Despite the conventional wisdom that e-voting would take place first in established democracies and later in developing countries, the speed of implementation has been higher in the developing world, especially in Latin America, with several countries such as Brazil, Venezuela, Argentina and Ecuador implementing e-voting methods. This paper looks at the experience of Salta, the first Argentine district rolling out e-voting for the entire electorate in 2013. Based on a survey of 1,000 voters in the 2013 provincial elections, the voter's experience and confidence in the election process is analyzed. Among the key findings, there is a strong effect of a voter's ability to use the voting machine without assistance on the overall support for e-voting and positive perceptions of integrity in the election process. These results have both theoretical and policy implications.
One common way to ensure the security in voting schemes is to distribute critical tasks between different entities - so called trustees. While in most election settings election authorities perform the task of trustees, elections in small groups such as board elections can be implemented in a way that all voters are also trustees. This is actually the ideal case for an election as trust is maximally distributed. A number of voting schemes have been proposed for facilitating such elections. Our focus is on a mix net based approach to maximize flexibility regarding ballot design. We proposed and implemented a corresponding voting scheme as an Android smartphone application. We believe smartphones are most likely to be used in the election settings that we consider in the paper. Our implementation also enables voters to remotely participate in the voting process. The implementation enables us to measure timings for the tallying phase for different settings in order to analyze whether the chosen mix net based scheme is suitable for the considered election settings.
Internet voting developments in Canada are growing quickly, with activity focused in local elections, political party leadership votes and unions. In some instances, the federal structure of the Canadian state facilitates Internet voting use, while in others it inhibits it. The result of this system of divided jurisdiction is that Internet voting use in Canada resembles a patchwork, showing strong concentration in some areas and no penetration in other places. In addition to scattered geographic use, a variety of approaches to implementation are employed. In some cases online ballots are complementary to paper, while in others elections are now fully electronic. I-voting can be a twostep process requiring registration or a more direct one-step voting procedure. Likewise, Internet voting is offered in the advance portion of certain elections, whereas in others it is available for the full voting period. Finally, given that private companies administer the Internet voting portion of elections there is also a mixture of technology.
This paper introduces an extension to the Estonian Internet voting scheme allowing the voters to check the cast-asintended and recorded-as-cast properties of their vote by using a mobile device. The scheme was used during the 2013 Estonian local municipal elections and the 2014 European Parliament elections. 3.43% and 4.04% of all Internet votes were verified, respectively. We will present the details of the protocol, discuss the security thereof and the results of implementation.
The German federal constitutional court ruled, in 2009, that elections had to have a public nature. EasyVote, a promising hybrid electronic voting system for conducting elections with complex voting rules and huge ballots, meets this requirement. Two assumptions need to hold, however. The first is that voters will verify the human-readable part of the EasyVote ballot and detect discrepancies. Secondly, that electoral officials will act to verify that the human-readable part of the ballot is identical to the machine-readable part, and that they, too, will detect discrepancies. The first assumption was tested in prior work, so in this paper we examine the viability of the second assumption.We developed an EasyVote tallying component and conducted a user study to determine whether electoral officials would detect discrepancies. The results of our user study show that our volunteer electoral officials did not detect all of the differences, which challenges the validity of the second assumption.Based on these findings we proceeded to propose two alternative designs of the EasyVote ballot: (1) In contrast to the original EasyVote ballot, the human-readable part highlights only the voter's direct selections in orange, i.e. votes that are automatically distributed by selecting a party are not highlighted; (2) The second alternative includes only the voter's direct selections and highlights them in orange. Both alternatives reduce the number of required manual comparisons and should consequently increase the number of discrepancies detected by election officials. We evaluated both alternatives in an online survey with respect to ease of verification and understandability of the cast vote, i.e. verifying that the human-readable part contained the voter's selections and understanding the impact (distribution of votes) of the corresponding selections.The results of the online survey show that both alternatives are significantly better than the original EasyVote ballot with respect to ease of verification and understandability. Furthermore, the first alternative is significantly better than the second with respect to understandability of the cast vote, and no significant difference was found between the alternatives with respect to ease of verification of the cast vote.
