In this course, you'll learn what every citizen should know about the security risks--and future potential — of electronic voting and Internet voting. We'll take a look at the past, present, and future of election technologies and explore the various spaces intersected by voting, including computer security, human factors, public policy, and more.
Optical Scan Voting
Loading...
Del curso dictado por University of Michigan
Securing Digital Democracy
97 calificaciones
De la lección
Computers at the Polls
Voting enters the computing age
Conoce a los instructores
J. Alex HaldermanAssociate Professor
Electrical Engineering and Computer Science
Optical Scan Technology, which is also sometimes called Optical Mark Sense
Technology was first developed around the 1950's and it was originally used for, for
scoring standardized tests. Anyone who has taken the SAT has used one
of these systems probably. It's a, a, if you have filled out one
these bubble forms with a number two pencil, that's optical scan.
Optical scan voting was an idea that came, came along around the 1960's.
People developed the, the first initial machines based on the testing technology
and then gradually these machines became deployed and, and very widespread in the
US. If you think about the paper ballot from
the nineteenth century that we put in a ballot box, one of the biggest problems
with it was the, the integrity of the counting process.
If malicious insiders took over the counting progress, they could announce
whatever totals they wanted. So, the idea with optical scan was to
replace these potentially malicious certainly subjective humans who were part
of the counting process with an impartial automated machine.
So, we move from that nineteenth century technology of the ballot box to the
twentieth and twenty-first century technology of the precinct count optical
scanner. So, let me illustrate the way the voting
process works with one of these machines. The voter fills out their ballot and puts
it into a slot on the machine. At that point, the ballot goes into a
ballot box that's attached directly to the scanner.
At the end of the election, after everyone's voted, the machine prints out a
paper tape that has the totals for how many bubbles were filled out for each of
the candidates. Most of these machines also have a
removable memory card, a storage card like the flash memory for your digital camera.
And this maintains an electronic record that should match the paper tape.
So, here are a couple of styles of ballots that used with optical mark sense or
optical scan voting. On the left, this is a very common style.
You see, there are these broken arrows and the voter just has to fill in the gap
between the arrow for the candidate they want to select.
Another style is much more similar to the, the SAT's, standardized tests, they're
little ovals that the voter fills out. Here's what's happening inside one of
those machines. So, this is an, a technical illustration
from a patent, but we can demystify that a little bit.
What you see there on the left side of the screen is a light source.
This is going to illuminate the ballot as it moves by.
Then, in the middle, you have an optical sensor.
Basically, this is the machine's vision system.
It's able to see the bubble and the ballot flies by underneath.
So, what actually happens inside one of these machines is a, a little bit more
sophisticated. And turns out to have some important
implications for the voting process. So, inside the machine are an array of
emitter detector packages. Each of these is basically a light source
coupled with a very simple kind of light detector.
As you can see here, there are eight of them ranged in columns, in a line under
which ballot will pass. So, the ballot in this picture is moving
from the bottom to the top, underneath the sensors one through eight.
And each of this sensor is going to produce a different amount of electrical
current depending on how much light it senses.
So, if there is a mark on the ballot, underneath the sensor that will register
differently from a space that's not marked.
On the left and right of this ballot you see these rectangular marks, and these are
alignment marks. This tell the scanner when a row of ovals
is going to be passing under each of the detectors.
And these detectors are like very, very simple kinds of eyes.
All they can do is sense brightness or darkness.
You can imagine that if you were to hold up a translucent piece of glass in front
of your face you could tell whether it was daytime or nighttime but you couldn't see
much else. This is all the sensitivity that each of
this has. Inside the machine's electronics, there's
some preset threshold that separates an area that's considered to be dark enough
to be filled in from an area that is light enough to be not filled in.
But, exactly where to set this threshold is a tricky thing to determine.
Conceptually what this results in, is that there are grid of locations on the ballot
page where the scanner could detect a mark, and this has implications for the
layout of the ballot, and for the positioning of those alignment marks as
you see here. A more modern style of optical scan
machine uses a more sophisticated detector that's a bit more like what you'd have in
a fax machine or a computer scanner. This kind of array instead of having just
once sensor per column, it has many sensors per column and it produces an
output that's much more similar to the kind of picture you might take with your
digital camera. This has possible positive implications in
that it can capture much more information from the ballot and be used to distinguish
marks with greater accuracy. On the other hand, in order to go from a
picture of part of the ballot to knowledge about whether it's marked or not, requires
some pretty fancy computer algorithms so this has to be implemented in software.
