Combating Vote Fraud and Coercion
Combating Vote Fraud
Whenever a vote is cast outside of the guaranteed secrecy of a polling
booth, a would-be vote buyer may be able to take physical control of
the casting of the ballot. VoiceVote eliminates this practice. All
votes, including early and absentee ballots, are cast on VoiceVote
voting machines, providing the same certainty that it is the approved
voter who
votes as on Election Day, and with the same anonymity guaranteed by the
protection of a voting booth.
The transparency of VoiceVote undermines the basis of vote buying. VoiceVote provides a means for anyone to print out sample ballots in advance of the election. These sample ballots appear identical to a vote receipt issued after a ballot is cast, including containing a dummy cryptographic signature. Anyone could produce any number of sample ballots before election day at almost no cost and in unlimited numbers. A sample ballot would only lack a valid digital signature, and could not be distinguished from an actual, valid ballot receipt until after the election was completed and the verifying keys of legitimate voting sessions were published. The would-be buyer of votes would be confronted with a large number of offers of sample ballots, driving down the return on investment in bought votes to near zero.
To ensure that the purchased votes were not merely sample ballots, the vote buyer would be compelled to collect vote receipts (or key information from the receipts) and to record the identities of the sellers. He would have to ask the vote seller to forgo payment until after the election results had been published. The sellers would have no means of enforcing the completion of the transaction. The inescapably low level of trust between buyer and seller would make this form of vote buying unlikely.
Even worse for the vote buyer, the unique digital signature on each ballot would provide a way for law enforcement officials to mark forged vote receipts, much like marking the currency used to pay off a ransom. This would provide a powerful new tool to law enforcement officials to pressure street-level operatives to "roll over" on the political boss who financed a vote-buying operation.
A valid receipt presented for the first time for payment after the election would similarly be of no value, since VoiceVote provides a means by which anyone can easily print a duplicate receipt of any ballot that was cast. A cryptographically certified ballot receipt is proof that a ballot has been cast, but gives no indication who cast it.
Sample ballots would present no threat to the integrity of the election process proper because digital signatures are unforgeable. Sample ballots would be easily and reliably detected after the publication of the verifying keys. Widespread knowledge of the worthlessness of sample ballots after the publication of the verifying keys would serve to enhance popular confidence in the integrity of the electoral system.
To illustrate how VoiceVote serves to insulate voters against pressure to disclose their vote, consider the following example of a coercive atmosphere: Say that Veronica lives and votes in a precinct that is overwhelmingly forest-friendly, and that she herself belongs to the Forest Fanatic Society. Nevertheless, for reasons that seem good and sufficient to her, she votes for Joe Logger for chief forest ranger.
Scenario A: Community pressure. Suppose that an election system is used that does not issue voter receipts (that is, any current election system). If the Forest Fanatics ask each of their members to state publicly that they voted against Joe Logger, Veronica has three choices: she may refuse to make any statement about her vote, she may disclose it, or she may lie about it.
Now suppose that the VoiceVote system is in effect, and that Veronica has been issued a receipt after casting her vote and that all ballots have subsequently been posted on the Internet. If the Forest Fanatics ask all their members to post their ballots on the community bulletin board, Veronica has exactly the same three options: she may refuse to post any ballot, she may post the receipt for her vote, or she may download a ballot from the Internet that was cast against Joe Logger and post it (that is, she may lie about her vote). There is nothing to distinguish a downloaded ballot from one distributed to a voter at the polling place, and nothing to indicate the identity of the voter on any ballot. Therefore, Veronica's posted ballot no more proves how she voted than a verbal statement. Since it would be common knowledge that anyone could download any ballot, the entire practice of exerting social pressure in this way would be discouraged.
Scenario B: Stolen vote. Suppose that the pro-forest sentiment in this jurisdiction is so strong that the precinct election judges and all the poll watchers collaborate to discard Veronica's vote for Joe Logger. In the VoiceVote system, Veronica can prove that her vote has been discarded by producing her digitally signed ballot and trigger an audit of the election, which would be performed using the election authority's printed paper ballots. What's more, she can accomplish this anonymously by sending her digitally signed vote receipt to a vote integrity organization -- say, the Center for Election Responsibility and Trust (CERT). Veronica's vote receipt in the hands of CERT has the same power to challenge the theft of her vote as in has in her hands. In this way, the VoiceVote system greatly enhances the secrecy of the ballot: it allows a voter whose vote has been stolen to not only effectively challenge the theft, but to do so without disclosing her identity.
Scenario C: Suspicion of stolen votes. Suppose that no votes are actually altered or discarded, but Veronica, knowing the strength of pro-forest sentiment, is suspicious that election fraud has occurred. Under the VoiceVote system, her suspicion is dispelled by the fact that she can confirm that her own vote for Joe Logger was properly recorded and by the knowledge that every other voter can likewise check their own vote and can anonymously challenge any instance of vote tampering.
