The following is a description of the specifics of how a VVAT system could work in Ireland, using a modified version of the proposed system. Some changes here are not strictly required for implementation of a VVAT. This implementation is based on auditing by comparing electronic votes to paper ones. This is just one possible implementation.
I suggest ways of dealing with some problems which are not specific to VVAT (they can occur in the proposed system) and which are not addressed by any procedures for the proposed electronic system.
This text is unfinished and I intend to update it in the next few days, with some rewording for clarity, and possibly some additions after I look for loopholes.
Please give any comments you have on this on the discussion forum.
The following terms, when used in this text, have the meanings given here:
References to elections also apply to referenda and references to constituencies also apply to other types of electoral area.
The following hardware changes to the Nedap voting machine would be required:
It would be an advantage if the machine could return rejected printed ballots to the voter. The voter could then destroy it him/herself. This way, the voter can ensure that noone sees their rejected ballot (this might be important if it was entered by mistake, because there would tend to be few rejected ballots in each machine and an agent could probably tell if the voter rejected a ballot and entered a new one (by the sound of the printer, for example) ) and that it does not actually get counted. Such ballots would not prove anything and would have a mark printed on them to indicate that they were rejected (see the section The Printed Ballot). The extra cost of this is might not be justified.
Another option would be to have two ballot boxes in the machine, with the machine directing rejected ballots to a separate box. I would still recommend printing a mark to indicate that these ballots are rejected, since they would be in close proximity to the accepted ones and there would be a risk of someone moving some of them into the box of accepted ballots (however, to get away with this, they would have to tamper the electronic system also, and there would be a risk of being caught by agents).
Printing of paper ballots and cutting the paper
The operation of this is described in the section Voting - Normal Procedure.
The first two changes are for assisting in comparing the electronic votes to the paper ballots, so these changes would not be necessary if the audit involved conducting a full manual count instead of comparing votes. These features could still be useful, in that case, to help determine whether a discrepancy was caused by human error in the audit or by failure of the electronic system. The third change listed below, provides for recovery from the a situation where all copies of the electronic votes are corrupted (which is very unlikely) or deemed to be unreliable due to a fault being discovered in a machine. This is not essential and is a feature which is made possible by the use of a VVAT.
A VVAT could be implemented without any changes to the count centre software.
Printing Summary of Votes from a Machine or Group of Machines
The software would have the facility to print a list of all unique votes and the number of each which there were on a ballot module or a group of ballot modules 2.
They would be sorted in alphabetical order of first preference candidate, then second preference candidate and so on for all preferences. This printout could be used for comparing the paper ballots to the electronic votes. (Of course, a tampered machine could print this list wrongly. The audit procedure described below will still show that the system has failed in this case).
The printout could look something like this:
|
Each unique vote has a row of boxes for the count staff to mark - one box for each paper ballot matched, in order (left to right). The last one has an asterisk, so that fraudulently adding boxes would require erasing this.
To make it easier to find a vote, a heavy line divides groups of votes with the same first preference. Every second vote is shaded to make it clearer which row of boxes relates to each vote (to reduce the incidence of errors in marking these).
The meaning of the information at the top of the page is as follows (some of these are just ideas for other improvements to the system, which might also require a change to the voting machine or other changes to IES):
| Election | Title of the election. |
| Electoral Area: | The electoral area (constituency, ward, etc.) in which the machine was used. |
| Machine(s): | The number of the machine, or all machines in the group. If the ballot module has a serial number, it would also be printed here. |
| First and Last Votes: | The time at which the first vote and last vote on the module were recorded. This is not essential, but I suggest that recording this on the voting machine, reading it to the count centre PC and displaying it here would be useful. |
| Start and End of Voting: | The time period during which the machine was in a mode where it accepts votes. Another feature which is not essential but might be useful. |
| Number of Votes: | The total number of votes cast on the machines (this does not include rejected ones), the number of votes excluding deliberately spoiled ones (if this is supported), the number of rejected votes, the number of times the machine was activated without recording a vote. |
| Hash (SHA-1): | A cryptographically secure hash of the binary data of the votes on the ballot module (as one block), in a clearly defined format. This is not currently supported by the system, and is not essential, but could improve security if was added and the voting machine printed a copy of it for each agent at the end of polling. |
| Printed at: | The time at which this report was printed, the page number and number of pages. |
| Count PC serial number: | Any unique ID of hardware in this PC. For example, it could be an Intel CPUID. |
| Ballot module read at: | The time at which the ballot module was read by the count centre PC. If any votes were entered manually (see point 3 below), the number of such votes would be shown here also. |
| Voting machine model: | The model of voting machine used, and the revision of the motherboard, if applicable and available. |
| Voting machine software version: | The version number of the firmware in the voting machine. |
| IES version: | The version of the software on the count centre PC. |
Square brackets are used around values to prevent text being fraudulently added by an agent in order to falsely claim incorrect behaviour.
