Talk:Voter-verified paper audit trail

Reversion

I have reverted to my more detailed entry. Discussions regarding voting equipment that ignore the election process and the duties of the election official are not useful to anyone. Please expand the technical portions as necessary but please do so within the context of election processes and laws, thank you.

Who wrote this? It seems incredibly naive to think that the 'election process' is sufficient to prevent against vote rigging and fraud. Poll workers and election officials have been at times been found to be clueless and not entirely impartial, sometimes even disregarding electoral statutes altogether. Many countries, the US most certainly included, have a history of electoral fraud perpetrated with preventive regulations in place. In the case of electronic voting, when there is no paper trail, and in which voting machine companies have a vested interest in errors not being discovered, the stakes are even higher.

Election fraud has happened and will happen again even under near-ideal circumstances. Right now we're not even close. LeoTrottier 00:19, 24 October 2006 (UTC)

You're right. The process and the people are not suffieicnet to prevent fraud. My comments strive only to add the people and the process to the discussion. Just like the process alone cannot prevent fraud, neither can technology alone prevent fraud.

VVPAT vs. VVAT

I'm not so sure I agree with the collapsing of the VVPAT page and the VVAT page. The latter is a super-set of the former and many of us (for example, in the ACCURATE group) see VVPAT as one possible solution that is particularly appropriate for the short-term. -- Joebeone (Talk) 16:55, 21 March 2006 (UTC)

extensive changes

I just reverted extensive changes [1] to this page that should be discussed here and cited thoroughly. -- Joebeone (Talk) 19:40, 4 August 2006 (UTC)

I have reverted to my more detailed entry. Discussions regarding voting equipment that ignore the election process and the duties of the election official are not useful to anyone. Please expand the technical portions as necessary but please do so within the context of election processes and laws, thank you.

review

I'm going to review this page and make some changes (that I'll cite sources for). Let me know if you'd like to help. -- Joebeone (Talk) 18:10, 5 September 2006 (UTC)

This article sounds much like an excuse for why VVPAT aren't being used. The second paragraph of the overview immediately casts into doubt the necessity and feasibility of VVPAT in a way that completely disregards expert opinion that VVPAT are necessary for assuring the soundness of electronic elections. It seems to have been implicitly assumed that electronic voting is the way things have always gone, and that there could/should never be a return to (recountable) paper ballots. Nothing, of course, could be further from the truth. VVPAT is what legitimizes and makes accountable an optional electronic voting system that is meant as an improvement. LeoTrottier 00:49, 24 October 2006 (UTC)

Article title

Is it Verified or Verifiable? I really think verifiable is more accurate and in general makes more sense. Anyone agree? --Electiontechnology 00:39, 11 September 2006 (UTC)

My impression is that 'verifiable' does not necessitate that the voter actually do any verifying. Verified means that they do. 'Verified' is more secure, in my view. LeoTrottier 22:59, 23 October 2006 (UTC)

"The Ballot" Section

Why is this here? There is arleady a ballot article, and it doesn't seem to have anything to do with the VVPAT. --Electiontechnology 00:39, 11 September 2006 (UTC) I moved this to ballot, it seems to make more sense there. -- Electiontechnology 02:05, 16 November 2006 (UTC)

Overview caveats

It seems that putting caveats in the overview regarding why or how VVPATs are difficult implement is like explaining how backup parachutes are good, but an expensive and complicated addition to existing parachute technology. The point is that, in a voting system that is optional to begin with, it doesn't matter how costly and difficult it is to make it sound and secure. The system is worse than useless unless we can be sure it's working as intended.

For this reason I think caveats should be moved elsewhere in the article, and not put in the overview. If you think different, please discuss the proposed changes here. LeoTrottier 17:53, 26 October 2006 (UTC)

Leo, are you taking issue with the entire Implementation Challenges of VVPAT section? If so, the point of the section isn't that backup parachutes are a bad idea. To continue with your analogy, let's say you (a county) were told were told you were legally required to jump out of a plane (hold an election). Of course you would want to find a parachute (voting system) and backup parachute (independent audit system). Now you're told you have to have a specific kind of backup chute (paper), but those chutes are very expensive and you have to buy the only chute you can find the qualifies, and that chute isn't very good. Would you have liked to have known before they passed a law requiring you to have that type of chute that you would be stuck with the cheap crappy chute?

