What Robert's Rules of Order can teach us about electronic voting standards.

Robert's Rules of Order (RRO) is widely quoted but rarely read. In fact, unless you are a parliamentarian, you can get along with a visceral appreciation of the actual content. But when it comes to electronic voting, it is worth taking a closer look at what RRO says and doesn't say about how to design and implement a trustworthy voting system that incorporates technology while not compromising our civil liberties.

Looking more closely at RRO reveals important parallels between Humanist principles and the social and technical processes associated with the design and implementation of voting systems in which the individual voter is respected. Humanism and Its Aspirations says that "science is the best method for determining" knowledge of the world, "as well as for solving problems and developing beneficial technologies" The Humanist Manifesto III also recognizes a "civic duty to participate in the democratic process" as part of an ongoing development and refinement of principles. The core of this "lifestance" is an open procedure that aims to achieve consensus while anticipating the need to correct mistakes to preserve our civil rights.

In the United States, the Supreme Court has traditionally intervened to protect civil rights when plaintiffs have presented evidence of systemic and systematic bias or unfairness in legal procedures. In cases involving elections and juries, for example, the Court has intervened to strike down laws and practices and to stipulate new procedures to prevent biased and unfair practices. No legal system can guarantee that justice will be done, but eliminating unjust procedures removes obstacles to producing legitimate outcomes.

Procedures in technological development are also an important issue because the Help America Vote Act (HAVA) is spending $3.9 billion to help states modernize their voting machines. Most states are purchasing touch screen systems. Recent scandals and revelations concerning the reliability and accuracy of touch screen voting machines suggest that "modernizing" voting machines may actually reduce the trustworthiness of election technology. Americans need a legal mechanism to ensure that new machines don't threaten due process and civil rights by introducing new forms of distortion and corruption that legislators don't understand. Something like an environmental impact statement ought to be added to HAVA to determine if new technology actually improves election processes. Since federal money is at stake, due process complaints and challenges could stop the modernization process until better industry standards are developed. Indeed, many independent computerized voting experts have suggested that we rely on paper ballots, improved management of elections, and better training of election workers until better standards and technology are developed.

Using the court system is necessary because politicians are unlikely to be comfortable with changes in voting systems. Technological change can upset established political patterns and create uncertainties about how to win elections. Sorting out the risks requires learning about social and scientific issues that tend to be low priorities for both legislative representatives as well as their constituents. Obtaining injunctions against using voting equipment that doesn't meet high standards of trustworthiness can contribute to a sustained debate about the issues.

The lack of openness about voting system problems in contemporary U.S. political culture stands in sharp contrast to what is found in the RRO model. RRO is a system for creating voting systems to collect and process votes. Although there are many editions and interpretations of the text, RRO guidelines offer advice about each step of a voting process to avoid errors that can jeopardize the integrity of the outcome. The rules don't specify what has to be done at each step; instead, they highlight issues and options that voting practitioners have identified as important to consider in any voting plan.

The guidelines include customary practices for building error detection and correction into vote counting. Nothing about the voting process--including the validity of the agenda or the voters--has to be accepted on blind faith. By default, the emphasis is on validation of the process.

Voters are free to scrutinize voting outcomes. Whether votes are taken orally, by division of the whole, or by show of hands, each participant can actively audit the outcome. Everyone can hear the voices, see how the whole is divided, and count raised hands. The rules allow anyone to ask for a recount. In addition, voters may request that alternative ways of representing preferences and counting votes be used. For instance, if the results of a voice vote are unclear, a show of hands or division of the whole can be used to scrutinize the results.

RRO also describes options for using alternative voting methods to assure that the intent of the voters is accurately represented. For example, the traditional one-person/one-vote method cannot communicate tied preferences and doesn't provide information about relative intensity of preference for other voting choices. Methods that allow voters to rank all of the choices or indicate which ones they approve can provide a more precise and accurate representation of voter intent.

Collecting voice, hand, or division votes relies on the customary practice of informing voters about the meaning of their choices just before a vote is taken. If there is any ambiguity, voters can seek clarification before voices speak, hands are raised, or bodies move. Everyone is given their due.

As a flexible system for creating voting systems, RRO incorporates multimedia, real-time communications processes for defining and implementing user requirements for taking a vote. The system of rules, based on hundreds of years of organizational experience, has become a standard reference for any voting situation. But RRO doesn't provide detailed advice about elections by paper ballot or voting machine--both of which are relatively modern inventions. Ballots based on nonpaper media date back to Roman times and have become more common with technology development and the evolution of democratic elections. But the use of paper forms in mass elections has required the development of new quality control mechanisms for managing and counting votes.