Security features (for example, an official stamp) could be applied to the paper. If none are used, this printout could easily be forged. While precautions are taken to make this more difficult to fraudulently modify, forgery is possible (laser printer toner can be relatively easily removed from a page), but security of the system does not depend on this.
This report could, alternatively, be laid out with the preferences of each vote listed vertically (more closely resembling the paper ballot).
A facility to search for a specified vote
This is not essential, but it would be useful to be able to enter a set of preferences of a vote and have the system report how many votes from a selected machine or group of machines2 have exactly these preferences.
If this is used to search for the preferences of a given paper ballot from the system, and they are not found, this would prove that the system had behaved incorrectly. However, if it finds the vote, it cannot be relied upon, because a tampered machine could give a false result.
When an audit fails, this may provide clearer evidence of the failure.
A facility to manually enter votes
This could be used in the event of both copies of a ballot module being corrupted or failure of the system to correctly read a ballot module.
If this feature is used, the system would record how many votes were entered for each machine or group of machines2 and
output this in all relevant results output.
There would be a facility to delete or modify votes which are entered manually (but not individual votes which were read from a ballot module electronically).
The system should keep a log of all actions done using this functionality and this should be published after the election (Note, however, that falsifying this log would not be difficult, so ensuring integrity of the system depends on agents watching the person using the count centre PC at all times).
IES could display the number of votes on a ballot module as it is read.
This is not essential, but would increase the change of detecting some types of error.
Lists of votes can already be extracted from the system (some results from the general election were published), so software to do this could be written separately from the IES software.
The ability to have this written as a separate application would tend to reduce the cost to the government, due to competition - they could put out a tender and choose the lowest bidder. If this was put out to tender, the government could make it a condition of the contract that the source code would be published (made available to everyone on the Internet).
Implementing it as part of IES is likely to make it easier to use for the computer operator.
|
The names of the candidates are printed in order of preference. Each line of the ballot shows the preference, a space, then the candidates name in a uniform format, which would exactly match the name printed on the face of the machine. In the event that a candidate's name was too long, it would have to be shortened or truncated in this printout, but the paper on the face of the machine would also indicate how it would be displayed on the printed ballot. The letters in brackets would indicate the party affiliation (or an indication that a candidate is non-party) of each candidate (in abbreviated form). (I have avoided using actual party names here). This makes alteration more difficult (by adding redundancy) and also reduces the chance of a vote being manually miscounted for a candidate with a similar name. In this example, "(-)" indicates that a candidate is non-party (independent) (it could equally be "(NP)" or "(IND)" provided that no party name has those initials).
Machine NumberThe machine number (or any type of unique identifier for it) could be included (as shown in the example above). It would have to be possible to configure the machine not to print this. Machines which are likely to get below a certain number of votes would be configured not to print the machine number on the ballot, and the votes from those machines would be mixed with others which also did not print the machine number on the ballot. It must be possible for the voter to verify that this number is the same number printed on the paper ballot of everyone else who uses the machine. This could be achieved by displaying the machine number on a printed notice on the machine. The voter could compare this to the number on the printed ballot and could that it does not change for each voter since it is on a printed notice. Printing the machine number on the ballot does not compromise secrecy any more than revealing the list of votes from a machine. The advantage of this is that, if there were a failure, this would make it clearer that the electronic system failed, rather than the audit system. For example, without this, when the paper ballots do not match the electronic votes, one could theorise that some paper ballots had accidentally been moved from one box to another. Such a claim could not be disproven and could be used as an argument against carrying out a full investigation.