We show how modern interactive verification tools can be used to prove complex properties of vote-counting software. Specifically, we give an ML implementation of a votecounting program for plurality voting; we give an encoding of this program into the higher-order logic of the HOL4 theorem prover; we give an encoding of the monotonicity property in the same higher-order logic; we then show how we proved that the encoding of the program satisfies the encoding of the monotonicity property using the interactive theorem prover HOL4. As an aside, we also show how to prove the correctness of the vote-counting program. We then discuss the robustness of our approach.
When the Council of Europe started to deal with the subject of electronic voting in 2002, the impact of its work was not foreseeable. What followed, however, was basically a "success story": The Recommendation on legal, operational and technical standards for e-voting (Rec(2004)11), which was adopted by the Council of Ministers on 30 September 2004, has been the most relevant international document and reference regarding e-voting for a decade. Since 2010, the role of the Council of Europe with regard to e-voting has shrunk. Nevertheless various Member States expressed the desire to further review the Recommendation in the forthcoming years. Following an informal experts' meeting in Vienna on 19 December 2013, the Committee of Ministers was confronted with the suggestion to formally update the Recommendation in order to keep up with the latest technical, legal and political developments. The forthcoming Review Meeting on 28 October 2014 may help set the course for future e-voting activities of the Council of Europe.
We present the initial set of findings from a pilot experiment that used an Internet-based end-to-end verifiable e-voting system and was held during the European Elections 2014 in Athens, Greece. During the experiment, which took place on May 25th 2014, 747 people voted with our system in special voting stations that were placed outside two main polling places in Athens, Greece. The election mimicked the actual election that was taking place which included a great number of parties. After casting their ballot, voters were invited to complete online a post-election questionnaire that probed their attitudes towards e-voting. In total, 648 questionnaires were collected. We present a description of the experiment and a regression analysis of our results. Our results suggest that acceptance of the e-voting system was particularly high especially among the most educated, the technologically adept but also -somewhat surprisingly- older generations.
This paper discusses the Decryption and Counting Ceremony held in conjunction with the internet voting trial on election day in the Ministry of Local Government and Regional Development of Norway in 2013. We examine the organizers' ambition of making the decryption and counting of electronic votes public in order to sustain trust in internet voting. We introduce a pragmatic approach to trust that emphasises the inseparability of truth from witnessing it. Based on this and on a description of how the event was made observable and how the complexities in the counting process were disclosed, we discuss what we term economy of truth from the perspective of the IT community involved in the ceremony. We claim that broadening the economy of truth by including more explicitly social and political perspectives in the ceremony, and in internet elections in general, and how witnessing is brought about, would make a more solid case for understanding how democracy is transformed.
This paper discusses the Norwegian experiences in piloting a verifiable, remote voting system in a legally binding, public election. First, we provide a highlevel description of the system used. We then go into detail about the major challenges that were encountered in the implementation and execution of the system. In particular, the generation and printing of return codes and the key management are described in detail. We also discuss the relationship between the Norwegian Electoral Management Body and the system integrators, indicating how verifiability may enable new models of cooperation.
We discuss the use of POLYAS, an Internet voting system, in GI elections before 2010, in 2010 and 2011, as well as in future. We briefly describe how the system was extended in 2010 to provide partial verifiability and how the integrity of the GI election result was verified in the 2010 and 2011 elections. Information necessary for partial verifiability has so far only been made available to a small group of researchers. In future it would be ideal to make this, and more information, available to the general public, or to GI members, in order to increase the level of verifiability. We highlight legal considerations accompanying these possibilities, including publishing more details about the election results, the requirement for secret elections and avoiding vote buying, and how to handle complaints. Motivated by legal constraints, we propose further improvements to the POLYAS system. Finally, we generalize our findings to any partially verifiable Internet voting system.
