The U.S. election is playing itself out even as I write this. While the final result is not known, we do know that computer-based system could have improved voting immensely. At the very least, the vote counts could be known within seconds of the polls closing. The act of voting could also be made clearer, faster and less error prone. The need for the infamous “butterfly” ballot could have been eliminated entirely.

This column outlines a system design to do that. As you may expect, it is not a simple problem. There are three major elements:

• The GUI design
• The Interface design
• Security Issues

Some general principles apply to whatever GUI design is used:

• The GUI is simple and consistent
• Always give feedback to the voter
• The voter can change their mind at any time, until they finally accept all their choices and submit their ballot to be counted.
• The voter can navigate easily to any part of the ballot at any time.
• The GUI must be able to provide help in a variety of languages.

The Interface Design element takes into account the following:

• The device the voter uses may be local to the polling station or remote, as in overseas or on the Internet.
• The voting device needs to be able to work online or offline. Thus, both store and forward and straight client/server architectures should be supported.
• The Interface Design must be tolerant of component failure.
• The Interface can be used by people who are visually or otherwise impaired.

Security issues are very real in this new Internet and computing age. These security issues include:

• Only registered voters get a ballot.
• The system should be auditable so all parts of the system can be verified to be working as intended. This implies that the system itself needs to be Open Source so as many eyeballs as possible can check for security and other issues.
• Voting early and often should be detectable without compromising which voter cast which ballot.
• Voting over a network, spoofing is detected and discarded.
• The resultant database can not be corrupted or changed, other than through legitimate means
• Reports can not misrepresent the actual data.

Because of this litigious age, changes in the ballot must be accommodated up to the last minute, as allowed by law. This need to accommodate change will affect all other aspects discussed so far.

There are four possible types of selection: 1 of n, like voting for president; m of n, like voting for 3 board members out of a slate of 7; and n of n, where a voter can vote on any or all 15 propositions. For any type of selection, “None of the Above” is allowed. The fourth type of selection is along strict party lines, with allowances to override specific issues and candidates.

State laws determines who and what can appear on the ballot, in what order people and propositions appear, and whether check boxes are on the left or right side of names. Also, some states allow for write-in selections.

What is not allowed for in most state laws is what happens when more choices are available than can fit on a screen or normal polling device. The issue here is whether the position on the ballot prejudices the vote. For example, do you want your favorite proposition to be the last one of 37 on the third page of propositions.

The GUI is just one aspect of the interface with the voter. We can also use audio feedback where voice commands are used to make selections and the choices are spoken back to us. Whether to use male or female voices is then an issue, particularly if different languages are possible. Also, unless we have highly directional and limited range sound or headphones and mike, we have a privacy and security issue using an audio interface.

For the visually impaired voter, a magnifying glass may be part of the interface to increase the size of parts or the whole of the screen.

For novice voters or those that have never used a similar system, tutorials should be available, usually immediately after selecting the language for the ballot.

The election board may also choose to include pictures or video clips of the candidates, their families, pets, guns, dead relatives and anything that the candidate’s political advisors say is an “at home” touch. Why, we could even include a selection where the candidate states their position on any given issue.

The use of the magnifying glass, audio I/O, pictures, etc should be made part of the preferences that appear as part of the GUI.

A voting token consists of a uniquely encoded key. Each registered voter can receive one or more tokens from a set of tokens for that voter, but only one token of the set can be used. Voting tokens can be sent by mail, email, fax or given out at the polling station. Upon starting the voting process, the voter is asked to enter the token manually or through a reader. The token is valid until the voter casts their ballot, at which time, all tokens in the set is marked as used and kept in a “Used” database. Thus, the number of tokens must match the number of ballots cast.

The voting token consists of a precinct, county, state, time and date of issue, media code, and a unique serial number as a minimum. It can also contain the voter’s name and address. The voter token is kept entirely separate from the actual ballot information. Think of a voting token as a key a house and the ballot as the contents of the house.

It is tempting to track ballots and voting tokens with place and time stamps, but that allows for matching who votes and what they voted for. However, the secrecy of the vote may need to be balanced with the need to avoid fraudulent ballots. For example, how do you protect against ballot box stuffing? Normally, you would match polling place attendance lists against votes cast.

The database must have distributed capabilities; transaction processing with commit and rollback; the ability to encrypt individual pieces of the information; and, various levels of security. The transaction facility ensures that if the system fails for any reasons, at most, only one vote will be lost. Encryption ensures votes remain secret. The security levels help ensure only authorized personnel have access.

Design choices include: is there one encryption key for the whole database or for each individual ballot or for each precinct? What happens if the decrypting key is lost. How do we protect against this?

The falling fortunes of the dot coms and the uncertainty of the election results, even before the election, have affected the jobs figures. While the number of jobs offered has fallen since April, the decline has leveled off. Chart #1 shows the normalized job trends over the last eleven months. Ordinarily, things that don’t change are not very interesting. But in this case, the fact that things have leveled off is good news.

(Note: Chart #1 is normalized for the number of jobs in January of this year. That is, the number of opening in January 2000 has been taken as 1.00.)

Over the last 18 months, a number of platforms have competed for dominance. One of the interesting aspects of this is how fast demand for the main platforms has been growing or shrinking. Demand is defined as the rate of acceleration/deceleration in the trend line for the period shown. From Chart #2, we can see that demand has been slowing for the older platforms, while the newer ones, like Windows 2000 and Linux has accelerated faster than all others. Again, the exception to the rule is Solaris. It is right up there with the newbies. This indicates that Sun is increasing its dominance of its markets. These demand lines are positive at the moment because of the long period of expansion. Over the last 30 days, demand for all platforms has followed the general trend and decelerated. However, the short term has not yet outweighed the long term demand.