Electronic Voting: the Devil is in the Details

Chantal Enguehard, Jean-Didier Graton, "Electronic Vot ing: the Devil is in the Details", avril 2008. 1 Electronic Voting: the Devil is i n the Details Chantal Enguehard LINA - UMR CNRS 6241 2, rue de la Houssinière, BP 92208, 44322 Nantes Cedex 03, France chantal.enguehard@univ-nantes.fr Jean-Didier Graton Expert in law, technology and economics of IT security, Chairma n of the European Computer and Communication Security Institute (ECCSI) Bastion Tower, 20, Place Champs de Mars, 5 - 1050 Brussel s, Belgium info@naccsi.net Abstract: Observing electronic voting from an international point of view gives some perspective about its genesis and evolution. An anal ysis of the voting proc ess through its cultural, ontological, legal and political dimensions explains the difficul ty to norm alize this process. It appears that international organizations are not capable to properly defend the fundamental rights of the citizens. The approach that w as ta ken w hen DRE voting computers appeared seems to have reoccured with VVAT voting computers and the european e-poll project . Keywords: VVAT, DRE, voting computers, e-voti ng, electronic voting, e-poll, elect ronic voting systems I - Time lines on facts I.1 - Genesis of electronic voting The hi story of electronic voting is short. W e intend here to give a quick review about the spread of electronic voting systems of all di fferent flavors (voting computers 1 , kiosks 2 and internet voting 3 ). We make a distinction between two types of dissem ination of electronic voting systems. The first type is found in countries which have a strong willingness to use electronic voting systems. These e-voting deve lopers c ountries encourage companies, that are in most cases l ocal, to produce such systems. The majority of these companies were alrea dy involved in security or bank 1 To use a voting computer, each elector must go in his/her usua l election poll where s /he can re gister his/her i ntent of vote directly on t he voting computer. At t he end of the e lection period the voting computer gives the sum of the votes that it computed. The term "voting computer" will be prefered to "electronic voti ng machine" because the latter is often abbreviated in "voting machine" which already r efers to mechanical voti ng machine (like the l ever machine). Using the s ame term to refer to two different objects inevitably leads to confusion a nd should be strongly avoided. 2 Kiosks allow each vot er to process hi s/her vote from any pol l station. Thus, a ll the kiosks are linked to a central serveur which controls the unicity of each vote, registers the intents of votes, and expresses the r esults at the end pf the voting period.. 3 An interne t voting system is a remote voting system whom functionality are close to kiosks. The main difference i s that electors don't from from a controlled place (the poll stati on), but from any computers that is linked on internet. activities a nd invested in this new market bec ause e-voting technology is simple, easy to produce and offers a significant profit margin. In additi on the competition between companies is weak because the market is segmented by the necessit y for the e-voting products to conform to the election laws of the country it is developed for. We find thi s situation in countries that make extensive use of electronic voting: Ne therlands (with the Dutch company N EDAP), but also in the United States (with the American companies Premier 4 or Election Sys tems and Software-ES&S), i n India (CMC Limi ted is a subsidiary company to the Indian Tata), in Belgium where the voting system has been developed by local firms and also in Brasil: since 1996 5 , this country has been using voting computers, specially deve loped by two American vendors: Unisys (50,000 computers) and Diebold (350,000 computers). These Brasilan voting computers were de signed by the El ectoral Supreme Court (Tribunal Superior Eleitoral - TSE). We find the same situation i n countri es that use elec tronic systems on a minor scale: Australia developed its own system eVACS, the Estonia states devel oped their own internet voting systems. The second type is found in e-voting adopters countries w hich decided to use voting s ystems coming from foreign countries: w e find Nedap voting computers in Germany, France, Ireland, Ital y and Poland; there are Indian voting computers in Nepal; ES&S voting systems have been us ed in France and United Kingdom; the Spanish compa ny Scytl exports in Finland, Philippines, Austra lia, Switzerland; Indra, another Spanish company, supplies F rance. I.2 - Success and failures E-voting assessments differs according to their authors. Electoral official organizations are generally very satisfied with the e-voting systems they decided to use, especially among e-voting developers countrie s. The electors opinion is much contrasted. We distingui sh three typical groups. 