Keywords

1 Introduction

Although the ability to vote privately and securely in elections is a foundation of many societies, people with physical or cognitive disabilities often find it either impossible or extremely difficult to vote. The 2002 Help America Vote Act (HAVA) recognized these concerns as a significant problem to American democracy. HAVA required that new voting systems be developed to accommodate all users and allocated federal funding to foster the design and development of accessible voting technologies [1].

In order to interact more effectively with technology, users with physical or cognitive, learning, or attention related disabilities (e.g., blindness/vision impairment, hearing impairments, motor/dexterity impairments, dyslexia, ADHD, etc.) use specialized assistive technologies, which are often further modified to meet their unique needs. These personal assistive technologies allow users to input and receive data from devices in formats that are easier for them to control and manipulate. Common examples of assistive technologies include: screen readers, screen magnifiers, joysticks, touch screens, sip-and-puff, foot pedals, trackballs, and two-button switches. Therefore, the voting process should support the use of personal assistive technologies to allow voters to use devices that are comfortable and familiar to them. These accommodations present security implications that need to be explored and addressed.

2 Security Concerns for Accessible Voting

Because efficient and ethical elections are a cornerstone of democratic societies, questions of both voting security and accessibility need to be addressed. For example, the Committee of Ministers of the Council of Europe published a recommendation to member states on legal, operational, and technical standards for e-voting [2]. In the United States, the Elections Assistance Commission published the Voluntary Voting System Guidelines (VVSG) 1.0 for designing usable voting systems [3]. In the VVSG 1.1, a proposed revision to the 2005 guidelines, the Election Assistance Commission outlined a number of threats to voting security that must be addressed before an election reaches “acceptable levels of integrity and reliability [4]”. Security recommendations based on these issues include:

  • Identifying voters (e.g., making sure that only authorized voters can vote);

  • Controlling access (e.g., making sure that only authorized election officials can access certain processes and/or data within the voting system);

  • Maintaining data integrity (e.g., making sure that the selections entered by the voter on the ballot marking device match the data generated by the ballot counting device);

  • Preventing data manipulation (e.g., making sure no one is able to modify, insert, or delete data in the voting system after a ballot has been submitted);

  • Securing data transmission (e.g., making sure a voter’s confidentiality is protected during the transmission of data);

  • Ensuring voter privacy (e.g., making sure that a voter’s identifying data and election choices cannot be linked at any point during the election process);

  • Providing an auditable trail (e.g., making sure that data exist for voters and auditors to validate the results of an election); and

  • Protecting against external threats (e.g., making sure that voting systems are protected from any viruses, malware, or hackers).

A number of potential accessible voting technologies have been developed in order to accommodate all users and to maintain the integrity of elections. These designs and ideas can be split into three categories:

  1. 1.

    Designs for building universal voting systems (i.e., designing new voting stations and ballot counting devices that are accessible to all voters);

  2. 2.

    Designs for incorporating voters’ personal assistive technologies at polling places (i.e., allowing voters to connect their own technologies and devices to voting systems at the polling place); and

  3. 3.

    Designs for allowing voters to vote remotely using their own devices (i.e., allowing votes to be cast from personal devices outside the polling place).

While each of these designs has the potential to enable more people to vote, they can sometimes effect security. In the sections below, we present examples of designs proposed for each of the categories listed above and discuss security implications these proposed solutions present.

2.1 Security Concerns with Accessible Voting Systems

Most currently deployed systems, including direct-recording electronic systems, do not meet HAVA disability accommodation requirements for a number of reasons, as discussed by Runyan [5], e.g., the lack of dual-switch input control interface for voters with severe manual dexterity disabilities; inadequate audio access features for voters who are blind or have low vision, cognitive impairments, severe motor impairments, or learning or attention related disabilities (e.g., dyslexia or ADHD); lack of simultaneous and synchronized audio and visual outputs; lack of voter-adjustable magnification; and inadequate privacy curtains around the booth, etc. Furthermore, when Swierenga and Pierce [6–8] analyzed several voting systems with accommodations, they discovered considerable issues that would prevent many users with disabilities from being able to successfully use the systems. For instance, users operating one system via the two-button interface designed for people with manual dexterity issues would have to press a button over 1,200 times to complete the NIST Test Ballot without making any errors.

