Halifax elections are going hi-tech, but while election officials hope internet voting is the cure for voter apathy, skeptics say it is a threat to democracy itself.by Tim Bousquet | photos Aaron Fraser
he three weeks from October 14 to November 4 are something of an election marathon: The Canadian federal election is October 14, Nova Scotians elect their municipal councillors and school board members October 18 and the US elections, when Americans vote for president, all congressional positions, a third of the Senate and a host of state and local offices and propositions, are November 4.
It is, truly, a momentous time, with astounding geopolitical, economic, social and environmental issues in the mix.
But for what and whom citizens on both sides of the border vote is a discussion for another time. What concerns us here is how they vote. And when it comes to the mechanics of how people actually cast their votes, there is no doubt: Canada gets it right, and the United States gets it wrong.
Over the last eight years, the US has seen an embarrassing parade of election failures and mishaps. The 2000 elections were plagued by voter registration irregularities and ballot problems like the infamous "butterfly ballot" and "hanging chads," and were finalized only when the US Supreme Court ordered a stop to the recount process and summarily awarded Florida, and therefore the entire country, to George W. Bush.
Afterwards, many states acquired electronic voting machines, which were sold as a solution to confusing paper ballots. The new touch-screen machines resembled familiar ATMs and results, which required no interpretation from partisan voting officials, could be reported immediately, as soon as the polls closed.
The reality, however, was something else. The new machines were plagued by malfunctions, "lost" votes and programming and user error. Because they left no paper trail, there could be no possibility of a recount or audit. Election error again became an issue in the 2004 election, especially in the state of Ohio, another swing state that brought victory to Bush.
Recently, some states have passed legislation that effectively bans the electronic machines, and thousands of machines valued at many millions of dollars have been scrapped. Earlier this year, Florida sent 30,000 electronic voting machines to a recycling company; the machines had been purchased to replace the butterfly and other paper ballots. Ohio's new $138 million electronic voting system is mired in a series of lawsuits left over from the 2004 elections.
Still, 36 percent of American voters will use electronic machines in the upcoming presidential election, and two weeks ago the Washington Post reported that a software error was detected in machines manufactured by Premier Election Services, previously known as Diebold. The error, which can result in votes being "dropped"---uncounted---as results are transferred from the machine to a central tallying point, has been present in the machines for as long as 10 years. These machines will be used in 34 states in November.
It's no wonder that Americans are increasingly distrustful of the voting process. Voting experts challenge every aspect of elections, including the registration process, the procedures at the polling place itself, the use of electronic machines and the counting and recounting of votes.
Contrast the sour American experience to Canadian elections: In this country, voters show up at the poll and are handed a paper ballot and a pencil. They check the box next to their preferred candidate and put the ballot in a box. After the polls close, an election official opens the box, and the official and poll observers from the political parties examine each ballot and agree on how the vote was cast. A final tally takes about half an hour.
The Canadian system is clean, unambiguous and fair.
But the Halifax Regional Municipality doesn't like the Canadian system, and is determined to change it.
To that end, HRM council has awarded a $487,151 contract to Intelivote, a firm started by Dartmouth resident Dean Smith, to conduct an internet and telephone vote as a component of the upcoming municipal and school board election.
Through the last week of September, every HRM resident on the voter list will be mailed a letter containing a personal identification number and instructions for how to vote over the internet or phone. The internet/phone vote will actually take place from October 4 to October 6, two weeks before the "regular" election day.
At any time over those three days voters can log on to a website controlled by Intelivote. They'll have to maneuver through a "capture challenge"---the familiar security routine of retyping the squiggly letters found in a blurred box---then use their unique PIN and date of birth to identify themselves. From there, a simple menu will walk them through the three or four steps of the election---the vote for mayor, for councillor, for school board member and (if eligible) for the African-Nova Scotian school board rep.
Alternatively, voters can call a phone number and maneuver through a simple voice mail menu to cast votes. Technically, the phone vote is just a component of the internet vote, with the phoned-in votes moving through the same system as those votes cast from computers.