1 - The early adopters group is composed by technophiles who are by definition very enthusiastic about e-voting. They lose thei r faith in technology when it become s obvious that voting systems are not more reliable than usual computers. 2 - The s ceptical group is quantitati vely small. It is a hete rogeneous group which encompasses computer scientists, t echnophobes and security experts . This group’s tendency is to doubt whether e-voting is useful and to question officials. 3 - T he median group brings together the majority of the vote rs. These persons obviously respect official decisions a nd, at first, accept the idea that e-voting is a ne utral m edia to vote, even if they observe some pract ical problems when they vote. By pra ctising e-vot ing, t heir opinion move s, generally by analogy with well-known objects or situation (pocket ca lculators, computers, money- transfer, etc.) that are commonly presented by media, even if they are not appropriate. After an astonishment period, they become capable to e valuate the advantages and disadvantages. These different populations a re c onfronted by difficulties that appeared after a few elections which used electronic systems. Many errors were reported in the regi stration of votes. It was also reported that some voting computers failed to start up, encountered breakdow ns or showed some strange behaviour. For instance, in the USA, the Montgomery County Election Board published a report about the 2004 presidential electi on whic h stated that "189 voting units (7%) of units deployed failed on Election Day. An addi tional 122 voting units (or 5%) were suspect ba sed on number of votes captured" [Montgomery County Election Board 2005]. " A few machi nes in Miami-Dade Count y 4 Formerly Diebold 5 Electronic voting was generalized through the whole count ry in 2002. reset themselves while voters we re trying to vot e. Precincts in Palm Beach County reported problems activating some of the electronic cards used to authenticate the voters. Even mark-sense ballots designed to be re ad by optical scanne rs prove d troublesome" [Mercuri 2002]. "In November 2003 in Boone County, Indiana over 144,000 votes were ca st eve n t hough Boone County contains fewer than 19,000 registered voters." [Simons 2004] In Belgium, during the 18 May 2003 election day, an error of 4096 votes has been discovered. It had been impossibl e to explain or reproduce this error, even a fter examining the faulty computer Rapport Chambre et Sénat belge 2004, page 21]. In Québec, where electronic voting was used to process 95% of the votes in the local elections of 2005, so many proble ms were encountered that the city decided to return to traditionnal paper ballot: results arrived hours in late, some m aterials broke down, internet connexion ha d been cut and many votes had been counted twice by error [Bea ulieu 2006]. In addition, researchers demonstrated that some voters were not able to vote independently be cause of their lack of expe rimence with computers (digi tal gap) [ Birdsall e t al. 2005] . It was al so discovered that electronic computers w ere not well adapted to blind people. In addition, controversy arose around the la ck of transparency, security, and reliability. Researchers demonstrat ed that it was impossible to check the results which a re automatically delivered and also that results could be tampered with without detection. With the exception of Ireland, which decided to not use the 75,000 voting computers that were previously bought, most of the concerned states tha t were deeply involved in electronic voting reacted by as king for improvements, thinking that problems were due to the lack of expe rience and could be easily fixed. In the USA, for example, with the Help America Vote Act, the congress allocated $3,8 bi llion to states for improvement of voting system infrastructure, voter education, and training of election officials [ Shelley 2004] . In addition, some c ountries, like V enezuela, moved to the new concept of Voter Verified Audit Trail first expressed by Rebecca M ercuri [Mercuri 2000]. The USA, the South K orea and the Kingdom of Belgium would appear to be following this trend, forgetting the fact that adding complexity to a system always makes it be come more fragile and less reliable. Among the countries that experimented on a very limited scale, some just stoppe d the ir trials (Italy, Spain), wa iting for a better technology, w hile some others are still continuing w ith experiments but without any extension, (France, UK, Switzerland, et c. ). At