Transcription
Developing aMethodology for ObservingElectronic VotingWaging Peace. Fighting Disease. Building Hope.
The Carter Center strives to relieve sufferingby advancing peace and health worldwide; it seeksto prevent and resolve conflicts, enhance freedom anddemocracy, and protect and promote human rights worldwide.
Developing aMethodology for ObservingElectronic VotingOne Copenhill453 Freedom ParkwayAtlanta, GA 30307(404) 420-5175Fax (404) 420-5196www.cartercenter.orgOctober 2007
The Carter CenterContentsIntroduction and Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Summary of November 2006 Meeting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1The Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Baseline Survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6Observation Checklists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Staffing Implications for an Election Observation Mission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Pilot Test: Venezuela Presidential Election, Dec. 3, 2006 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Smartmatic Machine Controversy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Audits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Piloting the Observation Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Findings and Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Next Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17AppendicesBaseline Survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Poll Opening Observation Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30Election Day Observation Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Poll Closing Observation Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Participants List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
The Carter CenterTIntroduction and Backgroundhe increasing use of new electronic voting(e-voting) technologies in elections aroundthe world has been recognized by the international election observation community as one ofthe paramount challenges facing election observationtoday. As a whole, international election observationorganizations have had relatively little experienceobserving elections in which e-voting technologiesare used. In addition, the inherent lack of transparency of electronic voting technologies discourages easyobservation.E-voting systems thus pose important and uniquechallenges for election observers: How can observersassess the workings of electronic systems where theprocesses of vote counting and tabulation are ofteninvisible? What aspects of traditional observationremain relevant for e-voting observation? What canand should be observed in the automated or e-votingsystems? What are the critical and essential accesspoints in e-voting processes that observers need inorder to assess the integrity of the voting exercise?Does e-voting present new dynamics or challengesfor the interrelationships between relevant stakeholders such as vendors, legislators, election officials,and others? Are there unique legal or legislativeimplications for e-voting systems?To address some of these questions, The CarterCenter has embarked on a two-year initiative aimedat developing an effective methodology for observingelections in which electronic voting technologies areused. On Nov. 2, 2006, The Carter Center hosted thefirst activity of this initiative — a small workshop ofrepresentatives of election observation organizationsand e-voting experts aimed at fostering collaborativediscussion and the development of a draft methodology for observing electronic voting. This meeting,called “Developing a Draft Methodology forObserving Electronic Voting Technologies,” builton the results of a previous workshop hosted by theCenter in 2005 on the challenges posed by electronicvoting technologies.Shortly after the November 2006 meeting, TheCarter Center deployed a specialized technical missionto Venezuela to observe the use of electronic voting inits Dec. 3, 2006, presidential election and to conducta preliminary field test of the methodology. Followingthe Venezuela mission, Carter Center staff and consultants worked to update and revise the methodology.The Center plans to test the draft methodology in atleast two additional pilot missions.This short document, with the attached reviseddraft observation forms, summarizes the discussionsof the November 2006 meeting, the methodologicalfindings of the technical mission to Venezuela, andsubsequent efforts by Carter Center staff to revise thedraft methodology for observing electronic voting.1Note. The Carter Center gratefully acknowledges the government ofIreland, Jim Stanard, Cherida Smith, and the Hughes Foundation, whosegenerous support makes the Center’s election standards project possible.1 This report was written by Avery Davis-Roberts, program associate inthe Carter Center’s Democracy Program.Summary of November 2006MeetingPerspectives on Electronic Voting:Professor Douglas JonesIn advance of the November 2006 meeting, TheCarter Center developed a draft methodology forreview by meeting participants. This methodologyserved as the basis of discussion during the meeting.As an introduction and overview to the topic of electronic voting technologies, professor Doug Jones ofthe University of Iowa opened the meeting with ashort presentation on the ways in which different perspectives on the use of electoral technologies can helpto identify openings and opportunities for more meaningful observations.2 According to Dr. Jones, it ishelpful to understand the path of the voting machinethrough several cycles — the election cycle, the lifecycle of the machine itself, and the cycle of data flow2 http://www.cs.uiowa.edu/ jones/1
