Chairman: Most of those questions were directed at Mr. Callan, so he might like to reply. He might also give the committee some indication as regards the contracts or commitments he has entered into on the introduction of electronic voting.
Mr. Callan: I am pleased to do that. Effectively, there is a contract with our suppliers for the provision of the 7,000 or so voting machines required to roll out the system countrywide for June 2004. The main contract is still awaiting signature, but I have said that the effective position is that the commitment is there.
Chairman: How does that operate? What sort of arrangement did the Department of the Environment, Heritage and Local Government enter into?
Mr. Callan: A letter of intent was issued last January from the Department of the Environment, Heritage and Local Government to the main suppliers. The final legalities of a contract have been sorted out and are ready for sign-off by both sides to the agreement. There would be difficulty if the Department were to withdraw, or to seek to withdraw, from the position it stated in its letter of intent last January, even though the formal signature of the contract has not yet been executed.
On some of the other points raised by Deputy McCormack, on the issue of the public's confidence or otherwise in the handling of elections in Ireland, it is the position since the foundation of the State that duties under the legislation pertaining to Irish elections are generally vested in the Minister for the Environment, Heritage and Local Government. The Department on a day-to-day basis carries those responsibilities. Mr. McCarthy is right in saying the Department is not usually in a position to run elections, but it provides the legal framework and guidance to all the statutorily deputed people at local level as to how they perform their functions. In recent years a number of functions as regards the electoral process have been hived off to statutory commissions. The Standards in Public Office Commission exercises a certain monitoring of the electoral process. The Constituency Commission is a statutory independent entity that deals with the preparation of new constituency boundaries. The Department of the Environment, Heritage and Local Government still carries executive responsibility for many of the systems and much of the co-ordination and support to local authorities and returning officers that is necessary for the good conduct of elections. As long as those functions are vested in the Department, we carry them to the utmost of our ability. If it is the wish of the Legislature to assign them to an independent entity, so be it; that will happen in its own time. We have to discharge our duties well and urgently.
Deputy McCormack again made a plea for the paper trail and I have set out the Department's honest judgment on this issue. It is felt in the Department that the paper trail will generate endless confusion because it will not be clear ultimately whether the electronically registered vote or its paper counterpart is the validly cast vote. I mentioned that only a small minority of electoral authorities worldwide which use electronic voting have adopted a paper trail. This illustrates that the presumption in the context of electronic voting is against the use of the paper trail. It is certainly a presumption that is manifest in the behaviour and the decisions adopted by those who are charged with the running of elections in all kinds of places over the world.
Deputy McCormack asked also about the capacity of presiding officers and poll clerks to deal with the new system. An essential part of the preparations already underway in the Department is training up staff from local authorities and, indeed, the registration authorities. As we move closer to the election we already have courses in preparation involving the Department and the IPA, which will brief these people very fully on their duties. There will be no fixing of the machine in polling station locations by anybody. The machines will be brought back securely to counting centres under the control of the returning officer.
My experts may wish to respond later to the points made in Mr. McCarthy's presentation, but I am under the guidance of the Chairman as to how to structure those responses. Perhaps other members may wish to speak first.
Chairman: We will take a few more questions and then later the Secretary General may give a general reply. We will deal directly with the questions as posed. We ask members to address the questions to whomever he chooses. Should Ms McGaley wish to make a general comment later that will be permitted.
Deputy Gilmore: The members of the committee will have ample opportunity to discuss these issues. What I would like to hear today is an exchange of views between the various experts who are assisting the Department and the people who have given their opinion to the committee. Mr. McCarthy queries the reliability of the software, the counting system and the issue of the paper trail. It would be informative for the committee to listen to the exchange betwen people who understand this business
Chairman: The committee system does not allow for the type of exchange advocated by the Deputy. We decided on a question and answer session. It is about, as Deputy John Bruton once stated, asking the right question. I cannot see other ways of proceeding other than the question and answer session as we agreed on last week.
Deputy Gilmore: In that case Chairman, let us hear from the manufacturers of the machines and its software on the points raised by Mr. McCarthy. Is it the case that this has not yet been tested for the European elections? What is the response to Mr. McCarthy's point that nobody in his right mind would use Microsoft Access for a critical system? We did not deal with what would happen in the event of a power failure. If somebody is in the process of voting and the power fails, has he voted or not? How does one check that? In particular, how does the presiding officer at the polling station deal with it? If somebody enters his or her vote and then the power goes off, it comes back on five minutes later, does the presiding officer given him or her another vote? How does the presiding officer check whether the vote has registered on the system?