a supranational level, Europe goes further by s tarting deployment of the e-poll system whic h is supposed to manage "polling pre paration, voters' identification and authent ication, authorization, vote c asting, vote counting and communication of t he re sults" i n the nam e of the reinforcement of the European integration.This projects includes biometric identi fication, centralization of the uniqueness of each vote and the possibility for the vot er to vote from any poll station. I.3 - International Organizations During this period different international organizations, such as the Office for Democratic Institutions and Human Rights of the Organization for Security and Cooperation i n Europe (OSCE/ODIHR) or the Europe an Union (EU), sent assessment missions, observing electronic voting systems as traditional voting ones. Some international organizations produced some guidelines about elections that explicitly take into account electronic voting ([United N ations 2005], [ComVe 2002]). It seem s that international organizat ions consider electronic voting as a tool which may aid in making elections more peaceful. For m any ye ars, the se organizations have been confront ed wit h major disorders in polling stations, including voter i ntimidation, ballot stuffi ng, ballot box replacement, etc. Voting computers woul d seem to be a radical solution for such problems 6 . II - Obstacles to a supranational organization of vote Many obstacles present themselves when an attempt is made to define a unique set of precise rules which may be applied to the orga nization of a democratic e lection, or a unique voting system tha t could be used by several different countries be cause an electronic voting s ystem is a highly comp- lex, multi-dimensional object. II.1 - Cultural Obstacles Traditions are different in different countries, including differences in voting activit ies. These voting traditions include, for example: - the format of the ballot: while ma ny count ries use an A ustralian ballot, a French voter still votes by choosing one ba llot which holds the na me of the candidate or the list t hat s/he prefers. Australi an ballots can present also di fferent aspects: pe ople have to write numbers or to fill a circle or to m ark a column, etc. Any change in these habits can have huge c onsequences and may change the result of the vote 7 . - the susceptibilit y to fraud depends strongl y on the history of the country. Italy encounters ma ny problems because of the informal mafia; in France, before the obligation to use transparent urns , ballot stuffing was common. Young democraci es with a little experience of voting proc edures are not sufficiently aware of these possibilities for fraud and are therefore unable to take m easures to minimize them. - different vot e couting systems are in use: For example Run-Off V oting is us ed in France, Ireland uses Single Transferable Vote, G ermany uses Mixed Mem ber Proportional, Norwegians vote wit h an Additional Member System, etc. - in addition t he organization of t he polling office ca n take many different form s depending on the size of the poll s, the number of urns , the number of officials, the possibility for the voters to actively partici pate in the orga nization of the polling day (in France, in each poll office, vot ers usually count the votes at the end of the poll day), the counting process, the totalizat ion process, the publication of the results, etc. Differences may exist eve n within a single country: in France the publication of the results is very different from a city to another. Some make public t he det ailed results (poll by poll) including the numbers of procurations and signatures on the registry to control the uniqueness of each vote, some others publish only the number or the percentage of the vote s obtained by each candidate. The introduction of a new voting proc edure should be prepared by an a pprenticeship based on the practical knowledge people get, and targetted to the diffe rent c ategories of population that have to manage wit h the ne w system: citizens, el ectoral organi zations, judges, lawyers, et c. The a ctual lac k of knowledge makes the people worrying about false problems. but incapable of de tecting and diagnozing eventua l real mal functioning. This s ituation is ve ry risky because if a real problem occurs and is not detected in time, the consequences coul d be huge, technically (if ballots are spoiled for instance), thus politically, considering t hat an election can not be done again. 