start	end	text
0	6320	Hi, I'm Philip Stark. Thank you for coming to this virtual talk. I'm going to talk about testing
6320	11600	ballot marking devices. This is joint work with an undergraduate student, Ron Shi, who visited
11600	18600	Berkeley for the last year and did some research with me. Why do we need to test ballot marking
18600	23380	devices? Well, they can print votes that differ from what the voter saw on the screen or heard
23380	29280	through the audio interface. The idea of voter verifiability is not really refined enough to
29280	35500	capture the security properties that we need in a voting system. In particular, the ability to
36080	41520	catch an error and spoil the ballot and request another opportunity to vote isn't enough to make
41520	47140	ballot marking devices safe voting technology. For example, recent research by Bernard et al.
47140	53320	showed that only 7% of voters notice errors that ballot marking devices have introduced
53320	60900	into the printout. In effect, the security properties of paper are undermined by using
60900	67200	ballot marking devices to mark the paper. There's a problem with the BMD security model in general.
67200	71920	It basically makes voters responsible not only for their own errors, but also for the overall
71920	77060	security of the system. But they don't give voters the tools they need to do that job. In particular,
77060	81600	there's no way for a voter to present any other party, including an election official, with
81600	88000	evidence that a BMD misbehaved. So if a voter complains to a local election official, there's
88000	92520	no way for the election official to know whether the complaint reflects an actual malfunction,
92640	99180	a voter error, or a cry of wolf trying to undermine the trust election. As a result of that error or
99180	104560	malfeasance could change a lot of votes without raising any kind of alarm. A number of proponents
104560	110760	of BMDs claim that they have benefits such as preventing overvotes, warning about undervotes,
110760	116420	eliminating the possibility of ambiguous marks. I think that there's problems with those arguments.
116420	120780	In particular, they assume that ballot marking devices function correctly. And there are many
120780	125320	recent examples of failures on a wide scale, including in the state of Georgia, Northampton,
125320	131040	Pennsylvania, and in Los Angeles. Precinct count optical scan systems can also protect against
131040	137820	overvotes and undervotes. In fact, that's required under BBSG 1.0. So how can we figure out whether
137820	142540	ballot marking devices actually worked adequately in a given election? We need to know that whatever
142540	148860	errors occurred weren't numerous enough to change the outcome of any contest in the election.
148900	152580	Three different approaches have been proposed to testing ballot marking devices.
152620	157940	One is pre-election logic and accuracy testing, where you look at a machine before election day,
157940	162480	run some test patterns through it, and verify that it prints the right thing. Another approach is
162480	166320	passive testing, where you look at something like the spoiled ballot rate and try to detect
166320	171260	anomalously high rates of spoiled ballots as a possible signal that the machines are misbehaving
171260	175840	and voters are catching it. And the third approach is parallel or live testing, where
175840	181920	testers periodically throughout the day, on election day, or during early voting period,
181920	187920	will mark some ballots but not cast them, and verify that what's marked on the printout matches
187920	192620	what their intent was. And the point of our research is to show that none of these, in fact,
192620	198540	work in practice. Now, how much testing do we really need to do? That depends on how big a
198540	204300	problem would make a material difference, and I have argued a long time that a sensible threshold
204300	209040	for materiality is enough to change the reported winner of one or more contests. That is, we'd like
209040	215000	to have high confidence that whatever errors occurred, they didn't alter who won. Many contests
215000	221160	in the U.S. are decided by less than one percent, even statewide contests. For example, in 2016
221160	228160	presidential election, the margin in statewide contests in Michigan, Rhode Island, Pennsylvania,
228160	233280	and Wisconsin were all under one percent, with Michigan being as low as 0.22 percent.
234100	239380	Now, I'm going to frame this as a two-person adversarial game and think about what strategies
239380	244740	are available to the two players. So the evildoer is Mallory, who's trying to alter the outcome of
244740	249140	one or more contests in an election. Mallory doesn't want to be detected. The point of this
249140	253740	isn't to cast fear, uncertainty, and doubt. It's to get away with altering an election outcome.
254100	260060	Mallory knows how the ballot marking devices will be tested in general because that will
260060	264240	be a matter of public record. That is an action taken by the local election official.
