Trust in electronic voting and counting systems can be strengthened through mandatory auditing of these systems as soon as possible after an election to verify that the system was able to accurately capture results from the election. The legal framework for elections should specify the process through which a post-election audit should be implemented as well as the consequences of any difference found between electronic and paper records. The audit should take place as soon as possible after an election and should be open for observation by oversight groups.
Comprehensive testing and source code reviews, as well as possible certification mechanisms, will do much to ensure that electronic voting and counting systems deliver accurate results. However, to ensure trust in these systems, it is crucial that they be auditable and audited after use so that the results can be verified as accurate, ideally by an independent organization.
The way in which this auditability is provided varies depending on the type of electronic voting or counting system in question (e.g., it is different for electronic voting systems, electronic counting systems and especially for remote electronic voting systems). The most common way in which auditability is achieved for electronic voting machines is through the use of a voter-verified paper audit trail, which can be manually counted as a check against the electronic result generated by the electronic voting machine.
Regardless, an audit mechanism is a way both of checking that the technologies worked properly and of verifying the results, by comparing the electronic and auditable versions of the results. In addition to checking the operation of the system, this also helps build confidence in the system, more so if the audit is done under the full observation of stakeholders in the process.
In order to build and maintain confidence, conducting audits of the results generated by electronic voting or counting systems should be mandatory.43 The (paper) audit trail should be manually counted and the results compared to the electronic results generated. Because it is unlikely that such an audit will be possible in every location, audits should be conducted in a randomly selected sample of locations that are only informed of the impending audit after the close of polling or counting. In contentious elections it may be appropriate to allow candidates to select a predetermined number of polling stations for manual audit in addition to the randomly selected samples. This allows the candidate to focus on areas where fraud may be suspected.
The legal framework should make clear how this audit process takes places, the number of locations, the ways in which the locations are selected and informed, when the audit takes place, the people who may be present during the audit, how the results of the audit are reported, and the consequences of any difference between electronic and paper records.
The audit process should be conducted as soon as possible after the election. An audit right after the close of voting and counting avoids the possibility or perception of tampering or manipulation before the audit takes place. If an immediate audit is not possible, then the sample to be audited should be sealed in a tamper evident way until the audit can take place. The audit should be fully observable by election observers as well as the media and political party and candidate agents.
The results of the audit process will need to be interpreted differently depending on the kind of technology being used. With electronic voting technologies there should be no differences at all between the result generated from the audit trail and the electronically generated result. If a difference is found, then it will be prudent to conduct a recount of the audit trail to make sure that the manual process has not generated a mistake. Should a difference between the manual count of the audit trail and electronic count of votes still persist, even if only by one vote, this will be seen as an indication of some flaw in the operation of the electronic voting machine or the audit trail. Even a small deviation would be a critical concern. Without an understanding of why a difference is possible, it also cannot be known if this flaw could lead to much larger deviations between the electronic result and audit trail in other locations that are not being audited or in future elections.
With electronic counting technologies, the interpretation of differences between the manual recount of the audit trail and electronically generated results is more difficult. Different voters mark paper ballots in different ways, and sometimes these voter marks are interpreted differently by electoral officials. The advantage of electronic voting technologies is that they interpret ballot marking in a consistent manner, according to the instructions provided to them. A difference in vote totals through a manual count of the ballots may be due to the counting machine reading voter marks in a different way than the election official. It may be the election official has made a mistake, or it could be a simple difference in the ability of individuals to discern small differences in shading that may clearly indicate the intent of a voter, but which the machine is incapable of detecting. In extreme cases, it could be that the difference represents an error in the ballot-counting rules provided to the counting machine. This requires an amendment to the counting machine software. Depending on the severity of any error in the ballot-counting rules provided to the counting machine, this may have implications, even serious implications, for the results generated by counting machines across the election.
43 This is supported by the Council of Europe (2010) in its E-voting Handbook in which it recommends that a paper audit trail should be combined with a mandatory count of paper votes in a small but statistically meaningful number of randomly selected polling stations, p. 12.
Evaluation of System