6 This argument is explicitly used by suppliers to convince their customers. On the web site of the manufacturer Unisys which equippe d Brazil, we can read a declaration of Paulo Cesar Camarão, Inf ormation Technology Director of the Electoral Supreme Court, saying “One of the principal benefits of the solution is that it ha s completely eliminated the chance for fraud in our elec tions ” 7 In 2007, in Scotland, local elections and scottish parliament electi on took pace the same da y). T he usual ballot format has been adapted to this double election, this ne w ballot caused confusion for several thousands of people whose ballots had been invalidated. II.2 - Ontological Obstacles Eliminating human i nvolvement in the voting tabulation appears to be a protection against fraud, errors or m isbehaviour. The human ris k is then repl aced by technol ogical risk that ca n be statistically evaluated. This approach is usual in many areas including technological innovations like fast trains, nuclear power plant, et c. But, in this analysis, the complexit y of ele ctronic vot ing sys tems has bee n undere stimated because two major dimensions of this object were ignored. Firstly, such sys tems are supported by com puters which are not stable. T here are constant updating a nd upgrading (on s oftware, drivers, periphericals) that make it almost impossible to follow the cl assical certification approac h because a certified object should be recertified each time it is modifi ed. Secondly, the laws that decide the rules for voting are also susceptible to change, forcing the voting s ystem to be quickly adapted to the new law. This potential c onstant e volution (elec tronic and legal) of an electronic voting system consti tutes a n high level of risk that is not met by any other tec hnological object. II.3 - Legal Obstacles The common voting criteria that are defined by the Venice Commission are very poor and do not fix all the parameters of the voting process. The e-poll project cites this six principles "of Europe’s electoral heritage": Universal suffrage, Equal suffrage, Free suffrage, S ecret suffrage, Direc t suffrage, Frequency of e lection. These criteria are far from being sufficent to define the conditions that must be in place in the organiza tion of a democratic election: there is no word about transparency and the necessity for t he voters themselves to control the election and eventually contest the results [Enguehard 2008]. Elections depend on the respect of fundamental values w hich have not been enough precisely defined in Europe. The European Convention on Human Rights defi nes t he right to vote for every citizen but does not inte rfere in the electoral contentious affairs that could lead to invalidate an election. This t ext is only a framework and does not give any information about how to conduct an election. Therefore the European Court on H uman Rights is not competent on elections. The Veni ce Commi ssion does not define e xplicitely t he essential independance of the organisationnal body in t he case of e lectronic voting. This que stion is cruci al because it is impossible to check whether a computer is i ndependent or not. In additi on this commission confused mechanic al a nd electronic voting m ethods and thus produced recommandations on e-voting that are not operational. For example, the principle 43 states "Electronic voting methods must be secure and re liable" and gives s ome definition of re liability a nd security but do not precise how t he level of security and reliability should be evaluated. The principale 44 adds that "the system’s transparency must be guaranteed in the sense that it must be possible to check tha t it is functioning properly." but the range of t his transparency and the conditions to get an effective transparency are not enonciated. II.4 - Political Obstacles Introducing electronic voting causes deep changes in the ha bits a nd right s of t he citizens w ho may, therefore, be unwilling to accept this evolution. In France, in addition to the officia ls, traditional polls are under the eyes of scrutinizers, official delegates from pa rties and m agistrates, the counting is directly process ed by citizens. The introduction of e lectronic voting simpl y suppressed scrutinizers while officials, official delegates from parties and magistrates can no longer control anything except what the voting computer accepts to display or print. This lac k of popular, polit ical and legal invigilation contributes to dimini sh the confidence in the electoral system. We have a lse to note the resurgence of re gionalism in E urope, since t he 1980s w hich is a political translation of the cultural differences [K eating 2003]. III - Limits Many inte rnational assessment missions took place in count ries where electronic voting systems are in use: DRE voting systems 8 , VVAT voting systems 9 , or internet voting systems 10 . III.1 - Limited observations on DREs Several observation