For (Digital) Poll Books — Custody Matters!
Today, I am presenting at the annual Elections Verification Conference in Atlanta, GA and my panel is discussing the good, the bad, and the ugly about the digital poll book (often referred to as the “e-pollbook”). For our casual readers, the digital poll book or “DPB” is—as you might assume—a digital relative of the paper poll book… that pile of print-out containing the names of registered voters for a given precinct wherein they are registered to vote.
For our domain savvy reader, the issues to be discussed today are on the application, sometimes overloaded application, of DPBs and their related issues of reliability, security and verifiability. So as I head into this, I wanted to echo some thoughts here about DPBs as we are addressing them at the TrustTheVote Project.
We’ve been hearing much lately about State and local election officials’ appetite (or infatuation) for digital poll books. We’ve been discussing various models and requirements (or objectives), while developing the core of the TrustTheVote Digital Poll Book. But in several of these discussions, we’ve noticed that only two out of three basic purposes of poll books of any type (paper or digital, online or offline) seem to be well understood. And we think the gap shows why physical custody is so important—especially so for digital poll books.
The first two obvious purposes of a poll book are to  check in a voter as a prerequisite to obtaining a ballot, and  to prevent a voter from having a second go at checking-in and obtaining a ballot. That’s fine for meeting the “Eligibility” and “Non-duplication” requirements for in-person voting.
But then there is the increasingly popular absentee voting, where the role of poll books seems less well understood. In our humble opinion, those in-person polling-place poll books are also critical for absentee and provisional voting. Bear in mind, those “delayed-cast” ballots can’t be evaluated until after the post-election poll-book-intake process is complete.
To explain why, let’s consider one fairly typical approach to absentee evaluation. The poll book intake process results in an update to the voter record of every voter who voted in person. Then, the voter record system is used as one part of absentee and provisional ballot processing. Before each ballot may be separated from its affidavit, the reviewer must check the voter identity on the affidavit, and then find the corresponding voter record. If the voter record indicates that the voter cast their ballot in person, then the absentee or provisional ballot must not be counted.
So far, that’s a story about poll books that should be fairly well understood, but there is an interesting twist when if comes to digital poll books (DPB).
The general principle for DPB operation is that it should follow the process used with paper poll books (though other useful features may be added). With paper poll books, both the medium (paper) and the message (who voted) are inseparable, and remain in the custody of election staff (LEOs and volunteers) throughout the entire life cycle of the poll book.
With the DPB, however, things are trickier. The medium (e.g., a tablet computer) and the message (the data that’s managed by the tablet, and that represents who voted) can be separated, although it should not.
Why not? Well, we can hope that the medium remains in the appropriate physical custody, just as paper poll books do. But if the message (the data) leaves the tablet, and/or becomes accessible to others, then we have potential problems with accuracy of the message. It’s essential that the DPB data remain under the control of election staff, and that the data gathered during the DPB intake process is exactly the data that election staff recorded in the polling place. Otherwise, double voting may be possible, or some valid absentee or provisional ballots may be erroneously rejected. Similarly, the poll book data used in the polling place must be exactly as previously prepared, or legitimate voters might be barred.
That’s why digital poll books must be carefully designed for use by election staff in a way that doesn’t endanger the integrity of the data. And this is an example of the devil in the details that’s so common for innovative election technology.
Those devilish details derail some nifty ideas, like one we heard of recently: a simple and inexpensive iPad app that provides the digital poll book UI based on poll book data downloaded (via 4G wireless network) from “cloud storage” where an election official previously put it in a simple CSV file; and where the end-of-day poll book data was put back into the cloud storage for later download by election officials.
Marvelous simplicity, right? Oh hec, I’m sure some grant-funded project could build that right away. But turns out that is wholly unacceptable in terms of chain of custody of data that accurate vote counts depend on. You wouldn’t put the actual vote data in the cloud that way, and poll book data is no less critical to election integrity.
A Side Note: This is also an example of the challenge we often face from well-intentioned innovators of the digital democracy movement who insist that we’re making a mountain out of a molehill in our efforts. They argue that this stuff is way easier and ripe for all of the “kewl” digital innovations at our fingertips today. Sure, there are plenty of very well designed innovations and combinations of ubiquitous technology that have driven the social web and now the emerging utility web. And we’re leveraging and designing around elements that make sense here—for instance the powerful new touch interfaces driving today’s mobile digital devices. But there is far more to it, than a sexy interface with a 4G connection. Oops, I digress to a tangential gripe.
This nifty example of well-intentioned innovation illustrates why the majority of technology work in a digital poll book solution is actually in  the data integration (to and from the voter record system);  the data management (to and from each individual digital poll book), and  the data integrity (maintaining the same control present in paper poll books).