New voting systems and technologies are currently being investigated, and these voting systems would replace existing systems in polling places that do not adequately address accessibility concerns. For instance, the Smart Voting Joystick prototype could be used as a universal input device for an accessible voting system [9], and the Prime III system research project is exploring a multimodal approach for providing equity in access, privacy, and security in electronic voting [10, 11]. In addition, Los Angeles County is attempting to develop a universally accessible system for the nearly 4 million registered voters in Los Angeles [12].

Although questions of security have yet to be specifically addressed in these new designs, it is likely that these new systems can be built using similar security protocols and strategies to those already employed by contemporary voting systems. However, replacing voting systems is a slow process and may be cost inhibitive to many precincts, and it is likely that the implementation of these systems may have a longer timeline due to these financial and infrastructural costs.

2.2 Security Concerns with Personal Assistive Technologies Used at the Polling Place

In order to avoid some of the unique security concerns that stem from remote voting (see next section), some researchers have proposed allowing voters to bring personal assistive technologies and/or their own mobile devices to the polling place to be used in the voting process. In these instances, voters would interface their personal assistive technologies or devices directly with ballot marking or ballot counting machines, reducing the strain on local election officials to provide accommodations and support to all voters. While some alternative input devices (such as two-button switches and sip-and-puff) may be available at polling places, they do not cover the range of needs that potential voters may have, and may in fact make the voting process more difficult for many voters with dexterity impairments. Allowing voters to use their personal assistive technologies has the potential to reduce user error, since users are already familiar and comfortable with the technologies [13].

However, whenever two devices are directly connected, potential security risks of virus transmission and/or hacking exist, especially when one of the devices is a ballot marking or ballot counting machine that may be used by subsequent voters. Most existing designs for directly connecting personal assistive technologies (and their software drivers) to election systems would rely on using a USB connection. Although efficient, USB connections are not immune to attacks (both intentional and unintentional). It is feasible that voters could, knowingly or unknowingly, transmit malicious software from their personal assistive technologies or devices into election systems during the connection, and/or use the direct connection as a means to manipulate election data or election processes, thereby compromising the integrity, privacy, and security of the election.

Assistive technologies also present security risks simply because of how they interact and work with operating systems. Some assistive technologies can programmatically drive the operating system and other applications based on input from the user. In order to do this, assistive technologies need to be able to access processes that run at a higher integrity level (IL), including protected system user interface elements [14]. Allowing assistive technologies to have access to these processes on election machines, therefore, may give users access to otherwise confidential system elements. However, this access would not compromise election integrity if the software is well-designed, or runs on a secure operating system.

2.3 Security Concerns with Remote Voting

To improve accessibility, some engineers and designers are considering products for enabling people to vote using their own mobile devices and personal assistive technologies, remotely. A Pew Research Center survey found that 42 % of American adults own a tablet computer and 58 % own a smartphone [15]. Thus, the prevalence of mobile devices presents a low-cost and immediately implementable pathway for accessible voting. Additionally, enabling remote voting would remove one of the largest constraints imposed by polling places; namely, the need to travel to a particular destination and wait for the necessary equipment in order to vote, which is a significant issue for individuals with disabilities [6, 16].

A number of designers and researchers have attempted to leverage the prevalence of mobile technologies to enable remote voting and the use of personal assistive technologies and devices to vote. Examples of these projects include the Anywhere Ballot [17] and the EZ Ballot [18], and Michigan State University’s mobile user interface design specification [19]. However, remote voting poses an additional and controversial burden on security. After the U.S. Department of Defense piloted an Internet voting program with deployed military members called the Secure Electronic Registration and Voting Experiment (SERVE), a number of computer scientists and researchers were quick to point out the security risks posed by such a system [20]. Specifically, they criticized SERVE for: (1) no voter-verified audit trail and the potential for insider attacks, (2) lack of privacy of encrypted voting data, (3) vulnerability to election corruption on a large scale, (4) lack of control over the voting environment, and (5) potential for vote buying and selling. This analysis of security risks concluded that Internet voting cannot be made secure with current technology.