mission did took place in countries using DRE voting machines. The lack of transparency of t hese new technological systems did not alert the international observers at the first stage because their guidelines did not include t hese new objects. While UEM do not say a word about ele ctronic voting in i ts observation guidelines, the ODIHR/OSCE upda ted its Election Obs ervation Book, in an e ffort to take i n account the apparition of electronic voting in its fifth edit ion in 2005. Becoming conscious of the inobservability of DRE voting computers, the ODIHR/OSCE sent an expert mi ssion in 2006 in Belgium "to increase [it s] com parative knowledge of e-voting sys tems, also with a pers pective on how to most effectively observe such processes. " This report express clearly that "observation of the e-voting system is de facto limited to an analysis of t he security mechanisms in place, and to an observation of their i mplementation." [odihr/OSCE Belgium 2006]. III.2 - A case studies: the Voter-Verified Audit Trai l (VVAT) A VVAT voting computer presents t o each voter a pri nted vers ion of its ballot in order to give him/her the possibility to c heck that it complies with his/her choices. These ballot papers are kept in a urn, so there is a t heoritical possibility to verify the results of the computers by counting manually the content of the urn. The main idea is t hat only a part of the urns would have to be recounted (to save time and money). Many international organizations produces documents that tend to give favor to VVAT voting computers. The Venice Commission 11 expressed "electronic voting should be used only if it is safe and reliable; in particular, voters should be able to obtain a c onfirmation of their votes and to correct them, if necessary, respecting secret suffrage; the system must be transparent ;" but i t did not give any operational definition of transparency to defi ne what should be transparent to who. The ODIHR/OSCE stat ed "In the absence of a paper trail , which could allow the voters to verify the accuracy of their vote, and would provide for possibilities of a paper recount in case of doubt, there is no way the above mentioned aspects can be dire ctly observed." [odihr/OSCE 2006] The ODIHR/OSCE observation book s imply warns to be aware of "Electronic voting systems with no vot er-verified audi table paper trail or other manual audit capacity.", letting think that electronic voting systems with audit capacity are a cceptable.[odihr/OSCE 2005] All these guidelines have been conceived in re action to the opaqueness of t he DRE voting computers and ha ve been built on a consens us between the participants without working towards a 8 Presidential el ection in USA [odihr/OSCE USA 2004], federal election in Belgium [odihr/OSCE B elgium 2007], presidential election in France [ odihr/OSCE France 2007], parliamentary elections in N etherlands [odihr/OSCE Netherlands 2007] 9 Parliamentary elections [EU E OM Venezuela 2005] a nd pr esidential elections in Venezuela [EU EOM Vene zuela 2006] 10 Parliamentary elections in Estonia ([odihr/OSCE Estoni a 2007] 11 which confuse mechanical and electronic voting methods , ignoring the ontological difference of these two objects. complete analysis of the new system t hey favor, following the same approach that let the DRE systems been deployed without any reaction. An analysis of The VVAT reveals tha t there is a complete lack of s afeguards to fram e this re count possibilities: the VVAT process is verifiable that is fa r to mean verified. Technically, i f its results are not verified a V VAT is equivalent to a DRE voting computer, inc luding all the D RE defaults that are now well known 12 . So, VVAT voting computers prete nd t o im prove t he reliability of the voti ng proc ess. A ctually, if there is no recount, there is no reliability. At l east the right to recount should be unforce by law. Thus, obs ervations must precisely conc entrate their at tention on the real verifications that are made and the y must deal with com plex questions that imply l egal, organi zational and technical dimensions. For instance, it s hould be decided what s hould happen, if a voter claims that the printed ballot paper does not reflect her/his choice (will s/he be believed, being unable to prove her/his intent?). How, when and by who are chosen the computers whose results are audited? Who do recount manually the ballot papers? Are the ballot papers counted just after the ele ction and in the poll s tations, or days after election in another pl ace? Who can a sk for a recount and obtain it? Legally, what should happened if the ballots counti ng differs from the automatic counting? etc. These questions are not yet t aken in account as is evident from the