In an effort to promote a greater understanding of the voting systems that sit in the middle of the election technology spectrum somewhere between hand-counted paper ballots and Internet voting this work presents a classification of the electronic voting technologies currently used in the United States. A classification structure is presented, and characteristics of current and future technologies are discussed. Finally, the paper concludes with a discussion on practically using the structure and future expansion to include other voting technologies.
The VALG project is introducing evoting for municipal and county elections to Norway. Part of the evoting system is a mix net along the lines of Puiggaĺi et al.– a mix net which can be efficiently verified by combining the benefits of optimistic mixing and randomized partial checking. This paper investigates their mix net and proposes a verification method which improves both efficiency and privacy compared to Puiggaĺi et al..
The Norwegian return codes, used within an Internet voting project piloted in September 2011, intend to simultaneously achieve both receipt-freeness and individual verifiability. They are delivered as text messages with a code representing the value of a voter’s cast ballot, but, according to the Norwegian Government, they would not breach the principle of secrecy, and they are not voting receipts, since the voter could always cancel the vote. However, some international electoral standards, like the Recommendations on E-voting from the Council of Europe, clearly forbid an Internet voting system that enables a “voter to be in possession of proof of the content of the vote cast.” This paper analyzes the extent to which the Norwegian system complies with this standard and it concludes that there is no contradiction in using a teleological approach.
There are many security challenges associated with the use of Internet voting solutions. While we are not advocating for the use of Internet voting in this paper, we do assert that if an Internet voting solution is going to be used, its deployment must be undertaken with continuous security auditing in place – security auditing that begins with the development of the Internet voting system by the manufacturer or election jurisdiction and continues throughout the system’s use in the field.
This paper describes the design of a supervised verifiable voting protocol suitable for use for elections in the state of Victoria, Australia. We provide a brief overview of the style and nature of the elections held in Victoria and associated challenges. Our protocol, based on Pret a Voter, presents a new ballot overprinting front-end design, which assists the voter in completing the potentially complex ballot. We also present and analyse a series of modifications to the back-end that will enable it to handle the large number of candidates, , with ranking single transferable vote (STV), which some Victorian elections require. We conclude with a threat analysis of the scheme and a discussion on the impact of the modifications on the integrity and privacy assumptions of Pret a Voter.
As the utilization of various e-voting technologies has notably increased in the past few years, so has the amount of publications on experiences with these technologies. This article will, therefore, map the literature while highlighting some of the important topics discussed within the field of e-voting. Particular attention will be paid to the non-technical dimensions of implementation, including the socio-cultural, organizational, and political dimensions.
When properly implemented, electronic election systems provide accurate vote counting, timely transmission of results, and secure electoral processes. Independent testing and certification by qualified testing laboratories offer election administrators, election stakeholders, and the public assurance that e-voting systems are trustworthy. Testing is an essential tool to safeguard the integrity of e-voting systems.
We report on the design and implementation of a new cryptographic voting system, designed to retain the look and feel of standard, paper-based voting used in our country Israel while enhancing security with end-to-end verifiability guaranteed by cryptographic voting. Our system is dual ballot and runs two voting processes in parallel: one is electronic while the other is paper-based and similar to the traditional process used in Israel. Consistency between the two processes is enforced by means of a new, specially-tailored paper ballot format. We examined the practicality and usability of our protocol through implementation and field testing in two elections: the first being a student council election with over 2000 voters, the second a political party's election for choosing their leader. We present our findings, some of which were extracted from a survey we conducted during the first election. Overall, voters trusted the system and found it comfortable to use.
Hao, Ryan & Zielinski (2010) propose a two-round decentralized voting protocol that is efficient in terms of rounds, computation, and bandwidth. However, the protocol has two drawbacks. First, if some voters abort then the election result cannot be announced, that is, the protocol is not robust. Secondly, the last voter can learn the election result before voting, that is, the protocol is not fair. Both drawbacks are typical of other decentralized e-voting protocols. This paper addresses these issues: we propose a recovery round to enable the election result to be announced if voters abort and we add a commitment round to ensure fairness. In addition, we provide a computational security proof of ballot secrecy.