The asterisks above and below the names and around each line make it more difficult to alter - to insert another preference (or add letters to the end of a name, e.g. changing "John" to "Jonathan", though the party initials prevent this too), it would be necessary to erase some of these asterisks first. Only three asterisks are used above and below (rather than filling the whole width of the paper) so that the voter could easily notice if more or fewer asterisks were used. (Since a tampered machine could compromise secrecy by printing ballots in non-uniform ways). For the same reason, each line is not padded to the edge of the paper. Security of these ballots, however, would be primarily based on physical security of the ballot box, is in the paper system.
Alternatively, the full list of candidates, each with the preference beside him/her, could be printed, but I think that this format is both more intuitive for the voter (when verifying it) and clearer for people conducting a manual count (it could be sorted faster). Since there is less information, there is less scope for a tampered machine to make it non-unique without being noticed. It could be argued, however, that this method is more prone to manually miscounting votes for a candidate with a similar name.
The last line is printed when the voter approves or rejects the ballot. A rejected one could look like the following:
|
The "REJECTED" message is formatted to be conspicuous (so that it can be easily separated from the valid ones in a manual count). The number of greater than and less than symbols is chosen for the same reason as the number of asterisks.
There should be a notice near the machine, explaining what the printed ballot should look like and encouraging people to report if it is not exactly correct or if the print is faint.
A voter may think that the system is behaving incorrectly because they are using it incorrectly. In this case, the machine operator could instruct them on how to use it or demonstrate how to vote, without actually pressing the "Cast Vote" button. Then the machine operator would move away and the voter would try to vote again. In the event that he/she still could not vote after repeated attempts, if the he/she is willing to give up the secrecy of his/her vote, the machine operator could show them how to use it or even vote for them (but this is undesirable). If he/she is not, then he/she will not be able to vote and is in a similar position to someone who finds a fault but cannot demonstrate it because of secrecy.
If a voter cannot learn how to use the machine and knows that he/she cannot use it correctly, he/she could possibly be treated similarly to a blind or disabled person - with someone assisting them to vote. In this case, there is a risk that a voter might be intimidated into requesting that someone assists them in this way. This is not ideal - whether this assisted voting is allowed or not - but it is no different to when there is no VVAT.
In either case, this is not an issue with the VVAT.
If a voter falsely claims that the machine is behaving incorrectlyWith inkjet and laser printers, this can be detected and the machine could stop accepting votes until the cartridge was replaced. However, the most cost-effective solution would be to use the existing matrix printer in the Nedap machine for printing the paper ballots.
The ribbon should be checked or replaced before the election so that it is unlikely to run out.
If it does run out of ink:
It is usually necessary for one voter to give up the secrecy of his/her ballot in order to prove that the system is behaving incorrectly.
If, in the cases above, the problem was resolved by using a different machine or retrying with the same machine, the voter has cast their vote correctly, and can report the failure, but cannot prove it. If this is happening, it is likely that some voters are not noticing the failure.
However, since only one voter has to give up the secrecy of his/her vote to prove the failure, this is likely to be enough to detect a fault and should provide a strong disincentive to tampering.
While this situation is not ideal, it is much better then the situation where there is no VVAT - in that case, the voter would either not know that the system had failed at all, or, at best, would still have to give up the secrecy of their vote to demonstrate an error. If the system was competently tampered, the voter would have no way of knowing.
Voters should be encouraged to report any problems they have with voting machines, even if they cannot prove incorrect behaviour. If a significant number of such reports were received, or if there is any evidence of incorrect behaviour, they should be investigated.
These procedures may seem complicated, but one has to remember that, without a VVAT, it is simpler only because errors (or tampering) would not be detected in certain cases (hence, there is no procedure for dealing with it).
Unproven FailureA situation can occur in which a voter can see that a machine is behaving incorrectly and cannot cast his/her vote as intended (the failure might occur with certain combinations of preferences only), but cannot prove this, since they are not willing to give up the secrecy of their vote.