observation mission that was deployed for the parliamentary election in Venezuela. V VAT com puters were used t o vot e but the observation mission did not pay enough attention to these questions [EU EOM Venezuela 2005]. The second mission, to a presidential ele ction, just noted a few percentages relating to the increased number of polling s tations in which the voting re ceipts were counted but were not present to observe whether the choice of the machine was really ra ndom or whether best securit y practices were adhered to during the transportation and recount of the ballots [EU EOM Venezuela 2006]. Finally i t should be kept in mind that even if the right to rec ount becomes guarantied, real recounts will become more and more rare because, historically, we can see that once a task is done by computers, humans c ease to m anage i t. VVAT c omputers have been build to conquest the lost confidence of the voters. Voters will as k for recounts unt il they recover their confidence in t he voting system, and then, once the confidence back, the y will stop to ask for recounts. III.3 - A case studies: the e-poll project The e-poll project was one of the e-en project founded by Europe. This project is ba sed on the Venice Comm ission whi ch reflects the consensus between the partipant countries. We did not find any deep ana lysis about the feasability of t his project. It is a kiosk system, allowing people to vote from any poll station. Biometry is used to identify the voter. T he system prints a receipt to give the voter an insurance that his/her vote has been taken i n account. Experian, the com pany responsible for the "Regulations and Specifications" working pac kage had several experiments in electronic voting. It organiz ed the vote for the French living abroad in 2006. One of t he reports, published by an expert who a udited the system during the vote period, revealed that there were no safeguard to close poll stations where only a very few voters (one or two) had been previously re gistered. T hese poll stations opene d despite the risk of not respecti ng the confidentiality of the cast vote [Pellegrini 2006] . In fact , during the vote period, Experian suddenly became aware of this probl em and decided to cl ose several pol l stations wit h a few registered vote rs (Kabul, Banda ar, Riga, Skopje Tbili ssi, Reykjavik, Col ombo, Ulan-Bator, etc.), destroying t he few votes that were al ready cast. Voters were not informed that their votes had been canceled in t his operation. The option of voting from any polling station, whi ch e lectronic voting systems may offer, can lead to similar problems. If all the countries in Europe are taken into account it is strong possibility that a 12 A VVAT computer is a DRE computer with a printer and a process to conduct the ballot paper to the urn. This additional features may breakdown and thus, fragilize the e ntire process. citizen of a country with a sma ll populat ion might well be the only voter taking part in hi s national elections from a particular foreign polli ng station. A court case revealed t hat during the same election doz ens of citizens voted with the sam e computer. The decision m akes clear that the judge did not realize that this "group voti ng" reveals a loss of confidentiality [Conseil d'État 2007]. This ca se is a simple example which shows that t he poor capability t o antici pate problems is often a characteristic of e-voting impleme ntations. In addition, the capac ity to identify the voter, register its vote and respect the confidentia lity of the vote cannot be dem onstated to voters. Generally s peaking, this project does not consider the crucial dimension of transparency, des pite its strong involvement in legitimating the res ults of the election process. Finally, e-poll claim s t hat i t is "fostering the active partic ipation of the population in the voting process", whereas all the experience of t he last 15 years shows that electronic voting does not increase t he turnout rate. Actually, opposite to an "active participation", this system deprives citizens of the right to control the voting proces s, forcing them to a passive attitude. This project presents has many other deficienc ies that can not be detailed here. Conclusion Many governm ents which fa ce a strong pol itical opposit ion are waiting for the international organizations to standardize vot ing procedures and ele ctronic voting s ystems, even if s everal scientists cl aim that the defined standards present serious problems and that such certification procedures do not s olve the majority of security or usabilit y problems [A lexander 2004], [Mulligan 2004], [McG aley 2006], [Barr 2007] . U ntil now , int ernational organizations limit themselves to a search