The three-day internet vote is a pilot project intended to demonstrate the feasibility and reliability of the system. Smith, city staff and councillors all say the internet vote will be successful, and future elections will employ it for the entire election, not just for an early vote.
Among the public at large, nobody has suggested there was anything wrong with the clean, unambiguous and fair Canadian system of voting with paper ballots, and the public didn't ask for the internet/phone vote.
That said, Haligonians seem not to overly object to the prospect of an internet vote. There has been no public protest in Halifax over the issue, no opposition to electronic voting expressed at council meetings and just one letter in a local newspaper about the issue.
South of the border, however, voting experts are aghast at the prospect of an internet vote.
"Internet voting is a bad idea all around, and the fact that election officials who do not understand the technology are willing to risk such massive, and in many cases undetectable, fraud in the municipal elections is exceedingly negligent," says Rebecca Mercuri, the leading US critic of electronic voting schemes. Mercuri defended her doctoral thesis, on the then-obscure issue of "electronic vote tabulation checks," just 11 days before the contested 2000 election, and found herself thrust into the limelight. Her writing was cited in briefs submitted to the Supreme Court for the Bush v. Gore decision that awarded Bush the presidency, and she testified before several congressional committees charged with investigating the election fiasco.
"I remain skeptical over any security plans for internet voting," agrees Douglass Kellner, the co-chair of the New York State Board of Elections, which oversees the second-largest state election system in the US. "And I remain skeptical that there will ever be any security plans that work. Experts have worked long and hard to make the system fool-proof, without success, and I haven't heard that the citizens of Halifax have figured out how to do it."
Doubts aside, Halifax's internet vote is moving forward. And depending on how many people use the new system, the internet vote could determine the results of the municipal elections. In a very real sense, Dean Smith might tell us who the next mayor is.
Which raises the question: Can we trust Dean Smith?
The motherlode
Smith's involvement with voting started back in 1992. That year, the Nova Scotia Liberal Party was the first political party on the planet to choose its leader through an electronic voting system, a phone voting system using servers in Ottawa to handle votes cast during the Liberal convention at the Metro Centre in Halifax.
But in an inauspicious beginning for electronic voting, the computers crashed and the election couldn't be completed. Smith, who was then doing IT work with MT&T (the precursor company to Aliant), was called in to fix the problem.
"It was a Bell Canada system that they were running here in Nova Scotia," Smith explains. "I took a team to Ottawa, and we very quickly determined the types of problems that it had. It was a simple IT thing, but the long and short of it was it was a big black eye for the company."
Smith repaired the system and two weeks later the Liberals tried again; the system worked without a hitch. Smith worked for a few years on other telephone voting projects with MT&T, then moved on as a manager for various IT companies. "But in the back of my mind I always knew that the next evolution in voting would be electronic voting."
There simply wasn't the volume of electronic voting necessary to sustain an independent business, says Smith, until Ontario approved electronic voting in 1996. Intelivote was incorporated in 2003, and has since run union and organizational votes---Smith mentions a soccer league's evaluation of a coach---and, increasingly, municipal elections.
In 2006, Intelivote handled elections for eight small Ontario townships, the largest of which, South Frontenac, had just 18,528 voters. But that experience gave the firm a reputation as a reliable vendor, and last year Intelivote ran two elections in the United Kingdom---for the Borough of Rushmoor, with 101,000 voters, and the District of South Bucks, with 68,000 voters.
Halifax, with about 280,000 potential voters, establishes Intelivote as a leading player in the field. Success here will position Intelivote for the 2010 Ontario municipal elections, which Smith characterizes as the "motherlode." And, he notes, officials from Winnipeg will be observing the Halifax election in anticipation of using internet voting in that city's 2010 regional election, an area containing 1.2 million people. "That will be the largest electronic event ever done," says Smith.
And while the US public remains skeptical of all electronic voting schemes, election officials there are moving forward with internet-based elections. In 2004, the US military aborted a plan to use the internet for the two million personnel based around the world after Mercuri and Avi Rubin, a computer scientist at John Hopkins University, questioned the security of the system, but the military is moving ahead with an internet vote for the 2008 elections. Further, some 13 states are investigating using the internet to allow troops in Iraq to vote in state elections, and both the Republican and Democratic parties are moving toward internet votes for their primary elections of presidential candidates.