This is a problem with any DRE system - not a problem with the VVAT. This might occur less often without a VVAT, but that is because such a fault is less likely to be detected without a VVAT. In my opinion, it is better for a voter to not be able to vote than to vote and have his vote recorded incorrectly, unknown to the voter. The latter case preserves confidence in a system which is behaving incorrectly.
Information printed by the machine before and after polling would be printed using the same printer, but it would not cut the paper. The paper could then be torn off and not put in the ballot box.
Before voting, the agents would be shown that there are no paper ballots in each machine (as well as the existing checks).
After the close of voting:
As an added security precaution, the paper ballots could be transported separately from the primary ballot modules.
As each ballot module is read, IES (as modified) would display the number of votes in it. This would be compared to the number of people marked of the electoral register, entitled to vote on that machine, adjusted for anyone who was allowed to vote on a different machine to the one they were registered for. If the number of votes was higher, or significantly lower, this should be investigated and the constituency should be audited.
If it was only slightly lower, it could be explained by people identifying themselves and then leaving the polling station without voting.
A discrepancy could be accounted for by a voter innocently voting on the wrong machine, or an error in the records kept manually of people allowed to vote on a different machine. In these cases, the total number of votes for all machines in a polling station should still equal the total number of people marked of the electoral register for that polling station (except for people who left without voting).
If both copies of a ballot module are corruptedIf a ballot module and its backup are both corrupted, votes from that machine could be manually entered to the system from the paper ballots (this is very unlikely since each module holds two copies of the data).
Audits would have to be done on whole constituencies, since if only certain machines in each constituency were audited, the count software, if tampered, could alter votes from ones which were not audited only. This could easily be done if, as I am suggesting, the count centre PC prints reports by machine for use in auditing (tampered software could alter votes from machines for which no report was printed only).
Constituencies to be audited could be decided as follows (by all of the following):
Some of these points may require better specifications of the system to be made available (and to be written if they do not exist).
Whenever votes from a backup ballot module are included in the count, the votes from its machine should be audited, since security of the backup ballot module may not have been as tight as for the primary one.
The Importance of Random SamplingRandom sampling (for auditing) is important (even if parties can nominate specific constituencies) so that a minimum probability of a constituency being chosen can be determined statistically.
For example, if one constituency is chosen randomly (out of 42), the probability of any given constituency being chosen is 1/42. However, if a human chooses one, the probability is not necessarily this, because the human may have a bias, and this bias cannot be quantified without a significant amount of past data. The danger is that it might be predictable that a certain constituency would be neglected. If one constituency is chosen at random and one nominated by a person, then the probability of any given one being chosen cannot be easily determined, but it is at least 1/42 (a minimum value for the probability).
Random sampling would also help to assure each voter that his/her vote has a chance of being audited (without it, there might be a perception that the parties never choose a certain constituency).
A decision has to be made on whether the full list of votes from the electronic records of votes is to be published for all constituencies or only for selected ones. With the auditing system I am proposing, it would be necessary to publish these for all audited machines, at least.
Decisions on which constituencies to audit could normally only be made after the electronic system had returned a result in every constituency. Results in each constituency should be considered provisional until they are audited or it is decided that they will not be audited.
The votes could be counted manually as in the paper system, but this leads to issues with the random distribution of surpluses. One option is to use pure proportional representation in both the electronic and manual counts. This would be a slow process to do manually.
The system I suggest here is based on pure proportional representation, but instead of conducting a full manual count, the paper ballots for each box (i.e. each machine) are compared to the electronic record of votes.
Briefly, the audit is based on the following:
Step 3 also requires each party to either have access to software which they trust to do the count or to do a count manually. The latter is likely to be too expensive. A party would tend to trust a program if either:
It is likely that there would be a few open-source implementations of this software (I know of two being written at the moment, including my own one) available from people with different political interests. Any computer literate person could verify that each of these gives the same result.
Comparison of paper ballots to electronic records of votes could be done as follows:
It should be accepted that if the electronic system fails, significant expense may be incurred by extended auditing and, possibly, counting votes in another way (even manually if necessary) - this is the price of democracy. The measures discussed in this section are last resorts, which it is hoped would never have to be used.
In this case, votes already cast cannot be relied upon. Most of the paper ballots are probably correct, but some may be incorrect due to the voter not checking them.
