Voting Integrity, Confidence and Empowerment

Empowering Voters to Verify Election Results

In the VoiceVote paradigm the voter is assumed to be an informed public observer, whose confidence in the fairness and accuracy of elections is crucial to the health of our democracy. Further, the voter can actively test and enforce election integrity. VoiceVote runs "sunshine elections." All the information that the public needs to vet an election is proactively provided as a matter of right.

Transparency and anonymity are the critical features of the VoiceVote system. The creation of a paper trail for voters and the publication of all ballots -- without any identification of the voter who cast each ballot -- and other election information on the Internet enables the voting public to confirm the integrity of each vote and of the election process as a whole. The information published on the Internet includes each ballot, with its unique ballot identifier and signature, each voting session identifier and session verifying key, a tally of the votes for each candidate and/or question on the ballot and the cryptographic certification of the program source code. Using this information, the public can verify every election, without the need for a court ordered recount.

All ballot records are cryptographically certified, which means that they are unforgeable and that any tampering can be detected. Unlike some other proposed cryptographically based systems, the voter's anonymity is not dependent on the strength of the cryptography. The identity of the voter remains secret even if the cryptography is broken.

After the polls close and the results are published on the Internet, any voter may go online and perform these basic audits of the election:

• Check their own vote. Any voter may look up the ballot that matches the unique identifier on their ballot. (Note: this is an identifier of the ballot, and has no connection to the identity of the voter.) The voter enters this identifier, and the election authority displays the corresponding ballot. The ballot identifier could be barcoded on each printed ballot, permitting it to be easily read. 

• Check against ballot box stuffing. Anyone may compare the number of ballots cast in each precinct to the number of applications for ballot issued by the voting authority. The two numbers must be equal. This provides a safeguard against ballot box stuffing. This safeguard is generally present in current election procedures, but not in a form readily accessible to the public. 

• Check against ballot tampering. Anyone may download a complete sets of ballots for any jurisdiction and confirm that each one is authenticated by the digital signature of the corresponding voting session. Even the smallest alteration of a ballot will be detected by the digital signature. 

• Check that all votes are correctly counted. Anyone may download the complete set of ballots in any electoral jurisdiction and conduct an independent tally of the votes on each ballot question.

• Anonymously challenge missing or altered ballots by providing a copy of the receipt to a representative, the election authority or law enforcement or by pointing out instances in the public record of ballot box stuffing or ballot tampering.

• Participate in a group, each of whom checks their own ballot anonymously and/or assists others in checking their ballots (e.g. vision impaired to confirm that ballots marked by voice were correctly recorded)

• Before and after each election check the software used by the election including operating systems and algorithms for digital signatures and ID generation or consult with experts of choice who have examined the software without having had to sign a non-disclosure agreement.

Large numbers of voters may be expected to check their own ballots in an elementary exercise of democracy. The participation of any significant number of voters in auditing the election, using their cryptographically certified paper trail, makes it extremely unlikely that any systematic alteration or discarding of votes will go undetected. A single lost or altered ballot is all that is required to trigger a full-scale official investigation and recount.