Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Joint Standing Committee on Electoral Matters - 26/03/2014 - Conduct of the 2013 federal election and matters related thereto

GORE, Professor Rajeev Prabhakar (Private capacity)

TEAGUE, Dr Vanessa Joy (Private capacity)

Committee met at 10:18

CHAIR ( Mr Tony Smith ): I declare open this public hearing of the Joint Standing Committee on Electoral Matters. I would point out to you that the committee does not require you to give evidence under oath. I advise you that this hearing is a legal proceeding of the parliament and therefore has the same standing as proceedings in the respective houses. We have your submission. Would you like to make a brief opening statement or would you prefer to go to questions on your submission?

Dr Teague : We would both like to start with a brief opening statement, just for those who have not read the submission or would like to be reminded. We are both computer scientists at universities in Australia. Our submission details the privacy verifiability and security of electronic voting systems. The main idea is that an election result that relies on an electronic process that cannot be verified is an election that could potentially get the wrong answer, either through accidental program errors or through deliberate electronic manipulation. So that is really what it is about.

If you are a voter or a scrutineer and you are looking at a comforting message on the screen, you are not necessarily really getting evidence about what is happening to the underlying electronic data. The possibility of electronic elections to be manipulated is real. There have been numerous security analyses in the Netherlands, India and the United States where security research demonstrated realistic attacks that would have allowed them to manipulate the election results and would, importantly, have been undetectable. The important theme here is that potentially electronic results could be changed without that kind of manipulation ever necessarily coming to light.

There are some good, simple solutions in a polling place for electronically assisted voting, using some kind of human readable paper record that gets retained as an evidence trail. Some kind of combination of some electronic voting and electronic vote reporting with paper evidence is used in India and in many parts of the United States. I know you have received at least one submission along these lines from CGI. The high-level idea there of the combination of some electronic voting with some paper evidence is a perfectly sensible. The details of the cryptographic protocol there were not at all well thought out, which is pretty typical of the industry. We can talk more about that, if you like.

CHAIR: That was at our Sydney hearing.

Dr Teague : But the high-level idea that you can use electronic assistance connected with a paper evidence trail—that the voter checks their own vote to see if it accurately reflects their intentions and then the paper evidence trail is retained for scrutineers and observers—is a sensible idea.

My research area is in using cryptography to allow people to verify election processes without necessarily needing to retain a paper trail at the polling place. These techniques provide a very high level of verifiability and a very high level of evidence supporting the election result, but they are also extremely complicated for voters, they are complicated to implement and they are complicated to deploy.

The final topic in the submission is internet voting. The short summary is that doing internet voting in a sufficiently secure and useable fashion is just not a solved problem. Nobody really knows how to do that well. We do not really know how to authenticate voters remotely and make sure that the person is the eligible voter that they are claiming to be; we do not really know how to make sure that the vote is accurately cast in the way that the voter intended; and, although we have some techniques for proving that the votes are properly dealt with later, it is hard to scale those techniques to Australian elections. There are a range of potential attacks on internet voting systems that would be difficult or impossible to detect.

Prof. Gore : I would just like to make a couple of points about electronic voting and then I would like to run a little experiment, where I am going to ask you to try to think a little bit about internet voting, just to give you an idea of why it is so difficult, rather than make the points that are already in the submission.

First of all, I just want to reiterate Vanessa's point—that internet voting is just too dangerous. Don't do it. It is as simple as that. There are various electronic voting solutions which are possible. The point that I want to make—which we also made in our submission—is that, at the end of the day, it has to be able to withstand a challenge in the High Court of Australia, because that is where a losing party is going to go. They are going to ask questions which have not been asked before in a legal context. For example, 'How can you prove that what I cast was actually what was counted? How can you prove that it was counted correctly?' We have complicated voting systems in Australia—the STV analogues.