If the fault is thought to affect only certain machines, those machines could be taken out of service and voters who would have voted on them could use other machines in the same polling station, if there is more than one machine. The machines could be replaced with spare ones. However, it may not be apparent at that stage, whether the fault affects only one machine or is a software bug or design flaw which affects all machines.
One option is to stop using the electronic system and revert to the manual system of voting. This would require stationary and ballot boxes to be kept at each polling station or at central locations from which they could quickly be delivered to a polling station when needed.
If the fault found did not involve printing paper ballots wrongly, and did not prevent votes from being entered as the voter intended, voting could continue until the close of polling, with voters, everywhere in the country, could be reminded to check their paper ballots. Then votes from the affected machines could be entered manually during the count.
After the voting, an investigation would be held to determine the cause and extent of the failure. It would then be possible to assess whether all electronic votes or all paper ballots from the affected machines can be relied upon.
If it is decided that only the paper ballots can be relied upon, then these would be entered manually.
If it is decided that both paper and electronic records should be correct, then the count would proceed as usual, but the affected machines would have to be audited.
Depending on the nature of the fault, the affected machines may be all machines in the whole country.
If it is decided that the paper ballots cannot be relied upon, and that the number of such ballots is enough to change the result of the election, then an election should be held again, in which only the voters who voted on the affected machines vote. The votes cast in this way would replace those from the affected machines in the original election and the count would then be completed in the affected constituencies.
If the cause was determined to be fraud, the election should be held again, if necessary without using the electronic system. I consider this necessary because the full extent of the fraud may not have been discovered.
If the system is found to have failed (i.e. produced an incorrect result), three things happen:
Either the fault must be found and corrected in a transparent way (and then the constituency must be fully audited again) or the constituency in which it is found to have failed must be counted by another means.
The audit must be extended, i.e. a greater proportion of constituencies must be audited. If the fault is not identified (and transparently revealed), then any constituency could have suffered the same fault. Therefore all constituencies should be audited. If the fault is identified, then it could be determined which constituencies could have been affected. However, since there is the risk of human error in making this determination, an increased number of constituencies should still be chosen (randomly or selected by agents) to be audited.
An investigation into the cause of the failure is carried out. The first phase of this investigation would involve examining equipment and software. This may be hindered by the fact that the software is not open-source. Procedures should be defined detailing how this examination should be carried out. The agents should be entitled to be given copies of the software installed on any relevant count centre PCs. The aim of this first phase is to localise the fault (determine what parts of the system are affected) and classify the failure as one or more of the following:
The investigation must be thorough since fraud could possibly be disguised as another type of failure. In the event of fraud, there is no guarantee that the cause will actually be determined as fraud (it could be mistaken for another type of failure or never determined). For this reason, the penalties for fraud must be high, to provide a deterrent.
Paper ballots should be kept for a reasonable amount of time after an election, in case evidence of fraud emerges at a later stage. The continuing risk of being caught long after the event should provide a further disincentive to commit fraud.
If the failure was caused by a software bug, which is then fixed, demonstrating what the fault was would help restore confidence in the system. This can easily be done in an open-source system - once the bug is revealed, programmers can locate it and verify it in a copy of the software which was released before the election. However, in a non open-source system, it is likely that the public will never know whether the failure was caused by tampering or a bug, unless they completely trust the software vendors to tell them this. For this reason, I think that, in a non open-source system, such as this, it would be necessary to audit all constituencies in the event of a failure.
I have not specified this in detail yet, but briefly, the options are:
If a spoilt vote is supported, it might use one of the buttons which would otherwise be used for candidates (thus reducing the maximum number of candidates in each election by 1).
There would be a facility to define groups of machines (or ballot modules, since one ballot module comes from each machine). When the number of votes cast on a particular machine (on its ballot module) is below a certain threshold, it would be grouped with one or more other machines. These groups would be defined before reading the modules. One of these groups could be selected to print a list of votes for. When a machine is in a group, the system would not print a list of votes for that machine individually nor allow searching for a vote from that machine specifically. Some method combining votes from a number of machines is needed whether a VVAT is used or not (Minister Cullen has promised this), though in the system, as it is now, this could be done by software external to IES.
| Evoting | John Lambe |