[House Hearing, 107 Congress]
[From the U.S. Government Publishing Office]



 
                     HEARING ON TECHNOLOGY AND THE
                             VOTING PROCESS
=======================================================================

                                HEARING

                               before the

                   COMMITTEE ON HOUSE ADMINISTRATION
                        HOUSE OF REPRESENTATIVES

                      ONE HUNDRED SEVENTH CONGRESS

                             FIRST SESSION

                               __________

              HEARING HELD IN WASHINGTON, DC, MAY 24, 2001

                               __________

      Printed for the Use of the Committee on House Administration


                       BOB W. NEY, Ohio, Chairman
VERNON J. EHLERS, Michigan           STENY H. HOYER, Maryland, Ranking 
JOHN L. MICA, Florida                    Minority Member
JOHN LINDER, Georgia                 CHAKA FATTAH, Pennsylvania
JOHN T. DOOLITTLE, California        JIM DAVIS, Florida
THOMAS M. REYNOLDS, New York
                                 ------                                

                           Professional Staff

                     Paul Vinovich, Staff Director
                  Bill Cable, Minority Staff Director


                   TECHNOLOGY AND THE VOTING PROCESS

                              ----------                              


                         THURSDAY, MAY 24, 2001

                          House of Representatives,
                         Committee on House Administration,
                                                    Washington, DC.
    The committee met, pursuant to call, at 11:00 a.m., in Room 
1310, Longworth House Office Building, Hon. Robert W. Ney 
(chairman of the committee) presiding.
    Present: Representatives Ney, Ehlers, Doolittle, Hoyer, and 
Fattah.
    Staff present: Jeff Janas, Professional Staff; Reynold 
Schweickhardt, Technology Director; Roman Buhler, Counsel; Paul 
Vinovich, Counsel; Chet Kalis, Professional Staff Member; Sara 
Salupo, Staff Assistant; Robert Bean, Minority Staff Director; 
Matt Pincus, Minority Professional Staff; and Keith Abouchar, 
Minority Professional Staff.
    The Chairman. The committee will come to order. I want to 
thank the witnesses for coming to the committee. I would note 
we have several things going on in a conference on the Majority 
side, so the members will be coming in. Also the ranking member 
has a previous commitment, but he will be here; and a couple of 
the other members will also be coming in at different times. We 
do have Mr. Fattah and myself, So we appreciate you coming.
    Our witnesses are Christopher Baum, Vice President/Research 
Director of the Gartner Group, Stamford, Connecticut; Thomas 
Palfrey, Professor of Economics and Political Science, Co-
Director MIT Voting Technology Project, California Institute of 
Technology, Pasadena, California; David Woods, Professor, 
Institute for Ergonomics, Associate Director of the Midwest 
Center for Inquiry on Patient Safety of the Veterans Health 
Administration, from my alma mater, Ohio State University. I 
attended there when we used to beat Michigan regularly, years 
ago. And Ronald Rivest, Viterbi Professor of Computer Science, 
Laboratory for Computer Science, Massachusetts Institute of 
Technology, Cambridge, Massachusetts.
    I want to welcome all the witnesses. As you are probably 
aware, we have had different panels on election reform, and I 
think they have been interesting panels as this has progressed. 
This is the fourth hearing in a series of hearings. Your panel 
brings a different, I think, perspective to the hearing 
process. The first panel we had were secretaries of state, 
State legislators, county commissioners, disabled community, 
and American Legion.
    Our second hearing had the local election officials, who 
were on the front line of this, and then the third hearing 
included the vendors. And now we have the technology 
exposition. And now I think from the academic side and the 
technological side, you will bring a different perspective for 
us.
    Mr. Fattah, do you have a statement?
    Mr. Fattah. Thank you, Mr. Chairman. Let me thank you for 
your continuing role in this to tackle this issue that is 
critically important to the lifeblood of our democratic 
process. I have an opening statement that I would like to 
submit into the record on behalf of the ranking member, the 
gentleman from Maryland, and I would like to do that if there 
is no objection.
    The Chairman. Without objection.
    [The statement of Mr. Hoyer follows:]
    [GRAPHIC] [TIFF OMITTED] 87478A.001
    
    [GRAPHIC] [TIFF OMITTED] 87478A.002
    
    Mr. Fattah. And I would like to thank our witnesses today 
and I look forward to their testimony. I have a particular 
interest in the Caltech-MIT project, but I am sure that each of 
our witnesses will have testimony that will help us grapple 
with this issue. Thank you, Mr. Chairman.
    The Chairman. And thank you, Mr. Fattah.
    And we will begin with the first witness, Christopher Baum.

    STATEMENT OF CHRISTOPHER BAUM, VICE PRESIDENT/RESEARCH 
         DIRECTOR, GARTNER GROUP, STAMFORD, CONNECTICUT

    Mr. Baum. Mr. Chairman, distinguished members of the 
committee, Gartner is honored today to give testimony on the 
trends in voting technology. The events of last November point 
clearly to a crisis in confidence in the American electoral 
system. However, there is no clear consensus on how to fix the 
problem. Some believe that electronic voting is the only way to 
go. After all, it is the same technology that worked so well in 
the banking industry. However, there are other opinions. Last 
week I was present at an election site in Boiling Point, 
Pennsylvania, where voters were invited to try a new 
computerized system in a ``shadow election.'' after they had 
cast their official ballot on the regular system. I saw one 
gentleman who declined to try the new system. I asked him why. 
He said, if you aren't smart enough to vote on paper, you 
shouldn't be allowed to vote.
    However, Gartner believes that computer-based voting 
technologies, with appropriate supporting processes and 
infrastructure, can significantly reduce election problems and 
restore the public trust. The public has already demonstrated 
its faith in electronic systems using ATMs to make deposit and 
filing taxes electronically. Computerized voting appliances can 
significantly improve both the balloting and tallying 
processes, increasing accuracy both in the votes cast and the 
vote count.
    Gartner recently completed a survey on the intentions of 
the United States' largest voting districts in the aftermath of 
the 2000 Presidential elections. The findings of the survey 
have been submitted to this committee; but, in summary, we 
would like those present to consider the following:
    Forty percent of the districts surveyed have already either 
implemented new technology or have begun major new voting 
technology projects.
    Those favoring Federal guidance on purchasing and 
implementing new technologies are evenly matched with those 
opposed to such guidance, about 45 percent on each side, with 
10 percent abstaining.
    One quarter of those opposing Federal guidance specifically 
listed implementation problems with the Americans With 
Disabilities Act, ADA, and the National Voter Registration Act, 
``Motor Voter Act,'' as examples of why Federal intervention is 
not warranted.
    However, 50 percent of those in favor of Federal guidance 
cited the need for uniformity in Federal elections. The most 
cited example was guidance in establishing proper unit trails 
that can support recounts, but do not impinge on privacy.
    While desires for overall Federal involvement is mixed, 65 
percent favored a specific Federal role in the valuation of new 
voting technology.
    And, not surprisingly, 75 percent reported that their 
jurisdictions would require increased fundings to acquire new 
technology.
    As a result of this survey, Gartner believes that the local 
voting jurisdictions are willing to purchase and implement new 
voting technologies in time for the 2004 Presidential election, 
if the Federal and State funds are made available by mid-2002. 
Gartner predicts that if Federal and State funds are not 
available by mid-2002, no more than 40 percent of the voting 
precincts currently using antiquated systems will successfully 
implement new voting technologies in time for the 2004 
elections.
    By comparing the survey results with buying trends, voting 
system life cycles, voting appliance costs, and projected 
funding, Gartner has created a projection of voting technology 
for the next 3 Presidential elections. These projections have 
been submitted to the committee.
    In the short term, optical scan technology will experience 
a quick growth, as it is the easiest alternative to implement, 
and offers a single solution for both polling place and 
absentee voting. Eventually, however, direct record electronic, 
or DRE, and the closely-related i-voting technology also win 
out.
    There are a number of stumbling blocks in addition to 
funding. First and foremost, is the vast number of different 
procurement procedures used throughout the country. These 
processes are at best cumbersome and lengthy. This is not just 
another technological purchase. There are significant political 
pressures at work as well. For example, Philadelphia recently 
signed its contract for new voting technology in April, capping 
off a process that began in 1995. Also daunting, is the fact 
that no single standard exists to certify voting technologies. 
There is an opportunity for the Federal Government to provide 
guidance and promote innovation in this area.
    While this hearing focuses on voting technology, it is 
critical to realize that there is more to an election than 
casting a ballot. Without rational improvements in voter 
registration, authentication, Election Day planning and 
operations, and the ballot tallying process, we run the risk of 
fixing Election Day but not improving the voting process.
    Thank you for your attention.
    [The statement of Mr. Baum follows:]
    [GRAPHIC] [TIFF OMITTED] 87478A.003
    
    [GRAPHIC] [TIFF OMITTED] 87478A.004
    
    [GRAPHIC] [TIFF OMITTED] 87478A.005
    
    [GRAPHIC] [TIFF OMITTED] 87478A.006
    
    The Chairman. Appreciate your testimony.
    And next, Mr. Palfrey.

