[EM] Re: touch screen voting machines

[David GLAUDE]

Ken Johnson wrote:

>> To deal with this, in Belgium by law, if the printed vote is not what 
>> you like, you call the president of the voting burreau and you vote 
>> again in front of him. And sorry for the secrecy of your vote. He will 
>> click on "OK vote match" for you. ;-)
>>
> Another possible approach - The voting machine should query the user to 
> verify that the displayed and printed results are correct, and press 
> "Accept" BEFORE the result is posted. If the user rejects the vote, the 
> machine gives them a cancellation receipt as evidence that their vote 
> has not yet been entered in the system.

This is exactly what we do.
The ticket is printed.
The user is prompted to verify if the printed vote and the on-screen 
vote are the same. [Please take note that what is on screen might be 
different from the voter intent. Let say I click A and the computer 
display B and print B!!! How do I complain?]
* If you accept, the ticket is "CUT" and fall inside the ballot box 
(this mean there is a printer and ballot box attach to each voting 
machine). The voter can only see one vote (the last one, his own vote) 
and has no physical access to the ticket/printer/ballot box.
* If you do not accept, then a CANCEL LINE is printed on the ticket 
(paper) as to remind that this paper ballot should not be counted during 
the manual recount. But there come the president of the voting place. 
Some kind of an alarm ring and he get to help you vote and verify the 
behaviour of the machine. This is where you loose the secrecy of your 
vote...

I don't know how practicaly it take place because this was experimented 
on two location only. I only have the law (and source code) to read in 
order to understand what are the possible scenario.

But we have too many vote representation to deal with:
* Voter intent
* On screen vote
* On paper vote (our ticket)
* On the magnetic card vote
* Vote as readed by ballot box
* Vote as counted at the end of the day
* Vote as counted on the ticket at the end of the day

Making sure all those match and will match is difficult.

>> Partial recount are useless... How do you know the computer was not 
>> just showing what you wanted to see?
>
> The computer doesn't need to know what you want to see. Rather than 
> querying the computer to validate a specific vote, you just download the 
> entire vote database, sorted by vote serialization ID, and inspect it 
> directly.

Should I stress one more time to PRINT the database and then verify 
whatever you want to verify.

>> 1.  MUST enable potential recounts
>>
> Why is that a necessity? If the election result is invalidated, just 
> hold another election. Computerization, combined with robust 

The point is that in most election we want all the citizen of the state 
to vote at the same time without influance of the result of other 
location. That's why in my country and other european country, no poll 
result can be given in the few days bevore the vote and until all had a 
chance to vote.

It would be easy to influance the vote by announcing some partial result 
before the end. (Remember Florida). So

> verification means, should make voting processes and software as 
> efficient and reliable as commercial financial systems, 

I would prefere no software, if software there is then I don't care 
about efficiency, but I want reliability of software for spaceship and 
nuclear power station. All written in very secure language like ADA and 
with pre- and post- condition raising exception is parameter or result 
are outside of scope or do not pass some sanity test... I want the code 
to be free software or open source for peer review...

 > so this should be an exceptionally rare occurence.

Believe me, shit happen. In 12 years of electronic election in Belgium, 
there was no single election without technical problem... be it hardware 
or software.

Confidence in the result and user acceptance of electronic voting 
decrease each time. ;-)

David GLAUDE