Page 19 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

The Witness-Voting System
11
The Voter Information Transfer Model (VITM)
6
The VITM comprises the voting process in its general aspects. We consider a set
of voters with access to voting means controlled by an election operator (EO).
The voting means is the totality of physical means used, such as electronic or
human-based, with ballots or not, to collect the voters’ expressed intent and
provide an election outcome with a tally of votes for each respective race in the
election. No one knows how anyone else voted (voter privacy), not even the EO.
Different times and places may be used for voting. Voters may see different op-
tions; e.g., voters may be presented with different races (e.g., using ballot styles),
with a different option order for each race (e.g., using ballot rotation), use dif-
ferent languages and media (e.g., touch screen, voice). We include the possibility
of faults (from various sources including hardware, software, and human error),
attacks (passive and active) and even just threats by adversaries, all of which
can interfere with the voting means and with the voting process, with varying
consequences including, most notably, to influence the outcome.
By direct correspondence with Information Theory concepts [9, 11], we for-
mally identify signals with the votes as seen and cast by each voter, which are
encoded and sent by a communication channel (e.g., a ballot), and are received
at a relay point (e.g., the ballot box), where they are combined with other in-
puts and eventually decoded (tallied) to produce the output signal (the election
outcome). The signals are selected by each voter within a number of options
that includes all possible signal combinations, as defined by the election’s rules
for that voter. The voting system must be designed to operate for each possible
selection (e.g., voted ballot), as voters must have freedom of choice. Faults (e.g.,
human, software), attacks and threats by adversaries represent interference that
may change the output signal (causing election outcome errors).
To prevent any confusion, it must be emphasized that the votes seen and cast
by a voter are not stochastic variables in our approach. The fact that Informa-
tion Theory uses probability distributions to describe signals as chance variables
does not mean that we are modeling the cast votes as randomly changing their
nature between states, or as a random superposition of states. Rather, given the
available evidence (e.g., ballot box and witness records), we use probabilities to
represent degrees of belief (belief is the probability that the evidence supports
the claim) about the mutually exclusive hypotheses as to what the cast votes
might be, of which only one set of selections (cast ballot) is actually true for each
voter. This represents the condition that only one ballot is valid per voter. 15
In a communication system, the message is what is transfered from sender to
receiver. According to Information Theory, the message has information mea-
sured by the uncertainty as to what the message may be. The cast votes have in-
formation because while the votes are chosen among a number of known choices,
the selection is unknown except by the voter (which satisfies the secret ballot
condition). The observation that the voter knows the selection is not relevant;

15
Even if each voter is allowed diverse opportunities to vote (e.g., to prevent coercion
online [18]), there is only one set of selections that is true for each opportunity.