for political consensual positions which make up only a minimal set of t he conditions that are necessary to ensure democratic elections. In addition their ass essment missions a re limited to observing only what is defined in this incomplete cons ensus, while ignoring more pertinent criteria. With the case of the e-poll project we saw how Europe fails t o protect the citizens' interests because of the lack of definition of a precise set of fundamental rights. Such a goal can be attained only through negotiation because some countries would have to change to conform the new rul es, and not by consensus. The e conomic di mension is also at stake bec ause elect ronic voting is now a m arket whose interests may not be the same than the citizens' ones. References [Alexander 2004] Kim Alexa nder, "T he Need for Transparent, Accountable and Verifiable U.S. Elections", A Framework for Understanding Electronic Voting, 2004. [Barr 2007] Earl Barr, Ma tt Bishop, and Mark Gondr ee, "Fixing Federal E-Voting Standards", Communications of the ACM. Vol.50, N°3. March 2007. [Beaulieu 2006] Alain Beaulieu. Les ratés de s élections munici pales. Magazine Direc tion informatique, décembre 2005-janvier 2006. [Birdsall et al. 2005] Stéphanie A. Birdsall, W illiam F. Birdsall. Ge ography matters: Mapping human development and digi tal acc ess. First monday, peer-reviewed journal on t he internet , vol.10, number 10, October 2005. [ComVe 2002] European Commission for democracy through law (Venice commission), "Guideli nes on elections", July 2002. [Conseil d'État 2007] Conseil d'État, N° 294889, l ecture du vendredi 10 août 2007. [Enguehard 2008] Chantal Enguehard. Transpar ency in Electronic Voting : the Great Challenge. I nternational workshop on E-democracy - State of the art and future agenda, S tellenbosch University, South Africa, 22 – 24 January, 2008. [EU EOM Venezuela 2006] European Union Election Observation Mission, "Presidential Elections Venezuela 2006 Final Report", 2006. [EU EOM Venezuela 2005] European Union Election Observation Mission, "Parliamentary Elections Venezuela 2005 Final Report", 2005. [Keating 2003] Keating, Midhael & James H ughes ( eds.). The Regional Challenge in Central and Eastern Europe. Ter ritorial Restructuring and European Integration. B ruxelles: P. I. E. – Peter Lang. 2003. [McGaley 2006] Margaret McGaley, J . Paul Gibson,"A Critical Analysis of the Council of Europe Recommandations on e-voting", Electronic Voting Technology Workshop, Vancouver B.C., Canada, August 1, 2006. [Mercuri 2000] Rebecca Mercuri. Elect ronic Vote Tabulation C hecks & Balances. Ph.D. dissertation, School of Engi neering and Applied Science of t he U niversity of Pennsylvania, Phi ladelphia, PA , October 27, 2000. [Mercuri 2002] Rebecca Mercuri. "A Better Ballot B ox?" IEEE Spectrum Online , October 2002. [Montgomery County Election Board 2005] Montgomery County Election Board's report, "2004 Presidential Ge neral Election Review: 'Lessons Learned,'" [Mulligan 2004] Deirdre Mulligan, Joseph Lorenzo Hall, "Preliminary Analysis of E-voting Problems Highlights Need for Heightened S tandards and Te sting" in Electronic Voting Best Practices A S ummary. based on the Symposium on Voting, Vote Capture & Vote Counting, Kennedy School of Government Harvard University, June 2004. [odihr/OSCE 2005] odihr/OSCE, "Election Observation Book", fifth edition, ISBN 83-60190-00-3, 2005. [odihr/OSCE Belgium 2006] ODIHR OSCE, Expert Visit on New Voting Technologies Loca l Elections Kingdom of Belgium , 8 October 2006. [odihr/OSCE Belgium 2007] odihr/OSCE, "Belgium Federal Election, 10 June 2007", 19 October 2007. [odihr/OSCE Estonia 2007] odihr/OSCE, "R epublic of Estonia parliamenta ry elections 4 March 2007 OSCE/ODIHR Election Assessment Mission Report", 28 June 2007. [odihr/OSCE France 2007] odihr/OSCE, "France P residential Election 22 April and 6 May 2007 OSCE/ODIHR Election Assessment Mission Report", 4 October 2007. [odihr/OSCE Netherlands 2007] odihr/OSCE, "The Nethe rlands Parliamentary Elec tions 22 November 2006 OSCE/ODIHR Election Assessment Mission Report", 12 Mar ch 2007. [odihr/OSCE USA 2004] USA 2 November 2004 Electi ons - OSCE/ODIHR Needs Asse ssment Mission Report, 7-10 September 2004 , Warsaw, 28 September 2004. [Pellegrini 2006] François Pellegrini, "Rapport d'observations", juin 2006. [Shelley 2004] Shelley, Ke vin, Secretary of St ate Kevi n Shelley Brings In Team of Experts to Help Manage Federal Voter Funds, October 8, 2004. [Simons 2004] Barbara Simons, " Electronic Voti ng Systems: the Good, the Bad, and t he Stupid ", AC M Queue vol. 2, no. 7 - October 2004 . [United Nations 2005] United N ations, DECLARATION OF PRINCIPLES FO R INTERNATIONAL ELECTION OBSERVATION, New York, October 27, 2005.