Page 13 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

The Witness-Voting System
5
Questions and Answers
2.3
Q1: What happens if a witness element malfunctions, is compromised, or records
are erased, or edited?
A1: The witnesses are placed at least with triple redundancy. Because each wit-
ness is at least somewhat independent, the chance that a fault or attack will affect
N > 1 witness at the same time is a decreasing function of N. More witnesses
can be added, as needed.
Q2: What happens if the number of voters who signed the voter list is not exactly
the same as the number of ballots in the ballot box?
A2: A correct tally result can be achieved when the various witness ballot record-
ings are played and used in the transparent error-detection and consensus process.
In addition, witnesses can also be used to verify the voter list.
We propose Q3 and Q4 to further explore the WVS design. 5
Q3: How do I know that when I selected and cast a ballot for candidate A, that
something hidden in the ballot box did not change my vote to B?
Q4: If my vote is supposed to stay secret, how can I verify that it was counted
correctly?

3 The Problem

Election outcome trustworthiness has been a longstanding problem. To exemplify
the problem setting, consider a typical example where a known number (who
sign the voter list) of known voters (who are identified in voter registration)
receive pre-approved ballots, privately make choices on race options, and cast
their ballots into a one-way ballot box; after the election is over, the ballot box
is opened for the first time and all ballots are tallied, with totals made public.
No one knows how anyone else voted (the secret ballot condition).
The equation:

Number(Voters)= Number(Ballots)

represents the basic and intuitive requirement that the number of voters who
voted must be equal to the number of ballots in the ballot box.Inthe US,today,
this requirement is explicitly not used in public elections with any voting sys-
tem, paper or electronic. The official reason given for this omission is that it is
impossible (sic) to do so with secret ballots, as no one knows which ballots may
be extra or missing in case of a difference. 6
The official procedure in such cases is to count all the ballots found in the
ballot box, even though the signed voter list may contain a different number of
voters. In support of this procedure one often hears the argument that if the
number of extra or missing ballots does not influence the election outcome, no
5
For comments, please use this paper’s full title in the Subject line of the email.
6
We note that the HS/WVS uses secret ballots and solves this problem; see Q2/A2.