Technology Review - Published By MIT
Advertisement

Scratch-and-Vote System Could Help Eliminate Election Fraud

A new lottery-style scratch card has been developed that might make elections less susceptible to rigging.

By Duncan Graham-Rowe

Wednesday, August 09, 2006

smaller text tool iconmedium text tool iconlarger text tool icon

Compared with modern touch-screen voting systems, it may seem low tech. But according to its creators, the scratch-and-vote (S&V) system is a good way to let voters check that their ballot papers have been counted as they intended.

In future elections cryptography could allow voters to check that their “X” is associated with the candidate they voted for (Credit: istockphoto.com/Panaroid)

Using a current touch-screen system, "there is no way for an individual voter to know that his or her vote has been properly counted," says Josh Benaloh, a cryptographer who pioneered the development of cryptography in elections, and who now works for Microsoft Research in Redmond, WA. "Even election officials cannot be certain that the systems are free of errors."

Some of these machines are now designed to print paper receipts for each vote that's cast. This procedure is a little better, says Benaloh; but voters are still dependent on other people and procedures. "In practice, voters have no way to ensure that their votes are being counted properly or that they are being counted at all," he says.

With encryption-based voting systems, end-to-end verifiability is possible, because any voter should be able to "audit" the entire voting process. At the same time, such auditing processes must be balanced against the need for anonymity, says Ben Adida at MIT's Computer Science and Artificial Intelligence Laboratory. Adida created the S&V system with Ronald Rivest, professor of electrical engineering and computer science at MIT, who co-created RSA, one of the most widely used encryption algorithms.

Traditional paper-based systems do not provide sufficient anonymity because the unique number printed on the ballot to ensure that it is legitimate can be traced back to the voter's name. Therefore, a number of researchers have tried using cryptographic techniques to keep a voter's identity a secret while ensuring that all votes cast are legitimate.

The S&V approach builds on this idea and can be used in conjunction with a number of existing voting schemes. One recently proposed scheme, called Prêt-à-Voter, involves the listing the candidates' names in random order on one half of the ballot, with the tick boxes on the opposite side. After votes have been cast, a voter tears along a perforated line separating the list of names from the tick boxes. Developed by Peter Ryan at the University of Newcastle-upon-Tyne in England and David Chaum, a cryptographer who founded DigiCash, the system depends on a cryptographic code on the tick-box side of the ballot to encode the list of candidates' names in the order they appeared on the original ballot.

The concern with this kind of system is how to ensure that the information encrypted matches the order of the candidates' names. This can be achieved by giving each voter two ballot papers. The voters choose which ballot is audited and which they'll use to cast their vote. This audit process tells them nothing about the validity of the ballot paper itself -- but it does provide a 50:50 chance of spotting a rigged ballot paper. And, given such a high probability, illegitimate ballot papers would quickly show up in an entire electorate.

The S&V approach makes this auditing process secure because it allows a ballot paper to be checked without having to involve an election official (who in theory could be corrupt and tamper with a ballot). When applied to the Prêt-à-Voter scheme, S&V adds a scratch surface on the side bearing the candidates' names, while the order of the candidates' names is encoded cryptographically beneath the tick boxes. "This scratch surface is exactly like a lottery card," says Adida.

Comments

  • Anything is better than nothing
    Anykind of system is better than the touch screen system.  Touch screen system is full of potential for fraud.
    Rate this comment: 12345
    Guest (Faith)
    08/09/2006
    Posts:1
  • Improving on it
    I suggest a scrath and sniff feature be included so that we can determine whether or not a candidate or measure stinks.
    Rate this comment: 12345
    Guest (Johnny)
    08/09/2006
    Posts:1
  • Way Too Complicated
    I code some fairly complicated programs, and I thought this idea was way too complicated for ordinary use.  No ordinary person will trust it, because they don't understand it.  But isn't trust the idea you are trying to address?
    Rate this comment: 12345
    Guest (Bruce)
    08/09/2006
    Posts:1
    • Too complicated for Bruce
      Oh please...this can not be too complicated for you if you really "code some fairly complicated programs."  I haven't coded anything since I finished my doctoral dissertation in 1978, and I understand it.  As for explaining it, I would hire a professional explainer to do that.  They're good at that stuff.
      Rate this comment: 12345
      Guest (Election Administrator)
      08/09/2006
      Posts:1
  • Improve turnout
    Make it resemble a lottery ticket and even give a chance of winning a prize.  then you'll get out the vote!
    Rate this comment: 12345
    Guest (Paul)
    08/09/2006
    Posts:1
    • being done
      In at least one region of the U.S. this is being tried by an "impartial" group that supposedly only wants to "get out the vote."  But what kind of voters will this attract?  Idiots who only care about getting stuff "for free" and are too stupid to realize that nothing is free -- somebody always pays.  Guess which way they are likely to vote?
      Rate this comment: 12345
      Guest (dmm)
      08/09/2006
      Posts:1
      • Get out the Vote
        I never said anything about the quality of voters this proposal would  resonate with!!
        I know what you mean!!
        Rate this comment: 12345
        Guest (Paul)
        08/09/2006
        Posts:1
  • correct vote
    Voter standing two line, put two camera
    head count broadcast on net realtime

    easy spot line size different
    Rate this comment: 12345
    Guest (easy fix)
    08/09/2006
    Posts:1
  • Touch Screen
    Here's how to solve this problem:

    1. Anyone who walks up to a touch screen terminal can vote; it's up to the elections officials to police the perimeter around the terminals. 