Since the late nineteenth century, however, the development of new voting technology has been based on a reactive strategy of responding to problems by harnessing new technologies without evaluating them from an end-to-end perspective. This strategy has been propelled by a faith in technology articulated by Jacob H. Myers, the designer of the first lever device, that machines can be built to "protect the voter from "rascaldom" and make the process of casting a ballot perfectly plain, simple, and secret." From the Hollerith card to the touch screen machines, faster speed and "absolute" secrecy have motivated voting equipment designers. But we now realize that speed doesn't necessarily provide trust and we understand that anonymity doesn't guarantee security. In fact, speed and anonymity can mask accidental and malicious errors and unwittingly undermine voter intent and the integrity of the voting process.

No voting system is likely to be completely immune from accidental and malicious error. Designing for error means building in mechanisms that allow errors to be discovered. Otherwise, we have to rely on blind faith. Using a paper ballot to verify touch screen input is better than no verification at all. But paper auditing cannot assure us that the verified vote is actually transmitted to the database and counted when the final results are tabulated. Recent mishandled delivery of voting data cartridges from touch-screen equipment and the risks of transmitting voting data over the Internet make it reasonable to include some form of active auditing as part of a standard for end-to-end security.

Consistent with RRO, scientists and engineers have suggested the use of software that can automatically incorporate alternative voting methods into electronic voting equipment. But this option wasn't included on the final list of issues recommended to George W. Bush for further consideration. However, Instant Runoff Voting (IRV) advocates have resuscitated the issue by systematically promoting their ranking methodology as a solution for tied or close elections. These efforts to legitimize and institutionalize IRV methodology in all machines force us to consider how to implement their proposal in a trustworthy way. At a minimum, this solution would require partial identification of voters to assure that the reinterpretation of the intent of the voters is derived from valid individual voting data. Validating this relationship is necessary for avoiding accidental or malicious error in recalculating the voting outcome.

Instead of thinking in absolutist terms about issues such as voter identification, designers of voting systems should focus on inventing techniques to satisfy user requirements for verifying that the correct ballot information has been submitted, recorded and counted correctly. The requirements of system users should determine the technical specifications, not vice versa. If current technology makes it unfeasible to implement certain user requirements, we shouldn't automatically drop them because they seem too complex, risky, difficult, or costly to design and implement. We should develop our own best practices based on careful experimentation.

Taking the trustworthiness of our voting systems seriously should mean that elections satisfy the most rigorous standards for computer-mediated communications. Thinking out of the box about voting requirements can allow us to consider techniques being developed for "mission-critical" applications. A recent trend in computer science is to develop better computer languages that will enable us to build better software tools for building voting systems. For instance, formal methods are being developed to build software systems that are less vulnerable to accidental or malicious error. For example, "type-safe" electronic transactions could assure that software systems satisfy certain conditions before they are run. Code that passes a runtime proof-check would prohibit a vote from being sent to the wrong destination and would prohibit errors caused by poor programming practices or languages. Type-safety could also prevent Trojan horses that can undermine the integrity of the vote-counting process.

Program analysis and model-checking techniques could also be developed to prevent error from occurring in voting software. Program analysis can verify that software doesn't make illegitimate use of real-time memory, storage, network resources, and processing capabilities of an operating environment. Similarly, model checking verifies that a program is operating according to its specifications.

Academics and software professionals engaged in the search for better voting software are investigating an open systems approach to solving many of the technical and social problems associated with proprietary voting system solutions. For example, the Open Voting Consortium is exploring the social as well as technical implications of creating software in which source code is scrutinized and tested by multiple professionals. Unbeknownst to most citizens, this approach has been used to generate reliable software tools for mission-critical applications in space and security. Applying the same principles to the development of voting software tools hasn't been fully investigated.

The new emphasis on procedural analysis of software tools for elections highlights the relevance of standards for scientific rigor, honesty, and due process. The wisdom of the RRO model is that it prompts us to use reason to be as certain as possible that voting systems meet our expectations. Preventing election problems is more efficient and less risky than trying to fix them after they have occurred. But openness is required to assure that election standards satisfy reasonable social and technological standards.

Arnold B. Urken teaches political science at Stevens Institute of Technology. He is an elections computer consultant and a founding member of the Open Voting Consortium.