Electronic Voting

We present a game-theoretic approach to coercion-resistance from the point of view of an honest election authority that chooses between various protection methods with different levels of resistance and different implementation costs. We give a simple game model of the election and propose a preliminary analysis. It turns out that, in the games that we look at, Stackelberg equilibrium for the society does not coincide with maxmin, and it is always more attractive to the society than Nash equilibrium. This suggests that the society is better off if the security policy is publicly announced, and the authorities commit to it.

A risk-limiting audit is a statistical method to create confidence in the correctness of an election result by checking samples of paper ballots. In order to perform an audit, one usually needs to know what the election margin is, i.e., the number of votes that would need to be changed in order to change the election outcome.

In this paper, we present a fully automatic method for computing election margins. It is based on the program analysis technique of bounded model checking to analyse the implementation of the election function. The method can be applied to arbitrary election functions without understanding the actual computation of the election result or without even intuitively knowing how the election function works.

We have implemented our method based on the model checker CBMC; and we present a case study demonstrating that it can be applied to real-world elections.

The rate of e-voting implementation in developing countries is too significant to ignore, yet the lack of theoretical common ground has resulted in dispersed ways of perceiving the technology. The objectives of this paper, therefore, are twofold: (1) providing a thematic landscape and defining the state of the current research on e-voting in developing countries, and (2) propounding courses for future research on e-voting which emphasize social, organizational and technological accounts of the technology. Following a systematic examination of sixty seven articles, this work found that the current studies have inclined towards technological centrism and that the question is no longer ‘why’ but ‘how’ to fit e-voting concepts and theoretical constructs into the various contexts of developing democracy. There is also evidence to suggest that system design studies have often been conducted without sufficient effort allocated for the strategic design of e-voting initiatives. This paper thus argues that future research on e-voting in developing countries should be focused on drawing the holistic image of reciprocal relationships between social and technical aspects of the technology. As a consequence, future studies must perceive e-voting not as a mere technological means but rather as a complex socio-technical agent that plays an important role in social and political reforms. They need to be more critical of the motives behind e-voting initiatives and conservative in following established development frameworks.

In-polling-booth electronic voting schemes are being implemented in government binding elections to enable fast tallying with end-to-end verification of the election result. One of the most significant issues with these schemes is how to print or display the ballot without jeopardising privacy. In several of these schemes, freshly generated unmarked ballots contain critical information which combined with public “bulletin board” information breaks ballot secrecy. We present a practical solution which uses re-encryption inside the polling booth to print ballot papers in a privacy-preserving manner. This makes practical, at a user rather than computer level, multi-authority voting.

In this paper, we propose a new method for cast-as-intended verification in remote electronic voting. We consider a setting, in which voters receive personalized verification code sheets from the authorities over a secure channel. If the codes displayed after submitting a ballot correspond to the codes printed on the code sheet, a correct ballot must have been submitted with high probability. Our approach for generating such codes and transferring them to the voter is based on an existing oblivious transfer protocol. Compared to existing cast-as-intended verification methods, less cryptographic keys are involved and weaker trust and infrastructure assumptions are required. This reduces the complexity of the process and improves the performance of certain tasks. By looking at cast-as-intended verification from the perspective of an oblivious transfer, our approach also contributes to a better understanding of the problem and relates it to a well-studied cryptographic area of research.

We describe an update of the Estonian Internet Voting scheme targeted towards adding verification capabilities to the central system. We propose measures to ensure the auditability of the correctness of vote decryption and i-ballot box integrity. The latter will be improved to a level where it would be possible to outsource the vote collection process to an untrusted party and later fully verify the correctness of its operations.

An election is a process through which citizens in liberal democracies select their governing bodies, usually through voting. For elections to be truly honest, people must be able to vote freely without being subject to coercion; that is why voting is usually done in a private manner. In this paper we analyze the security offered by a paper-ballot voting system that is used in Israel, as well as several other countries around the world. We provide an algorithm which, based on publicly-available information, breaks the privacy of the voters participating in such elections. Simulations based on real data collected in Israel show that our algorithm performs well, and can correctly recover the vote of up to 96% of the voters.

We present security vulnerabilities in the remote voting system Helios. We propose Apollo, a modified version of Helios, which addresses these vulnerabilities and could improve the feasibility of internet voting.