The Carter CenterDepending on the electoral body, there may or maynot be postelection audits that check the accuracy ofthe tabulated vote. These postelection audits wouldideally occur before the official results have beenannounced and would be another opportunity forelection observers to assess the efficacy and inclusiveness of the procedures in place.between different equipment and software and different physical locations. The next several sections summarize the main points of Dr. Jones’ presentation andthe discussion among meeting participants.Election CyclePre-election tests and audits are an optimal opportunity for international election observers to assess notonly the functioning of the electronic voting systembut also the access of key stakeholders to the electoralprocess, including the technologies in use. However,when considering the election cycle, there are variousfactors that limit the extent and effectiveness of pretesting and auditing of the electronic voting system.First, there is often political pressure to extend thecandidate registration period. If candidates areallowed to register at a later date, the period betweencandidate registration and election day may not belong enough to conduct the proper audits and tests.Shorter testing periods translate into shorter periodsfor correcting any detected errors or flaws in theelectronic voting system, which can result in seriousproblems that must be resolved in an unrealisticallyshort period of time.A second important factor is the location andchain of custody of machines throughout the electioncycle. Election observers should pay particular attention to the chain of custody of the machines, especially once they have been distributed from thecentral warehouse, where testing likely takes place, tothe polling places. Once the machines are deployedto the polling places, physical security measuresbecome paramount as transportation and in-pollingplace storage provide a significant opportunity fortampering to take place. Because testing of themachines does not usually occur once the machinesare distributed to the polling place, observing thechain of custody becomes the most effective means ofensuring that the equipment has not been tamperedwith or that any tampering that does occur is evidentand that proper procedures are followed.Third, after election day has concluded, votinginformation must be transmitted to the central tabulation system. The actual collection of the resultsfrom the voting machines usually involves the use ofmodems, memory sticks, and other electronic devices.Machine Life CycleThe machine’s life cycle begins with the invention ofthe voting equipment and ends when the machinesare finally retired from use. Ideally, the first electionemploying a new voting technology will be a minorelection with a low number of voters because thereare almost always significant glitches associated withthe first deployment of a technology.Before the voting machines are used in an election,the electoral jurisdiction should assess whether themachine meets not only a set of recognized certification standards for electronic voting systems, but alsothe particular requirements of the election takingplace and of the jurisdiction in which that electionwill occur. A jurisdiction may have different requirements for a voting machine depending on variousfactors, including whether the jurisdiction is rural orurban, the number of registered voters, and so forth.Ideally, an independent body will be responsible forthe certification of the technology and will determinewhether or not the machine has met the standardsset for e-voting technologies. In the United States,independent testing authorities (ITAs) perform thisfunction. These laboratories are private companiesthat have been accredited by the U.S. ElectionAssistance Commission. However, the extent of atesting authority’s actual independence is dependentto a large degree on the electoral body and thevoting machine vendor. In the United States, forexample, the ITAs often are paid to test the equipment and software by the voting machine vendor,potentially compromising the legitimacy of thecertification process.Observers should seek to answer the followingquestions when considering the certification process:What are the certification standards for a particularjurisdiction? Are these standards public information?2
The Carter CenterIs the process for certifying electronic voting systemstransparent?After the machine has been independently certified and accepted by the electoral body, the decisionto deploy the technology can be made. At that point,election officials and poll workers must be trainedto operate and use the machines. If the decision todeploy the technology is made too late, the amountof time available to test the machines, to properlytrain poll workers and election officials on their use,and to familiarize the electorate with the technologymay be condensed to the detriment of the electoralprocess. Observation of the training of poll workers,election officials, and the electorate must be a centralcomponent of any e-voting observation methodology.Cycle of Data FlowWhen considering e-voting, observers should tryand identify all the delivery paths of informationbetween various software programs and equipment.Understanding the expected flow of information willhelp observers to identify potential opportunities formanipulation of the system and to assess whetheradequate security procedures (both technical andphysical) have been put in place. The cyclical flowof information and equipment between the vendor,the tabulation center, the warehouse, and the pollingplaces requires that a certain level of security beimplemented at each exchange of information toensure that the system is, at least, tamper-evident.Figure 1 summarizes the cycle of data flow.Figure 1: Cycle of Data Flow1. Vendor produces equipment and software.2. Machines and software are delivered to the warehouse and tabulation centers — data flow betweenvendor and tabulation center and warehouse.3. Machines are then deployed to polling places — data flow between the polling place and thewarehouse.4. On election day, votes are cast and then the election results are sent to the tabulation center —data flow between the polling place and the tabulation center.5. After the election, the equipment is returned to the warehouse for storage — data flow between thepolling place and warehouse.3