  STATEMENT OF THOMAS R. PALFREY, PROFESSOR OF ECONOMICS AND 
 POLITICAL SCIENCE, CO-DIRECTOR/MIT VOTING TECHNOLOGY PROJECT, 
    CALIFORNIA INSTITUTE OF TECHNOLOGY, PASADENA, CALIFORNIA

    Mr. Palfrey. Mr. Chairman, and members of the House 
Administration Committee, thank you for letting me speak to you 
today. I am Thomas Palfrey, professor of economics and 
political science at Caltech, and codirector of the Caltech/MIT 
voting technology project. My counterpart at MIT is Stephen 
Ansolobehere who is a political science professor there.
    A week after the 2000 Presidential election, David 
Baltimore, the President of Caltech, called up Charles Vest, 
the President of MIT, with an idea. The idea was that our two 
institutions should collaborate to develop improved voting 
technologies. The problems observed counting the vote in 
Florida and elsewhere originated with technology.
    Presidents Vest and Baltimore assembled a team of computer 
scientists, mechanical engineers, process engineers, systems 
specialists, and social scientists. The Carnegie Corporation 
and our two institutes have funded our endeavors.
    We are in the initial phase of our project, which is a 
study phase and will culminate in a report this summer, which 
will include a number of public policy recommendations. You 
will hear some of those recommendations today.
    First, what is voting technology? Voting technology is 
usually and incorrectly equated with voting machines. In fact, 
voting technology encompasses a wide range of issues related to 
conducting an election, and the Caltech/MIT voting project has 
been addressing all of these issues collectively. Voter 
registration systems, ballot and voter-interface design, 
security, absentee ballots, voter education, polling place 
practices, and recounting procedures are some of the important 
components of the overall technology of voting systems.
    First, what are some of the problems that we have 
identified? First of all, the high-risk rates of uncounted, 
undermarked, and spoiled ballots, what our preliminary study 
called residual votes. The average incidence of such votes is 
on the order of 2 percent and has been there for about half a 
century, as far as we can go back and measure. Counties using 
punch cards average the highest residual vote rate of about 3 
percent, but even if you exclude these, we are still over 1\1/
2\ percent in residual vote rate. That converts to 1\1/2\ 
million votes or more in the most recent Presidential election.
    Our project identifies what we think is a realistic goal of 
shooting at about a half a percent, because we must understand 
that some of these uncounted ballots are intentionally 
uncounted in the sense that the voters did not actually cast a 
vote.
    What are some of the other problems? There is a poor 
monitoring in the system. There is very little systemwide data. 
Something we noticed when we began our study is when we began 
to look for numbers, they aren't all there. So, we basically 
contacted thousands of counties directly to try to get 
information about undervotes and overvotes, absentee ballots, 
how much they spend on election polling place practices, and so 
forth, and it is not collected in the systematic way.
    This lack of monitoring makes it difficult to provide 
feedback for industry and for voting administrators to improve 
the system.
    There is flawed and haphazard recount procedures. Some 
States have nothing in place. Other States have rules that are 
so vague that it is very difficult to implement in a systematic 
and uniform way. We discovered that with Florida.
    Lack of uniform standards for usability and accessibility. 
Many of the systems that exist now do not conform to typical 
standards that we have acquired under ADA. The user interfaces 
on some of the newer machines--some of the older machines--make 
it very difficult for the voter to figure out how to correctly 
cast the vote. Examples like the butterfly ballot are the most 
obvious ones, but one can find other examples in large numbers.
    Finally, there are shortcomings in the voter registration 
system. The system of cleaning or not cleaning, and purging or 
not purging voter registration rolls, has created problems at 
the polling places.
    What sort of recommendations do we have in mind? Well, the 
first and most obvious is probably to phase out at some pace--
we are not sure what the right pace is--what we call dominated 
technologies. These are technologies that are underperforming 
and do not have significant enough cost advantages to justify 
them.
    The second complementary recommendation is to phase in 
undominated technologies. The current leading technologies 
right now appear to be precinct-counted optical scanning 
equipment and two forms of electronic voting. The first form 
being what I would call integrated touch screen machines. That 
is, a big box, so they are basically modern lever machines, 
except they are electronic and have a touch screen interface, 
and modular systems which have a touch screen, and then it is 
connected to more off-the-shelf type of equipment. So the 
architecture is actually different.
    All three of these have advantages, however some of them 
have disadvantages. The electronic technologies are really in 
their infancy, so innovation is playing a big role in the 
development of these. It is an ongoing process and it needs to 
be encouraged.
    Third, the transition from old machinery to newer machinery 
has to be done at a measured pace. It is not something that can 
be done overnight. We are talking about a relatively small 
industry, that in a good year, might have $150 million to $200 
million in revenue. We are talking about over 3,000 counties 
who have strapped budgets. We are talking about complicated 
ways of providing Federal funding through grants processes and 
things like that.
    This is not something that can be done overnight. It has to 
be done in such a way that there is a lot of thought and study 
that goes into it, and it should be done as an ongoing process.
    Finally, along with Federal funding, we think it would be 
advisable to have set up an independent Federal agency, 
independent from the FEC, that oversees election administration 
in the country, helps administer these grants, administers 
research grants to research institutions in universities, and 
organizes the data, serves as an information clearinghouse.
    Thank you for the opportunity to speak today.
    The Chairman. Thank you.
    [The statement of Mr. Palfrey follows:]
    [GRAPHIC] [TIFF OMITTED] 87478A.007
    
    [GRAPHIC] [TIFF OMITTED] 87478A.008
    
    [GRAPHIC] [TIFF OMITTED] 87478A.009
    
    [GRAPHIC] [TIFF OMITTED] 87478A.010
    
    [GRAPHIC] [TIFF OMITTED] 87478A.011
    
    [GRAPHIC] [TIFF OMITTED] 87478A.012
    
    [GRAPHIC] [TIFF OMITTED] 87478A.013
    
    [GRAPHIC] [TIFF OMITTED] 87478A.014
    
    The Chairman. Professor Woods.
    Mr. Woods. Mr. Chairman, Congressman Fattah, and 
distinguished members of the committee. November 2000 was a 
vivid time in all of our lives, and in the heartland of America 
as well as here within the Beltway. The intense debate 
following the electoral surprise and crisis paralleled debates 
I have participated in as a human factor psychologist and 
researcher in industries such as nuclear power, aviation, and, 
most recently, health care.
    The first step in that debate always seems to be assigning 
blame. Some people argued it was a voter error problem. Others 
commented on the antiquated technology such as punch cards. 
Many of the young people caught up in the debate were quite 
intrigued by these devices, thinking them only relics of their 
parents' ancient history.
    My field of human factors studies the interaction of people 
and devices, people and computers, and how these systems 
sometimes fail to have both technological and human components.
    What has our science learned from aviation and health care 
work that we can apply to election technology? First, the 
difficulties we witnessed are not simply voter error. Rather, 
they are system issues in the interaction between people and 
technology. And I want to point out that these interface issues 
apply just as much to the election official interacting with 
the equipment as well as to the voter interacting with the 
equipment.
    Second, the difficulties we witness cannot be solved simply 
by replacing apparently antiquated equipment. Replacement 
systems can exhibit poor user/device interface that results in 
predictable risks of error.
    Third, the good news. Many of these issues can be addressed 
by basic bread-and-butter usability, engineering and testing 
techniques, techniques that have been developed through our 
work with the Department of Defense and aviation and aerospace 
industries, and today have matured in the computer software 
industry, and are readily available, quick, and economical to 
apply.
    Fourth, there are unique aspects to the voting context that 
create potentially difficult design decisions and tradeoffs 
that require careful consideration and longer-term investment 
of our energy and innovation skills.
    Let's go back through these four points a little bit more. 
It is very important to recognize--and we constantly deal with 
this problem after a crisis like the November election--we very 
easily fall back into the blame game. Which is easier? A black 
eye for human intelligence or a black eye for technology? 
Instead, we have to look at the system and the interaction. The 
failures are in the failure design for effective interaction 
between people and technology.
    Second, unfortunately, buying the vendor's latest model or 
bringing in computer interfaces, in and of itself, will not 
make issues and problems revealed by the Florida ballots and 
electoral controversies go away. The kinds of problems that 
were revealed can apply to the interaction of people and any 
kind of technology.
    I also commented that we have a mature research base that 
is available, and a mature engineering base that is available 
to apply. Techniques for usability-testing the prototype 
designs have matured in the software industry and these can be 
brought to bear very economically.
    Examples of the kinds of principles and techniques we bring 
to bear is the principle of good feedback. If you have to have 
effective device design for interaction, for usability, give 
people feedback so they can see the results of their actions, 
recognize problems, and correct them. The same principle 
applies to the interfaces with the election officials 
tabulating the vote; provide a visible audit trail.
    With computer technology you can design electronic voting 
systems in many ways. You can even try to copy old paper or 
lever technology over inside the computer system. The change to 
computer technology brings potential benefits, but also new 
pitfalls. And this imposes a responsibility on the designers to 
think through how the functions you want to accomplish can 
break down, and how trouble can arise. This requires usability 
testing.
    There is also the need in the long run for careful 
consideration of the new issues that arise. Balancing security 
and visibility feedback, providing wide access across a diverse 
and aging population, handling large numbers of issues and 
ballot choices in a timely fashion, supporting recovery for 
mistakes, and doing it all in a low cost, are formidable design 
challenges.
    I want to point out that adopting new technology may reduce 
our overall average in accuracy or imprecision rate, but create 
the possibility of new forms of failure.
    From past research we also find if vendors' claim for 
failure-proof designs merit skepticism, as the humorist Douglas 
Adam quipped, ``The major difference between a thing that might 
go wrong and a thing that cannot possibly go wrong is when a 
thing that cannot possibly go wrong in fact goes wrong'' it 
usually turns out to be impossible to get at or repair.
    So part of usability design is to take into account the 
possibility for error and unanticipated situations. 
Computerized voting and tabulation systems must support our 
human ability to check and detect if new inaccuracies are 
creeping in. It is easy to rationalize away the need for 
action. Hyper-close elections are rare. My precinct didn't 
really have a highly publicized problem. It was only the usual 
error rate.
    The Chicago Tribune, in a study, concluded that the error 
rate in Cook County in the last Presidential election had 
doubled to 6 percent. I and my colleagues in the human factors 
profession are shocked that we seem so willing to tolerate even 
that traditional 3 percent failure rate as a norm. And we ask, 
where in business or transportation or medicine would we 
tolerate such failure rates?
    Voting is the centerpiece of democracy, and we need to 
establish systems to monitor for the early warning signs that 
inaccuracies or systematic errors are creeping into our voting 
system.
    In closing, I would like to remind you that technology 
alone is not sufficient. Harnessing the system of people and 
technology to fulfill the ideals of the democratic process 
calls us all to make a commitment to excellence. Thank you.
    The Chairman. Thank you.
    [The statement of Mr. Woods follows:]
    [GRAPHIC] [TIFF OMITTED] 87478A.015
    
