By: Barry Cohen

Barry Cohen — Fri, 29 Sep 2006 06:26:06 +0000

Ben,
Your statement that “a voting system must preserve ballot secrecy, even against the wishes of the voters themselves,” invites a more precise consideration of the meaning of ballot secrecy.
To begin with, I’d like to make two rather obvious points:
1. The voter knows how she voted. I would call this the First Principle of Voting. It is true in both secret and open ballot systems. It is desirable to use this knowledge to protect the integrity of the system and to enhance voter confidence in the integrity of the system.
2. The voter has the right to refuse to disclose how she voted, to disclose how she voted, or to lie about how she voted. Call this the Second Principle of Voting. This right is an essential part of political freedom and it must be protected by law and custom. It cannot be guaranteed by technology or by election procedure. I assume that you do not mean to reject this right when you say that “a voting system must preserve ballot secrecy, even against the wishes of the voters.”
A good voting system precludes the disclosure of a voter’s election choices except by the action of the voter, but it cannot prevent social pressure to disclose (or to not disclose).
Let’s adopt your test example of a coercive atmosphere created by the “friendly office bulletin board.”
Say that Veronica lives in a precinct that is overwhelmingly forest-friendly, and that she herself belongs to the Forest Fanatic Society. Nevertheless, for reasons that seem good and sufficient to her, she votes for Joe Logger for chief forest ranger.
Scenario A: Community pressure. Suppose that no voter receipts have been issued. The Forest Fanatics ask each of their members to state publicly that they voted against Joe Logger. Veronica has three choices: she may refuse to make any statement about her vote, she may disclose it or she may lie about it. Now suppose that the VOICEVote system is in effect, and that Veronica has been issued a voter receipt and that all ballots have been posted on the Internet. If the Forest Fanatics ask all their members to post their ballots on the community bulletin board, Veronica has exactly the same three options: she may refuse to post any ballot, or she may post the receipt for her vote, or she may download a ballot from the Internet that was cast against Joe Logger and post it. There is nothing to distinguish a downloaded ballot from one distributed at the polling place, and nothing to indicate the identity of the voter on any ballot. Therefore, Victoria’s posted ballot no more proves how she voted than a verbal statement. Since it would be common knowledge that anyone could download any ballot, the entire practice of exerting social pressure in this way would be discouraged.
Scenario B: Stolen vote. Suppose that the pro-forest sentiment in this jurisdiction is so strong that the precinct election judges and the Democratic and Republican poll watchers collaborate to discard Victoria’s vote for Joe Logger. In the VOICEVote system, Victoria can prove that her vote has been discarded by producing her digitally signed ballot, and trigger an audit of the election, which would be performed using the printed paper ballots. What’s more, she can accomplish this anonymously by sending her signed vote receipt to a vote integrity organization — say, the Center for Election Responsibility and Trust (CERT). The vote receipt in the hands of CERT has the same power to challenge the theft of Victoria’s vote as in has in Victoria’s hands. In this sense, the VOICEVote system greatly enhances the secrecy of the ballot: it allows a voter whose vote has been stolen to effectively challenge the theft without disclosing her identity.
Scenario C: Suspicion of stolen votes. Suppose that no votes are actually altered or discarded, but Victoria, knowing the strength of pro-forest sentiment, is suspicious that election fraud has occurred. Under the VOICEVote system, her suspicion is dispelled by the fact that she can confirm that her own vote for Joe Logger was properly recorded and by the knowledge that every other voter can likewise check their own vote and can anonymously challenge any instance of vote tampering.
We have designed the VOICEVote protocol with the dual objectives of securing elections against tampering and of giving the public confidence in the integrity of the system. We believe that the combination of well-established cryptography with simplicity, transparency and direct involvement of the public, including in the post-voting phase, is the best means of achieving these goals.

By: joe

joe — Wed, 20 Sep 2006 22:20:21 +0000

I had an interesting discussion with Ping (Wagner student at Berkeley) about what kind of proof would be sufficient for a vote-buyer or coercer. It’s an interesting problem.

Comments on: The Secret Ballot is not Optional

By: Barry Cohen

By: joe