My expertise is actually complementary to Vanessa's, and it is about building and verifying vote-counting programs and algorithms to make sure that they actually count the votes according to the legislation. In the case of, say, first past the post, this is a trivial problem. But, in the case of Hare Clark or the Senate counting system it is not a trivial problem and it is very, very easy to get it wrong—and various people have got it wrong.

One thing you might want to consider is: if we go down the path of electronic voting of some sort there are lots of academics who would be willing to play the devil's advocate and attempt to hack the system or break the system. We cannot do it legally but we can if you give us access to it and permission to do it. This has been done in various jurisdictions. So the idea of opening it up to academic hackers is something you should seriously consider. It has been done elsewhere.

I would like to come back to the idea of a thought experiment. You might be wondering why electronic voting is so damned hard. We can put a man on the moon and bring him back safely, but we cannot run internet or electronic voting. Why is it so difficult? I would like to run through what internet banking would have to look like if it had to abide by the rules of voting. Many people ask: why is electronic voting not like internet banking? We can do internet banking, why can't we do electronic voting? I would like to turn that on its head and ask: what if we had to implement internet banking according to the rules of electronic voting? What would it look like?

Senator TILLEM: There are two concepts. One is electronic voting at a polling place. What you are talking about is electronic voting away from a voting place—remotely.

Prof. Gore : It is. That is the worst-case scenario. But the problems also apply to booth votes. I am going to give you the worst-case scenario, but we can go into the details of the fact that these things also raise their heads in booth based systems. As Vanessa said, the booth based systems are also incredibly complicated. You might be wondering why they have to be so complicated. There are two basic tenets of voting. You must be able to prove that you have voted. You must not be able to prove how you voted. Pretty much everybody accepts those two tenets of voting. The first one keeps the Electoral Commission off your back, because you will get fined in Australia if you do not vote. The second one stops you from being coerced or bribed. If you can prove how you voted when you walk out of the polling booth somebody could pay you—or somebody could be holding your son or daughter for ransom, in the worst-case scenario. The idea is that the second one stops you from being able to be coerced. You can swear: 'Yes, I did vote exactly how you instructed me to', but you cannot prove it. So nobody is going to try to bribe you or coerce you.

Let us turn that around. Suppose we said that, for banking, the principles now are that you must be able to prove you did a transaction but you must not be able to prove what the amount of the transaction was. So the amount of the transaction is your vote, and you have to keep that secret. You have a payment card which you take to the shops. That does the transaction and shows it to you on your computer at home. They send you bank statements if you need them, so it does not necessarily have to be internet based. But what can they show you? First of all, you buy a coffee. The shop can give you a receipt but they cannot tell you it cost $3.50, because then you would be able to prove how much the transaction was. So you get a receipt which asks: 'Did you do a transaction?' and you say, 'Yes, I did. Here it is.' But it does not say that it cost $3.50. That would be a weird thing, already. You might buy a coffee, but would you do a more serious transaction with someone if they did not give you a proper receipt? Secondly, you get a detailed statement at the end of the month and what can it say? It says that on 26 March you bought a coffee from the coffee shop at Parliament House. It cannot show you the amount, because, again, you would be able to prove what the amount of the transaction was. All it says is what you did.

On a normal bank statement what do you get? You also get the balance before and the balance after. If you did that you would be able to work out the difference and prove how much the transaction was for. You cannot show the remaining balance in your bank account. You are going to get a list of transactions at the end of the month which says that on certain days you have done a transaction at a particular shop. You have no idea how much money is in your bank account because, if we showed you that, you would be able to work out the difference and prove how much a particular transaction was.

You cannot even have it so that it tells you when your bank account has reached zero, because if it did that, then your knowing that you might be able to do some dummy transactions and prove how much your final transaction was for. So what we would have to do is something like: when your account goes into the red, we automatically add 10 per cent to each of your transaction. But, again, we cannot tell you what the amount of the transaction was. On the reverse, if you put more money into your bank account, we cannot tell you when your bank account is in the black, because, again, if you knew where the zero cross-over point was, you might be able to prove what the amount of a transaction was. The question then is: would you use this system? That is why electronic voting is so hard; it because those two tenets are basically contradictory. You have to be able to prove how you vote, but you cannot prove how you vote.