The Carter CenterThere are two components for providing propersecurity during the various exchanges in the cycle:physical security and technical security. Physicalsecurity measures often include documented chainsof custody to certify that each person involved in theprocess performed the proper protocol for the deliveryand transfer of equipment and data. Technical security,on the other hand, usually involves cryptography toensure that the software and the machines cannot betampered with. The need for observers to focus exclusively on technical security measures generally occursonly if the physical security procedures have proveninadequate.The methods used for transferring data from thepolling centers to the tabulation center and for finallytabulating the votes can also present a significantchallenge to observation and auditing. Most tabulation centers are set up with individual technicians sitting in front of computers, making it very difficult toobserve the work that they are actually performing.The method for observing at the tabulation centermust be fundamentally different from the way thatthe rest of the electoral process is observed.It was suggested that by working toward moreharmonized methodologies for observing electronicvoting, the election observation community is helping to articulate standards for e-voting based onwidely accepted democratic principles, such as transparency and accountability. The Council of Europerecommendations go a step further and begin to tiethose emerging standards to international law.More generally, members of the group questionedwhether electronic voting could ever be completelyobservable. Proprietary issues and nondisclosureagreements between the vendor and the electoralbody can add to the opacity of electronic votingsystems.Technical ExpertiseMeeting participants agreed that there is a generalshortage of people, in both developing and developedcountries, who have the technical expertise notonly to observe all aspects of the electronic votingprocess but also to work with electoral commissionsto adequately administer electronic elections. Afew members of the group suggested that the gapbetween the knowledge of the technicians whorun the election and that of the electorate couldbecome so wide as to make the processes of electronicvoting completely opaque to observation. In suchcircumstances, the ability of the general publicto lodge complaints or legal challenges would beseverely eroded. Similarly, political parties alsosuffer from a lack of technical capacity to observeelectronic voting. There was a general consensusthat political parties should be trained to observeelectronic voting; one concrete suggestion for anext step was the creation of training programs forpolitical party agents and other key stakeholders onvoting technology.International Standardsfor Electronic VotingDuring discussion at the November 2006 meeting,there was general agreement among the participantsthat consideration of the legal framework is anespecially important aspect of observing electronicvoting and that the right of key stakeholders to haveaccess to complaints procedures and other effectivelegal remedies becomes even more critical when newtechnologies are introduced. Several participantssuggested that developing international standards forelectronic voting technologies could give observersthe tools necessary to assess both the legal frameworkof a particular country’s elections and the electronicvoting system. The Council of Europe’s Standardsfor Electronic Voting Systems are one example ofinternational standards.33 racy/02%5FActivities/02%5Fe%2Dvoting/4
The Carter CenterPThe MethodologyThe use of electronic voting technologies alsowidens the scope of focus for observers in that itintroduces new stakeholders into the electoralprocess, such as certification bodies and vendors. Tounderstand the impact of technologies on the qualityand conduct of the elections, observers must considernew types of information that would not necessarilyhave been included in traditional observationapproaches, such as the contractual relationshipbetween the election management body andthe vendor.In order to develop a standard methodology thatcan be applied in a wide variety of circumstances andto a variety of technical solutions, the Carter Center’sdraft e-voting observation methodology aims to identify key issues and questions to be assessed. The draftmethodology includes generic template forms thatallow the methodology to be used in a number of different countries and on different voting systems. TheCarter Center, in creating the draft methodology, hastried to respond to all of thepreviously mentioned challenges and will continueto refine and improve it as we gain a better understanding of the intricacies of these challenges.The draft methodology is based on two principalobservation instruments: a baseline survey andobservation checklists:rior to the November 2006 meeting, TheCarter Center developed a draft methodologyfor observing the use of electronic votingtechnologies. This draft methodology served as thebasis for discussion during the workshop. As outlinedabove, the principal