More importantly, you just learned that the Parachute Assistance Commission (EAC) was finally appropriated the tens of millons of Help America Parachute Act dollars it guaranteed in 2003 and it releases a new and improved technology for parachutes at a fraction of the cost. But oh wait! You can't use them.

Obviously that analogy is a bit drawn out, and I'm not telling you that VVPATs are bad or that they shouldn't be there. I just think that the problems associated with the VVPATs both as an integrated function and as an after-the-fact feature are part of the picture and relevant to the discussion. Even if they are the best technology we got they're still no holy grail.

If you just were talking about the one sentence I changed, I think It can be significantly more difficult to implement a VVPAT as an after-the-fact feature is pretty direct. I just thought most was a little inappropriate, becuase the quantity shouldn't be the measure it should be the frequency.

Electiontechnology 22:05, 26 October 2006 (UTC)

Intro

Taintain:

1. Please stop deleting the explanation of the fundamental aspect of the VVPAT. (Verifying voter intent)
2. You just cannot say that a corrupt machine cannot alter paper. If you are going to stipulate that the machine is corrupt, you have to understand that the VVPAT could be equally corrupted. Many VVPATs list each individual action by the voter (i.e. Candidate A selected, Candidate A deselected, Candidate B selected) Once the VVPAT is out of the voter view, if the machine is corrupt, how can you say it could not make changes to the paper? That is just a garauntee you cannot make. It absolutely is a "barrier," but you cannot say " At this point the only risks of election fraud remaining are the same as with a classical poll using paper and ballot boxes like destroyed ballots" because it is just not correct. At minimum the machine could intentionally make certain votes illegible. You simply cannot say that the machine tampering with paper is impossible.

P.S. If you have comments for me, please leave them here or on my talk page. --Electiontechnology 02:28, 16 November 2006 (UTC)

Electiontechnology:

1. no, the really fundamental aspect of paper are, that they're readable by humans and not alterable my voting machines. the "verifying voter intent" is a consequence of that.
2. please cite a reference of a voting machine that's able to alter or destroy the VVPAT once it's seen by the voter.

and no, i will not leave Your diebold-version there and talk someplace else. --Taintain 22:01, 16 November 2006 (UTC)

You misunderstand, I said "stop deleting the explanation of the fundamental aspect of the VVPAT." I didn't say anything about the fundamental aspect of paper. You also seem to have a fundamental misunederstading of the VVPAT, if it doesn't verify the voter's intent, then it is useless, that's why the first two V's stand for Voter Verfied. You can't just brush it off as a consequence. To the second point, since you seem to think that you must provide sourcing for all possible options, then can you provide an example of a corrupt voting machine? If not, your logic says that you have to remove every reference to "corupt" voting machines. I in no way advocate that. Corruption and tampering are serious concerns with all parts of a voting system. Lastly, to your nonsensical final comment, A) what does Diebold have to do with anything? Please don't think I in any way support them or any of their election systems products; B) Again, I think you misunderstood, I was just saying if you had comments for me specifically, you should leave them on my talk page. Hope we can clear this up. --Electiontechnology 22:57, 16 November 2006 (UTC)

P.S. You should read this. "9.6% [of VVPATs] were either destroyed, blank, illegible, missing, taped together or compromised in some way. 1.4 percent of the VVPATs were missing ballots." Please understand that these are serious concerns. --Electiontechnology 23:03, 16 November 2006 (UTC)

the fundamental aspect of a VVPAT derives from the material paper. anyway, i included your sentence. there are enough demonstrations of corrupted voting machines, princton, nedap-hack, accuvote, ... but show me one where the voting machine is able to change the paper after being verified by the voter? those 1,4% of the ballots missing some percent of their votes where accidentally, so please put that into the section of technical problems. the intro is for explaining what VVPATs are all about. --Taintain 00:02, 17 November 2006 (UTC)

I'm not at all sure what you are trying to say with that last response. Regardless, it is factually incorrect to say a corrupt machine cannot alter a VVPAT. I do not think I can be more clear. This is a question of potential.--Electiontechnology 00:14, 17 November 2006 (UTC)

ok, i clarified that. if You have a reference of a corrupted voting machine being able to alter the VVPAT after the voter has verified it, please post it. then we can go on in this discussion. if not, please leave the section as it is. --Taintain 00:45, 17 November 2006 (UTC)