"I don't think you'll get this type of voting at the federal election in the Untied States, but you'll get it in everything up to the federal election---local races and primaries," says Smith.
Intelivote is poised to become one of the primary electronic voting vendors in what could potentially become a multi-billion dollar market. Seen in that context, the Halifax election is about much more than whether Peter Kelly's votes are counted correctly, or whether a few votes are dropped in the Ecum Secum district race for school board member.
To catch a voter
But why should the electronic voting industry exist in the first place---especially in Canada, which already has a functional and fair voting system?
The answer to that question invariably comes back to one concern: declining voter turnout. Halifax hasn't yet reached the abysmally low rates of voting regularly experienced in the US, but voter turnout is universally agreed to be too low--- just 54 percent of eligible voters took part in the 2004 mayoral election, with still lower rates for the election of individual councillors.
In general, those districts with the lowest average incomes also have the lowest voting rates---only 35 and 36 percent of potential voters turned out to vote in District 12 (downtown-north end) and District 9 (north Dartmouth), respectively, while the sprawling Eastern Shore district, which includes many poorer communities, did only marginally better. Collectively, all council districts averaged just 48 percent turnout.
There could be many reasons for declining voter turnout. Perhaps citizens think their government is not responsive to their needs, regardless of who is elected. Perhaps the electoral process is viewed as a cynical exercise in marketing candidates, unrelated to the real concerns of the voters. Perhaps potential voters feel government is simply broken beyond repair, so why bother? Such reasoning, anyway, might explain why people disenfranchised from the wealth and prosperity of society might also disenfranchise themselves from the political process.
But rather than dealing with hard issues concerning the effectiveness and responsiveness of government, bureaucrats and politicians have found another explanation for low voter turnout: It's too difficult and bothersome to get to the polls. Never mind that in past decades voting often meant trudging long distances through inclement weather, and yet voter turnout was higher; today, when polling places are well-placed around the community, including in retirement homes, university dorms and even prisons, getting to the polls is said to be a monumental chore---too much to ask of the average citizen.
The corollary to this argument is the supposition that people, especially young, "connected" urbanites and the tens of thousands of students in Halifax, are "used to" doing all sorts of things on the internet---their banking, their shopping, etc. Betwixt downloading iTunes and updating their Facebook status, they're just another mouse click away from voting for mayor.
Additionally, our aged population has a difficult time moving around, and so letting them vote via phone or on the computer is likewise a worthy service.
Yet when BBC political research editor David Cowling looked at 14 elections in Britain that used internet voting, including the Rushmoor election conducted by Intelivote, he wasn't impressed. "There seems to be no evidence that e-voting increases participation in elections," he concluded. "The experience of pilots to date suggests that those who vote by internet would have voted by more traditional methods in any event, in the absence of any e-voting option."
Cowling believes that a five-percent increase in the Rushmoor turnout was unrelated to the internet balloting.
Still, internet voting might increase turnout, so what's the harm?
"But is it necessarily good that voting should be made so easy?" replies Douglass Kellner, the New York State election official. An attorney, Kellner was appointed to the election board by the Democratic Party, which traditionally looks to increase voter turnout. "There's something to making the commitment to get to a polling place, to stand in line with your fellow citizens and voting," he says. "I'd be very concerned [about Halifax's internet vote]. You have to wonder, why is this necessary---especially when it compromises the integrity of the ballot?"
Security
Smith has heard the concerns about ballot integrity many times before.
"They're valid concerns," he says, when asked about the issues raised by Mercuri, Kellner, Rubin and others in the US. "They're educated academics that understand that those are important issues. And there's another subset of the population that says, 'We understand that, we appreciate that, but we still need a solution. Is it a reasonable solution to offer internet voting?'"
Smith has no doubts about his system, and is willing to discuss it openly, at length and in detail. He repeatedly expresses "respect" for skeptics, and only occasionally reveals a frustration at "naysayers" who "have made a lot of money from this."
