[EM] 3ballot - revolutionary new protocol for secure secret ballot elections

[Juho]

On Oct 14, 2006, at 5:30 , Dave Ketchum wrote:

>>> Is it compatible with Condorcet?  I remain a backer for Condorcet's
>>> combining capability with tolerable complexity.
>> I think yes, but unfortunately it is more difficult to serve   
>> Condorcet than e.g. plurality (one has to trade a bit with  
>> complexity  and/or privacy since the Condorcet ballot format is  
>> not as easy to  split in separate votes).
> The voter does equivalent of ranking each candidate.  Counter  
> counts =/>/< rank between each two candidates 1/3/6/10 pairs for 2  
> to 5 candidates.
>      Voter thinking plurality could be recorded as a special case.
>      Else best I can see right now is a vote for each > or < pair -  
> a LOT of records if many candidates - but no records for = whether  
> reason is same voter rank or voter ranked neither.

This sounds like a good approach if one is ready to accept the  
relatively high number of material it produces (in relation to the  
size of the pairwise comparison matrix). The voter can in principle  
check that all her preferences are there (e.g. check that Y>W row is  
there) (there should be only one such row but maybe she will not  
complain if there are two :-) ; no W<Y rows though). The voter can  
check some rows to see that they are filled correctly (e.g. Q>W, Q>W,  
W>Q, assuming that three columns are used).

> I stay with Condorcet for letting voters state preferences more  
> completely, yet easily, than with Plurality or Approval.  But  
> counting such manually AND correctly is a challenge.

I'd also like this. If the number of candidates is not too large it  
should work ok. I think the (numerous) ballots should be machine  
readable (which may mean also machine made) to help the counting  
process. Manual checks could be made as well (full manual counting  
would be good as well but maybe not feasible if the number of  
separate ballots gets high).

>>> Given a TRUE voting machine, why add 3ballot?  ZERO value in  
>>> this  effort.
>> I think ThreeBallot does good job in defending against foul play  
>> in  the vote counting process. I don't know what you exactly mean  
>> with a  TRUE voting machine but maybe any kind of machines could  
>> be improved.  The voting machines could be thoroughly and  
>> neutrally tested and  sealed and be based on open source code. If  
>> they collect all the  results in electronic format they could be  
>> connected to Internet and  memory sticks immediately after the  
>> voting ends and results would be  public after that. Hard drives  
>> and/or memory could be destroyed if  needed. Paper trail is still  
>> possible also in the machine based  scenarios.
> I question whether 3ballot helps the counting process,  It  
> complicates counting, making more room for those inclined to do evil.

It complicates the process, and using Condorcet still adds some more  
complexity, but of course there is also the other side, possibility  
to check that some individual votes were not deleted, modified or added.

> I am against destroying any kind of memory:
>      There should be nothing there that needs privacy.
>      Could be data evil ones wish destroyed.

I agree that in principle everything should be open. The risks that I  
was considering were like having the votes stored on the hard disk in  
the order of voting (logically or physically), which might reveal  
something.

>> Some more words about the complexity of the method. I'll give one   
>> example of an alternative and simpler method. How do you evaluate  
>> the  usability/complexity of this method?
>> - the voting machine puts one copy of each ballot in one basket  
>> and  several receipt copies of it in another basket
>>      - we may have several ballots per voter if we use  
>> ThreeBallot  style ballots (receipt copies could be made of all of  
>> them)
>>      - or alternatively only one if that is secure enough (could  
>> suit  your needs)
>>      - it is also possible that the voter gives only her opinion  
>> to  the machine and the machine then generates more complex ballots
>>        (three or maybe broken into separate "rows")
>>        (also Condorcet based votes could be split this way)
>> - the voting machine has no memory
>> - the first basket contains the results of the election
>> - the second basket is used for distributing receipts
>> - the receipts will be distributed to interested people, limited   
>> number of random receipts to each of them
>>      - there are several copies of the receipts and limitations  
>> in  the distribution to defend against receipt holders using them   
>> maliciously
>> - the distribution may start right after the election is closed,  
>> or  when the basket contains many enough ballots to protect privacy
>> At least in basic plurality voting this method may be  
>> considerably  simpler than the one that Rivest described (numbers  
>> based ballots  with negative votes, as discussed by Warren Smith  
>> and Michael Rouse  on this list).
>> Distributing personal receipts is also possible but maybe not done  
>> if  simplicity is what we seek.
>> I assumed that the machine had no memory. If it had, I'd  
>> recommend  full publicity of the right after the voting closes.
>> Any chances of making the "receipt style" methods simple enough  
>> for you?
>
> Would take a lot of thought as to how they offer value without  
> destroying privacy, and do something good about evil doers.

Not asking for a complete analysis but if you find weaknesses please  
let me know.

Juho Laatu


	
	
		
___________________________________________________________ 
Yahoo! Messenger - NEW crystal clear PC to PC calling worldwide with voicemail http://uk.messenger.yahoo.com