265800	273800	So Mallory knows the state history of the machine. Mallory knows how voters are
273800	277780	interacting with it and knows what votes have been cast earlier in the day, how long each voting
277780	283540	session took, and so on. And Mallory has a good model of voter behavior because Mallory can
283540	287580	basically install spyware on voting machines and keep track of how voters interact with those
287580	293820	machines in previous elections and on into the future. In contrast, Pat is our tester. Pat is
293820	298480	trying to make sure that any ballot marking device problem that alters one or more outcomes will be
298480	304940	detected. In contrast to Mallory, Pat has to obey the law, has to protect voter privacy. Pat doesn't
304940	309340	know which contest Mallory will attack nor the strategy Mallory is going to use to attack them.
309340	315640	So this is a very asymmetric problem. All right, so because the threshold for materiality depends
315640	321580	on the number of votes that it takes to alter an election outcome, it's important to keep track of
321580	330300	how big or how small elections are in the United States. The median turnout by county in 2017,
330300	339340	not 3017, oh sorry, in the 3017 U.S. counties that there are in 2018 was a little under 3,000 voters.
339740	345620	There are fewer than 43,000 voters in more than two-thirds of U.S. jurisdictions.
345980	353560	And in 73 percent of states, more than 50 percent of counties have fewer than 30,000 active voters.
353560	364360	That is, the median size of turnout in a county is 30,000 voters or fewer. In 92 percent of states,
364360	369760	that number is 100,000. That is, more than 50 percent of counties have fewer than 100,000
369760	378580	active voters. In 2019, only 317 U.S. cities had populations of 100,000 or more
378580	385680	out of more than 19,000 incorporated places. So if about 80 percent of the population is a voting age
385680	391560	and turnout is about 55 percent, which is roughly what it's been historically, then contests for
391560	397620	elected officials in something like 98 percent of incorporated places involve fewer than 44,000
397620	403980	voters. So we need to think about ways of testing things on contests that involve fewer than 44,000
403980	410320	voters, and many contests will involve even, you know, fewer than 3,000 voters. The 2019
411900	418460	median population of U.S. incorporated areas is about 725, so about 50 percent of incorporated
418460	426140	places have a turnout of less than 320 voters. All right, this is just to give an idea how much
426140	433220	of the country has a median turnout, had a median turnout in 2018 of less than 30,000 voters. It's
433220	439400	most of the country by area. So what's Mallory's strategy space? How can Mallory figure out which
439400	446920	transactions or what votes to try to alter? Mallory basically can pick based on a very large
446920	452880	number of state variables in the ballot marking device, the time of day, how long the wait was
452880	458580	between voters, how many people have voted on the machine already, how does this particular voter
458580	462820	interact with the machine, including the selections, what contests the voter ignores,
462820	468120	how many times the voter revises selections, how long the voter reviews things, whether the voter
468120	475180	looks at every page of candidates in a contest, how long the voter reviews selections, inactivity
475180	481240	warnings, BMD settings, font sizes, languages, whether the voter uses the audio interface,
481240	486000	the sip and pop interface, all of these things are available to a maldoer, to Mallory, to try
486000	492300	hack the election. Now here are some examples of just how many different possible voting
492300	498120	transactions there are. I'm giving two columns of numbers. The more realistic number is pretty
498120	506040	realistic in the United States. Many jurisdictions have ballots that contain 20 or more contests,
506040	510780	but we're going to use three as basically a lower bound. And similarly, you can look at different
510780	514980	variables that Mallory could use to target these things, from the number of candidates per contest,
514980	522680	time of day, number of people that voted, time for selection, the settings that the voter uses,
522680	528560	the contrast and saturation of the screen, font size, audio use, tempo, volume, and so on. So
528560	532920	conservatively, there's on the order of six million different combinations of settings
533540	539820	that are likely to have some reasonable probability of being used. More realistically,
539820	545560	there's something over 10 to the 47th, a truly staggering number of possible voting transactions.
545560	551040	There's no way to probe even a microscopic fraction of those using testing, either
551040	558500	pre-election logic accuracy or live testing. So what can Pat do? That's what Mallory can do.
558500	564620	Pat can monitor voter behavior in a non-invasive, non-privacy invading way, in particular can look
564620	570460	for ballot rates, and Pat can try to catch a malfunction by using the BND before, during,
570460	575960	or after an election. That is, doing logic and accuracy testing, or live testing, or post-mortem.
575960	581760	So Pat really does have to test at random in some way. If Pat tests in a way that's
581760	587640	predictable, such as once an hour, or pulls only one machine aside and tests it, or tests only some
587640	593060	combinations of votes, only interacts with the machine in some particular way, then because
593060	599960	Mallory knows what Pat's strategy is, Mallory can just avoid changing those transactions and hide.
