Re: Left off the ballot?

From: Douglas W. Jones <jones_at_cs_dot_uiowa_dot_edu>
Date: Wed Apr 14 2004 - 08:54:27 CDT

> For a touchscreen system, there's no way to directly prove that the
> screen
> display was correct, because it's under software control. But you can
> "prove" it indirectly. For example, perhaps this would work: if the
> system
> runs the same software all day (from ROM, CD, etc.), the software is
> archived when the polls close, and the sequence of votes is recorded
> and
> archived, then it should be possible to "replay" the day and show that
> the
> machine always showed the correct thing on the screen (or not).

No you can't. It's illegal to store the voted ballots in a way that
allows the connection between voter and ballot to be reconstructed,
so while you can replay the day, to some extent, you can't know which
ballot was voted when.

Here is what a voting system can save:

   An audit log showing when the polls opened, when it was enabled
      to allow a voter to vote, when that voter cast a ballot, when
      the polls were closed, and when the final totals were printed.
      This log will also include records of switchover to battery
      power, time powered up, time powered down, and other significant
      events.

   Every ballot cast.

What you don't get to replay is:

   The order in which a voter made selections, including select, deselect
      reselect sequences as the voter composed their ballot.

   Which ballot was cast at what time.

The problem is, a Trojan, or equivalently, a bizarre glitch, could be
triggered by such things as select-deselect sequences or the order of
votes for different candidates. This replay cannot capture this, so it
cannot prove that something strange happened.

Here is a proposal for inclusion in a "Fraud-O-Matic" touchscreen
voting system: To remove a candidate from the ballot for the next K
voters, a voter may: Go to the race in question, select and then
deselect each candidate in the race, in presentation order, from top
to bottom, and then do the same thing from bottom to top. Then, select
and deselect the victim K times, then select the candidate you prefer.

We need to make sure, in any voting system, that the audit trail is
sufficient to defend against the accusation that the system could
contain
such a feature lurking somewhere inside.

                        Doug Jones
                        jones@cs.uiowa.edu
==================================================================
= The content of this message, with the exception of any external
= quotations under fair use, are released to the Public Domain
==================================================================
Received on Fri Apr 30 23:17:05 2004

This archive was generated by hypermail 2.1.8 : Fri Apr 30 2004 - 23:17:29 CDT