There are two styles of optical scan machines that are really commonly used in
voting. And one of these is the one I mentioned at
the beginning of this segment, the Precinct Count Optical Scan Machine.
And you see one of those on the left. This is one that is in the precinct, the
voter inserts their ballot right there, and it goes into a ballot box directly.
The other kind of optical scanner is something called a Central Count Optical
Scanner. And this involves collecting the voters
ballots at the polling place in a more traditional kind of ballot box, and then
transporting them to a central location and feeding them through a high-speed
scanner in bulk. The advantages of precinct count include
that you're making a record of the voter's vote immediately.
So, there isn't a risk of the ballot box. There isn't as much of a risk anyway, that
the ballots might be tampered with, before they get to a central counting location.
Probably the biggest advantage though, is that a precinct count optical scan machine
can look for problems with the ballot. It can see that the voter has made too
many marks for one candidate, or, or has forgotten to fill out something
potentially, and send the ballot back to the voter to try again.
This really helps cut down, especially on the, the number of over-votes on instances
where the voters marked too many choices. So, it's a really important kind of
usability feature. Central count machines can't do this,
because they're not interacting directly with the voter.
But they do have the advantage that you need a lot less equipment.
You can do a central count with just, just a normal ballot box at each precinct.
You don't have to own and maintain, and store a fancy computer voting machine at,
for each polling place location. So, now you have some sense of how optical
scan balloting works. And I'd like you to take a minute and
think about what could go wrong. So, there's a lot that can go wrong with
optical scan voting, just like the other kinds of voting we've discussed.
One of the more prominent issues has to do with the way people interact with optical
scan ballots. So, ballot's generally provide some
instructions for how to fill them out. For instance, use only a number two
pencil, completely fill in the oval, etc. If you give directions like these to
people, how well do you think they're going to follow them?
The, the, answer is that not everyone follows them exactly right.
Here's a collection of marks from real voted ballots in one particular election.
And you can see how much variation there is here.
Some people use blue ink, some people marked an x instead of filling in the
oval. At least, one person used red ink, and
each pencil mark is slightly different. So, this is a challenge for optical scan
machines because it's possible that the machines are not going to interpret every
one of these marks as a valid vote. Well, here, here are some of the problems.
One, one issue is that these simple emitter detector sensors, the ones that
can only sense brightness, respond differently to different colors of marks.
They're going to be more sensitive to certain parts of the visible spectrum than
others. So, certain things that might look very
dark to the voter, to a human might not look like they're marked very darkly at
all to the machine, in particular, certain kinds of sensors that are very sensitive
to infrared might not see a red as a mark on the ballot at all, it might not be able
to distinguish between red or white. Another kind of problem is that the older
style of optical scanner that uses the sensors that essentially form a grid of
potential target locations are very sensitive to the alignment of the ballot.
So, if the ballot slightly changes size, because a, it's a, a very humid or a very
dry day, this cause paper to expand or contract.
Some of those bubble targets aren't going to be perfectly underneath the physical
locations of the sensors anymore and they might be read less well.
Another problem is the directional alignment on the page.
If the ballot's inserted into the machine's slightly crooked as you can see
in this illustration, that's another case where the sensors might not be perfectly
over the targets. Another issue is calibration.
Each of those sensors in the machines might respond slightly differently to the
same intensity of light because of physical variations in the electronics.
So, calibrating them make sure, making sure they're all responding appropriately
is a really tricky maintenance task. And then, there are different kinds of
marks. As you see here, certain kinds of marks
that are not completely filling in the oval might not be detected when compounded
with other factors like a slightly crooked ballot.
Where they might sometimes be detected and sometimes not.
It seems that because of all of these factors compounded, an optical scan ballot
has some chance of having errors in the scanning process.
And in an election of any size, you are almost certainly going to have some
fraction of ballots, and some fraction of votes that are misread or lost because of
problems like these. This is fundamentally a challenge to
almost every voting system though. We don't yet know how to make a voting
system that will work on a very large scale with absolutely zero error.
The problem with optical scan though, is there are a lot of different and somewhat
tricky errors like these that, that could potentially add up to, to a problem,
especially in a very, very tight race. So, it's important to do things to, to
make sure voters fill out the instructions correctly.
We'll talk a bit about that in a later lecture when we discuss usability issues.
Another kind of problem with the optical scan is something that some colleagues of
mine from Princeton pointed out in a paper just a couple of years ago.