601220	605800	Similarly, Pat can't just set aside machines on election day for live testing. Pat needs to test
605800	610300	the machines that are actually in use, or malware could detect that the machine is being used in a
610300	616900	way that is not typical of voters. And moreover, because there are so many possible combinations
616900	623180	of settings, combinations of ways of transacting a vote, uniform random sampling is doomed. You
623180	628840	really do need to sample more often from those transactions that voters are going to use more
628840	633840	often in order to have a reasonable chance of sampling at least once from any set of transactions
633840	638020	that contain enough votes to alter the outcome of one or more contests in the election.
638540	643040	So ideal sampling would mimic voter behavior. It would basically sample from what voters actually
643040	649960	do. So we're going to look at exactly that. Suppose we could mimic voters perfectly, how many
650520	654420	transactions would we actually need to use as tests in order to have a good chance of detecting
654420	661440	outcome-changing errors or alterations. So it's important to know that in a jurisdiction-wide
661440	667980	contest, changing the votes on 1% of transactions can typically change the margin by 2%, but if
667980	672860	there's undervotes, you can change it by even more than that. And if the contest is only on a fraction
672860	676960	of ballots cast in the election, then you don't need to change even that large of a percentage to
676960	682400	change a margin by a much larger percentage. For instance, if you have a contest that's only on,
682400	688040	that only 1 in 10 voters is eligible to vote in, and the undervote rate is 30%, then changing the
688040	693940	votes on 1% of transactions could change the margin in that contest by 29%. That's a lot of leverage.
694940	701940	So passive testing relies on voters noticing errors and spoiling their ballots. Now in order to
701940	707620	know how large a spoilage rate is enough to sound an alarm, we have to have a good idea of how often
707620	712480	voters spoil ballots when the machines are functioning correctly, and then we have to know
712480	718180	how often they will notice errors if errors happen, and whether they will report
718180	723600	those errors and thereby, you know, request a new ballot and trigger an alarm.
723660	728780	Problem is that kind of training data is unlikely to be available in part because you can't step
728780	733280	on the same election twice. There are all kinds of differences from election to election that are
733280	737260	likely to change the spoiled ballot rate, including complexity of the ballot, ballot layout,
738240	743500	complexity of the social choice functions, and so on. So how do we set a threshold for one to
743500	749140	sound an alarm if we're using passive auditing, passive testing? It's going to depend in part
749140	753920	on the number of transactions Mallory alters, which votes are affected, which contests are affected,
753920	757640	and so on. And Pat is not going to know any of these things. Pat needs to test in a way that
757640	762920	is going to be sensitive enough to changing the outcome of any contest whatsoever.
763600	768020	So let's make some really optimistic assumptions and work through the numbers and figure out just
768020	772140	how much testing Pat would have to do or how many voters would have to be voting in the particular
772140	777220	contest so that a change in their spoiled ballot rate would be noticed. But let's assume in
777220	781880	particular that the spoiled ballot rate follows a spoiled ballots follow a Poisson distribution
781880	786020	with a known rate if there's no hacking and a different known rate if there is hacking. Now
786020	790480	there's no reason to assume that except it's a common model for things. This is really just a
790480	797520	thought experiment. It's not intended to be a realistic model of how voters detect and
797520	802840	spoil ballots. We're going to look at contest margins of one to five percent and false positive
802840	807320	and false negative rates of five percent and one percent. So a false positive rate is saying that
807440	811560	there's a problem when there really isn't one. A false negative rate is failing to notice that
811560	816240	there's a problem when in fact one or more outcomes have been altered. Now here's kind of
816240	821900	how it plays out. This is for five percent rate of false negatives and false positives. If you look
821900	829520	at this, going across the top is the base rate of spoiled ballots when things are clean and then
829520	838580	as you go from row to row you're really looking at what is the rate of errors in the printouts
838580	843880	that would be required to reverse a margin of size one percent, two percent, three percent,
843880	848420	on to five percent. The detection rate we're assuming is either seven percent or twenty-five
848420	853980	percent. Seven percent is consistent with what Bernard et al. found in their study of actual
853980	860580	voters in an experiment that wasn't an actual election. So if you look at this to have a five
860580	866540	percent false positive and false negative rate, you'd need on the order of half a million ballots
866540	873380	or more for a realistic rate of voters detecting errors and spoiling their ballots to protect
873380	878540	against altering a contest with a margin of one percent. That number goes down as the margin gets
878540	883420	wider, but as I've already argued there are a very large number of contests that are decided by one
883420	889500	percent or less, important contests. If we make a more stringent threshold of requiring only a one
889500	893520	percent rate of false negatives or false positives, then we would need on the order of a million
893520	898680	voters or more in the contest in order to be able to detect an alteration to one percent to
899340	906400	to enough ballots to alter to reverse a margin of one percent. So let's think about how big this
906400	911220	number half a million or a million is in the context of actual elections. And so let's I'm
911220	916880	going to use California as an example. 41 of California's 58 counties had fewer than 100,000
916880	922300	voters in the 2018 midterm election, so passive auditing would not have worked for any of those.