Senator RUSTON: Is it only an issue for the internet?

Prof. Gore : No.

Senator RUSTON: You have the capacity to implement other measures of verification and authenticity at a polling booth and still do it electronically.

Prof. Gore : Okay. Such as?

Senator RUSTON: First of all, you could print out your own receipt. For instance, you go in there and vote electronically. You get a formal vote. You print it out and look at it and say, 'I'm happy to put it in the box.' You have voted electronically but you have also got the hard copy, which you can stick in the box. You can check it. You can physically hold it—just like you hold your ballot paper—and you put it in the box. You end up with a situation where, if there is some allegation of corruption, you actually have a physical copy of it.

Prof. Gore : Now you understand why the designs that you are seeing are the ones where we say, 'You printed something out and there is a printed record.' So that is part of the solution.

Senator RUSTON: It still allows electronic voting; it is just that the paper is backup.

Prof. Gore : Absolutely. I agree. I basically said there are various possible solutions but I wanted to get across to you why it is so difficult. That is all I am trying to drive home. We have seen some submissions on your web page. There was one from Chris Murphy—someone Murphy—that claimed you could save $100 million a year by doing everything on the internet because—

Mr GRIFFIN: There are people who think the world is flat, too. Democratic processes bring up all sorts of things.

CHAIR: Deputy chair, on that intervention, why don't you ask your questions.

Mr GRIFFIN: Sure. On that point, I would put it another way: it is theoretically possible to implement electronic voting and, in practical terms, though, there are a number of reasons why it is difficult, which really relate to the question of the costs involved in setting up the system, the time taken to actually exercise the democratic process and then all the issues around verification et cetera that you mentioned before. There is an element of—and it is a bit of a buzz phrase—'Let's go electronic.' I guess the context of that is, say, the ACT. I would like to tease out some of those points a little bit more in terms of what the difficulties are in implementing electronic voting systems on a more uniform basis with respect to a federal election.

Dr Teague : Are you talking about internet voting or computers in a booth?

Mr GRIFFIN: Again, not wishing to put words in your mouth, I think what you have really said is that, given the context of the technology et cetera, internet voting at the moment is not practical from the point of view of safety and security. So, down the track, if technology changes, maybe you might want to have a look at it then, but looking at it now would be a waste of time.

Dr Teague : Agreed.

Mr GRIFFIN: With electronic voting there is a question of how you might do it. My sense of it is that, whichever way you do it, it produces different problems around the question of either the cost of it or the actual time taken et cetera in exercising the democratic right. I would not mind teasing some of that stuff out.

Dr Teague : The first thing that I would talk about again is the evidence trail—so the possibility for manipulation or just errors and the retention of an evidence trail are two opposite sides of the same coin. I would say that the first design criterion ought to be that however computers are used in voting should produce an evidence trail that gives voters evidence that their vote is cast in the way that they intended and allows the scrutineers, observers and others some evidence that once the vote is cast it has been properly dealt with.

There are two main ways of going about that. The first is the possibility of making a simple paper trail which, obviously, is easy to understand: the voter gets to check that what they are looking at accurately reflects their vote. Then whatever process would otherwise normally happen for paper votes happens for those printouts as well.

As I said, my research area is more complex methods for achieving the same kind of evidence trail, but those methods are quite complicated. The Victorian Electoral Commission is running a trial with a very sophisticated kind of system that does not require them, necessarily, to retain a paper evidence trail at the polling place. But I would not necessarily recommend that that is the right thing to roll out throughout the nation in time for the next election because of the complexity of that kind of system.