Other computer scientists have echoed similar thoughts, including David Jefferson, who argued that, “There is no way to guarantee that the security, privacy, and transparency requirements for elections can all be met with any practical technology in the foreseeable future” [21]. In 2008, the Verified Voting group released their Computer Technologists’ Statement on Internet Voting which listed five technical challenges they felt must be overcome before secure internet voting is possible [22]. These challenges include: (1) the voting system as a whole must be verifiably accurate in spite of the fact that client systems can never be guaranteed; (2) there must be a satisfactory way to prevent large-scale or selective disruption of vote transmission; (3) there must be strong mechanisms to prevent undetected changes to votes; (4) there must be reliable, unforgettable, unchangeable voter-verified records of votes; and (5) the entire system must be reliable and verifiable.

It is worth noting that not all of the designs referenced in this remote voting category require the transmission of data over the Internet. Some systems have users vote using telecommunication networks (i.e., televoting). While not identical, televoting faces similar security challenges to Internet voting. Additionally, other systems allow users to vote remotely using their personal assistive technologies or devices and then print a paper ballot that can be counted by already-existing ballot counting devices. These designs still must address security and accessibility questions of auditability for voters with visual impairments (e.g., how do users who are blind ensure that print-outs are accurate?) and questions of voter verification (e.g., how do systems know that the registered voter identified in the system is the one doing the voting?).

3 Designing an Accessible Mobile Voting System User Interface

Because of the complexity and multiplicity of factors surrounding both accessibility and security in voting, it is likely that any proposed solution to the question of how to make an accessible, yet secure, voting experience will itself be multi-faceted and complex. We will now discuss research we have conducted using an accessible mobile interface for voting, and how that interface could be used with personal assistive technologies in a polling place to provide a secure and accessible voting experience. While not the only potential solution to this challenge, we believe this can be used to demonstrate ways to move towards an election characterized by both integrity and accessibility.

Our research team at Michigan State University created a specification for an accessible mobile voting user interface [19]. This design specification was based on prior research for creating usable, accessible voting systems, including Laskowski, et al. [23], the U.S. National Institute of Standards and Technology (NIST) [24], Election Assistance Commission (AIGA) [25], Vanderheiden, Treviranus, Ortega-Moral, Peissner, and de Lera [26], Gilbert et al. [10, 11], Laskowski and Redish [27], Redish et al. [28, 29], and Swierenga and Pierce [6, 7]. These projects examined ballot interaction characteristics (e.g., selecting/deselecting options, multi-selection, overvoting/undervoting messaging), optical scan ballot design (e.g., displaying election information, ballot instructions, ballot navigation), ballot layout (e.g., typeface, type size, distances between elements, etc.), touch screen interaction design, voting using touchpads/button boxes, audio interaction design, plain language ballots and system messages, auto-personalization, usability and accessibility testing methodologies and standards, and more.

There are many challenges in designing an accessible voting system, and many more challenges in designing an accessible mobile voting system. Thus, we also drew from other mobile ballot design projects, including the Anywhere Ballot [17], the EZ Ballot [18], the Georgia Tech Research Institute voting ballot testbed [30, 31], Oregon’s alternative ballot format [32], Rice University’s research on voting using mobile touch screen devices [33], and Michigan State University’s voting system design research [6–8, 34]. These mobile voting system design projects focus on small screen design, touch screen design, on-screen instructions, and ballot interaction designs. However, our project was unique in that we specifically focused on making a system that was accessible to persons with dexterity and visual impairments, as well as voters who have limited or no experience with mobile technologies. We also attempted to balance accessibility requirements with security concerns throughout the ideation and design process.

3.1 Requirements for an Accessible Mobile Voting User Interface

Based on our research, we generated a list of general requirements for an accessible mobile voting user interface. The specifications were broken down into 14 design categories, including units and sizing, font and text, button size, button spacing, touch screen and gestures, color, system behavior, user selections, region consistency, focus order, focus visibility, selection visibility, auto-personalization, and hardware buttons. For example, in our research we found that all buttons (including slider and page up/down buttons in scroll bars) must be at least 20 mm in length and width and must have a visible solid border that meets color requirements; all functionality must be available via tap, the preferred and most effective gesture for individuals with motor skill impairments; and the system must support personalization by storing users profiles that hold information about user preferences and the device/assistive technology being used to customize the interface to meet the needs of the user.