As Smith tells it, there is a categorical difference between the electronic voting machines used in the botched US elections, which are known as "a direct recording electronic device," and his internet voting system. In fact, he keeps a direct recording electronic device in the lobby of Intelivote's Burnside office, a kind of object lesson in how not to run an election.
The internet system that will be used in Halifax has four levels of security checks, he explains.
First is what is known as a "penetration test," which is conducted by Thor Solutions, an IT security firm. That company tries to break through "six or seven different levels of security" in the Intelivote system in order to see if the security mechanisms can prevent someone from hacking into the machines running the election.
The second security check is an analysis of Intelivote's encryption system, the process by which the several computers running the election "speak" to each other. Smith maintains this really isn't an issue in the Halifax election, because the machines are only "millimetres apart" in the Aliant data centre on North Street.
The third security check is an external audit of the entire voting process conducted by the prestigious auditing firm Ernst & Young. That company will examine the issuing of PINs, how the list of voters is handled, the spelling and placement of candidates' names on the ballot, protection of voters' privacy and all the other minutiae of the election process.
Lastly, there is an analysis of the overall network security, the Aliant "blanket" that lies on top of the Intelivote system. With an internet election, election officials have to be prepared for both aggressive attacks by people looking to disrupt or steal the election, and for accidental or happenstance problems with the internet generally. Smith says he is confident that the Aliant network is prepared.
But Rebecca Mercuri isn't at all convinced.
Like Smith, Mercuri speaks quickly and with an obvious enthusiasm for her work, and is willing to talk at length about what she sees as the many problems facing internet voting.
Although she is unfamiliar with Intelivote, "these companies all claim that they've done this," she says dismissively of security guarantees. "But you don't know how fraudulent it is; you have no way of knowing whether it's secure. And for political office---a local municipal election, is it going to get hacked? Who knows? Depends on what city it is, really.
"The fact of the matter is that the internet is not a secure medium, so there is no way to secure an internet election to make sure you don't have some massive denial of service attack during the election, spoofing, re-routing, and it also brings up this whole possibility of election fraud, coercion, vote selling---all of that now becomes even more possible with internet elections."
Mercuri details some of her concerns, including vote selling and coercion, problems in the transmission of votes, spoofing and the recording of votes.
Vote selling and coercion
"Coercion doesn't have to be a person with a gun to your back, it can be very subtle," she says. "Think of a religious group: They're against a certain candidate because they're for abortion or what have you, and they say to all their parishioners, 'OK, we're going to set up computers here Tuesday night, you all come and vote here, and we'll have a big party afterwards.'
"It can seem very benign, but people might be fearful that other members of their church community say, 'Oh, we didn't see Jane at the party, how come she wasn't there?' That sort of thing."
Likewise, she says, a union might organize a vote in exchange for a promise of landing a road contract from a certain candidate, or a husband might cast his wife's ballot, particularly if there's an abusive or unstable family situation.
"That's done now," says Smith, referring to the broad acceptance and use of paper absentee ballots, and the problem of people "assisting" elderly voters in the voting booth. "The question is, in an organized forum, in our solution, you'd have to get to me in the two minutes it takes me to vote, and that can be anytime over the three days or week."
Mercuri agrees that vote coercion is already a potential problem. "But in the precincts you do have more protection," she says. "You can say to your union leader, 'Hey, I voted for Joe,' but when you go into the precinct they're not there, they're not hovering over your shoulder. You can vote however you want in the private booth.
"If we have more rampant internet voting, I think we're going to see more shenanigans."
Transmission of votes
There are several ways to interrupt the transmission of votes over the internet, says Mercuri.
"Denial of service attack is when the capacity of a server is overwhelmed," she explains. "Many are due to viruses. You could plant a virus with a 'time bomb' in it---it's all over the internet but doesn't become active until a certain time. If you did this a day or two before the election, no one would know because the virus companies are a week behind."
In such a scenario, the entire internet could be shut down, although Mercuri admits it's unlikely someone would go to such trouble for a small-ish municipal election. But there could be a specific denial of service attack aimed at a particular set of servers or URLs that are in use for the election.