Chairman: Does Mr. Callan wish to reply to that?
Mr. Callan: Chairman, I gladly invite our experts to respond to Deputy Gilmore. I will respond to the query on the European constituency counting rules because in a sense the Department is the custodian of the legislation involved. No testing has been carried out on the European constituency counting rules, because the rules are exactly the same as the Dáil counting rules, which have been assiduously tested. It would be duplication as we are talking about the same issue. We have been in test mode with the Dáil counting rules and there is no difference between them.
Deputy Gilmore: The trials on elections have been done in three constituencies with a total poll of approximately 60,000.
Mr. Callan: We are talking about the application of the counting rules. The logic of the counting rules is exactly the same. Our experts will answer the database issue and whether the system has the capacity to deal with bigger numbers. On the question of Microsoft Access, the PCs that will be used for counting will be security hardened and not networked in any way. Our experts will explain more on that. I will let the experts deal also with the power failure issue. Mr. Henk Steentjes will address some of these issues.
Mr. Henk Steentjes: On the question of what happens if there is a power failure in a polling station, the moment the voter casts his vote on the electronic voting machine or the ballot paper is going into memory, storage of the vote is done in a fast memory inside the machine. It completes the vote storage when power comes back on or a battery is attached to the machine. When the power comes back on again, the power storage in the module with all the securities involved is resumed and all checks are carried out to confirm that all vote storage was according to the rules. The presiding officer can easily see if the number of voters on the control panel display has increased, so he or she can easily see if the votes have been counted. If the power failure occurs before the voter presses the "cast vote" button, then the vote is not stored. That is also easily seen when the power comes back on because the number of voters, which is indicated on the control panel, will not have increased by one. That is the way we deal with this and it is a good and secure way.
Mr. John Pugh: We are happy that, with the security protocols that have been put in place around the system and its implementation, the Microsoft Access database is secure. We have subjected the database to tests and we are quite happy it can handle the level of data that is required.
Mr. Callan: The point deserves to be made that we will use Microsoft Access in stand-alone, security-hardened PCs, which are not networked or connected to any other system in any way.
Deputy McCormack:Following what Deputy Gilmore said earlier, if we keep asking questions and the ten witnesses keep answering them, we will not get anywhere because we are not the experts. Some of the experts are on the lower benches and they should ask the technical questions that we are unable to ask.
Deputy Gilmore: They could at least comment on what we have been told.
Chairman: Deputies can direct their questions. We had some of these experts with us last week and they raised concerns. There may be concerns of a technical nature but we have a fair grasp of what they are. If members wish to ask such questions or express those concerns, they should feel free to do so. We will proceed with a question and answer session.
Deputy Allen: We are not trying to obtain a technical assessment before buying a new car; we are talking about the validity of the democratic process, which is a very serious issue. The procedures are seriously flawed if the experts who have been invited here are not allowed to interact. I have reservations about the way in which we are doing our business. There should be an interaction between both lists of experts.
I must apologise, Chairman, that I was absent for much of the session, because I had to attend to business in the Dáil Chamber and a vote prevented me from returning to the committee earlier. I understand, however, that a question was asked about the status of the contract for purchasing the machines, which has not yet been signed. I do not think a question was asked about the status of the other moneys that have been allocated - for example, the public information contract for €4.5 million or €5 million that was entered into just a day before the Minister was asked to appear before the committee.
While I did not hear the question, I heard the answer about the verifiable paper audit trail but I am not convinced or impressed by the answer. Any system is flawed that lacks a facility to inform that it is allowing me to vote for candidate A if I press a button to vote for that candidate. Any system that does not have a paper trail is similarly flawed and I do not see any problem regarding voter confidentiality or confusion in this regard. The refusal to introduce a verifiable paper audit trail is based on penny-pinching over costs, rather than ensuring that the system is secure. I would also like to hear about the source code.
There are 41 questions that I have not yet read from Mr. McCarthy but each of them should elicit a written response. Until that happens, the whole mechanism should be put on ice. The headlong rush into introducing this system by June 2004 is indecent and unsafe. It involves the expenditure of massive amounts of taxpayers' money in a system that has not been approved by the committee. There has been little consultation about the issue, which has been pushed by the political head of a Department who is the director of elections for one party. That is democratically unsound. There may be a legal justification for the Department doing this but the matter should be swiftly reviewed. In the absence of answers to these questions and without a proper forum for a real exchange of opinion between experts on both sides, the Minister should state that nothing will happen next June until all the reservations and questions have been answered to everybody's satisfaction.