The issues that protects against are: issues around either just plain accidental bugs—misrecording or dropping the votes; issues around accidental operator error in the context of electronically transferring the votes or installing the software; and of course deliberate electronic manipulation, either of the software before it arrives at the polling place, of the software during the process of voting or of the data afterwards. There have been instances of bugs in Australian electronic voting already—I think we mentioned in our submission that in the New South Wales internet voting trial there was a bug in the software. There does not seem to be any reason to believe that it was deliberate—it was just an accidental error. In fact, it was not even a software bug, it was an incorrect assumption in the minds of the people who were writing the code about what the computer of the person casting the vote was going to be like. The result was that some of the votes ended up with the letter 'N' instead of preference numbers in at least some of the squares. It was a small fraction of the vote and it did not get a lot of attention because it did not make a difference to the election outcome. Yet you can see the possibility for that kind of accidental electronic problem to cause a serious issue in a real election.

The other class of errors is deliberate hacking or manipulation. Although there has not been a demonstrated, prosecuted case of that in the case of electronic elections, the whole point of that kind of attack is that you would not necessarily know that it had happened, you would not necessarily know who had done it and you would not necessarily be able to gather enough evidence to prosecute. There have been a number of security studies by real security researchers who have had a chance to investigate the kind of polling place electronic voting machines that do not produce a paper trail. These have been used in India in various forms. They have been used in the United States all over the place, and they were used in the Netherlands for a while. They were different kinds of machines with different technologies, but every time a group of real security researchers got the chance to have a go at a machine they demonstrated quite devastating attacks that would have allowed them to manipulate the results of the election and that would have been undetectable.

I know that you run computers in the polling place in the ACT and the argument is that they are all perfectly secure—'They're all perfectly secure; they're disconnected from the internet and therefore we don't have to worry about the security issues.' I do not find that argument convincing at all, in the context of the international experience that every time any group of serious security researchers has had a chance to investigate the security properties of those kinds of machines they have demonstrated a way of manipulating the election without being detected.

Mr GRIFFIN: So these are technologies which are still in the process of evolving. Do you think that even in the future, if we were sitting here in maybe five or ten years time, you would probably have a different answer?

Dr Teague : The answer right now, for the next election, is to produce a plain-paper evidence trail. Do it, by all means, but produce a plain paper evidence trail that the voter gets to look at to check that their vote is cast as they intended and which the scrutineers and other observers get to watch in exactly the same kind of way they would watch ordinary paper votes.

Mr GRIFFIN: If that were the case, why were people doing it?

Dr Teague : I don't know. I am not necessarily saying that you should.

CHAIR: There would be a whole lot of expense to get the result a few hours or a few days quicker, but your point is that the process of scrutiny would still occur.

Mr GRIFFIN: If you have a polling booth with, say, 2,000 people going through, the time taken for those voters to exercise their democratic right would have real implications for the conduct of the polling booth. Potentially you would annoy voters with the time it would take them and with the number of times they would need to line up. The end result would be a verifiable process with earlier results—an hour earlier—but not much else.

Dr Teague : I think you are basically right. There are a couple of reasons for considering it—as an option, rather than the only thing available. One good reason for considering it as an option is to serve voters who cannot use pencil and paper—voters who can't see, voters who can't read instructions in English, voters who have motor disabilities that prevent them from using a pencil. That is one reason for introducing computers as an option in many of the states. The other reason is to help people check for accidental numbering errors and things like that. Again, that comes back to the idea of whether they can follow the instructions and whether they can use the pencil and paper to cast the vote they intend. There might be an argument for running a few computers as an option in each polling place—to offer checking for people who need it.

Senator O'SULLIVAN: At some stage in our current voting process we do a physical count—humans sorting pieces of paper, looking at them, making judgements. It then gets entered as data into pre-existing systems. When that data produces a report at the end of the day, that is the report we rely upon to know who won the ballot. Are the same vulnerabilities embedded in that now from a security perspective, from a software failure perspective and from an external manipulation perspective. Are those data systems as vulnerable as those that you suggest are not ready for us to use?

