Two Paper Trails Are Better Than One (or None)
Two Paper Trails Are Better Than One (or None)
The VoiceVote system produces
an unalterable electronic record and two separate paper trails. One
paper
trail is retained by the voting authority in sealed ballot boxes. The
other paper trail is retained by the individual voters. These dual
paper trails make the election authority and the voters co-guarantors
of the integrity of the election process. Each of the ballots in each
of
these independent paper trails is secured by a digital signature. The
two paper trails have identical information, each comprising a
complete record of the ballots cast.
The creation of even a single paper trail, in comparison with an electronic voting machine that produces no paper trail, enhances confidence in the security of the election process. However, we consider that a single paper trail that is retained by the election authority is inadequate for four reasons:
First, a paper trail is useless if the paper ballots are not counted, or recounted, in the case of a contested election, and such a count (or recount) occurs only in an official audit. Triggering an audit is generally a difficult, expensive, time-consuming process. Courts tend to be very reluctant to overturn elections, even those with many irregularities. In practice there are few audits. The VoiceVote system builds in automatic, direct voter verification of the integrity of every election. It reliably detects any material error that may occur, and triggers an audit using the election authority's paper trail in the case of a single provably lost or altered vote. Further, the process of the voters themselves checking that their votes are correctly recorded and counted greatly enhances voter confidence in the integrity of the system.
Second, if only a single paper trail is produced and deposited in a ballot box, the voter no longer has any power to independently check his or her own vote. The voter cannot guard against later alteration or wholesale replacement of the vote. This is a fundamental defect of a single paper trail retained by the voting authority. Further, with electronic voting systems it is impossible to guarantee that the paper trail produced corresponds to the electronic votes cast. It is entirely possible for a computer program to display one thing to the voter and to record something different on paper and electronically. Some proposed election systems permit the voter to see (but not touch) a paper ballot that is produced before it is deposited in the ballot box. Tests of this type of system reveal that voters often fail to detect misprinted ballots. VoiceVote gives the voter the ability to print and examine a trial ballot in the voting booth before finally casting a vote.
Third, paper ballot systems that are not cryptographically secured are susceptible to votes being altered, replaced or "lost," as history has repeatedly shown. Voter intent may be difficult to accurately determine from an ambiguously marked paper ballot, and the marks on a paper ballot or may be altered or obscured after the fact. Digital signatures provide a qualitatively higher level of certainty that no information on a ballot has been lost or altered, and are in widespread use in other high security applications.
Fourth , any system that does not permit the voter to retain proof of his or her vote prevents the voter from exercising their role as a guarantor of the integrity of the election. The right to vote is meaningless unless it is backed by the right to guarantee that the vote is properly counted. This shortcoming applies also to some types of cryptographic systems that have been proposed.
The VoiceVote system remedies these problems by building in checks that are integral to the digital form in which the ballot is originally cast. Every ballot has a random identifier that permits it to be tracked. Every ballot has a unique digital signature that guarantees that it cannot be altered without detection. The identifier and signature are integral to each ballot. These, together with the second paper trail in the hands of the voters and the public reporting of all ballots, enable each voter to directly check that their ballot has been accurately recorded. It is no coincidence that, when asked, voters strongly prefer the option of a cryptographically certified receipt that they can retain over a paper trail retained by the voting authority.
The creation of even a single paper trail, in comparison with an electronic voting machine that produces no paper trail, enhances confidence in the security of the election process. However, we consider that a single paper trail that is retained by the election authority is inadequate for four reasons:
First, a paper trail is useless if the paper ballots are not counted, or recounted, in the case of a contested election, and such a count (or recount) occurs only in an official audit. Triggering an audit is generally a difficult, expensive, time-consuming process. Courts tend to be very reluctant to overturn elections, even those with many irregularities. In practice there are few audits. The VoiceVote system builds in automatic, direct voter verification of the integrity of every election. It reliably detects any material error that may occur, and triggers an audit using the election authority's paper trail in the case of a single provably lost or altered vote. Further, the process of the voters themselves checking that their votes are correctly recorded and counted greatly enhances voter confidence in the integrity of the system.
Second, if only a single paper trail is produced and deposited in a ballot box, the voter no longer has any power to independently check his or her own vote. The voter cannot guard against later alteration or wholesale replacement of the vote. This is a fundamental defect of a single paper trail retained by the voting authority. Further, with electronic voting systems it is impossible to guarantee that the paper trail produced corresponds to the electronic votes cast. It is entirely possible for a computer program to display one thing to the voter and to record something different on paper and electronically. Some proposed election systems permit the voter to see (but not touch) a paper ballot that is produced before it is deposited in the ballot box. Tests of this type of system reveal that voters often fail to detect misprinted ballots. VoiceVote gives the voter the ability to print and examine a trial ballot in the voting booth before finally casting a vote.
Third, paper ballot systems that are not cryptographically secured are susceptible to votes being altered, replaced or "lost," as history has repeatedly shown. Voter intent may be difficult to accurately determine from an ambiguously marked paper ballot, and the marks on a paper ballot or may be altered or obscured after the fact. Digital signatures provide a qualitatively higher level of certainty that no information on a ballot has been lost or altered, and are in widespread use in other high security applications.
Fourth , any system that does not permit the voter to retain proof of his or her vote prevents the voter from exercising their role as a guarantor of the integrity of the election. The right to vote is meaningless unless it is backed by the right to guarantee that the vote is properly counted. This shortcoming applies also to some types of cryptographic systems that have been proposed.
The VoiceVote system remedies these problems by building in checks that are integral to the digital form in which the ballot is originally cast. Every ballot has a random identifier that permits it to be tracked. Every ballot has a unique digital signature that guarantees that it cannot be altered without detection. The identifier and signature are integral to each ballot. These, together with the second paper trail in the hands of the voters and the public reporting of all ballots, enable each voter to directly check that their ballot has been accurately recorded. It is no coincidence that, when asked, voters strongly prefer the option of a cryptographically certified receipt that they can retain over a paper trail retained by the voting authority.