    [GRAPHIC] [TIFF OMITTED] 87478A.016
    
    [GRAPHIC] [TIFF OMITTED] 87478A.017
    
    [GRAPHIC] [TIFF OMITTED] 87478A.018
    
    [GRAPHIC] [TIFF OMITTED] 87478A.019
    
    [GRAPHIC] [TIFF OMITTED] 87478A.020
    
    [GRAPHIC] [TIFF OMITTED] 87478A.021
    
    [GRAPHIC] [TIFF OMITTED] 87478A.022
    
    [GRAPHIC] [TIFF OMITTED] 87478A.023
    
    The Chairman. Mr. Rivest.

 STATEMENT OF RONALD L. RIVEST, VITERBI PROFESSOR OF COMPUTER 
    SCIENCE, LABORATORY FOR COMPUTER SCIENCE, MASSACHUSETTS 
       INSTITUTE OF TECHNOLOGY, CAMBRIDGE, MASSACHUSETTS

    Mr. Rivest. Chairman Ney, Mr. Hoyer, and distinguished 
members of the Committee on House Administration, I thank you 
for the opportunity to testify to your committee on the issue 
of security in voting technology. I have been involved in the 
mathematical aspects of security for the last 25 years. I lead 
the cryptography and information security within MIT's 
laboratory for computer science. I am a founder of RSA Data 
Security, a leading provider of security technology. Codes I 
have developed are used daily to secure millions of on-line 
Internet transactions.
    For the past 5 years, I have investigated the security of 
electronic voting. My students have implemented an electronic 
voting system used for student elections at MIT. I am currently 
participating in the Caltech MIT voting project just described 
to you by Professor Palfrey. Our initial report will be out 
this summer. The opinions expressed here are my own.
    I find voting intriguing. It is not only important for 
democratic society, but it is also technically challenging.
    The challenge arises primarily from the need to remove 
voters' identities from their cast ballots, in order to prevent 
vote buying and the coercion of voters. This requirement for 
anonymity makes electronic voting different than electronic 
commerce or electronic banking, where well-labeled receipts and 
well-labeled audit trails are standard. This requirement for 
anonymity can also make fraud easier as the addition, deletion, 
or modification of an anonymous ballot is harder to detect.
    In 1869, inspired by the potential benefits of electricity, 
Thomas Alva Edison was granted U.S. Patent 90646 for an 
electric vote recorder. Congress declined to use it because it 
reported votes too quickly. Today, inspired by the potential 
benefits of computing and Internet technology, inventors and 
election systems vendors are offering new technologies. We need 
to carefully assess what these new technologies can offer, to 
see if they really meet our needs and do so securely.
    Given the short time available, I would like to offer some 
personal opinions on the security of existing prospective 
voting systems. I would be happy to expand further on any of 
these points in response to your questions.
    Number one, we are not ready for Internet voting from home. 
I believe that voting equipment should be under the control of 
election officials. At least a decade of further research and 
development on the security of home computers is required 
before Internet voting from home should be contemplated.
    Number two, however, I believe that we should use the 
Internet to post A lists of registered voters, B lists of 
actual voters, and C lists of actual ballots cast. Not being 
matched with the voters names, of course.
    Number three, as far as getting the biggest bang for the 
buck as far as security goes, I believe we should (A) improve 
voter registration procedures and the computerization of voter 
list registration lists; and (B) eliminate absentee balloting 
except for cases of need. I am against voting by mail for 
convenience. I prefer having a national voting holiday or 
allowing voters to vote several weeks early at the town hall if 
need be. Voters who vote absentee are simply not guaranteed the 
same freedom from coercion and bribery that ordinary voters 
have.
    Number four, I believe voting systems should have a 
physical audit trail. That audit trail should be directly 
created by the voter, or at least directly verifiable by the 
voter when he casts his vote. It need not be paper, but it 
should be immutable and archival. Many have proposed electronic 
systems fail this requirement. Electronic voting systems offer 
improved ease of use and lots of flexibility, but they do not 
intrinsically offer improved security. On the other hand, a 
physical audit trail is not a security panacea, although it is 
a big help.
    Number five, we must ensure the highest degree of 
confidence that our elections are free of manipulation and 
fraud. The certification of voting systems should be an 
important part of this process.
    However, it is difficult to certify complex software-based 
systems involving elaborate user interface and cryptographic 
functionality. Experts in computer security and cryptography 
need to be involved in the certification process. Requiring 
that all security-critical portions of the source code be 
``open source'' can greatly help to establish confidence in 
such complex systems.
    We are no more guaranteed protection against election fraud 
by buying flashy electronic equipment, than we are guaranteed 
protection against fire by buying a shiny new fire engine. 
Security demands depends on the entire system, not just the 
components, which need sound operational procedures managed by 
training personnel. These operational procedures, which 
themselves should be documented and certified, should primarily 
ensure that no single person or vendor is ever in a position to 
compromise the integrity of our democratic process.
    Finally, I know that we are in the midst of a technological 
revolution that provides both an enduring and improving set of 
opportunities, and an increasing set of vulnerabilities. If 
there is a chance to improve things now, then our focus should 
not be on immediately spending money for new equipment but, 
rather, on improving the higher-order processes of voting 
system research, evolution certification, selection, financing, 
staffing, and oversight as well as on improving voter 
education.
    I thank you for your attention.
    The Chairman. Thank you very much.
    [The statement of Mr. Rivest follows:]
    [GRAPHIC] [TIFF OMITTED] 87478A.024
    