Prof. Gore : They are, and what we are seeing here are the levels of understanding of the people running the elections. For example, your average electoral commissioner is not a security expert and so he or she relies upon the provider of the software to guarantee some level of security that the electoral commissioner is happy with. Unfortunately, the vendor has a commercial interest in making sure that their software gets selected.

CHAIR: I suppose the counter to that would be: you have all the physical ballot papers and scrutineers everywhere—certainly for the lower house I know what happened at the Lilydale West booth and I know how many booths there are. You have all that to fall back on. The essence of what you are saying is: unless you have a system that produces a printed, verified copy it is vulnerable. That is really what you are saying, isn't it?

Mr GRIFFIN: The software that is employed for most elements of Australian elections is about tallies, and not about inserting votes. For most aspects, data is fed in and it is separately verified at polling booths et cetera. One element that I would think you would need to look at would be access for the visually impaired, but that is a very small number. The second thing is the nature of the tallying count for the Senate, where the below-the-line votes are actually being punched in, and that is the only component, I would have thought.

Prof. Gore : How do you know that it is counting the votes properly? The only thing you can do is trust that the commercial vendor has produced a program that does it, and to my level of thinking, that is just not good enough.

Senator FAULKNER: I have read your submission with interest and I would summarise it as a submission that effectively goes to outlining the issues relating to the integrity of electronic voting and electronic vote counting. That is how I would sum up what you have put to us. It is both helpful and useful, but I think that what the other committee members here are doing is perhaps grappling with the threshold issue. As I said, it is a very helpful contribution to look at, the integrity of these matters, but I would like to ask you very directly the threshold question: do you support a change from our current paper-based election methodology to an electronic voting system given the sorts of concerns you have outlined to us today and given the sorts of concerns that are contained in your submission? For me, I would nail that down to the fundamental question, the threshold question that arises as a result of what you have told us both verbally and in your submission. That is one person's interpretation and I would be very interested in your response.

Dr Teague : I would say that I would not object to the introduction of computers in the polling place as long as it was done with care in the way that provided evidence of getting the correct election result. Now that it is not to answer Mr Griffin's question of why you would want to do that, but if you had a good reason for wanting to do that, I think it would be reasonable to do so as long as you provided an evidence trail in the way that we have described.

Senator FAULKNER: And you would accept that, Professor Gore?

Prof. Gore : Yes. There are various solutions that are possible. You just need to make sure that it is done properly, and it is not obvious that it is being done properly at the moment.

Senator FAULKNER: You would also say to us, I think, from what I have heard, that this would have to be a polling place based system not an internet based system. I want to be very clear on that. That is another threshold issue, is it not?

Prof. Gore : Absolutely, yes.

Senator FAULKNER: You would also say to us that in any polling place based system there would effectively have to be—and I may not be using the correct terminology here—a capacity for a paper record of the electronically cast vote. Is that fair?

Dr Teague : Yes. I think I mentioned in my introduction and in my submission that my research area is looking at using cryptographic methods to provide the same evidence trail without necessarily retaining a piece of paper in the polling place. I think it is possible that those kinds of techniques will be the thing that we will all be doing 20 years from now, but I would not say that that should be rolled out across the nation in time for the next election.

Senator FAULKNER: So understanding that and without going to my colleague the deputy chair's question about why do it in that circumstance given our current system, which is a perfectly reasonable question to put forward, are you able at all to say to the committee—and this may be absolutely beyond your area of expertise, and I appreciate that might be the case—what you think this might mean in terms of the financial implications, what the resource implications in the broad might be for such a change?

You may not be able to. I have asked this question before.

CHAIR: You asked it in Sydney.

Prof. Gore : I would like to make one other point. What you mentioned about the paper trail is essential, of course, but also needed is a level of scrutiny of the vote-counting process itself.