And that is that they, they looked at the styles of ways that different people fill
out those little circles, those ovals, on an optical scan form.
And they found that different people had a distinct enough style, you know, all of
these different ways of filling it out, that you could actually identify two marks
that came from the same person. So, this a somewhat theoretical attack
today, but in the long run you do worry that these small differences in how people
fill out these forms might be something that could be used to compromise voter
privacy. There's one more category of problems with
optical scan and perhaps, this is what you thought of when you asked what could go
wrong. And that has to do with the fact that
these machines are counting votes by computer.
So, if you think about how these machines work, the parts we've talked about so far
are mostly the electronic parts, the actual scanning apparatus.
But also inside the optical scan machine is a computer that's responsible for
reading the signals from the scanner, figuring out which candidates should
receive the votes and maintaining totals, running totals of the number of votes for
each candidate. This is the equivalent of those gears and
counters inside the lever machine. But unlike gears and counters, all of this
in an optical scan voting machine is controlled by computer software.
And computer software can be changed. It can be changed in ways that are, are
invisible. And we'll talk much more about that kind
of problem later in this and the next lecture.
But first, I wanted to give you an example.
An example of a demonstration of a way a computer voting machine could be used to
cheat. And this a an attack that was conceived
and demonstrated by a voting researcher named Harri Hursti about five years ago.
Harri Hursti's attack was against a, a, an optical scan voting machine made by
Diebold. And Harri's attack looked at what would
happen if the, the criminal, an attacker had access to that memory card.
The, the card that's used to that's used to hold an electronic copy of the results
and take it back to the central office for counting.
So, let's assume that the card is going to be very well protected after the voting
process finishes. Because after the voting process, everyone
knows their vote's stored on it. This is an important part of election
integrity. But what if someone was able to get access
to the card before all of those votes were cast?
When maybe people aren't realizing that it's it has important security properties.
So, Hursti's attack works like this. Before the election, he's going to try to
do the electronic equivalent of stuffing the ballot box, he's going to load up the
memory card with a number of votes for the candidate he wants to win let's say, it's
Ben. At the end of the election, this is going
to be ten votes added to the total for Ben because each time someone else votes, the
voting machine is just going to increment. It's going to, to count up on that number.
Now, the problem with this very simple version, just, let's say, we add ten to
Ben's category in the beginning by you know, by just, just putting the memory
card into the computer and changing the files, something like that.
The problem with the simple version of the attack is that it, it would be pretty easy
to detect. All that the, the election officials would
need to do is observe that the total number of votes in the machine is ten more
than the number of people who used it. So, that would be caught right away.
So, Hursti kept thinking and looked for a way that he could make the total number of
votes match the number of voters while still moving votes from one candidate to
another. What he realized was that the voting
machine's record of how many votes belong to each candidate performs arithmetic in a
very similar way to one of these mechanical counters.
Think about the, the odometer on your car. Maybe your odometer has six digits and in
that case, after you get to 999,999 miles and drive one more mile, your odometer is
going to wrap around back to zero. The memory card in the voting machine
worked in, in essentially an identical way.
And Hursti realized that if he programmed ten votes for the candidate that he wanted
to end and say 990 votes for the other candidate, then when real voters used the
machine, both numbers would increase. Let's say, everyone was going to vote for
George. He's going to get at least ten votes.
And it's going to wrap around back to zero.
So here, we've had ten votes for George, zero for Ben but notice the total still
adds up. A total of ten votes are in the machine.
That's because the votes for each candidate the added votes for Ben were
cancelled out by that, that initial 990 votes for George and the wrap around
effect. A, a slightly simpler way to think about
this would be to think about that 990 votes as being equivalent to negative ten
votes for George. In the way computers represent numbers
like this, those two are almost equivalent.
So, here you see the first example of a computer based attack on a voting system.
Luckily, because these are optical scan ballots, we have a way to catch this kind
of fraud which is to actually look at the paper ballots in the ballot box.
But more about that later. First, I want to talk about computer
voting machines that don't have that kind of paper back up.
And those are DRE voting machines. The subject of the next segment.
Explora nuestro catálogo
Inscríbete de manera gratuita y obtén recomendaciones personalizadas, actualizaciones y ofertas.
Coursera brinda acceso universal a la mejor educación del mundo, al asociarse con las mejores universidades y organizaciones, para ofrecer cursos en línea.
© 2018 Coursera Inc. Todos los derechos reservados.