    [GRAPHIC] [TIFF OMITTED] 87478A.025
    
    [GRAPHIC] [TIFF OMITTED] 87478A.026
    
    [GRAPHIC] [TIFF OMITTED] 87478A.027
    
    The Chairman. I appreciate the panel's input. I am going to 
go ahead and yield to Mr. Ehlers first.
    Mr. Ehlers. Thank you, Mr. Chairman. I appreciate that, 
since I have to leave shortly.
    I really appreciate the testimony we have heard, and it 
brings out a number of factors that have always struck me as 
very important. My background is both having served in local 
government where we deal directly with the election process, 
and also with being a scientist by training and being appalled 
at some of the things that I saw.
    I think the very first step, of course, is good law. That 
was a very major problem in Florida. The law was not well 
written, well structured, it was not clear, and could not be 
clearly interpreted. I think that problem is being dealt with 
rather quickly by most legislatures throughout this land.
    Secondly, we need good technology. I think we have done 
reasonably well in that in terms of the technology itself, 
ranging from the paper ballot up to the computers. What I find 
missing in that, however, is the next factor we need, and that 
is good human factors engineering. I think that has been a 
major problem with the newer election devices that have been 
developed and are on the market.
    I also think something we don't pay enough attention to is 
good security, good privacy, and good integrity. We pay a huge 
amount of attention to that in our computer systems in 
commerce. Even in the House, when we put that system in, that 
is one thing that I insisted on very strongly. And I am very 
proud, as is Ronald Schweickhardt who sits behind me, a staff 
member involved in this, and a number of other members.
    It is interesting to read in the paper about all the 
hackers breaking into the Pentagon, the Senate, the White 
House, but you have never read about them hacking into the 
House. I don't want to say that too loudly because then we will 
become the prime target.
    I am very pleased. We put a lot of effort on security, and 
I believe we have succeeded, but you have to have precisely the 
same security in the voting booth that we installed here. And I 
don't see that at all in the electronic systems, and even many 
of the other systems are not as secure.
    Just a quick comment on what was said earlier, I think it 
is important for everyone to vote at once, to the greatest 
extent possible. I am prejudiced on that because I run for 
office and my campaign is planned so that all the information 
is out there by Election Day. People vote 3 weeks ahead of 
time, they miss most of the information that I am providing. 
But also, absentee ballots lend themselves tremendously to 
abuse and fraud. The one thing we haven't mentioned here, I 
think the greatest opportunity for fraud, is in voter 
registration; and we need to pay much more attention to voter 
fraud there and ensuring that voting lists are good, that we 
purge them regularly; that when someone moves, they can't keep 
registration at their former address and so forth.
    Now, given these facts and some suggestion of research 
grants, what would you recommend the Federal Government spend 
its money on for research grants if we should decide to go in 
that direction? Where would you concentrate the efforts in 
trying to get at these various problems I mentioned?
    Mr. Woods. One of the resources that is available we have 
already, through work with aerospace, the Department of 
Defense, the government has already built up expertise on these 
human factor engineering issues. For example, in the national 
laboratories, they have expert groups who provide advice on 
these interface design issues to many government agencies. We 
could bring those in to, in the short run, provide a great deal 
of guidance about how to evaluate potential new systems and how 
to implement them and train the kinds of election officials in 
operating these to achieve greater levels of success and avoid 
some of these difficulties that could be done very quickly. 
Some of these organizations could provide input to election 
officials in the form of a guidance document, probably on the 
order of months, and on the order of tens of thousands of 
dollars in investment for a short-run benefit.
    Mr. Ehlers. But we have talked in here about educating the 
voters, training the poll workers and so forth. I really would 
like to see a system where that is not a factor. In other 
words, the human factors are so good that you don't need to 
educate voters.
    For example, in voting I think you should show the final 
slate and have a Regis Philbin question at the end: Is this 
your final vote? And, if not, you can go back and change it. 
Poll workers, too, they are wonderful people, just the salt of 
the Earth, really trying to serve their country in a very 
difficult job, which they only do a couple of times a year for 
long hours and hardly any pay, but they only do it a couple of 
times a year. You can't train them every time. And again, I 
think we need a system that doesn't require much training for 
poll workers.
    Let me ask a follow up question to that, and the others can 
comment on any of these issues. What is the Federal 
Government's appropriate role in this? We don't run the 
elections. We have always trusted local governments and States 
to handle that. How would we deal with the human factors issue? 
Are we going to recommend certain systems? Are we going to set 
Federal standards that systems have to meet in order to be used 
to elect Federal candidates? How do you see us playing a role 
in that?
    Mr. Palfrey. I think the Federal Government could certainly 
play a role in setting standards for certification of 
processes. I don't think the Federal Government wants to insist 
on everything being exactly one way. I think, for example, the 
current testing procedures that are done to certify equipment 
is machine testing. It is basically machines testing machines. 
I think human testing is needed for the ballot interfaces and 
for the various designs that are proposed. Currently there is 
no human testing. I think that is one thing that a Federal 
agency could do is to oversee the testing of these machines and 
the development of appropriate standards.
    Mr. Woods. There are many kinds of guidance documents 
available to organizations that design computer devices for 
human use. For example, several organizations have just put out 
new guidance documents on access to computer and electronic 
systems for the disabled and the visually handicapped. These 
kinds of documents do not tie the hands of designers but, 
rather, try to be a positive resource, to say there are some of 
the effective techniques and ways that you can design your 
electronic interfaces, as in this case, to make access for the 
disabled more successful.
    Mr. Ehlers. How do we deal with the security issue? You 
know, if we have the modern equipment of Tamany Hall, any 
college freshman can make some changes to the software on the 
computers. How do we really ensure the security of the hardware 
or the software?
    Mr. Rivest. That is a very complex question. I think 
continued monitoring of what is going on, making sure there is 
separation of function, taking apart voting equipment after it 
has been used to see if it has been tampered with, making sure 
the code is ``open source,'' and looked at by lots of people. 
It is a multifaceted problem. Making sure the poll workers know 
what is appropriate to do and what is not, making sure the 
equipment doesn't support modes of operation that would allow a 
poll worker to reset the clock or whatever you can do through 
various kinds of tampering. We are dealing with computer 
systems now that are very much--voting systems that are 
computer systems and have all the complexity and security 
problems of computer systems. We need to keep the system simple 
as possible to minimize the complexity. And security often 
arises from simplicity. So, looking for simplicity in design is 
an important criterion here, too.
    Mr. Ehlers. Do you think it would be reasonable after each 
election that all the systems are tested, that you run a quick 
program through them to make sure there----
    Mr. Rivest. It is reasonable to do some sampling, random 
sampling, look at some of them to see if there has been any 
tampering.
    Mr. Baum. Also, sir, you could apply statistics to the 
districts and find out where there are anomalies and test that 
equipment stronger, and you can harden the equipment that is 
being used. You can also move to internal memories on the 
computer systems that are unalterable so they can't be changed 
on Election Day. There are a number of technologies that you 
can apply here to this equipment to make them almost military 
grade in terms of hardness.
    Mr. Ehlers. What I hear coming through, though, is that you 
see the Federal role as one of doing the research, setting the 
standards, and helping the States and localities to meet the 
standards.
    Mr. Baum. That is certainly what our survey shows would be 
acceptable by State and local governments.
    Mr. Ehlers. Thank you very much. Thank you, Mr. Chairman.
    The Chairman. Thank you, Mr. Ehlers. Mr. Hoyer.
    Mr. Hoyer. Thank you, Mr. Chairman. Gentlemen, I apologize 
for my lateness. I had another meeting at 11 o'clock, and took 
that as quickly as I could and got here.
    Thank you, Mr. Chairman, for including my statement in the 
record. I won't repeat it.
    Mr. Baum in the end of your prepared statement, you 
mention, and I quote, ``the daunting fact that no single 
standard exists to certify voting technology.'' This is an 
opportunity for the Federal Government to provide guidance and 
promote innovation.
    You have just been discussing that, obviously, in response 
to Mr. Ehlers' question. Can you describe specifically how the 
Gartner Group found--what it found when it looked at the voting 
machine certification process.
    Mr. Baum. Yes, sir. What we found was disarray. There is, 
of course, the NASED who will approve voting machines, and 
anyone can adopt NASED-approved machines. But that process, 
while well documented, is still open to a certain amount of 
interpretation.
    For the States and local governments that do not accept 
NASED-approved machines, there quite often is no set standard. 
It is conceivable and I have seen instances where new 
technologies are being introduced, for the companies to call on 
local sales or local election officials. The response is, come 
back when you have been certified by someone, not necessarily 
who, but just someone.
    That is where the difficulty comes in. There are over 3,000 
touch points for election systems. One of the things that is 
very interesting, is we don't even have consensus on the number 
of counties there are in the United States currently. We went 
out and called the secretaries of state of each State and got 
the number of counties that they thought they had, and added 
them up and got 3,066. According to the Federal U.S. Census, 
there were 3,042. So there are some fundamental issues here 
that we really need to address. And the lack of standards, you 
simply cannot survive in a market where you have got a $20 
million opportunity or $200 million opportunity, and you have 
to deal with 3,000 separate standards for equipment.
    Mr. Hoyer. Could I say this as an aside, not necessarily as 