Senator FAULKNER: I appreciate that. I know that you are talking about two things. You are talking about the voting process and the vote-counting process, and my follow-up questions relate at this point to the voting process. My question about resources relates to the voting process itself. You may not be able to assist. CGI were unable to assist us, as you have probably seen from the Hansardtranscript.

Prof. Gore : I could not put numbers to anything, because that is just not my area of expertise. But I am pretty sure that, if the various electoral commissions around Australia had your blessings and your brief to implement such a system with adequate financial support, we could do something really good with this sort of solution. But, again, this is where Vanessa's expertise is. Her expertise is in these sorts of verifiable vote-casting systems.

Dr Teague : I do not really know. The answer would depend on a lot of important details. For example, would voting computers be the only option in every polling place or would we be talking about two voting computers as an option when the paper option was retained? That would make a huge difference to the cost. Would we be talking about a system that was implemented once and used throughout the nation? There is no cooperation at the moment, as far as I know, between the different electoral commissions, despite the fact that basically they are trying to solve the same problem. There is a huge set-up cost for getting the software implemented. At the moment it looks like we are going to do that seven or eight different times. It would make a huge difference if some of that could be shared. All of those kinds of details would make a huge difference to the pricing.

Senator FAULKNER: I do not want to prohibit others from asking questions here. We have not even talked about the vote-counting process. Really, as I hear what you are saying to us, whatever we do—whether we keep the current system unchanged or whether there is substantial change; whether we move towards either electronic voting or electronic counting methods—your critical concern goes to the integrity of those systems. That is really where your area of expertise is, and your concern is about the integrity of the system.

Prof. Gore : It is slightly more than that. It is demonstrable integrity. There is a fundamental difference.

Senator FAULKNER: I understand that. But if you consider transparency as a critical element of integrity that is understood. But I appreciate the point you made.

Mr GRIFFIN: Going back to your earlier comments, Professor, regarding the current software, the only major component that relates to elections for counting purposes now is the Senate, and it is the below-the-line votes which are individually punched in and then the buttons pushed. You seem to be suggesting that that in itself is not a verifiable process.

Prof. Gore : Currently, yes.

Mr GRIFFIN: You mentioned the fact that when security experts have gone into other jurisdictions and had a look at the software et cetera they have found ways to rort it. Do you know whether the AEC system has been tested to see whether in fact that is the case for it? If not, why not?

Prof. Gore : I do not know anything about the actual program that is used for the Senate counting, partly because the freedom of information request that was made by someone wanting to find out more details of it was denied on the grounds of commercial-in-confidence issues and also on the grounds that keeping it secret would keep it secure—which is just pure nonsense.

Mr GRIFFIN: But if I tell you I have to kill you! I think that is probably an interesting question for us to raise with the AEC at some stage in the future, regarding the nature of the current system and how it operates. We ought to examine that a bit further, I think.

Senator TILLEM: In all the jurisdictions that exist currently that use any type of electronic voting, which would be the one that is at the top of the list in terms of credibility, verifiability and all the other components that go into making it a useful model? And I mean internationally.

Dr Teague : I think there are lots of good answers. There are good answers here. Both Tasmania and Western Australia run a simple option for vision impaired and other disabled voters, which is simply a computer in a polling place that prints out an ordinary ballot. They can check the ordinary ballot and then they can fold it up and put it in an ordinary ballot box. It is a very simple, easily verifiable system. There is another possibility. The Victorian Electoral Commission is experimenting with some of the high-integrity cryptographic techniques to provide evidence that the votes are cast as they are intended and are properly included in the count. I have been working a little bit on that project. I think that would be an interesting project to watch, to see how it goes and understand whether or not that is a good plan to follow.

Senator TILLEM: Let me rephrase the question: who is the world leader in electronic voting?

Prof. Gore : There isn't one. Various systems are implemented around the world, and all of them have some deficiency.