You most certainly did not clarify that. Please stop reverting the article. This is a violation of wikipedia policy:Wikipedia:Three-revert rule. I am not sure if this is a language barrier that is contributing to this lack of understanding, I truly want this conversation to be in good faith, but you insist on ignoring my comments and inserting incorrect information into this article. Your edit, "...he can be sure that even a corrupted voting machine will not be able to tamper with it", is absolutely false, and at best misleading. As I've tried to explain to you repeatedly, you cannot say this is an impossible task. I again have done my best to remove only the factually incorrect information and incorporate your changes. Please take a moment to reread my comments and the source I recommended.--Electiontechnology

stating that You have repeated Yourself does not make a point. it's very nice that you say that you are in good faith and that i'm not a native english speaker, but we should be talking about the subject. please finally disclose the reference of a corrupted voting machine being able to intentionally modify a printed paper trail (i'm asking for the 3rd time!) the link You gave describes technical problems which You are free to include in a technical problems section. it does not belong in the intro of a VVPAT, the intro of cars does also not include that its breaks might fail. i've now inserted my sentence again, please don't remove it again without a reference. --Taintain 13:39, 17 November 2006 (UTC)

The most important part to me was that you stop deleting the postion about verifiability. Your missunderstanding of the editable paper is less important though still unfortuantely incorrect. Your example about cars does not match this situation. I'm not trying to put in the intro that it is changable, I just want to remove the incorrect information that says it is not changeable. A more accurate explanation would be that the car article doesn't incorrectly say that the breaks can't fail. You are simply incorrect is saying that it is impossible. You are stipulating (agree to the fact) that the machine is corrupt. How can you say it is still impossible? That aside, I think this is the most accurate version we've worked on so far and I want to thank you for continuing the coversation. I'm going to invite another user, who if you review his contributions you will see his views on electronic voting are much more similar to yours than mine, to comment. (User:Joebeone) I think an outside view might benefit the both of us as well as the article. --Electiontechnology 16:42, 17 November 2006 (UTC)

As a researcher in the field, it is imprecise to say that VVPATs are not changeable by voting machines. We can't prove that the machines can't change the VVPATs. In fact. the iVotronic VVPAT (called a Real-Time Audit Log, RTAL) is able to both advance and reverse the paper feed. If a VVPAT printer can reverse the paper feed, it would be trivial to do either a denial of service attack (where the paper is reversed and then a VVPAT voided or written over with gibberish) or a substitution attack (such as clever changing of the characters in a name to reflect a different vote). Also, not directly related to the issue at hand, if left unattended VVPAT printers could print willy-nilly more VVPATs. These are real possibilities. One thing that is for sure is that no reliable source has demonstrated either what I talk about above or that VVPATs are unmodifiable by the machine, so this wording should be changed. (I'll wait for responses before changing the language) -- Joebeone (Talk) 19:41, 27 November 2006 (UTC)

if voting machines can change the VVPAT it's caused by implementation problems. it's quite easy to use a printer which cannot rewind and mechanically block the printer when no voter-card is present. i included it in the implemenation section. --Taintain 14:26, 28 November 2006 (UTC)

Well, implementation problems are what we have on the market. Let me be more specific. The intro currently[2] has the following sentence:

Also a printed vote on paper is not changeable by the voting machine opposed to a stored vote in computer memory.

This is imprecise, at best, and likely incorrect. It may be under the ideal VVPAT implementation that this statement is correct, but then that should be qualified by a phrase such as, "In theory, ...". Currently, many security experts (and I can cite this) believe that changing the contents of a VVPAT or otherwise adding or subtracting votes is an attack we have to worry about with all major VVPAT implementations (via extra printing or modification of previously-recorded VVPAT records). I'll take a stab at making the intro more precise without destroying its spirit. OK? -- Joebeone (Talk) 19:04, 28 November 2006 (UTC)

I just took a shot at it and added a cite to the Brennan work that has such VVPAT attacks cataloged. Let me know what you think of this change guys. -- Joebeone (Talk) 20:23, 28 November 2006 (UTC)

what kind of "scientist" made this study? in the attacks on "DRE with VVPAT" it misses an obvious case: the paper reads "Adams", the display shows "Jefferson". this happens once, an election official is called by the voter and the machine goes straight to the FBI. if You know the people who made the study, please tell them to fix this error. i changed the "cannot be changed" to "hard to change" to credit all the theoretical attacks of appending and rewinding. --Taintain 00:02, 30 November 2006 (UTC)