a question? In the State of Maryland, which is a relatively 
simply organized State in that we have 23 counties and 
Baltimore City, could the discrepancy be that for many purposes 
Baltimore City is considered to be a county, NACo however would 
presume it to be a city?
    Mr. Baum. Right.
    Mr. Hoyer. So that might--I don't know how many other 
States have that same phenomenon--but that might count for that 
20-plus discrepancy between the two.
    Clearly, it would be useful from your standpoint, to have 
an agency at some level that looked to assist not in a 
mandatory way, but in an advisory way, to solve this chaos or 
disarray--I think you used the world ``disarray,'' chaos may be 
a harsher word--but disarray that you confronted?
    Mr. Baum. Yes, sir. We do not necessarily believe it needs 
to be a separate organization than the FEC, but we do think 
that there needs to be a place where officials can go and where 
vendors can do to say these are the requirements that we 
recommend, these are the procedures that can bring you to those 
requirements, and these are the sources of information.
    Mr. Hoyer. I would say, as an aside, to all of you as you 
do your work, it is my view that the time has come when the 
election administration responsibilities at the Federal level 
and the monitoring responsibilities of finances in elections 
need to be separate, not because they are inherently 
contradictory to one another as the OEA currently exists in the 
FEC, but because there is so much immediate demand on the 
financial oversight, that electoral reform at the Federal 
level, as it has at the State and local levels, has taken a 
second or third share.
    Professor Rivest--how do you pronounce that?
    Mr. Rivest. It is pronounced different ways within my own 
family.
    Mr. Hoyer. Well, I would like to pronounce it the way you 
pronounce it.
    Mr. Rivest. Rivest.
    Mr. Hoyer. You offer some very sobering insights regarding 
the fraud security of new voting technologies, specifically 
Internet voting. Let me say I also agree with the chairman and 
with yourself very strongly that voting is a communitarian 
process--George Will wrote a column on this some months ago--
and that coming together in and of itself has a value, I think, 
above and beyond the process value.
    You express confidence in using the Internet for improving 
voter registration, but please elaborate on how the Internet 
can improve registration. Obviously, as a number of you have 
referenced in your comments, that is a very key issue with 
which we need to deal if we are going to have voter confidence; 
that they come to the polls and they will be allowed to vote. 
That, coupled with a very good provisional voting process. But 
would you comment on that?
    Mr. Rivest. I would be very happy to comment on that, Mr. 
Hoyer. I think at the highest level, the voting system will be 
improved by a greater degree of transparency, having more 
information available to more people, more eyes looking at the 
process. Applying that to the voting registration process, if 
the voting registration lists are posted on the Internet in a 
way that anybody can look at, you will see fewer dead people on 
the rolls, you will see fewer people that are still on the 
rolls that have moved. You know, somebody will call up their 
official and say, did you know that so and so has left town? 
Things like this can happen.
    So just the process of keeping the accuracy of the voter 
registration lists will be improved by having it open and 
public, as I believe it should be.
    I think the process of registering to vote per se, is not 
something we should be attempting to do over the Internet. I 
think it should require an in-person visit. But once you are on 
the registration rolls, having your name listed as you are 
registered to vote in this county, I think that would be a 
help.
    Mr. Hoyer. Do you have any thought as to how long it would 
take to construct a statewide system in a State like 
California, which is--well, there are no States like 
California. That was a stupid thing to say. There are only a 
few Nations like California. But a State--let's say a smaller 
State, Florida, has just gone to mandating a system of central 
registration. I don't know what cost that they attributed to 
that. Maryland is going to a central registration system. I 
think that is going to be critical, because in an era of very 
mobile individuals and families, when you move from precinct to 
precinct, house to house, and you really don't--there is 
nothing that tells you this is a precinct line--that we need to 
have that kind of system.
    What is technically--how long would it take to create such 
a system in a State like Maryland or Florida or Pennsylvania, 
and what would its cost presumably be? Anybody have a guess on 
that? Have you looked at it?
    Mr. Rivest. Let me just respond. Part of it is different 
States do it in different ways. I think it is Michigan that is 
combining it with the DMV database. If you have a single voter 
registration database and that is its only function, you might 
be able to do it in 2 or 3 years. And I don't know what the 
cost would be per voter. But if you are trying to organize your 
State's citizen records along more lines than one, so you are 
doing the DMV and the Social Security or whatever, everything 
else altogether with within the State, I think that could be 6 
or 7 years and lots more money.
    Mr. Hoyer. Professor Rivest, one of the things, though, if 
you try to combine it, your transparency issue becomes more 
complicated, it seems to me, because there is information that 
voters clearly do not want and should not want transparent to 
the rest of us.
    Mr. Rivest. Yes.
    Mr. Hoyer. So that from my perspective, you are really 
going to have very limited use of a document that is totally 
transparent, and I agree with you it ought to be totally 
transparent, because I think that will protect against fraud 
and mistakes. I think my own view is that there are far more 
mistakes than there are actual intentional fraudulent acts.
    Mr. Baum. Sir, the National Voter Registration Act of 1993 
pretty much requires a strong link with the Department of Motor 
Vehicles in each of the States, so that has to be investigated. 
Even so, there are commercial products available already. At 
its most simple level, a statewide voter registration system is 
simply a database.
    Now, there are security issues that surround it, but they 
are all known and solvable. And when you are taking a look at a 
State with the population of New Mexico, or something like 
that, it is not even a large database, so these are--again, it 
is more of a political consideration than a technical 
consideration.
    Mr. Hoyer. Well, I am hoping that one of the things we do 
in legislation, that we are considering, is to have dollars 
available to assist States in the creation of a central 
database. In my view, in large part, the States will have to 
decide the individual problems and how they create that; that 
we can assist them in doing that to provide greater voter 
confidence when they go to the precinct, somebody will know in 
this computer age, when everybody gets on the Internet, can get 
access to gargantuan amounts of information, that they can get 
information that Joe Dokes has in fact registered to vote in 
this State.
    So, Mr. Chairman, I have got other questions but I know 
that time keeps running. Do you have questions?
    The Chairman. I have got questions.
    Mr. Hoyer. Why don't I yield to you?
    The Chairman. And if you want more time. I want to ask a 
specific question, Mr. Palfrey. Are you aware of any research 
that has studied the voting patterns of persons who are 
dyslexic or, let's say, illiterate?
    Mr. Palfrey. With respect to the voting technology?
    The Chairman. And how to facilitate and help those 
individuals. Or is there technology that--for example, 
technology comes forth--is it helpful, not helpful?
    Mr. Palfrey. There is some informal research. I don't think 
there has been very much that has systematically been done to 
identify specific problems with technologies. Certainly, with 
respect to user interfaces, maybe Professor Woods can say more 
about this as far as dyslexic interfaces, but I think as far as 
handicapped considerations, use of audio, use of Braille and 
also overlays for the optical scanning equipment.
    The Chairman. We know, if it is an issue of sight, I saw 
the equipment here. So we know you have the earpiece. If it is 
an issue of height, you can accommodate downwards. But if it is 
an issue of dyslexia or an issue of illiteracy--
    Now, an easy answer is, we take somebody in the voting 
booth, a poll worker. For a lot of people, though, it is such a 
private item about voting. So I just wondered--again, for 
sight, there are certain devices, but what about dyslexia?
    Mr. Palfrey. Well, there are examples----
    Mr. Hoyer. Can I make a comment, because I would like to 
hear--everything you mentioned, the hearing--that the audio 
transmission may not only solve the sight problem but may solve 
the inability--the dyslexic problem or another reading problem 
that might occur. That might solve, most of us wouldn't think 
of it in those terms, but it may do that as well. You might 
want to comment on it.
    The Chairman. And touchtone screen. It was an interesting 
issue that we were discussing today.
    Mr. Palfrey. Right. And that is a possibility in some 
foreign countries, where illiteracy is a more serious problem 
than it is here. In South America, for example, they actually 
have pictures of the candidates, or icons to represent 
different parties, for example, to assist voters who can't 
read.
    The Chairman. Also, Professor Palfrey, in your study over a 
20-year period, 60 percent of the counties have adopted new 
technologies of one sort or the other. Forty percent of the 
counties have been using the same technology basically, I would 
assume, for 20 years. Are there any similarities or common 
characteristics about counties that have been using the same 
technologies for a long period of time versus the ones that 
have switched to some new technology? Are there any 
outstanding----
    Mr. Palfrey. Yes, there are two factors that seem to be 
important with that. The larger counties, populationwise, we 
have tended to switch to new technologies, largely to handle 
problems of bandwidth and just dealing with large numbers of 
voters. So, they are concerned about speed and cost. That 
actually was one of the reasons for the transition even earlier 
to punch card systems, but certainly transitions from paper 
ballots to optical scanning equipment was done for cost and 
speed considerations in larger counties. There is also a 
correlation, with sort of average income levels or the sort of 
county revenues controlling for size, that counties that don't 
have as much to spend, available to spend, have not been 
changing as fast.
    The Chairman. Mr. Baum, I wanted to ask you a question. You 
had stressed, and I think made a couple of good points about, 
the fact of the different standard where somebody turns to an 
election official and they say, ``as long as you are 
certified.''
    Mr. Baum. Right.
    The Chairman. Let me just throw something out here, because 
you mentioned the word ``agency'' a couple of times, as other 
people indicated. Let's assume you are not going to create an 
agency per se, as we would think an agency to be, because the 
