfrom three factors: Malicious computer code, or malware, can often be written in such a way that it is very difficult to detect. (11) DRE software is moderately complex, and it is generally accepted that the morecomplex a piece of software is, the more difficult it can be to detect unauthorized modifications.