There are parties here that are representing many people who still have serious reservations. It is wrong for any democratic country to push through such a system about which some of the participants are unhappy. It flies in the face of democracy. I am asking the Secretary General of the Department to recommend to the Minster to put the new system on ice until such time as everybody's questions and reservations have been satisfactorily dealt with.
Chairman: I am reluctant to interrupt the Deputy but that is exactly what we have decided. Last week we wrote to the Minister and asked him to indicate what contracts had been entered into. We also asked that no further commitments should be made until the committee has concluded its investigation. The Deputy used the word "experts" on a number of occasions, although I am not sure if the people concerned would call themselves experts or not.
Deputy Allen: They are more expert than I am.
Chairman: We have to be fair and say that there are experts on both sides who have different opinions. Mr. McCarthy came in here with approximately 40 questions to which the Deputy wants instant replies.
Deputy Allen: No, I asked for written responses.
Chairman: The Deputy does not want us to proceed with the matter until such time as those questions have been answered. It is a really tall order to seek instant responses like that. The purpose of the meeting today is to ask pertinent questions of the experts on both sides and following that process we will decide how we should proceed. There is no point in going back over what we discussed at the last meeting, which was the same thing.
Deputy Allen: I asked for a written response to the questions put.
Chairman: If we confined the questions it would be more helpful to us all.
Deputy Allen: The artificial barrier that is between the four people at one end of the room and the six people at the other end should be eliminated so that there can be an interaction.
Deputy McCormack: We can overcome that because I want to ask----
Chairman: I am sorry but Deputy Cuffe is next.
Deputy McCormack: When I get a chance, I want to ask Ms McGaley a question.
Chairman:That is fine, you can do that.
Deputy Cuffe: There is a touch of Kafka to our deliberations this morning, including the method of questioning. I find it quite bizarre that we cannot ask the experts to quiz those in charge of the system. Having said that, the words "paper trail" have a deep resonance for all of us on the committee because they reflect tangibility. Do the experts from the Department not accept that there is strength in a paper trail? All of us with experience of elections are familiar with what ten, 1,000 or 10,000 votes look like. They are tangible and visible. Do the departmental experts not accept there is a huge difference between that and a single Microsoft Access file? Do they not accept that the possibility of interference with a computer file is completely different from the possibility of interference with a ballot paper? Are they not concerned about that issue?
The principle of double-entry book-keeping operates in the banking sector, so that the financial institution has a record and so does the individual account holder. If there is a difficulty it can be reconciled by examining both entries. Do the departmental representatives not accept that this principle is a good one that should be applied to the most important aspect of the democratic process, which is the issue of voting? I cannot understand why the principle of a verifiable record cannot be applied.
The third issue relates to technology. I receive a dozen emails every morning containing patches that I should attach to my hard drive. If I push the wrong button, I can do untold damage to my files. Does Mr. Callan accept something similar could happen to the technology he is using?
Reference was made at last week's meeting to a wireless card that can accept data in a stand alone PC and transform it. Mr. Callan said precautions are taken. Presumably, all the ports are sealed and it is not possible to transfer the data. However, I am aware of the amount of data I can hold on a small USB card on my key ring. Perhaps I am a Luddite but there are concerns about how a small change can have enormous consequences. There is a tangibility to the paper ballot, to which we are accustomed.
My questions relate to the paper trail, the principle of a verifiable record and technology. I would welcome the Department's thoughts on them.
Ms Margaret McGaley: Paper is completely different to electronic records. It is visible, tangible and, even if it goes into a box, it does not change. When I press the "cast vote" button on an electronic voting machine, I have no idea what is going on inside the machine. It does not matter how many experts give me assurances and how many institutes have tested it. When I press the "cast vote" button, I lose sight of my vote completely. When I mark a paper ballot and insert it in a box, I may not watch as it is transferred through the system but somebody is watching. Several independent people are watching the box as it is transported to the count centre and, therefore, I know my paper ballot exists until it gets to the centre and is counted. I want the same assurances from other voting systems that there is tangible evidence of my vote when it comes to counting.