downside of that, frankly, in the election process, is that it 
is not an environmental issue or a highway where you have a 
daily ongoing situation. So therefore, the thought of agency 
would tend to scare people across the board here, I think on 
both sides of the aisle, and a majority of both, only because a 
downside could be that there would be constant rules made by a 
rulemaking body that would make people eventually shiver about 
the agency saying whether you have an ID at the poll or not, 
versus, you know, the local governments and the Congress.
    So let's assume we don't have a full-blown agency. But what 
would you--or could you speculate, on what you would want to 
see if we created some type of body that was an advisory type 
of body; who would be on that body, in your opinion?
    Mr. Baum. Well, first I would like to respectfully suggest 
that it is certainly more than a one-day project or a single-
day project. The example I like to give most is that of a 
wedding. When you start planning a wedding, the events of the 
day actually become very much smaller in proportion to what it 
took you to get there. And running an election from an election 
board's point of view is very much like planning a wedding year 
after year after year.
    The Chairman. I should clarify. I know it is year-round. I 
am just saying, if you had an agency, though, and you set up a 
full-blown agency, if it does have a daily function, I think we 
would be scared of the product after about a year. If you have 
an agency that creates a new staff daily, thinks of new rules 
to create on local people, I should tell you where I am coming 
from on that.
    Mr. Baum. So in that setting, then, I think that what you 
need is representative--I think what we are talking about here 
is really a governance board, not a new kind of committee, but 
people that are involved with the process. And that means that 
you have people from State and local and Federal elections; you 
have people that have other concerns, interest groups, people 
who come in that are proponents for those who have 
disabilities; making sure that people that come in, from the 
Majority and Minority parties, to ensure that ballots are fair 
in the way that they are set up, and people with other 
interests coming in--I was going to use the term 
``disinterested,'' but we are all voters, we should all be 
interested. Like my fellow panel members here; people that can 
come in and come together and build a consensus on these, 
including the vendors themselves.
    The Chairman. Thank you.
    I had a question of Professor Rivest. For the machines you 
are familiar with--because Mr. Swigert tells me he wouldn't let 
you bring a laptop in here. That is how good you are. So those 
voting systems which you are familiar with, how long would it 
take to break into them while in a polling place? That could 
change the results of an election, if that could be done? Is it 
a long time process?
    Mr. Rivest. I think it depends on who is doing it. I think 
if you have a voter who is just walking in to try to, you know, 
monkey with the equipment he is probably unlikely to have much 
effect. A poll worker, similarly, has little background with 
the equipment and wouldn't know quite what to do except to 
operate it. A vendor's technician on-site might have intimate 
knowledge of how the machine works and might have a 
preprogrammed smart card to change a tally or something like 
that.
    So I think it depends on knowledge of the equipment. It 
could be very quick if someone knowledgeable--changing 
electronic systems, you know, can be done quickly. If there is 
a card that is plugged in, as many machines have, that controls 
the operation of the machine. If the card can be changed you 
are changing the programming of the machine. If there is no 
audit trail, if that card was removed and replaced, you may 
have a successful hack.
    The Chairman. Some observers have recommended an open 
source process, so software can be used to control voting 
systems that would be subject to impartial inspection that 
could lead to increased quality. What do you think about that 
idea?
    Mr. Rivest. I am in favor of it, basically. I think that 
this poll process is too important to be left wrapped in the 
cloaks of the vendors' claims of proprietary need. I think that 
having the software available for inspection by whomever will 
increase our confidence that the voting is being tabulated 
correctly.
    It is not sufficient by itself, of course. You need to 
assure that the software that you have looked at is actually 
the software that is running in the machine and have procedures 
installed to ensure things like that. But having the software 
out for inspection I think will be to everyone's benefit.
    Mr. Chairman. The last question I have is for Professor 
Woods.
    We had the voting machines in here, and I found them of 
interest because that is the first time in my life I have not 
used a punch card. I went originally to the X's we used to do 
when I first voted down in Ohio in Belmont County. Then we went 
to the punch cards, because that is what we used. So this is 
the first time I ever actually touched some other type of 
device.
    The one thing I would ask of the vendors is, don't help me, 
let me see if I can do that. I don't claim to have the ability 
of Mr. Ehlers on scientific knowledge at all our computers, but 
it was interesting just using the machines.
    Now, I noticed an exhibit was there when, once you wanted 
to make your choice, you had to retouch to cancel out and then 
you touch back. But then there was another machine that you 
pushed the next name, it automatically canceled back. Because 
of what you do, dealing with human interface and ergonomics, is 
there any machine, when you talk about the touch screens or 
maybe a non-touch screen, that is a better type of machine or 
the machine of the day?
    Mr. Woods. It is difficult for us to recommend a particular 
technology or system. But the example you use is I think a very 
illustrative example where some of the principles we found 
apply. One is feedback. So either of those systems can confuse 
people depending on the degree to which they get clear feedback 
with respect to their actions.
    So, for example, take the second case you have mentioned 
before, where you simply push the second candidate. Someone 
could get confused about what the impact of that is. Are they 
going to end up the equivalent on the punch card of having two 
holes punched? If you have clear feedback--for example, when 
you press the second one, the first one starts to blink in a 
salient way and then goes dark--those kinds of systems are 
likely to work better.
    The second aspect of my response, this is the sign of 
usability testing, is about that we have procedures for doing 
tests so we don't rely just on opinion or quick walk-up, a 
couple users trying it out. We have processes to do that that 
are very economical to generate the best kind of information to 
act on and get the best leverage when you have to make design 
decisions or purchasing choices. So by using that technology of 
user testing, technology that is used every day in the software 
industry for the products you and your family buy on the local 
scene, those kinds of tests can result in many of these kinds 
of questions and result in more easy to understand and use, 
especially for the diverse population that you pointed out is 
so critical to the voting application.
    The Chairman. One final thought--I will see if Mr. Hoyer 
has some questions--basically indicated here and at least one 
of the testimonies that, you know, it is the human error. You 
know, we know that is part of it. But if it is just a human 
error factor, should we just keep punch cards and spend a lot 
of money? Well, if it is only human error, could we keep those 
punch cards and spend a lot of money to educate people, or 
should we go on to something else?
    Mr. Palfrey. With respect to punch cards, I think we should 
go on to something else.
    The Chairman. Your testimony did indicate, though, that it 
is human error. Well, if it is, do you just work with what you 
have?
    Mr. Palfrey. One way I like to think about it is in terms 
of a technology being dominated. In other words, if you think 
about spending the effort to educate the voters, if you want to 
spend the same amount of effort educating voters using punch 
card systems or you are educating voters using an optical 
scanning system, what would the results be? And I think the 
results of one would be better than the other.
    The Chairman. Is there anyone that would like to keep punch 
cards?
    Mr. Baum. I think punch card manufacturers would like to 
keep punch cards.
    The Chairman. We know that.
    Mr. Woods. The success we have achieved in cockpits and 
other high criticality domains has come from dropping this red 
herring of human error. When we want to label a problem as 
human error, the scientific approach says you take that as a 
symptom of an underlying problem in the system and the 
interaction between people and technology. And there lies the 
grounds for improvement so that we can achieve what we all 
desire, in this case in the democratic process.
    So, now, with respect to punch cards in particular, it 
violates a very old rule for designing interfaces between 
devices and people, all right? The punch card, you actually 
make a hole, all right? The absence of something, the hole is 
supposed to indicate the presence, the state that we are 
interested in, the vote.
    If I had designed--when I started our designing nuclear 
power plant control rooms 20 years ago, if I had tried to code 
the critical state stage of the nuclear reactor using that 
principle that is done in punch cards, I would not be here 
today. We have learned through bitter experience in aviation 
interfaces and energy systems that is not a good way to set up 
the interface.
    The Chairman. You are making a good point. So I totally 
grasp it, it is not a good way to set it up to read that card, 
or it is not a good way to set up to have the human being, the 
voter, reacting that way of the punch?
    Mr. Woods. Both.
    The Chairman. I understand, on the reading side of it, I 
believe, of the machine reading it--it is probably not the 
word--but why the voter?
    Mr. Woods. We say that in all these issues of did they 
punch through, was the card aligned, the basic rule of thumb is 
you want people to make a positive indication so that you have 
transparency and traceability, as my colleague to my right 
indicated earlier.
    The Chairman. Do you have any questions? That is 
interesting.
    Mr. Hoyer.  Well I think that--we pretty much have a 
consensus I think in the country at State, local and Federal 
levels that we want to get--rid ourselves of the punch card, 
save perhaps the manufacturers, as Mr. Baum put it. But it is 
interesting that systemically there is a reason for that as 
well. I was glad to hear that.
    Let me ask Dr. Rivest, then I am going to go to some other 
quick questions. You have reservations about the Internet 
voting, and that is shared I think by a vast number of people, 
including myself. However, I would like your comments on 
whether it is worth testing in an area that we think does not 
work as well, and we need to make it work well and may be an 
area where we want to at least test this, and that is overseas 
voting and military voting. Could you comment on applications 