That wouldn't stop an election that uses the Intelivote system, says Smith. For one, he's confident that the Aliant network can handle any attempted denial of service attack. But even if it can't, "the longest internet outage that ever was was short of a day," he says. "We have three days for the Halifax election, and most are held over a week. If you had an instance where people couldn't get on the network, a denial of service that was national or regional, well, wait a couple of hours, wait a day, wait five days, you can still vote."
Still, as Mercuri points out, a large portion of the electorate waits until the last day and even the last hours of the election to vote.
"They can still use the telephone or go to the polling station," says Smith. "If there's an internet virus that day, what happens? Well, in our system, you go to the phone. And that's one of the things we do that's different from anyone else---if the internet goes down, you can pick up the phone."
Spoofing
Mercuri says there are problems at both ends of the voting process, in the creation of the ballot and the reception of the ballot.
On the creation side is what is known as "spoofing," when someone creates a fake internet site that looks exactly like what the official voting site looks like. A voter might be tricked into going to the site by a fake email.
"Spam comes in your mailbox and it looks like it's from the official election people," explains Mercuri. "It says 'We've had to change the address that you got in your packet, it was wrong, here's the right address.' Some people are going to fall for that, and then they'll go to the other website."
At the fake website, the tricked voter will enter in his or her PIN and date of birth, information that will be used by the spoofer to cast an actual vote via the real website.
"If this seems preposterous," says Mercuri, "it's actually going on right now with the US Internal Revenue site. A congressman accidentally posted the link to a scam IRS site on his congressional information page recently! So these spam/scam folks are very crafty, and you can imagine they will become even more so if votes can be siphoned off."
Smith discounts the concern completely. In order to affect the outcome of an election, "you'd have to get thousands of people to agree to do something that dumb," he says.
Recording the vote
On the other end of the voting process, when the vote winds through the Intelivote servers in the Aliant building on North Street, "you'll have no way of confirming that your vote actually transmitted the way it was intended to be transmitted," says Mercuri.
"It's unverifiable, there's no paper audit trail, there's no way to know that your ballot was recorded as intended. You have all the same problems as a direct recording electronic device, and then you add on all the problems of the internet. That's why internet voting is just the worst possible thing."
In the US, many states are moving to what is known as the "Mercuri method," a vote tabulation system suggested by Rebecca Mercuri. (Mercuri does not profit from use of the system.) In the Mercuri method, a paper ballot is run through a digital scanning device, and the votes are counted by a machine. The system leaves a paper trail, and it is therefore possible to run a recount.
The problem with the Mercuri method, says Smith, is that it still relies on computers to count the votes. "If you have 12 million ballots, you're not going to count those by hand."
Moreover, the insistence on a paper trail merely moves the problem one level down: "If I'm printing something out, I'll just print up what you want approved," he says. "It may have nothing to do with how the vote is counted.
"We do have a recount capability in [the Intelivote] system," he continues. "If you run it 20 times, you'll get the same result 20 times. Say you have a thousand people who went to the polls, you look at your elector list, and see you have a thousand people who went to the polls, and then you have a thousand ballots. But there's no way in any system to match the ballot with the voter."
Smith relates horror stories that have transpired in traditional paper ballot systems, his point being that no system is foolproof. For example, election officials in one British jurisdiction told him that when they pulled out the ballot boxes for use in an election, they found three of them were stuffed with ballots from a previous election that had somehow gone uncounted. In another jurisdiction, the ballot box caught on fire and was doused with orange juice, which left the ballots unreadable.
If three ballot boxes aren't counted in an election, you've lost those three boxes full of ballots, but if an internet system fails, doesn't the entire election fail?
"You've got to have risk mitigation processes in place," Smith answers. "Part of that is proving beforehand that the thing works, and that's what we've done, prove that our system works."
A matter of trust
Which brings us back to where we started: Can we trust Dean Smith? It's a rude question, but there's good reason to ask it.
Much of the distrust of electronic voting in the US stems from the failed experience of the Diebold machines, especially in the battleground state of Ohio, which still, four years later, hasn't worked through the complications and court battles stemming from the 2004 presidential election.
