[EM] 3ballot - revolutionary new protocol for secure secret ballot elections

[Dave Ketchum]

On Sat, 14 Oct 2006 12:13:12 +0300 Juho wrote:
> On Oct 14, 2006, at 5:30 , Dave Ketchum wrote:
> 
>>>> Is it compatible with Condorcet?  I remain a backer for Condorcet's
>>>> combining capability with tolerable complexity.
>>>
>>> I think yes, but unfortunately it is more difficult to serve   
>>> Condorcet than e.g. plurality (one has to trade a bit with  
>>> complexity  and/or privacy since the Condorcet ballot format is  not 
>>> as easy to  split in separate votes).
>>
>> The voter does equivalent of ranking each candidate.  Counter  counts 
>> =/>/< rank between each two candidates 1/3/6/10 pairs for 2  to 5 
>> candidates.
>>      Voter thinking plurality could be recorded as a special case.
>>      Else best I can see right now is a vote for each > or < pair -  a 
>> LOT of records if many candidates - but no records for = whether  
>> reason is same voter rank or voter ranked neither.
> 
> 
> This sounds like a good approach if one is ready to accept the  
> relatively high number of material it produces (in relation to the  size 
> of the pairwise comparison matrix). The voter can in principle  check 
> that all her preferences are there (e.g. check that Y>W row is  there) 
> (there should be only one such row but maybe she will not  complain if 
> there are two :-) ; no W<Y rows though). The voter can  check some rows 
> to see that they are filled correctly (e.g. Q>W, Q>W,  W>Q, assuming 
> that three columns are used).

Not happy with the volume but UNWILLING to give up on Condorcet, which i 
consider more important.

Note that many voters will vote the same as for Plurality, for which a 
special form might be possible.

Even when voting for multiple candidates, many voters should be happy with 
listing their top couple candidates.

BTW, whether this or other, we DO CARE as to count of Q>W vs Q<W.

> 
>> I stay with Condorcet for letting voters state preferences more  
>> completely, yet easily, than with Plurality or Approval.  But  
>> counting such manually AND correctly is a challenge.
> 
> 
> I'd also like this. If the number of candidates is not too large it  
> should work ok. I think the (numerous) ballots should be machine  
> readable (which may mean also machine made) to help the counting  
> process. Manual checks could be made as well (full manual counting  
> would be good as well but maybe not feasible if the number of  separate 
> ballots gets high).

BOTH machine readable AND manual readable is proper.

BUT, assuming proper attention to having TRUE voting machines, bothering 
with the pain of manual reading should be rare.
> 
>>>> Given a TRUE voting machine, why add 3ballot?  ZERO value in  this  
>>>> effort.
>>>
>>> I think ThreeBallot does good job in defending against foul play  in  
>>> the vote counting process. I don't know what you exactly mean  with 
>>> a  TRUE voting machine but maybe any kind of machines could  be 
>>> improved.  The voting machines could be thoroughly and  neutrally 
>>> tested and  sealed and be based on open source code. If  they collect 
>>> all the  results in electronic format they could be  connected to 
>>> Internet and  memory sticks immediately after the  voting ends and 
>>> results would be  public after that. Hard drives  and/or memory could 
>>> be destroyed if  needed. Paper trail is still  possible also in the 
>>> machine based  scenarios.
>>
>> I question whether 3ballot helps the counting process,  It  
>> complicates counting, making more room for those inclined to do evil.
> 
> 
> It complicates the process, and using Condorcet still adds some more  
> complexity, but of course there is also the other side, possibility  to 
> check that some individual votes were not deleted, modified or added.

Using Condorcet lets voters more completely state their thoughts.

Agreed we need to prevent "deleted, modified or added" - the question is 
how to accomplish that.
> 
>> I am against destroying any kind of memory:
>>      There should be nothing there that needs privacy.
>>      Could be data evil ones wish destroyed.
> 
> 
> I agree that in principle everything should be open. The risks that I  
> was considering were like having the votes stored on the hard disk in  
> the order of voting (logically or physically), which might reveal  
> something.

I would DEMAND that the record being prepared for hard disk have the 
ballots in true random order (sometimes those needing a random sequence of 
numbers use a formula that would give the same results tomorrow as it did 
today),
      Thinking, without studying, could the space used for accumulating 
data for records for this hard disk be such that no data would be lost 
even with expectable power failures?

DWK
> 
>>> Some more words about the complexity of the method. I'll give one   
>>> example of an alternative and simpler method. How do you evaluate  
>>> the  usability/complexity of this method?
>>> - the voting machine puts one copy of each ballot in one basket  and  
>>> several receipt copies of it in another basket
>>>      - we may have several ballots per voter if we use  ThreeBallot  
>>> style ballots (receipt copies could be made of all of  them)
>>>      - or alternatively only one if that is secure enough (could  
>>> suit  your needs)
>>>      - it is also possible that the voter gives only her opinion  to  
>>> the machine and the machine then generates more complex ballots
>>>        (three or maybe broken into separate "rows")
>>>        (also Condorcet based votes could be split this way)
>>> - the voting machine has no memory
>>> - the first basket contains the results of the election
>>> - the second basket is used for distributing receipts
>>> - the receipts will be distributed to interested people, limited   
>>> number of random receipts to each of them
>>>      - there are several copies of the receipts and limitations  in  
>>> the distribution to defend against receipt holders using them   
>>> maliciously
>>> - the distribution may start right after the election is closed,  or  
>>> when the basket contains many enough ballots to protect privacy
>>> At least in basic plurality voting this method may be  considerably  
>>> simpler than the one that Rivest described (numbers  based ballots  
>>> with negative votes, as discussed by Warren Smith  and Michael Rouse  
>>> on this list).
>>> Distributing personal receipts is also possible but maybe not done  
>>> if  simplicity is what we seek.
>>> I assumed that the machine had no memory. If it had, I'd  recommend  
>>> full publicity of the right after the voting closes.
>>> Any chances of making the "receipt style" methods simple enough  for you?
>>
>>
>> Would take a lot of thought as to how they offer value without  
>> destroying privacy, and do something good about evil doers.
> 
> 
> Not asking for a complete analysis but if you find weaknesses please  
> let me know.
> 
> Juho Laatu
> 
> 
>     
>     
>        
> ___________________________________________________________ Yahoo! 
> Messenger - NEW crystal clear PC to PC calling worldwide with voicemail 
> http://uk.messenger.yahoo.com
> 
> 


-- 
  davek at clarityconnect.com    people.clarityconnect.com/webpages3/davek
  Dave Ketchum   108 Halstead Ave, Owego, NY  13827-1708   607-687-5026
            Do to no one what you would not want done to you.
                  If you want peace, work for justice.