    Each registered voter can be given a card that is good for 1 vote, but again this card is not connected to the user's name in any way.

    Each voter is assigned a number (this has no connection to their name) and gets a printed receipt for their vote.

    2. The number of votes cast must match the number of people who signed in at any given precinct (this keeps extra votes from being cast).

    3. User's can match their number to published results in the days following the election (newspaper, online, etc) to make sure that their vote was counted for the correct person and that it matches their receipt.

    This method gives you anonymity and auditability.
    Rate this comment: 12345
    Guest (Phil )
    08/09/2006
    Posts:1
  • Sequence number
    Mr. Adida needs to do more research.  The "unique number" on the ballot is removed before the ballot is deposited in the ballot box and is therefore not traceable to the voter.  It is used to audit ballots before and after the election.  Voted ballots have no number on them.
    Rate this comment: 12345
    Guest (Has experience)
    08/09/2006
    Posts:1
    • Current System
      Agreed, they need to do research.  They're solving a problem that doesn't exist.

      Last time I voted it worked like this:
      1.  Went to checkin table, they checked me off the roster.
      2.  Was handed numbered ballot by election official.  No record was made linking my name to the ballot.
      3.  Went into booth and marked ballot. 
      4.  Took ballot to scanner, inserted into scanner.
      5.  Scanner verifies ballot correct (no double votes, all legible), counts ballot.
      6.  Ballot dropped into ballot box for recount, if needed.

      Note that:
      a.  no link between me and numbered ballot.
      b.  I see the ballot counted and in the box (clear path from scanner to box).
      3.  Any issues, manual recount possible - human eyes looking at legible paper ballot.
      Rate this comment: 12345
      Guest (jsmith)
      08/09/2006
      Posts:1
    • Unique identifiers
      Adida knows what he's talking about.  You are thinking of the number on the ballot "stub" which is torn off before the ballot is deposited.    Adiba is correctly concerned that it is unlawful in many states to attach a number to the cast ballot.  The problem he is attempting to overcome is the one of "how can a voter audit the disposition of her own vote when there is no way to identify which among all the votes counted was hers?"  This is a very real problem for those concerned about election fraud.  I remember that in "House of Spirits" Isabel Allende has a monumentally corrupt South American politician telling his party, "If there's ever a time when we can't get at the ballot boxes before the votes are counted, we're sunk!"   The problem with electronic voting systems is that the "ballot box" is now completely hidden and at the same time accessible.
      This is NOT a trivial problem.
      Rate this comment: 12345
      Guest (Election Administrator)
      08/09/2006
      Posts:1
  • Trust & verify
    I'd have to see closer how the proposal would work, but the "paper-verified" bandwagon is simple-minded: nothing prevents a receipt being printed that makes a voter feel good (echo his/her vote) while the machine is programmed to do something else.

    I've heard a diff't plan: you vote in the machine which prints your vote, which you inspect and deposit elsewhere (to be scanned, say). In the end the scanned totals by candidate must match the machine's tally. Redundant but safer. Built-in audit.
    Rate this comment: 12345
    Guest (Dubious)
    08/09/2006
    Posts:1
    • System Already Exists
      A system similar to this already exists.  It prints out the selections you make on the screen and then you scan it in after verifying it.

      However, the "paper-verified" position is not simple-minded.  Its purpose is to have an unalterable human-verifiable record which can be used to audit the reported results of the electionic voting machine.  The problem is that the paper receipt style that most touch-screen electronic voting machines have are clunky add-ons that are there only for HAVA compliance and are not counted as the official voting record.

      The simplest, cheapest solution is a simple OMR form that the voter actually marks himself and is the official record of the voter's intent (not some electronic record).  There is no need to make this more complicated.
      Rate this comment: 12345
      Guest (Chuck)
      08/09/2006
      Posts:1
      • OMR form
        There are difficult problems, still...  Multiple languages in large jurisdictions (11 in Los Angeles County, as I recall)  computer voting makes this problem much more manageable.  Also accessible voting for voters with disabilities...some blind and paralysed voters claim that OMR voting is inaccessible, even with the use of tactile ballots.  Federal laws control these issues and they cannot be ignored.
        Rate this comment: 12345
        Guest (Election Administrator)
        08/09/2006
        Posts:1
        • e-voting: the pluses without the minuses (1/2)
          As Election Administrator points out, e-voting machines have considerable advantages over hand-marked paper ballots--they cater nicely to diverse languages and multiple ballot styles, saving the cost of printing and securely storing and transporting thousands of blank ballots. They also enable many voters with disabilities to vote without assistance, i.e., privately.

