Page 17 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

The Witness-Voting System
9
hand recount or a machine recount of the same optical-scan ballots should not
be considered an independent recount or a satisfactory auditing of the process.
If we play the same CD in different machines, we still hear the same songs.
An optical-scan system may count and recount exactly the same number of
false votes, since anyone can internally mark any choice in an undervoted 11
race before the first count. 12 Such change would not involve any ballot swap
and would be undetectable in a visual inspection or a machine recount. Further,
ballots may be swapped, remarked, reprinted or exchanged during scanning (scan
a different set). Although a voter may see that his voted ballot was scanned and
verified as valid, the ballot can later be fraudulently overvoted 13 to invalidate it,
when the voter is no longer in sight. Again, a hand recount or a machine recount
of the same optical-scan ballots would not resolve these issues.
Optical-scan ballots are sensitive to stray marks and may count them as a
vote —for example, if a voter accidentally pauses with a pen over an oval and
then decides not to vote for any candidate, that mark may be counted as a
vote. Use of a non-standard pen by the voter, or by the voter indicating a choice
with a mark that is not readable by the scanner’s sensor, or by a degraded
sensor that is not reading correctly, or a ballot that has been contaminated with
smudges or bending, may also change the intended votes readable on the ballot.
Hand reading the optical-scan ballot may resolve the issues mentioned in this
paragraph.
On the topic of voter privacy, optical-scan ballots disclose all the cast ballot
choices, which is vulnerable to “voter pattern fingerprinting” (see Section 7.1).
Further, voters may use a pen with invisible ink to identify their paper ballots,
whichmarks canthenbe read by someone, even well after an election, in order
to reward or punish voter behavior (e.g., tagged voter did not vote as expected).
Forcing voters to publicly verify the correctness of their own ballots by scanning
them in public, or by having their ballots printed by a machine, is also a potential
violation of voter privacy. Voters should be able to express their disagreement
with the election choices, for example by overvoting, undervoting or by simply
nullifying their ballots (e.g., by writing on a paper ballot), without coercion.
Adding a voter-verified or universally-verifiable auditing enhancement to
optical-scan voting systems would be useful to introduce an auditing record
that is not the ballot itself.
However, a voter-verified enhancement for optical-scan voting systems implies
a privacy violation problem (see end of Section 4). The secret ballot requirement
also fails for auditing enhancements in optical-scan voting when voter privacy
is protected by trusting a quorum of verifiers or election operators (see end of
Section 4).

11
An undervote means to make less choices than possible in a race; if no choice is made
it is also called a blank vote. Voters may want to undervote.
12
Even if there is a specific oval for a “No Vote” or “Abstain” choice, voters may still
just mark the top races and not mark anything else down the ballot.
13
An overvote means to make more choices than what is allowed in a race; it nulls an
evaluation of that race (it becomes indeterminate). Voters may overvote as a protest.