## Vote Early, Vote Often

By Bruce Schneier
Wired News
November 16, 2006

In the world of voting, automatic recount laws are not uncommon. Virginia, where George Allen lost to James Webb in the Senate race by 7,800 out of over 2.3 million votes, or 0.33 percent percent, is an example. If the margin of victory is 1 percent or less, the loser is allowed to ask for a recount. If the margin is 0.5 percent or less, the government pays for it. If the margin is between 0.5 percent and 1 percent, the loser pays for it.

We have recounts because vote counting is -- to put it mildly -- sloppy. Americans like their election results fast, before they go to bed at night. So we're willing to put up with inaccuracies in our tallying procedures, and ignore the fact that the numbers we see on television correlate only roughly with reality.

Traditionally, it didn't matter very much, because most voting errors were "random errors."

There are two basic types of voting errors: random errors and systemic errors. Random errors are just that, random -- equally likely to happen to anyone. In a close race, random errors won't change the result because votes intended for candidate A that mistakenly go to candidate B happen at the same rate as votes intended for B that mistakenly go to A. (Mathematically, as candidate A's margin of victory increases, random errors slightly decrease it.)

This is why, historically, recounts in close elections rarely change the result. The recount will find the few percent of the errors in each direction, and they'll cancel each other out. In an extremely close election, a careful recount will yield a different result -- but that's a rarity.

The other kind of voting error is a systemic error. These are errors in the voting process -- the voting machines, the procedures -- that cause votes intended for A to go to B at a different rate than the reverse.

An example would be a voting machine that mysteriously recorded more votes for A than there were voters. (Sadly, this kind of thing is not uncommon with electronic voting machines.) Another example would be a random error that only occurs in voting equipment used in areas with strong A support. Systemic errors can make a dramatic difference in an election, because they can easily shift thousands of votes from A to B without any counterbalancing shift from B to A.

Even worse, systemic errors can introduce errors out of proportion to any actual randomness in the vote-counting process. That is, the closeness of an election is not any indication of the presence or absence of systemic errors.

When a candidate has evidence of systemic errors, a recount can fix a wrong result -- but only if the recount can catch the error. With electronic voting machines, all too often there simply isn't the data: there are no votes to recount.

This year's election in Florida's 13th Congressional District is such an example. The winner won by a margin of 373 out of 237,861 total votes, but as many as 18,000 votes were not recorded by the electronic voting machines. These votes came from areas where the loser was favored over the winner, and would have likely changed the result.

Or imagine this -- as far as we know -- hypothetical situation: After the election, someone discovers rogue software in the voting machines that flipped some votes from A to B. Or someone gets caught vote tampering -- changing the data on electronic memory cards. The problem is that the original data is lost forever; all we have is the hacked vote.

Faced with problems like this, we can do one of two things. We can certify the result anyway, regretful that people were disenfranchised but knowing that we can't undo that wrong. Or, we can tell everyone to come back and vote again.

To be sure, the very idea of revoting is rife with problems. Elections are a snapshot in time -- election day -- and a revote will not reflect that. If Virginia revoted for the Senate this year, the election would not just be for the junior senator from Virginia, but for control of the entire Senate. Similarly, in the 2000 presidential election in Florida, or the 2004 presidential election in Ohio, single-state revotes would have decided the presidency.

And who should be allowed to revote? Should only people in those precincts where there were problems revote, or should the entire election be rerun? In either case, it is certain that more voters will find their way to the polls, possibly changing the demographic and swaying the result in a direction different than that of the initial set of voters. Is that a bad thing, or a good thing?

Should only people who actually voted -- records are kept -- or who could demonstrate that they were erroneously turned away from the polls be allowed to revote? In this case, the revote will almost certainly have fewer voters, as some of the original voters will be unable to vote a second time. That's probably a bad thing -- but maybe it's not.

The only analogy we have for this are run-off elections, which are required in some jurisdictions if the winning candidate didn't get 50 percent of the vote. But it's easy to know when you need to have a run-off. Who decides, and based on what evidence, that you need to have a revote?

I admit that I don't have the answers here. They require some serious thinking about elections, and what we're trying to achieve. But smart election security not only tries to prevent vote hacking -- or even systemic electronic voting-machine errors -- it prepares for recovery after an election has been hacked. We have to start discussing these issues now, when they're non-partisan, instead of waiting for the inevitable situation, and the pre-drawn battle lines those results dictate.

earlier essay: Did Your Vote Get Counted?
later essay: My Data, Your Machine
categories: Elections
back to Essays and Op Eds

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..