          The trouble starts when e-voting machines are also given the responsibility of tallying the votes. To deserve voters' trust, the process of counting the votes must be open and transparent, and there's nothing transparent about silicon circuitry. As has been said before, the purpose of counting votes is to convince the losers that they lost; if the losers can't see the votes being counted, there's no way to settle the arguments.

          [continued...]
          Rate this comment: 12345
          Guest (AustinHam)
          08/11/2006
          Posts:1
        • e-voting: the pluses without the minuses (2/3)
          So how can we have both the benefits of e-voting and the transparency of open vote counting? Easy-- just restrict the job of the e-voting machine to printing each voter's filled-in ballot. Note that I'm not suggesting the dinky reel-to--reel "toilet paper" audit-trail printers now being retrofitted to DREs in many states. The ballots I'm suggesting would be printed in large friendly letters on 8.5 x 11 paper. They would be easy for voters to read, check, and drop into an ordinary ballot box. Suitable laser printers can be bought at retail for under $150.

          [continued...]
          Rate this comment: 12345
          Guest (AustinHam)
          08/11/2006
          Posts:1
        • e-voting: the pluses without the minuses (3/3)
          After the polls close, the machine-printed ballots would be counted by hand or by optical scanning. Either way, the machine-printed ballots would eliminate the judgment calls often necessary to infer the voter's intent from ballots marked by hand. They would be free of overvotes and disqualifying stray marks. And like all paper ballots, they would remain available for recounting until the losers are finally convinced.

          A system like the one I've described has been designed and prototyped by the Open Voting Consortium. You can read all about it at <www.openvoting.org>.
          Rate this comment: 12345
          Guest (AustinHam)
          08/11/2006
          Posts:1
  • Verification you are who you say you are?
    What I don't understand is that not once have I been asked to present an ID that I am who I say I am.  I know in some precints you can look to see a record of what elections each registered voter has voted in.  What's to keep someone from voting over and over using a list of names and precints for all those who have not voted in the past 4-5 elections?  All of these complications about trying to audit ballots seem pointless to me until we've taken care of the simple problem of verifying ID.
    Rate this comment: 12345
    Guest (A citizen)
    08/10/2006
    Posts:1
    • Verification--
      I live in a small community and everybody knows everybody by name already--they still ask for ID...so maybe your polling place is corrupt or something.
      Rate this comment: 12345
      Guest (beemerlady)
      08/14/2006
      Posts:1
  • [no subject]
    Rate this comment: 12345
    Guest
    08/10/2006
    Posts:1
  • fatal flaw

    Any scheme that enables a voter to determine whether his/her vote was counted correctly suffers from an inherent flaw-- it also would enable the voter to prove how s/he voted to someone else. That ability opens the door to vote buying and intimidation. It's to prevent such inducements that we have polling places where voters' privacy is protected (yes, mail-in voting suffers from the same flaw, which is why it should be abolished).

    This is one of those problems that's easier to solve if it is generalized. If a voter is convinced that all votes are counted correctly, it follows that his/her vote is counted correctly. This calls for a system in which vote counting is open and transparent, based on paper ballots (not necessarily marked by hand) which can be counted as many times, in as many different ways, as necessary to satisfy skeptics.
    Rate this comment: 12345
    Guest (AustinHam)
    08/11/2006
    Posts:1
    • coercion restanace
      In fact, these voter-verifibale schemes do not suffer from this claimed flaw. The point is that voters can confirm that their encrypted receipt is input into the tabulation. Various checks are performed to ensure that:

      1/ their vote intent is correctly encrypted in their receipt.

      2/ The tabulation process decrypts all receipts correctly.

      However, the tabulation process anonymises the votes by losing any link between encrypted receipts and decrypted votes.

      Thus, the voters can be assured that their vote is accurately counted as cast whilst not having any way to prove to a 3rd party how they voted.

      Reading the original papers should make this clear.
      Rate this comment: 12345
      Guest (Peter Ryan)
      08/15/2006
      Posts:1
  • scratch and vote
    Anything to prevent vote manipulation.
    Rate this comment: 12345
    Guest (Lila Roberts)
    08/13/2006
    Posts:1
  • Propaganda Wins over any Vote System
    An excellent voting system won't get the objetive because money invested in Propanga make votes.
    Rate this comment: 12345

    e-Nano
    08/18/2006
    Posts:1

Log In

Forgot your password?     Register »
Advertisement

Videos

Malleable Maps, Artistic Robots and Bubble Interfaces
Technology Review January/February 2010

Current Issue

Security in the Ether
Information technology's next grand challenge will be to secure the cloud--and prove we can trust it.
Advertisement
Advertisement
Advertisement
Subscribe to Technology Review's daily e-mail update. Enter your e-mail address

TECHNOLOGY RESOURCES
Advertisement
MIT Massachusetts Institute of Technology © 2010 Technology Review. All Rights Reserved.