The paper ballots are valid rather than the electronic ballots because that is why they exist. The paper ballot is the official record of votes cast. Whenever there is a recount, paper ballots are used and spot checks are used to confirm electronic results. A minimum number of constituencies will be spot-checked every time it is used.
Mr. Callan: I refer to Deputy Allen's questions. The Department had not entered into contractual commitments since receipt of the committee's letter last week and the Minister will shortly, following today's discussions and consultation with his officials, issue a reply to the committee on the matter. I do not wish to pre-empt his reply. I have, however, explained there is a substantial commitment, if not finally legally disposed of, in regard to the purchase of the electronic voting machines. The Department cannot, in prospect of the elections in June 2004, put things on hold indefinitely. We would be delighted to respond to all 40 of Mr. McCarthy's questions within the briefest interval and continue dialogue with all those who wish to gain a better appreciation and assurance about how the system will run. However, in terms of the need to gear up on training and the issuance of administrative and security protocols to local authorities, we have an executive duty and responsibility under legislation to get on with the preparations for the elections and we cannot compromise ourselves on the statutory duty.
On Deputy Cuffe's points, the Department does not accept the paper-based system is the gold standard against which we should compare other electoral management systems. The paper-based system was responsible for wastage of 1.1% of all votes at the last general election. In the worst case in one constituency, out of more than 60,000 votes cast, more than 1,000 were spoiled and the last seat in the constituency was won by approximately 80 votes. Inefficiencies and inaccuracies are inherent in the paper-based system, which has been running since the foundation of the State. These are compounded by inefficiencies and errors that we cannot accurately quantify in the manual counting process.
The purpose of the electronic voting initiative is to minimise such inefficiencies and to improve the system. That is a significant democratic loss and it has become worse in our experience of multiple polls such as those we face next June. The history of elections demonstrates that where elections are run together the rate of spoiled votes increases. These are not protest votes in the main. The Department's analysis of local election votes estimates that more than 90% of spoiled votes result from inadvertent error and so on. That is the major improvement we are trying to bring to the system and we believe it is a serious matter that the paper-based system is as prone to error as it is manifestly.
On the question of double entry accountancy or the principle of paper-based verification of what is done in the ballot, that has never been adopted under domestic electoral legislation. The principle is not accepted in the present system of voting. When a person casts his or her vote, he or she has no means of checking the vote again. No court has ever ordered that a vote should be produced and in the scheme of things that is impossible. When my vote is mixed with several thousand other votes, how could anybody establish that a ballot contains my vote and on whose say so would they-----
Deputy McCormack: One can see the ballot paper going into the box which is sealed and protected until the votes are emptied on the counter.
Mr. Callan: As the incidence of spoiled votes shows, it is possible that in lodging my vote in the ballot box that I have made a mistake and that I have not given my second preference to the person I intended. For example, I may not have my glasses on and the vote does not correspond with my intention. Receipts are not given to people. There is no way of taking an individual's vote out of the ballot box again and linking it with him or her.
Deputy McCormack: Nobody wants that.
Mr. Callan: That is the verification. In what sense does the present paper-based system offer verification or assurance to the individual voter?
Deputy McCormack: The verification is that the voter can see it and put it in the box himself or herself.
Mr. Robert Cochran: This is linked to a question the Deputy raised earlier on the initial presentation by the Secretary General on the history elsewhere in this area. It is correct that few, if any, VVAT systems are in place world-wide. There are relatively few electronic systems in place and the issue has not arisen. However, almost every day I receive correspondence from senior respected technical people and organisations around the world and all say that if we move ahead with electronic voting we must have VVAT. Computer experts world-wide say this is essential.
Chairman: Can that be supported?
Mr. Cochran: We mentioned the reasons already but I did not want to go back over old ground. The risks inherent in a system that -----
Chairman: Has evidence been produced and is it available?
Mr. Cochran: Yes, I do not have it all here with me but it is consistent.
Ms McGaley: Brazil has an electronic voting system but it is now retro-filling its machines with printers to add a voter-verified audit trail. In California it is law that by 2006 all voting systems must include a voter-verified audit trail. A well-supported Bill is going through the legislative system in the United States that will make this requirement federal law. If it goes through then all of the US states will be obliged to use a voter-verified audit trail. Although there are some systems in the United States that do not have a voter verified audit trail, their number is being reduced. A group called Verified Voting, started by a professor in the United States, has several hundred signatures of top professionals in the field who all agree that a voter-verified audit trail is the minimum requirement for an electronic voting system to be safe.