922300	928020	33 had fewer than 100,000 voters in the 2016 presidential election, so again passive auditing
928020	932700	would not have given you an acceptably low false positive and false negative rate, even under these
932700	937600	optimistic assumptions that everything follows a Poisson distribution with a known rate.
938340	943040	So passive testing couldn't have protected contests with margins of three percent or smaller
943040	949020	in those jurisdictions that have a hundred thousand or fewer voters. In many California
949020	953420	counties turn out so small that there would be no way to detect problems through spoilage rates
953420	958920	without having an unacceptably high rate of false alarms would be that invalidating elections left
958920	969080	and right. Okay, so that analysis assumed that votes were being changed more or less at random,
969080	975140	that every voter had some chance of having his or her votes altered, but in fact Mallory has
975140	980500	access to information to use to target the attack against voters who are less likely to notice
980500	990000	problems or less likely to spoil a ballot if there is a problem. In particular, Mallory could target
990000	998380	voters with visual impairments, voters who are blind, that could, if such voters, current ballot
998380	1003320	marking devices don't provide such voters a technology to check whether the printout actually
1003320	1010760	matches the voters intentions or what the voter was told on the audio output or on the screen in
1010760	1015560	you know in a larger font size. So if two percent of voters have a visual impairment that would
1015560	1020240	prevent them from checking the printout directly themselves, then Mallory could change the outcomes
1020240	1024220	of jurisdiction-wide contests that have margins of four percent or more without increasing the
1024220	1028760	spoiled ballot rate at all, because those voters would have no opportunity to notice that there
1028760	1036460	was a problem in the printout. Voters that have some kind of motor impairments that make it
1036460	1041840	difficult for them to, that limited dexterity that it makes it difficult for them to handle a piece
1041840	1047480	of paper, some ballot marking devices have an accessibility feature that allows a voter to
1048280	1053900	cast the ballot without actually handling it. In some cases those features don't even print the
1053900	1061220	until the voter has said I want you to cast this for me after you print it. Now because that doesn't
1061220	1066660	even give the voter the opportunity to look at the piece of paper, the ballot marking device can cheat
1067280	1072360	with impunity on ballots like that. So if there are enough voters who are using this autocast
1072360	1079700	feature, then relatively wide margins can be altered without any possibility of detection.
1080780	1087200	Languages other than English voters, if a voter is looking at a ballot on screen in one language
1087200	1093400	but then printing it out in English, the voter might be less likely to check the printout if
1093400	1101020	that's if the voter is not so comfortable in English. Moreover, if a voter who is a, you know,
1101020	1107420	clearly a native foreign language speaker reports a problem with a ballot, it might be the case that
1107420	1114620	some poll workers would be less likely to believe that the voter actually detected a
1114620	1120760	problem with the device and rather more likely to believe that the voter made a mistake.
1120760	1125220	There's all kinds of things that Mallory can monitor to try to target the attack by looking
1125220	1128620	at how much attention the voter is paying, whether the voter is in a hurry, whether the
1128620	1136720	voter is reviewing selections and so on. All right, so there are other problems with passive
1136720	1142320	testing. Among them, it becomes a really easy way to raise a thud attack through uncertainty
1142320	1147080	and doubt by simply asking voters to spoil their ballots more often than casting doubt on the
1147080	1153440	election. All right, so let's look at these oracle bounds now. Suppose that instead of relying on
1153440	1159540	voters to run the tests, we have to, we're going to try something like parallel testing, active
1159540	1165480	testing, or logic and accuracy testing, where we input test patterns and look at what comes out.
