An open letter to Larry Ellison

NY 23 is just one district among 435, but every district (and every county and state) has the same problem: states rights to the contrary, PL 107-252 (the 2002 Help America Vote Act) is widely seen as mandating evoting; all the popular evoting technologies follow the same model in which mechanical voting machines are replaced by customized PCs running voting software - and most of the problems encountered in New York 23 follow directly from accommodations made to fit a voting management process around this model.

The voting management challenge (which is not co-temporaneous for all voters) breaks down logically into three major stages: before the vote, during the vote, and after the vote.

The big problems faced by those compiling a list of eligible voters before the vote are verification and completeness: balancing the risk of disenfranchising eligible voters against the risk of enfranchising ineligible voters. Although actual processes vary on almost a county by county basis across the United States, most rely first on voluntary voter registration - a process that worked well when the population was relatively homogeneous, but now generally under-represents the educated employed (because it's voluntary) and over represents the uneducated, the unemployables, and the ineligible because these are professionally marshalled.

The people charged with collecting the vote must also verify eligibility immediately before issuing a ballot - and while that task is handled differently by those dealing with advance or absentee votes and those dealing with polling station votes, people in both groups face tremendous pressure to skew decisions on individual eligibility toward likely Democrat voters because of that party's national policy of suing on all close losses - something that often bankrupts their electoral enemies and threatens every electoral official not obviously a democratic partisan with having their personal lives, and family finances, destroyed through the courts and the press.

One consequence of this is that, particularly in counties, districts, or states where Democrats generally lose by small margins on election night, election officials tend to resign after each election - and this, combined with the drive to minimize the expense of running an election, usually means that most of the people making the decisions have no experience, little training, no chance to rehearse, and no one better off than themselves to call for help when things go wrong.

The vote counting phase is where the press sees most of the problems but, in reality, the occasional stuck printer and the reality or otherwise of e-cheats built into the voting machines would matter little if only genuinely eligible voters voted exactly once and the audit process ensured that all votes could ultimately be counted correctly. It's the weaknesses in the pre and post election processes, in other words, that put unusual stresses on the vote collection processes and thereby make it possible for people who find weaknesses in those processes to destroy the credibility of the entire effort.

Sun technology can help during all three phases - and virtually eliminate the problems affecting both vote collection and audit.

The basic components Sun would sell are:

1. all the software needed to make, present, count, and audit ballots - all as open source, and with a committment to its improvement through a Sun sponsored voting software foundation.

2. up to three pairs of servers per jurisdiction (typically county or state)

3. evoting terminals made by combining circuit boards and software from the 2FS Sun Ray with touch screens, a barcode reader, and a cartridge based roll printer - all in a single frame with no easily accessible components, keyboards, or ports.

4. integration, installation, support, and related software services including available, on call, expert testimony on the systems.

Each jurisdictional configuration would start with two systems, optionally locally redundant, in separate locations and primarily on different networks, managed by separate sysadmin teams of two with oversight by political appointees, each serving about half the Sun Ray based voting stations - with the databases on each set to replicate to the other in near real time with failover arrangements for each one to a third system run jointly by one sysadmin from each primary team.

State wide, and national, systems would be built up of these local systems.

In operation, voters would get a (self-authenticating) card with their names, addresses, and a 24 digit bar coded number on it identifying both the voter and the ballot questions the voter is considered eligible to respond to.

That card, when read on the terminal, would trigger the server to construct and display a ballot made up of the questions this voter is certified for and has not yet voted on.

As each question is answered, the system would record the vote, wait for write acknowledgment, mark the question as answered, and then wait for the next answer. On completion, card withdrawal, or a sufficient pause, the system would print a plain text summary on the paper roll, advance the roll, and write the same record to a database implemented using different technology on the shared (backup) server.

The benefits of this approach include:

• auditability and reliability: the Sun Ray software ensures that only authorized devices produce votes, that only the authorized application can write to the databases and paper rolls, and that the recorded data reflects the user's actions.

  Limited failures - of terminals, servers, networks, or sysadmins - will have no significant effect on counts or processes. Each server can be independently audited before, during, and after the vote - and results between the system records have to agree absolutely.

  Having the paper and ribbon rolls in cartridges inside the terminal frame makes them difficult to tamper with (as well as unlikely to jam) and testifies to the integrity of the paper trail needed for final comfort on the auditability issue - while writing the summary records to a different database technology on the backup machine protects against surprise software issues and sabotage.

• voter education: the overall process allows local electoral boards to set up web based practice sites for partisans on both sides to familiarize their voters with the ballots - and to set up one or more terminals for public access as training and familiarization aids prior to, or even during, the election.

• voter flexibility: this process allows the electoral board to issue most token cards in advance and thus allow voters to vote at any polling place they happen to be near on election day - even if that is an American embassy or base in another country.

  Aside from the obvious advantages this offers in terms of managing advance and absentee voting, the critical point here is that the system silently eliminates one of the most traditional ways of electoral cheating: having people swear in at multiple polling stations - a fraud that depends on the electoral board's expectation that the match between people showing up at polling stations and the subset of the list of eligible voters sent that polling station will not be perfect.

  More subtly, people with the right to vote in multiple jurisdictions can do so as long as each jurisdiction is using the Sun technology - and anyone who really wants to vote in multiple polling places can do so: but only once on each question.

• instant, accurate, counts: electoral boards can provide up to the second vote counts on each ballot question - broken down to any level that doesn't violate voter privacy.

  More importantly, the token issuance and verification processes for advance, absentee, and polling place voting can accommodate differing degrees of certainty about each voter's eligibility on each ballot question. In consequence results can be shown, at any time in the process, with or without votes cast by people whose eligibility is questioned by one side or the other.

  Notice, however, that this is a two edged sword with the rather nasty consequence that individual votes can be identified in this way. Significant legal controls exist to prevent this kind of information abuse now and will need to be reviewed as part of implementing this approach.

• low cost: total capital costs are comparable to, or only marginally less, than those for the traditional client-server approach - but things like simplified polling station management, easy on-line eligibility verification, and reduced training and turnover costs produce significant total process cost reductions for the customer.

One source of customer cost savings of importance to Sun derives from a fundamental difference between this approach and the traditional voting machine one: voting machines have to be stored between elections and, in effect, newly implemented every two years or so. The Sun solution, in contrast, is a specific application of a generalized system that can be used continuously - the voting stations, for example, are ideal kiosks for things like local license renewals and can, with minor (plug in/out) component change, be used in everything from schools to counter service at City Hall. Similarly the servers are general purpose - ideally equipped to handle public information services functions, but fully usable for almost any server function in the customer's data centers.

It's this system generality that drives Sun's profit opportunity here: not the chance to earn a few million selling to electoral boards, but the chance to put people, software, and a high stakes demonstration system into roles where they earn customer commitment from the git go.

There is a natural confluence of interest in this: Sun has the technology and the country needs it - because the customer may be able to justify the purchase on process cost savings, but the country's real bottom line on the Sun technology advantage here is elections that work - virtually eliminating audit, recount, and lawsuit costs while rebuilding credibility and public faith in the democratic process.