The VoiceVote protocol is designed with the dual objectives of securing elections against tampering and of giving the public confidence in the integrity of the system. These goals are promoted by the combination of well-established cryptography with simplicity, transparency and direct involvement of the public, including in the post-voting phase of the election.
The transparency of VoiceVote undermines the basis of vote buying. VoiceVote provides a means for anyone to print out sample ballots in advance of the election. These sample ballots appear identical to a vote receipt issued after a ballot is cast, including containing a dummy cryptographic signature. Anyone could produce any number of sample ballots before election day at almost no cost and in unlimited numbers. A sample ballot would only lack a valid digital signature, and could not be distinguished from an actual, valid ballot receipt until after the election was completed and the verifying keys of legitimate voting sessions were published. The would-be buyer of votes would be confronted with a large number of offers of sample ballots, driving down the return on investment in bought votes to near zero.
To ensure that the purchased votes were not merely sample ballots, the vote buyer would be compelled to collect vote receipts (or key information from the receipts) and to record the identities of the sellers. He would have to ask the vote seller to forgo payment until after the election results had been published. The sellers would have no means of enforcing the completion of the transaction. The inescapably low level of trust between buyer and seller would make this form of vote buying unlikely.
Even worse for the vote buyer, the unique digital signature on each ballot would provide a way for law enforcement officials to mark forged vote receipts, much like marking the currency used to pay off a ransom. This would provide a powerful new tool to law enforcement officials to pressure street-level operatives to "roll over" on the political boss who financed a vote-buying operation.
A valid receipt presented for the first time for payment after the election would similarly be of no value, since VoiceVote provides a means by which anyone can easily print a duplicate receipt of any ballot that was cast. A cryptographically certified ballot receipt is proof that a ballot has been cast, but gives no indication who cast it.
Sample ballots would present no threat to the integrity of the election process proper because digital signatures are unforgeable. Sample ballots would be easily and reliably detected after the publication of the verifying keys. Widespread knowledge of the worthlessness of sample ballots after the publication of the verifying keys would serve to enhance popular confidence in the integrity of the electoral system.
Combating Vote Coercion
A good voting system precludes the disclosure of a voter's election choices except by the action of the voter, but it cannot prevent social pressure to disclose (or to not disclose).To illustrate how VoiceVote serves to insulate voters against pressure to disclose their vote, consider the following example of a coercive atmosphere: Say that Veronica lives and votes in a precinct that is overwhelmingly forest-friendly, and that she herself belongs to the Forest Fanatic Society. Nevertheless, for reasons that seem good and sufficient to her, she votes for Joe Logger for chief forest ranger.
Scenario A: Community pressure. Suppose that an election system is used that does not issue voter receipts (that is, any current election system). If the Forest Fanatics ask each of their members to state publicly that they voted against Joe Logger, Veronica has three choices: she may refuse to make any statement about her vote, she may disclose it, or she may lie about it.
Now suppose that the VoiceVote system is in effect, and that Veronica has been issued a receipt after casting her vote and that all ballots have subsequently been posted on the Internet. If the Forest Fanatics ask all their members to post their ballots on the community bulletin board, Veronica has exactly the same three options: she may refuse to post any ballot, she may post the receipt for her vote, or she may download a ballot from the Internet that was cast against Joe Logger and post it (that is, she may lie about her vote). There is nothing to distinguish a downloaded ballot from one distributed to a voter at the polling place, and nothing to indicate the identity of the voter on any ballot. Therefore, Veronica's posted ballot no more proves how she voted than a verbal statement. Since it would be common knowledge that anyone could download any ballot, the entire practice of exerting social pressure in this way would be discouraged.
Scenario B: Stolen vote. Suppose that the pro-forest sentiment in this jurisdiction is so strong that the precinct election judges and all the poll watchers collaborate to discard Veronica's vote for Joe Logger. In the VoiceVote system, Veronica can prove that her vote has been discarded by producing her digitally signed ballot and trigger an audit of the election, which would be performed using the election authority's printed paper ballots. What's more, she can accomplish this anonymously by sending her digitally signed vote receipt to a vote integrity organization -- say, the Center for Election Responsibility and Trust (CERT). Veronica's vote receipt in the hands of CERT has the same power to challenge the theft of her vote as in has in her hands. In this way, the VoiceVote system greatly enhances the secrecy of the ballot: it allows a voter whose vote has been stolen to not only effectively challenge the theft, but to do so without disclosing her identity.
Scenario C: Suspicion of stolen votes. Suppose that no votes are actually altered or discarded, but Veronica, knowing the strength of pro-forest sentiment, is suspicious that election fraud has occurred. Under the VoiceVote system, her suspicion is dispelled by the fact that she can confirm that her own vote for Joe Logger was properly recorded and by the knowledge that every other voter can likewise check their own vote and can anonymously challenge any instance of vote tampering.
The VoiceVote protocol is designed with the dual objectives of securing elections against tampering and of giving the public confidence in the integrity of the system. These goals are promoted by the combination of well-established cryptography with simplicity, transparency and direct involvement of the public, including in the post-voting phase of the election.