Without a doubt, the voter’s user experience, as well as the election poll worker or official’s user experience, is very important (note pic above)—and we’re gathering plenty of requirements and feedback based on our current work. But before the TTV Digital Poll Book is fully baked, we need to do equal justice to those devilish details, in ways that meet the varying requirements of various States and localities.
Thoughts? Your ball (er, ballot?)
GAM | out
6 responses to “For (Digital) Poll Books — Custody Matters!”
Great blog post! I really appreciate the insights here, especially the list of three priorities at the end (data integration, data management, and data integrity). A very helpful way to think about this problem. Sorry I don’t have anything useful to contribute; I just wanted to say thank you.
One of the basic functions of an e pollbook and a voting machine for that matter is to have every voter history record backed up to a removable storage device as the record is recorded. With an iPad, there is no memory card slot or usb port to save his data to. What happens when your iPad pollbook fails? With mine, I simply pull out my sd card from the device. Every voter history record is saved onto the card. Seems to me you first need to pick the correct hardware solution.
First, so sorry we missed your comment in the pending queue. That should have posted. Second, you are absolutely correct! Many jurisdictions have specific requirements that will definitely inhibit various solutions being envisioned. The iPad project is principally a prototyping and envisioning/ideation exercise. So, the hardware chosen for this purpose is well serving of those needs, but not for many jurisdictions in a production setting, no argument. We do, in fact, have a couple of jurisdictions who approached us with more relaxed parameters enabling the potential application of a simpler device in terms of peripheral connectivity and networking — that motivated the iPad Poll Book prototype. I should note the iPad platform allows us to do a couple of things:
1. experiment with more advanced touch screen technology to support, for example, fine-grain signature capture; and
2. leveraging integrated capabilities such as built-in megapixel digital image capture to support things like drivers license bar code scanning and in some cases, voter head shot capture.
Bear in mind that a primary element of our Foundation’s charter is to envision, model, and prototype what the future might look like for elections technology. We are not in business as a commercial venture to actually “productize” next generation voting equipment. Rather, we are here to research, design, develop and make publicly available bases of technology that can be adopted, adapted, and deployed by any elections jurisdiction who seeks to innovate in a manner where no commercial solution exists, or if it does, at a cost-prohibitive level. (Emphasis on adaptation, by the way.)
That all noted… frankly, we’re pretty darn certain that ultimately consistent with the entire nature of our publicly available works, and more in line with operational realities, Android-OS based devices will be a far more likely production platform. There again, we also know of situations where even that amount of innovation may be constrained by local requirements that ultimately tie back to some sort of low-cost commodity based, OSS driven notebook or laptop. That latter point is one reason we have a focused project on a hardened operating system (OS), LINUX in nature (Android for mobile, or tether-free systems). Similarly, but considerably down the priority list, we have folks who are tinkering with wireless security innovations (you can believe there are applications far beyond that of the highly fault-intolerant world of elections that drive R&D in that arena).
Thanks again for your comment and input!
Judy et al-
I should also point out that our blog post is consistent with my reply earlier and Judy’s comment. If you notice paragraphs 12-14 we actually “poo-poo” the suggestion to deploy an iPad based POll Book that was presented to us recently. Nice technology, poor implementation thought. Again, our iPad Poll Book, while very sexy, is intended only to be an envisioning exercise or ideation process. Sure, there are a few jurisdictions out there who could potentially leverage this work into a production version based on the hardware configuration as it stands today. But those are edge cases. 😉
A comment on the purposes of the DPB:I agree it may be good for voter check- in or registering/updating voter info. prior to getting a ballot. DPB appear to considerably cut down the wait time for the voter. This would help us Election Judges in our polling place management & alleviate congestion. But here in Minnesota, we are looking at DPB/EPB for another reason. To ensure voters are in the correct precinct/polling location. In 2012 we had some snafus which were mainly caused by redistricting after the 2010 Census. Voters were unsure or unaware of their new polling place & showed up at their customary or old polling places. With the current paper-based system we have, the huge turnout in 2012 & the stress on our Election Judges, some errors were made that were only caught weeks after E-day. The DPB could be a solution to one of the major problems we continually see – voters not knowing where to vote or showing up at the wrong polling place. By having the capacity to instantly print a map & info of the correct polling location, the voter could be sent on their way sure of voting in the correct place.
Thank you for your thoughtful contribution. I apologize but for some reason this comment ended up in the wrong queue and was not properly posted. Ugh; we’re investigating what happened. Thanks again — you raised some important considerations.