Page 14 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

E. Gerck
6
one should care —even though undesirable ballots may have been taken from
the ballot box or desirable ballots may have been inserted.
However, when a voting system allows even one ballot to be missing or to
be inserted undetectably, this is sufficient proof that no ballot can be trusted.
More strongly stated, although no count difference may be found between the
voter list and the total of ballots in an election, still any or all the legitimate
ballots may have been compromised —for example, substituted 1:1 with ballots
that were forged, tampered with, or falsely invalidated.
Yet if ballots were not changed at all, as proved by digital signatures or any
other mechanism, votes may still have been marked not in the way that they
were seen or were intended by the voter (e.g., a vote for a candidate is shown
to the voter on the screen and matches what is also shown on a voter-verified
printout, but the vote is not recorded for that candidate), votes may have been
tallied incorrectly, or votes may have been revealed before the tally. 7
Even if vote tampering does seem to have occurred and influenced the election
outcome, the credibility afforded to pre- and post-election Logical and Accuracy
8
(L&A) tests and other contributing factors such as cost to rerun an election
and legal statutes protecting trade secrets, have such a force in the balance that
a candidate may not prevail in challenging the election outcome, albeit all the
contrary evidence that the candidate can collect [4].
However, satisfying an L & A test does not mean that the voting process is
trustworthy in the presence of an adversary that would interfere with the voting
process during the election (but hide its influence during L & A tests). Further,
a zero count difference when repeatedly reading votes from the same stack of
ballots does not mean that the ballots were the same that voters saw and cast.
To shed light into the problem of vote counting errors, it is important [17] to
distinguish accuracy from reliability, as shown in Table 2. See Fig. 6.5 in [12]
and Slide 3 in [18] for a visualization of these definitions. As Table 2 shows, an
L & A test fails to effectively measure either accuracy or reliability.

Table 2. Measurement Error Type Definitions

Accuracy The spread in measuring a single event. For example, whether a vote
that was seen and selected to be cast by a voter can be counted or
not from a ballot.
Reliability The degree to which measurements are expected to be replicable
in varying circumstances yielding the same results. For example,
whether the same votes cast before and during the election provide
the same tally result.

7
Vote leakage can guide get-out-the-vote and voter-suppression operations.
8
A Logic and Accuracy test is a deterministic test performed in a controlled environ-
ment. It consists of running sufficiently large predetermined patterns through the
voting system, capturing ballot images, and tabulating the ranked choice results.
The ballot images and the tabulated results can be compared to the predetermined
patterns.