The design requirements specified several ways of interacting with the tablet to accommodate different user groups according to their needs. These modes included: default visual layout (which accommodates a wide range of dexterity and visual impairments), screen reader, audio only, five button overlay, sip-and-puff, and external input. The external input mode provides for the use of personal assistive technologies that voters connect to the mobile voting device (in this specification, a tablet computer).

3.2 Design Feedback from Users with Disabilities

Using our interface specification, we built a functional prototype for a tablet computer and invited users with disabilities and assistive technology experts to provide feedback [19]. Both experts with disabilities and assistive technology experts expressed a keen desire to use personal assistive technologies, e.g., headphones, trackball, mouse, and refreshable Braille displays, in conjunction with the prototype. They also preferred to have the option to use the full range of touch screen gestures, instead of a limited set of allowed gestures.

For individuals with reduced dexterity, holding the tablet was determined to be a considerable strain, suggesting the need for a mount, however the angle and position must be customizable to accommodate individuals whose reach or height differs. For individuals with vision impairments, glare due to reflections and ambient lighting causes significant problems, which can be alleviated by allowing the angle of the screen to be adjusted and by providing appropriate shielding and placement. Using a matte screen (or adding a matte screen cover, if it does not interfere with touch screen sensitivity) was also recommended as a means to mitigate glare.

4 Using Intermediary Devices to Make Voting via Personal Assistive Technologies Secure

Based on our research as well as recommendations and feedback from potential users and subject matter experts, it is clear that allowing users with disabilities to vote using their own personal assistive technologies will significantly improve the accessibility of the voting process. However, we acknowledge that this can present significant risks to security. We therefore propose exploring the use of a secure intermediary (such as a computer or tablet) to translate the outputs of voters’ assistive technologies into secure inputs for stand-alone electronic voting systems. An alternative input device, such as a joystick, would be connected to the secure intermediary, and the intermediary would be connected to an electronic voting system. Personal assistive technologies would therefore never directly connect to voting systems, allowing these devices to be safely used at the polling place. The intermediary would convert the assistive device’s output signals into a simple, secure, and standardized output that can be fed into limited and sanitized (free of security threats) inputs for voting systems.

In addition, the intermediary can provide advanced functionality that would not otherwise be available, including custom control mapping, alternate keyboard support, automatic scanning, single button automatic scanning, user profiles, and can serve as an input device itself. Through the use of an open specification for input translation, simple configuration changes on the intermediary could immediately allow new or customized assistive devices to control existing voting systems.

5 Conclusion

Voting security and accessibility are crucial for enabling voters with disabilities to vote securely, independently, and privately. The three primary strategies for creating an accessible voting experience (i.e., building new voting machines with built-in accessibility components, interfacing personal assistive technologies with current ballot marking/ballot counting systems, and mobile/Internet voting using personal assistive technologies) all pose unique security risks. These risks include data security, data reliability, voter verification, and auditability, among others. Although there has been discussion on security in the mobile/Internet voting community, it has yet to be fully addressed within accessible voting system designs, despite being a major potential roadblock to allowing personal assistive technologies into the voting environment.

We propose the use of an intermediary device (e.g., tablet computer) as a secure “middle-man” between voters’ personal assistive technologies and official election machines to mitigate security risks. The intermediary device can also provide an alternative ballot design that adheres to our previously documented user interface requirements for accessible mobile voting interfaces that enhance the accessibility of the user voting experience. Security measures in intermediary devices would filter and prevent malicious attempts to interfere with or alter votes, acting as a firewall between the user and the voting machine. Hardware alterations to USB ports, for example, would enable only the use of control devices and not high speed data transfers.

We feel this concept will help move towards a secure, accessible voting experience for all users, and see the need for further research that explicitly explores the connections between accessibility, security, and voting, as well as a continued discussion about how to balance accessibility and security concerns in mobile/remote voting design.