In particular, we note that Apollo does not possess Helios’ major known vulnerability, where a dishonest voting terminal can change the vote after it obtains the voter’s credential. With Apollo-lite, votes not authorized by the voter are detected by the public and prevented from being included in the tally.

The full version of Apollo enables a voter to prove that her vote was changed. We also describe a very simple protocol for the voter to interact with any devices she employs to check on the voting system, to enable frequent and easy auditing of encryptions and checking of the bulletin board.

We outline various ways in which the single transferable vote-counting (STV) algorithm used by the Australian Capital Territory (ACT) differs from the basic STV algorithm as well-known from social choice theory. Most of these differences were instituted to make it easier and faster to determine the result of counting around 300,000 ballots by hand. We give small examples to show how such “simplifications” can lead to counter-intuitive results. We also argue that these “simplifications” significantly complicate computer implementation and general understanding of the counting procedure, especially in a mathematical sense. We then demonstrate the strange effects of these “simplifications” in real-world computer counted election results which were published by ACT Elections. It is imperative that electoral commissions begin the legislative processes required to replace their existing “simplified” STV with “unsimplified” STV.

In advanced democracies, the expansion of internet voting in national elections appears to have stalled. New announcements by governments of online voting initiatives seem to be matched by announcements elsewhere that trials will not proceed, or that completed trials will not result in wider deployment. Debates between proponents and opponents of internet voting in advanced democracies now run along well-worn lines. The same examples are endlessly recycled. This apparent inertia at the national level masks the gradual increase in examples of deployment at the sub-national level. These sub-national cases provide a growing stock of evidence about more and less successful ways of managing transitions to voting by internet. This article draws upon advocacy coalition theory to analyse some of these sub-national developments, focusing on remote online voting in Australia and Canada.

The introduction of remote electoral methods (also, e.g., postal voting) serves the citizen in providing an easily accessible and comfortable means of voting. In addition, remote voting is also considered a viable alternative for disenfranchised voters whose participation in elections has always been dependent on the methods they are offered – voters living or residing permanently abroad, voters who are living in conditions which make it difficult for them to attend elections for geographical reasons and voters with disabilities. All these voters need to make extra efforts in participating in the democratic process, and in all these cases, the principle of universality (or general elections) prevails over the possible concerns connected with the way of voting.

Still, Estonia is the only country in the world providing remote electronic means to its citizens in all elections countrywide. In this article we try to explain the reasons and modalities how Estonia could retain this service where other countries failed.

The theory of risk-limiting audits is well-understood, at least mathematically. Such audits serve to create confidence in the reported election outcome by checking the evidence created during the election. When election officials introduce election technologies into the voting process, it is best to do this after the appropriate auditing framework has been implemented. In this paper, we describe our experiences with piloting a risk-limiting audit of a referendum that was held in Denmark on December 3, 2015. At the time of the publication of this paper, Denmark’s election law did not permit electronic voting technologies to be used during voting allowing us to study auditing in isolation.

Our findings are that (1) risk-limiting audits also apply to paper and pencil elections; (2) election officials usually support risk-limiting audits even if no voting technologies are used because these audits can improve the efficiency of the manual count; (3) that practical and organizational challenges must be overcome to keep audits repeatable, in particular it must be possible to identify individual ballots repeatedly and reliably; (4) it is possible to arrange an audit for the result of an earlier stage in a count during a later stage, for example, an audit of the rough count results fine count; and (5) that whenever the electronic voting technologies are considered, auditing should be considered as part of feasibility study.

The question of the use of new technologies in different aspects of life has been considered in many countries with regard to the electoral process. Since 2000, more and more countries have held experiments with different types of e-voting. A growing body of research has emerged on this topic. However, not much attention so far has been given to the actual choices that legislators have to make when considering the introduction of e-voting. By sketching these issues, this paper aims to help to improve future discussions on this topic by ensuring that all relevant questions are being considered.

The paper discusses Poles’ opinions on the adoption of an alternative method of voting i.e. electronic voting (in the context of political preferences). The author focused on analyzing her research results on the adoption of e-voting systems in Poland emphasizing responses to the research question regarding Poles’ approval for having Internet-voting available in Polish elections and, whether, given the opportunity, the respondents would make use of this voting mode. In addition to own research findings, reference was made to the results of public opinion polls carried out by the Center for Public Opinion Research and the Ombudsman’s Office.