that may be perhaps more appropriate in that limited setting?
    Mr. Rivest. I would be happy to.
    I think that the military application is a good one to look 
at. I think that you have the kinds of controls both over the 
environment and the networks that you may not have in other 
kinds of remote Internet voting, and you also have a very clear 
and important need for our soldiers to be able to vote, and 
also I am in favor of experimentation.
    I think we need to plan to evolve our voting systems over 
the next 20, 30--you know, as technology improves, we are going 
to keep changing our minds as to what, as Professor Palfrey 
said, what the dominating technology is. But in order to learn 
what the dominating technology is, what the best voting systems 
are, we need to have experience with them.
    So, for all of those reasons, I think that experimenting on 
a small basis at first, maybe expanding if the system seems to 
work well, with remote Internet voting for military purposes, I 
would be in favor of that. But it needs to be carefully 
controlled and looked at. The Internet is a very fragile and 
vulnerable entity, and it is vulnerable to attack by malicious 
organizations from outside our country. So we need to make sure 
that there is back-up systems in place should our soldiers not 
be able to use the Internet.
    Mr. Hoyer. Thank you.
    Professor Palfrey, I was pleased to see in your statement 
that you support the five principles that Chairman Ney and I 
are essentially working around; and I take it from your 
statement that our focus should not be exclusively on the 
72,000 precincts, or whatever number precinct we have, the 
72,000 precincts, but on a broader array of the technology use 
in other technologies, used in other precincts, is that 
correct?
    Mr. Palfrey. That is correct, yes.
    Mr. Hoyer. How expensive do you think we ought to be on 
this in terms of assistance to improve an election 
infrastructure?
    Mr. Palfrey. Well, I think as far as coming up with a 
single number I am not sure that is quite the way that I think 
about it, partly because I view this as sort of an ongoing 
process. As far as approximately, I don't know if you are 
looking for approximate numbers.
    Mr. Hoyer. No, I was not looking for a number. I apologize 
if I implied that, obviously.
    But the bill that I have introduced, along with a lot of 
other people, sought first, as Florida has done, to eliminate 
the punch card system. And then, as you know, it provides 
ongoing resources for technology replacement as well as a lot 
of other things in terms of education and technology 
development.
    What I am wondering is, if we limited our first step to 
that, would you think that is an error, or do you think we 
ought to make sure that this can be applied to other 
technologies, i.e., lever machines initially? Obviously, we are 
talking about limited resources that we will come up with in 
the first traunch, if you will. That is what I am really 
getting at.
    Mr. Palfrey. I think there are other technologies that have 
known problems besides punch card systems. Without identifying 
specific vendors, there are examples of full face DRE machines 
that have not been successful, that the administrators that use 
them would probably be happy to replace. I think centrally 
counted precinct scan equipment should be replaced by precinct 
counting. If you are looking for a quick fix of that, that is 
certainly a better technology having to do with the voter 
feedback and also the ability for errors to be detected before 
the vote is tallied.
    Mr. Hoyer. so in other words--and I hadn't thought about 
that--but clearly everybody believes that in order for a system 
to be as accurate as it can be you need precinct where-a-voter-
is-still-present technology to let the voter know whether or 
not they have made mistakes.
    Mr. Palfrey. Yes. I think we are at a stage now where there 
exists technologies to do that. We should take advantage of it.
    Mr. Hoyer. Okay. That is helpful.
    Dr. Woods, you addressed three key factors of voting--user 
friendliness, voter feedback and balance the design. What is 
the best feedback tool to let voters verify whether they 
actually voted for the candidates that they want without 
compromising voter privacy?
    Mr. Woods. Well, you have hit the heart of the design 
problem from a human factor's perspective.
    Normally, as Professor Rivest indicated, we don't have 
those simultaneous constraints to deal with. Obviously, the 
feedback has to be something that can be terminated by the 
voter so that they get a display, they get feedback that says 
this is what the machine thinks you told it. Then, in 
registering their vote, the voter must have a confident feeling 
that that information has gone into the computer and the 
traceability back to them has gone away; and that requires 
careful design and testing with users, again meeting the 
challenge of the diverse kinds of populations we have in the 
voting. And that is the kind of usability testing that is 
standard in our profession and that we can carry out on a very 
rapid basis. But there is no way to give a global answer 
without going through that indurative testing process.
    Mr. Hoyer. Okay. Obviously, that, however, is going to be 
one of the key issues we need to deal with; and I say that 
perhaps not at our level. We are talking about a lot of things 
that, frankly, States and locals are going to make the 
decision--final decision on, perhaps with advice of counsel and 
best practices and best standards advice, but----
    Mr. Woods. This is where an independent technical group can 
come in and demonstrate. Often, we can show you some clearly 
undesirable ways to try to accomplish those goals, and we can 
point people in these kinds of guidance documents I have 
referred to to several different kinds of techniques that will 
work and how to do quick tests to verify that your particular 
choice as an election official or a State official will be 
successful.
    Mr. Hoyer. Thank you.
     Dr. Woods, let me ask you about the DRE machines, because 
I want to know what extent the flaws in DRE machines are 
attributable to poor ballot design versus problems that are 
inherent in the technology itself or perhaps a combination of 
the two. I think Dr. Palfrey just made the observation that DRE 
machines themselves--some technology applications have not 
worked as well and administrators are not pleased with how well 
they have worked. Could you comment on the issue?
    Mr. Woods. I haven't looked directly and evaluated those 
interfaces. Ohio State did run a study 2 years before the 
recent controversy evaluating a variety of different voting 
systems and anticipated many of the punch card difficulties and 
identified a variety of other problems with the visual layout 
of the ballot design, ways that people could miss certain 
aspects of the ballot choices they had. For example people were 
able to--we had some issues where people--shorter people missed 
certain referenda, didn't even realize that they had those 
options available to vote on them. That is why there was no 
choice made on those issues facing the voter. So those layout 
issues can apply.
    Mr. Hoyer. Anybody else have any comment on that?
    Mr. Palfrey. I think actually Mr. Ney identified one source 
of some of these problems when he mentioned the machines that 
he looked at and there was all sorts of variety of ways that 
lights popped on and went off and whatever. And if there isn't 
good, you know, clear instructions on the screen for what is 
going on, voters could easily get the wrong idea.
    Mr. Hoyer. Seems to me you need to take this technology and 
expose it to large focus groups and make a scientific analysis 
of the human error rate, user friendliness of the technology. I 
think that is going to take a lot of--I imagine you folks are 
the perfect people probably to do that on contract for some 
group, perhaps the OEA, which would be able to give grants to 
carry out such testing. I mean, ultimately, a human being is 
going to use this, got to put a lot of human beings in the room 
and see what happens.
    Mr. Palfrey. Not only sort of human testing, sort of human 
laboratory testing where you put them in a room and have them 
bang around it, and also field testing could be useful as well.
    Mr. Baum. In addition to in-field testing, we are not 
really talking about voter education here. That is an oxymoron. 
You don't go out and educate voters on the technology. They 
come in and use it.
    Mr. Ney, you indicated that was your first time seeing that 
technology. For a majority of voters the first time they are 
going to see that technology is when they go in to vote on it. 
That is incorrect. They should have had a familiarity with it 
before. You put it out in the shopping malls, you put it out in 
the libraries, you put it out in the high schools and let them 
go out and play with it some. So by the time they go in and see 
it, it is not an intimidation of the equipment.
    The Chairman. Especially for certain age years now. My 
children, if I buy a VCR today, they install it, my 12-year-
old. It used to be my 17 year old when he was 12. If I need 
something done on the computer, they come over, and they help 
me. I am the problem. They aren't.
    So I know you know the school age children through 
computers through school are not the--that they are not--that 
they don't need the education. They will have a much easier 
time. They don't fear things as I do. I am not a user of 
technology. I try and, you know, I do e-mail and things like 
that. So there is also age groups.
    That is why you have got a great idea, the malls. If you 
have a mobile traveling unit that goes to senior centers, it is 
you know, open to the public. The schools are great, too. But 
school children are going to adapt quicker because they are 
used to computers.
    Mr. Baum. It depends. I think my kids would be very 
intimidated by a punch card machine----
    The Chairman. Yeah, that is right.
    Mr. Baum [continuing]. And have a whole different 
experience with what the marked sensor cards are, too. The 
optical scan, you look at one of those, and you are taking a 
test.
    Mr. Woods. We refer to this problem as the walk-up 
interface problem, because people won't have practice. Even if 
it is you are voting in the same area, you only do it once a 
year. So it is always this kind of walk-up interface, and you 
have to remember again how to do it.
    I would point you, without even the latest technology, to 
the L.A. Olympics in 1984. One major telecommunications company 
in the U.S. Human factors group was--volunteered to help design 
the information system--the electronic information system for 
the athletes, the participants in those games, how to deal with 
people with different languages and backgrounds and compute 
awareness. And they needed information about the times of their 
various practices and preliminary heats and also how to contact 
and schedule meetings with that tremendous opportunity to get 
to know people from around the world.
    It was a tremendous success because they applied the 
science of human factors to those walk-up interfaces and 
experienced very few problems. People didn't think about it as 
a problem or a challenge, how to learn how to operate the 
device. They just walked up and found the information or 
communication to the people they wanted to contact.
    The Chairman. I think Mr. Hoyer made a good point about 