In 2004, Diebold Inc. had as its CEO Walden O'Dell, a member of "Rangers and Pioneers," a Republic Party group whose members had each raised $100,000 towards the re-election of George W. Bush. In pursuit of those fundraising goals, O'Dell wrote a letter inviting 100 wealthy and influential fellow Republicans to a party event at his home. "I am committed to helping Ohio deliver its electoral votes to the president," wrote O'Dell in the letter.
Additionally, Diebold refused---and its successor company, Premier Election Services, continues to refuse---to make the code running its machines public. The machines are a "black box;" there is no way for an outside observer to know how they operate or to test them for software errors or purposeful routes to steal votes.
Smith doesn't have any identifiable political attachments and says he isn't connected with the candidates or players in municipal politics.
"It'd be very difficult for us to stay in business if it failed every time or if we had an interest in making sure Candidate One or Candidate Two wins," he says. "Is there any interest in us screwing up our business future by compromising an election like that?"
To his credit, Smith will allow examination of Intelivote's software and code. "In our world, anyone who wants to take the time, effort and money to come to look at our code is welcome," he says. They will, however, have to sign a non-disclosure agreement.
Still, the electronic voting industry reads like a series of train wrecks: The 1992 Liberal leadership fiasco, the multiple problems with the 2004 American election, the US military's aborted internet vote, Walden O'Dell's partisan activism and the just-discovered long-term error in the Diebold machines. Have we, in Halifax in 2008, suddenly moved past that? Are we now in this new world where the concerns about electronic voting don't outweigh the benefits?
"Reflecting on the Liberal vote in 1992, compared to 2008, that's like comparing the Wright Brothers to the space shuttle," answers Smith. "In technology lifespan, that is 150,000 years. We fixed it the day after. Believe it or not, I bring that up. They ask, 'How did you learn about this?' We learned about it because it failed once and you learn never to do that---you never want to appear on the front page of the paper on a failure.
"You've got to make sure you understand the technology, and you've got to understand what's involved with the processes and you have to be really good at what you do to ensure that doesn't happen. And I think our company is really good at doing that."
Coupled with the auditing and security checks, Smith's openness and confidence will likely be enough to satisfy many observers. Halifax election officials, in any event, are confident the system will work as promised; internet voting will be as safe as the space shuttle. They trust Dean Smith.
But there's no placating the most studied critics of internet voting.
Mercuri fears the industry, which started by running relatively non-controversial and low-profile elections in small towns, is becoming more broadly accepted as it matures and starts running bigger and more important elections like that in Halifax---and ultimately, the vote for president of the United States. "People should realize that by turning their elections over to this kind of process, well, maybe it isn't crooked this time, but it opens the door to it being crooked the next time," she says.
Kellner, the New York State official, agrees. "Saying Halifax is foolish for adopting internet voting would be an understatement," he says. "Unless they really don't think elections are so important to keep uncompromised."
Tim Bousquet is news editor at The Coast.
Electronic voting failures:
1992 The Nova Scotia Liberal Party is the first political party in the world to use electronic voting to select a leader. The computer servers crash, and the vote can't be completed.
2003 Walden O'Dell, CEO of Diebold, the manufacturer of electronic voting machines used in the US state of Ohio, promises fellow Republicans that he'll "deliver" Ohio's votes to President George W. Bush.
2004 The US military cancels its planned internet vote for overseas personnel after computer experts demonstrate the system is not secure.
2004 Activists claim the Ohio elections are faulty, and question whether votes cast for the presidency were accurately recorded.
2008 Premier Election Services, the successor company to Diebold, admits that its machines have long contained a software error that may have incorrectly recorded votes. The machines are in use in 34 US states.
Dean Smith's successes
1992 As an employee of MT&T, he is called in to fix the problems with the Liberal Leadership vote. He repairs the system, and the Liberal election goes off without a hitch two weeks later.
2003 Smith starts Intelivote with four partners, and the company grows to include 70 private investors.
2006 Intelivote runs elections in eight small Ontario townships. No problems are reported.
2007 In Britain, Intelivote conducts an internet election in Rushmoor and South Bucks. Rushmoor sees a five percent increase in voter turnout.
2008 Halifax Regional Municipality hires Intelivote to manage an internet voting component for the October election.