Senator TILLEM: They all have some flaws; I understand. But say we were to ask you today, 'Which one would you recommend for us to adopt so that we could improve it?' Then, who is at the top of the list? Or, which system,? Or, who runs the system?

Dr Teague : I would copy Western Australia and Tasmania.

Senator TILLEM: Do they have the best system that currently exists?

Dr Teague : There are other solutions, but I think part of the issue is that other countries are solving different problems. For example, in the United States they have much simpler voting mechanisms.

CHAIR: First past the post.

Dr Teague : Exactly; it is just first past the post.

Senator TILLEM: But we are actually talking about the process of voting.

Dr Teague : Right, but my point is that that changes the answers. So, what is quite common in the United States is a combination of some form of electronic voting, combined with some form of a paper trail that the voter verifies. And they often do not do complete manual counting of the paper trail; they often do some random auditing—and they do that very carefully, and there is tremendous literature about exactly how you should do the random audit process. If you look at states like California, for example, you will see a very high standard for that process, which would be a good example if we were running those kinds of elections. But the questions are different for us because of our different voting method and because the Senate count, in particular, tends to produce very small margins at different rounds of elimination. That kind of random auditing process—which saves them a lot of money, because they do not have to do a whole lot of manual paper counting—would not work for us.

Prof. Gore : For example, the Irish Senate system is close to ours. They use preferential voting and the single transferrable voting system. I do not know when, but a couple of years ago they were building an electronic system. They were gung-ho. They ordered millions and millions of dollars worth of equipment. And then a bunch of computer scientists showed that the system was fatally flawed, to the point where that equipment is just sitting there idle; it has never been used, and Ireland has passed a law that bans electronic voting.

CHAIR: Would you be able to provide us with some information on that?

Prof. Gore : Sure. So, when you ask us what the leading system is at the moment internationally that we might say is okay, the answer is that there isn't one.

Mr GRIFFIN: The failure of the Irish system did not relate to the question of the capacity of the Irish to be able to vote? I just wanted to make that clear! It was not an Irish joke—okay!

Senator TILLEM: I have lots of other questions, but we might come back to them.

Senator O'SULLIVAN: In the event of a capacity to vote via the internet, does the technology exist that, if I were to cast my vote for the ABC Party, upon arrival of that data to wherever it was going they could verify that I had voted, assuming we had dealt with the identity of the voter issue. Can the intent of my vote then be converted to data in such a way as to extinguish the capacity for anybody to determine that I had made that particular choice? My point is, I have voted for ABC, my vote is converted over as a line item for ABC but no-one can ever track back and connect me to the vote.

Dr Teague : It is very hard to do that in a way that provides you with evidence that it was done properly.

Senator O'SULLIVAN: Let us say with the complex Senate paper you have voted below the line, so you have gone 1 to 77. Some people might want to fill it out manually on hard copy, so can that be scanned and then there is a capacity—I understand someone's 2 might look like an 8 and all those problems—to draw off that data and interpret it? Are we at a stage where that is an option?

Prof. Gore : Optical character recognition is used by the ACT Electoral Commission to digitally scan the paper votes.

CHAIR: Senator O'Sullivan, I do not think you were a senator at the time but you should get a copy of the presentation from the secretariat. We had them in here a month or so ago.

Senator O'SULLIVAN: Thank you.

Prof. Gore : You said that you had a meeting with the ACT Electoral Commission. Did you raise any of the points that were in our submission with them?

CHAIR: We had that presentation prior to receiving it. We certainly raised some of the issues. You are very familiar with the system, so I do not think there would be anything in the presentation that would add to your knowledge. You are welcome to have a look at it, though. I know you made mention of the Irish experience in your material, but if you have further information about that it would be good if you could talk to the secretariat. Thank you both for appearing today.

Resolved that these proceedings be published.

Committee adjourned at 11:03