focus groups. You have the scientific community that watches 
the group's interaction, you have your different type of people 
that are watching, but have you the people that participate in 
focus groups? I think that in fact, you know, would help a lot.
    Mr. Woods. Those usability tasks can be run.
    Again, I would point out there are plenty of interfaces and 
potential for problems to arise when the election officials 
interact in the various stages of processing the votes. We 
shouldn't forget about those interfaces as well, because that 
is where we would inadvertently introduce large inaccuracies.
    Mr. Hoyer. Thank you.
    Let me sort of ask a global question. If we could do only 
one thing this year, do you have any thought as to what that 
ought to be? In other words, the first step. I have mentioned 
some first steps personally, but do you have any views?
    Mr. Woods. Well, from my point of view, it would be very 
easy to put out a kind of initial guide to the human factors of 
voting technology that would give some examples, some basic 
principles and some testing focus group techniques, how to run 
the focus groups, to provide an initial resource to local 
election officials as they contemplate what decisions they 
should make now or put off as more information and options 
become available. And I think there are independent bodies, 
national laboratories such as Brookhaven National Lab or 
universities, who could respond quickly to provide that 
guidance.
    Mr. Hoyer. Any other Comment?
    Mr. Baum. I think if you were only going to do one thing--
and that is my sincere hope that that is not the case--it would 
be to publish some information on how to live with what you 
have. I mean, yes, there are challenges in each one of these 
technologies. But with proper planning, with good processes in 
place and good training in place, we can certainly reduce the 
error rate of even the equipment that is there by handling it 
better.
    Mr. Rivest. I think I would respond by saying to create a 
organization whose mission is to assist the States, the local 
officials, by creating a fund, and organization to generate and 
distribute and share information about voting systems, 
supporting research, supporting focus groups on usability, 
supporting hacker attacks on systems to see what can be done. 
You know, publishing a source code, when that could be made 
available. An organization whose goal is to help the State 
officials know everything that needs to be known about these 
systems so they can choose well.
    Mr. Palfrey. I would second that. Because I think one of 
the biggest problems is lack of information, okay? You have 
election administrators who are in a situation, whether the 
money is coming from the Federal Government or not, they are 
basically under pressure. They are going to have to replace 
some equipment. They don't have good guidance for how to do it, 
how to implement it, what kind of pitfalls there are. And it 
goes to security, it goes to all these other different issues. 
I think you really do need an agency or an organization who is 
responsible for collecting and providing an information 
clearinghouse of that sort.
    Mr. Hoyer. As I say and as you know, we do have an 
organization, small and incorporated within the FEC, the OEA. 
But, I was stricken by the fact that all of the Secretaries of 
State that testified and all of the election administrators 
that testified were looking to the OEA for better information, 
better--best practices advice and counsel, better standards 
advice. And you have echoed that, and I hope we do that.
    I want to say very quickly, I hope we don't do just one 
thing. I agree with that, and the question was, to that degree, 
rhetorical.
    Last question I will ask, Mr. Chairman, and I have some 
others here but, if we might, I hope that our staffs can feel 
free to contact you from time to time and get the value of your 
expertise.
    What would the best way for Congress to facilitate research 
and development of new voting technology, and how can Congress 
make it easier to develop and implement new technology? I think 
that is going to be, I hope, one of the aspects of what we will 
do. Because such a limited market, such a relatively--
``sterile'' is the wrong word but stable market, not a very 
volatile or vibrant market here, so the technology has not 
turned over as quickly as it otherwise might have. Florida has 
spurred that, and we will have a short window, in my opinion, 
to take advantage of that sort of awareness. So how can we best 
do that--that is, to spur our DT&E in this area?
    Mr. Baum. I would like to point out that, although the 
market for public elections may be set and stable, there are 
other kinds of elections where this technology applies. There 
are union elections, professional organization elections, and 
all kinds of places where these other factors are also a part. 
That allows the opportunity for the private sector and the 
public sector to cooperate here in building up standards that 
become then, generally accepted election standards. So that is 
one area of cooperation with the private sector where Congress 
can make a huge contribution. Also, as we have all stated 
before, coming up with standards that can be applied in these 
areas would make a significant contribution.
    Mr. Palfrey. I think one of the barriers to innovation, is 
that election administrators have to be cautious when they make 
an acquisition of a replacement for whatever technology they 
had. And what has happened is that they just switch wholesale 
to a new technology.
    I think one thing that would help innovation--and there are 
start-up companies that are out there trying to work on 
innovation in this area--is to provide some sort of funding for 
pilot testing, pilot experiments, and field testing so that you 
don't have to jump into it full force. You can try it out in a 
couple precincts, see how it is working, and monitor it. I 
think that is one thing that might help.
    Mr. Rivest. I think perhaps some guidance to either NSF or 
DARPA, or both, to support research in this area could be 
helpful. DARPA may seem strange, but in fact there is national 
security involved with these elections. NSF has traditionally 
funded research in computer security and cryptography, for 
example. As my colleagues have pointed out, there are also 
businesses that need to be involved. I am not sure what the 
best way to encourage them to innovate is.
    Mr. Woods. Another aspect of the activity of the 
independent resource in that area, we need a mechanism for 
people to monitor potential or emerging sources of inaccuracy 
and problems. This is almost a classic advice that we give to 
almost every agency that has safety, for the potential for a 
crisis to arise. We don't want to react after the fact to a 
crisis, like Florida, and try to repair and intervene. High 
reliability organizations are out there testing and monitoring 
their systems to notice early warning signs or even dress 
rehearsals. Instead of rationalizing away the dress rehearsal 
of inaccuracies in this, our system, which we have been too 
tolerant of, we need these bodies to be out there saying, 
whoops, look at what we are starting to see as problems, 
sharing that information so people can change the technology, 
change the education, and change the procedures they are using 
to prevent crises from happening.
    Mr. Hoyer. Thank you very much to the panelists. You have 
been very helpful, I think, and very thoughtful. Hopefully, as 
I said earlier, we will be able to work with you so you can 
help us. Again, there's a much longer term--States and 
localities and whatever agency, whether it is the existing OEA 
within FEC or some other organizational structure like that, 
work with them to accomplish objectives which I think clearly 
all of us want to accomplish.
    And they are not partisan in nature. Everybody wants to 
make sure that, not only does every American have the right to 
vote, but every American's vote is made easier to cast, more 
accurately, and counted correctly. And although this is not 
solely a technology problem, clearly it manifested itself in 
many ways as a technology problem, as well as a human behavior 
interface with technology problem.
    Thank you very much; and thank you, Mr. Chairman.
    The Chairman. We do appreciate your testimony today. You 
are an important component from the technology side.
    Also one thing, I want to assure you too, and I feel very 
good about, the way we have proceeded and also about the ideas 
that Mr. Hoyer has been able to develop and we have been able 
to develop together and, you know, to reach some basic 
consensus among members when you start to talk about it.
    I think the statement you made, Professor Woods, is what we 
are doing--you know, this isn't debating Florida, but Florida 
caused the debate. And I can barely remember anyone coming to 
me over a period of 20-some years, whatever office I have held, 
of saying, gee, this certain technology needs to be looked at 
or it needs work. It wasn't drawn out until you had some 
national view. And that is what the Presidential did.
    So I think what we are doing is trying to work with the 
desires of the locals to do something about the existing 
systems that are out there, but also I think what we are doing, 
is we are not in the middle of the crisis right now, we are 
personally not letting this situation go. We are driving a 
piece of legislation. I think it is going to be good. But I 
think we are reacting the right way to look ahead.
    So, I think your statements were well taken. It is the way 
to proceed on this, and I think that is what we are doing.
    Mr. Hoyer. Mr. Chairman, on a nonelectoral reform issue, if 
I might, I want to say to you and to Dr. Woods that--how highly 
resentful we in Maryland are that you have taken our president 
of the University of Maryland away. I don't know whether you 
have had an opportunity to get to know Brit Kirwan very well, 
but he is an extraordinary asset. He is a wonderful human 
being. Ohio State is very fortunate to have him. We miss him a 
lot in College Park.
    I am on the board of regents of the university systems, and 
I was a graduate of the University of Maryland and worked with 
Brit very, very closely for all the time that he was at the 
university which, as you know, was over 2 decades. I trust that 
Ohio appreciates him as much as they should. You certainly 
compensated him better than we did; and he appreciates that, I 
know. But I hope you enjoy working with Brit. He is a terrific 
fellow.
    The Chairman. We like him, and we in Ohio will not mention 
what Baltimore took from us in Cleveland a few years ago. We 
will just leave it at that.
    On that note, I ask unanimous consent that witnesses be 
allowed to submit their statements for the record. Members have 
7 legislative days to insert extraneous material into the 
record, and for those statements and materials to be entered 
into the appropriate place within the record. Without 
objection, so ordered.
    I ask unanimous consent the staff be permitted to make 
technical and conforming changes on all matters considered, by 
the committee at today's hearing. Without objection, so 
ordered.
    Having completed our business of the day for this hearing 
on election reform, the committee is hereby adjourned. Thank 
you.
    [Whereupon, at 12:35 p.m., the committee was adjourned.]

                                
