[EM] 3ballot - revolutionary new protocol for secure secret ballot elections

[Juho]

On Oct 9, 2006, at 1:15 , Dave Ketchum wrote:

> Is 3ballot worth the pain?

I think Rivest proved the concept to work. He obviously also tried to  
make the method as usable as possible. Wether benefits are bigger  
than pain may depend on where the system is used. In countries with  
no tradition of foul play there may be no need to use it. But in  
countries where foul play is common in the counting process the  
benefits could be sufficient.

It is also possible to simplify the method (trade out some unneeded  
features). See one method at the end of the mail.

> Does it REALLY provide the claimed service?

Yes, I think so. Usability might be questionable like you pointed  
out. Some risks remain like malicious software, when compared to  
traditional paper based methods, but I didn't see any major holes in  
the method.

> Does it complicate the voters' lives?

In its original form, yes. Increased trust on the method might  
compensate some of the pain.

> Is it compatible with Condorcet?  I remain a backer for Condorcet's
> combining capability with tolerable complexity.

I think yes, but unfortunately it is more difficult to serve  
Condorcet than e.g. plurality (one has to trade a bit with complexity  
and/or privacy since the Condorcet ballot format is not as easy to  
split in separate votes).

> Is it worth bothering with without demanding a TRUE voting machine  
> for its
> installation?  ABSOLUTELY NOT, for there are too many ways to  
> falsify the
> counting!

I think Rivest managed to keep the voting machine quite simple, which  
reduces the risk. But whenever there are machines involved one needs  
to be very careful. I favour manual methods in most cases (Rivest  
said so too) but if machines clearly bring benefits, then they must  
be ok.

> Given a TRUE voting machine, why add 3ballot?  ZERO value in this  
> effort.

I think ThreeBallot does good job in defending against foul play in  
the vote counting process. I don't know what you exactly mean with a  
TRUE voting machine but maybe any kind of machines could be improved.  
The voting machines could be thoroughly and neutrally tested and  
sealed and be based on open source code. If they collect all the  
results in electronic format they could be connected to Internet and  
memory sticks immediately after the voting ends and results would be  
public after that. Hard drives and/or memory could be destroyed if  
needed. Paper trail is still possible also in the machine based  
scenarios.

> ps, As to privacy, I read of video-camera phones.  Their usage has  
> to be
> tricky - can they verify a voter's actual vote as such without voting
> machine operation being set up compatible with such?

Yes, video cameras are a relevant threat. Vote buying and coercion  
can be implemented with them. Additional defences against these  
should take into account also the existence of the video camera and  
still camera threat. One simple way to defend against video cameras  
is btw to ban them and make voters aware of this. At least the voter  
could tell to the coercer that she could not record the voting event  
since she was not allowed to. One could put the voting machines in a  
place where others can see the voter but not how she votes.

> ps, quoting:  "I doubt there is a voting system in existence that is
> immune from enough vote verification to support vote buying or  
> coercion"
>       The lever machines I have been voting on all my life are  
> immune, for
> they keep NONE of the records of interest.

I don't know what kind of machines you have used but I have a feeling  
that also they might be vulnerable to recording the whole voting  
event with a video camera.


Some more words about the complexity of the method. I'll give one  
example of an alternative and simpler method. How do you evaluate the  
usability/complexity of this method?
- the voting machine puts one copy of each ballot in one basket and  
several receipt copies of it in another basket
     - we may have several ballots per voter if we use ThreeBallot  
style ballots (receipt copies could be made of all of them)
     - or alternatively only one if that is secure enough (could suit  
your needs)
     - it is also possible that the voter gives only her opinion to  
the machine and the machine then generates more complex ballots
       (three or maybe broken into separate "rows")
       (also Condorcet based votes could be split this way)
- the voting machine has no memory
- the first basket contains the results of the election
- the second basket is used for distributing receipts
- the receipts will be distributed to interested people, limited  
number of random receipts to each of them
     - there are several copies of the receipts and limitations in  
the distribution to defend against receipt holders using them  
maliciously
- the distribution may start right after the election is closed, or  
when the basket contains many enough ballots to protect privacy

At least in basic plurality voting this method may be considerably  
simpler than the one that Rivest described (numbers based ballots  
with negative votes, as discussed by Warren Smith and Michael Rouse  
on this list).

Distributing personal receipts is also possible but maybe not done if  
simplicity is what we seek.

I assumed that the machine had no memory. If it had, I'd recommend  
full publicity of the right after the voting closes.

Any chances of making the "receipt style" methods simple enough for you?

Juho Laatu

Send instant messages to your online friends http://uk.messenger.yahoo.com