1165480	1173800	So if we had perfect knowledge of voter behavior, that is if basically Pat could pick voters at
1173800	1178380	random and look over their shoulders while they vote and see whether the printout matched what
1178380	1184500	the vote was presented on the screen or in the audio output, that's kind of a best case scenario
1184500	1190460	that doesn't involve Pat having to figure out the distribution of voter transactions with
1190460	1194560	the BMD. So even under those circumstances,
1197500	1205480	it takes a fair number of votes in order to, you have to spy on a fair number of voters,
1205480	1208560	have to look over the shoulder of a fair number of voters to have a reasonable chance of
1209260	1216040	noticing a problem in the election. So for instance, if Mallory alters 15 transactions
1216040	1221000	in a contest that has a little under 3,000 voters, which was the 2018 median jurisdiction
1221820	1228860	turnout, that could change the outcome of the contest by one percent or more, but Pat would
1228860	1234380	need to look over the shoulder of at least 540 voters, about 18 percent of the capacity of the
1234380	1239260	machine. That would involve testing each ballot marking device several times an hour, but once
1239260	1244840	an hour would not be enough. If you're limiting things to once an hour for 13 hours a day,
1244840	1252440	to have a 95 percent chance of catching a problem, you have to have over 6,500 voters in
1252440	1256660	the contest, which is almost triple the median turnout in jurisdictions in the U.S. and 20 times
1256660	1262320	the median number of active voters in incorporated areas. In reality, Pat can't shoulder serve,
1262320	1266580	Pat needs to make a model of voter behavior, and that's got to be calibrated to data.
1266680	1272220	That's going to require monitoring voters in extreme detail, all of the details I mentioned
1272220	1277440	before in relating to voting transactions. That would compromise voter privacy completely
1277870	1284240	and probably be illegal. Nonetheless, let's imagine that Pat had a budget of running an
1284240	1292700	infinite number of tests using a particular model. How many voters would Pat need to observe in order
1292700	1297920	to get a model that was accurate enough to detect an alteration to some fraction of the votes?
1297920	1303180	To have 99 percent confidence of detecting a change to a half percent of the votes,
1303180	1308100	even if Pat could conduct an infinite number of tests in order to model behavior well enough to
1308100	1314420	detect things at that confidence level, would involve monitoring three and three-quarter
1314420	1319680	million voters in excruciating detail. Of course, their behavior in one election might not match
1319680	1324680	their behavior in another election, and many jurisdictions that you need to be monitoring
1324680	1330200	aren't big enough. They just simply don't have that many voters. As you look at larger margins
1330200	1335420	and lower confidence levels, that bound goes down. But even from 95 percent confidence of
1335420	1341100	detecting alterations to five percent of the votes, you'd have to observe more than a million
1341100	1347420	voters. These are very, very conservative bounds. If you had a test limit of 2,000 tests to conduct,
1347420	1351840	then the number of voters you would need to observe, you need to have an even more accurate
1351840	1356460	model, you would have to observe even more voters. So the message here is you really have to look at
1356460	1361660	monitor a million voters in excruciating detail, at least in order to have a reasonable chance of
1361660	1367200	picking up outcome-changing errors. All right, so the situation is really not very good. I mean,
1367200	1371760	it's actually worse than this. Even if you were able to do that much testing, if you find a
1371760	1376160	problem, the only remedy is a new election. You have no idea which transactions were altered,
1376160	1381520	what the right outcome should be. Margins aren't known before the testing happens. If it turns out
1381520	1386980	that the margin is smaller than you allocated testing for while the election was going on,
1386980	1393100	there's no way to go back and fix that. The tests themselves have uncertainty, and that means
1393100	1397420	that you really need to factor that in in deciding who really won. Is there really strong
1397420	1402640	enough evidence that someone really won? If there's only a 95% chance you would have seen a problem
1402640	1409960	that big. Moreover, this is going to require new systems, extra hardware, additional staff, and
1409960	1414260	additional training. This is a very expensive proposition, even if it could possibly be
1414260	1421980	mounted. So our conclusion is that also, as I mentioned before, while BMDs are widely touted
1421980	1428060	as helping some groups of voters, in fact BMDs pose an ideal vector for disenfranchising those
1428060	1433020	very same groups of voters because they will interact with the machines in specific ways.
1433700	1439040	In short, there doesn't really seem to be a way to rescue the trustworthiness of elections if
1439040	1442500	you're casting most of the votes on ballot marking devices, or a substantial fraction
1442500	1447120	of votes on ballot marking devices. And prudent election administration would involve minimizing
1447120	1451860	the number of voters who use ballot marking devices, really reserving them for their
1451860	1456400	accessibility benefits, where those accessibility benefits really do help particular groups of
1456400	1458800	voters. Thank you very much for your attention.