activities of the Center’stwo-year initiative on e-voting include a series ofcollaborative workshops and meetings, and pilot missions in collaboration with representatives of otherobservation groups, aimed at refining the methodology and increasing the hands-on experience ofinternational observers with electronic voting.The following section provides an overview of themethodology and highlights the guiding principlesthat were identified during the November 2006meeting discussions.In electronic voting processes, observers are facedwith trying to verify election processes that are attimes opaque or occurring within a so-called blackbox. Observation of electronic voting technologiesmust, first and foremost, be concerned with assessingwhether electronic voting technologies uphold international standards for democratic elections, such asthe secrecy of the ballot and the right of the voters toparticipate in government. Recognizing that electionday observation alone does not permit a completeassessment of whether these rights are being fulfilled,the Carter Center methodology takes a broaderapproach to the observation of electronic voting.As with traditional election observation, observation of electronic voting must begin well in advanceof election day and should consider the broaderelectoral context, such as the legal framework forthe elections, voter education, poll worker training,political campaigns, and so forth, as well as the eventsof election day. Furthermore, because many tests,audits, and preparations of the electronic votingequipment take place months in advance of electionday, observation of electronic voting requires additional emphasis on long-term observation anddocumentary research. Baseline survey: to be completed, to the extentpossible, in advance of the audits, tests, andelection day (see Appendix A) Observation checklists: to be completed basedon observations during the immediate electoralperiod — four to six months around election day(see Appendices B – D)The next two sections provide a detailed overviewof the baseline survey, which is broken into eightissue areas, and the observation checklists. This isfollowed by a summary of the Carter Center observation mission to Venezuela.5
The Carter Centerinternationally recognized rights of voters to cast asecret ballot, participate in their government, andhave their vote counted as cast. In addition, review ofthe legal framework will help observers gauge thedegree to which the election management body istaking active steps to promote transparency in theelectoral process through mechanisms such as audits,impartial and independent certification, and testing.In particular, Carter Center observers consider theroles and responsibilities of key stakeholders as outlined by law and focus specifically on the legallyenforceable accountability of stakeholders — bothtraditional stakeholders such as election managementbodies and nontraditional stakeholders such as certification bodies, vendors, and contractors. In addition,observers consider the degree of access granted bythe legal framework to domestic observer groupsand political party agents in addition to membersof international observation delegations. While thisis a critical aspect of observation of any election,the opacity of elections in which electronic votingtechnologies are used makes it critical that observersgain a sound understanding of these issues.The Baseline SurveyThe baseline survey used in the Carter Center draftmethodology contains 144 questions intended toguide the observation and assessment of the user. Theinformation gathered by answering these questions,based on interviews with stakeholders and the reviewof legislation, rules, regulations, and other pertinentdocumentation, should help the observation teamcreate a comprehensive picture of the voting systemin use and how it should work and thus allow a morecomplete assessment. In this observation model, thebaseline survey would be completed by long-termobservers and core team members, such as the fieldoffice director and in-country staff, with assistancewhere necessary from technical experts in the monthsleading up to the election.After collecting as much data as possible, the coreteam will produce a synopsis of the findings, providing an overview of the system that can be used by theteam and by short-term observers. In addition, thisinformation will be used to modify more genericelection day and other checklists so that they becomeeffective tools for capturing the observations of theteam on how the system actually works in practice.The baseline survey includes questions on eightgeneral aspects of the electronic voting system:(1) the legal framework; (2) technology vendors andprocurement of equipment; (3) certification, testing,and security of the system; (4) public confidence inelectronic voting technologies; (5) voter accessibility;(6) election day procedures; (7) contingencyplanning; and (8) ballot counting, recount, andcomplaints procedures.Technology Vendors and Procurementof EquipmentElectronic voting vendors and the systems theyproduce may be selected for a variety of reasons.Transparency and accountability in the tenderingand procurement processes are critical to ensuringthat the rights of voters are not undermined byprivate interests.By asking the questions outlined in the TechnologyVendors and Procurement of Equipment section ofthe baseline survey, observers will better understandthe reasons why election management bodies havechosen to introduce electronic voting technologies,why they have chosen a specific technical solution,and how transparent the tendering process is. In addition, this section of the survey will guide observers intheir consideration of the role of vendors in the electoral process, a role that in traditional elections maynot be as important. In particular, Carter Centerobservers focus on the nature of the vendor’s relation-Legal FrameworkAs with any election, consideration of the legalframework regulating the electoral process is essentialto a full understanding of it. A thorough review of thelegal framework will help observers assess the degreeto which the state has sought to provide not onlyclear and consistent rules and regulations for allaspects of e-voting and any reasonable eventualitythat may arise from its use, but also the degree towhich the state has taken clear steps to protect the6
The Carter Centership with the election management body and otherkey stakeholders to ensure that the relationship is freeof conflicts of interest and that there was a competitive and transparent tendering process that resultedin the selection of a particular vendor to providee-voting equipment and related services.CertificationImpartial, independent, and transparent systemcertification measures should be in place to ensurethat the system meets national or international standards, the requirements of the election jurisdiction,as well as the technological specifications outlinedby the vendor. International election observationmissions should not be responsible for the certification or testing of an electronic voting system. Becausethis responsibility lies with election managementbodies and the organizations with whom they work,Carter Center observers assess the functioning ofthe certification body and its relationship with otherkey stakeholders in the process, including the electionmanagement body, political parties, the vendor, andothers. Questions included in this section of the baseline survey are intended to help capture data aboutthe transparency, independence, and impartiality ofthe certification body and help observers understandany financial relationships that the certification bodymay have with the government, political parties, andothers that fall outside the bounds of the contractualagreement between the certification body and theelection management body. Observers also assess thedegree of access granted to political party agents andobservers, both international and domestic, in thecertification process.Certification, Testing, and Securityof the SystemThe Certification, Testing, and Security of the Systemsection of the baseline survey includes several criticalissues that observers must consider to gain a soundunderstanding of the system, including voter verifiedpaper trails and audits, certification, testing, physicalsecurity, software, integrity of the system, and ballotbuilding.Voter Verified Paper Trail and AuditsOne widely accepted means of ensuring that theelectronic voting system is recording votes as theywere cast by voters is the use of a voter verified papertrail (VVPT). A VVPT allows a voter to cast a ballotelectronically and then verify that the machine hasaccurately recorded the vote by checking a machineproduced paper receipt that captures the choice. Thispaper receipt should then be placed in a secure ballotbox that protects the secrecy of the vote and can bemanually recounted after the election. The results ofthe manual count can be compared to the electronicresults produced by the machine (see the case ofVenezuela, outlined in the next section of thisreport). Voters should not be able to remove theballot paper or other proof of how they voted fromthe polling place.Comparisons between the paper receipt count andthe electronic results are useful for ensuring that themachine is accurately recording the voters’ choices.If such comparisons are conducted on a statisticalsample of machines, the sampling method must beclear and be consistently applied and follow soundstatistical sampling practices to produce meaningfulresults that can be extrapolated to the universe ofmachines in use. In addition, observers should considerwhether the results of the paper count can be used asthe basis for a legal challenge to the election results.TestingElectronic voting systems, including equipment andsoftware, should be tested prior to the deployment ofvoting machines on election day to help ensure thatthe machines work as anticipated. This testing shouldbe conducted in an impartial and transparent mannerand should include all aspects of the system. CarterCenter observers should gather information thatwill help assess the impartiality, independence, andcomprehensiveness of the testing scheme in place.Physical Security of the SystemAs in a traditional election, the physical security ofelection materials is an essential measure for protecting the integrity of the election, regardless of thetechnical solution used. Election management bodiesshould have clear processes and procedures in place7
The Carter Centeraccess, or hacking. Observers should collect data thatwill help the observation mission assess the extent towhich steps have been taken to protect the integrityof the data transmission.that regulate physical access to the equipment,document such access, and prevent physical tampering with the machines. Included in these processesshould be mechanisms that allow any tampering tobe evident (such as seals over data ports) and clearregulations outlining procedures to be followed iftampering is discovered. Voting materials, includingelectronic voting equipment and backup paperballots, must be kept in a secure location at all timesand should remain s
Figure 1: Cycle of Data Flow 1. Vendor produces equipment and software. 2. Machines and software are delivered to the warehouse and tabulation centers—data flow between vendor and tabulation center and warehouse. 3. Machines are then deployed to polling places—data flow between the polling place and the warehouse. 4.
