Page 25 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

17
The Witness-Voting System
relay point, and the tally results (the end point B). The capacity of the correc-
24
to
tion channels physically available to the voting means are set and adjusted
achieve the condition C ≥ E, whereby the election outcome errors (interference)
can be as close to zero as desired. The Requirements composition and the im-
plementation development (including software) are similarly set and adjusted,
where correction channels are provided by the EO, the stakeholders, the voters,
and other elements within the third boundary.
The significant aspect is that the election outcome is error-free. It may seem
surprising that we should define an error-free result for a voting means in the
presence of interference, including the possibility of errors caused by faults and
attacks by adversaries, since we do assume in such circumstances that the cast
ballot may have been changed from what the voter saw and confirmed. However,
rather than strive for elusive perfect elements that could outright eliminate er-
rors as in a classical deterministic model, our approach is to explicitly include
the possibility of errors by means of a probabilistic description of undesirable
uncertainty (interference), where the Error-Free Condition is then applied.
6.4 Trust
We now impose what we call the transparency condition, in that to allay collusion
and security concerns we want the error-free condition to be publicly verifiable.
However, not all messages in a voting system are capable of providing accept-
able proof to any stakeholder as a verifier. For example, a proof that may be
acceptable by the EO may not be acceptable by voters. In order to rate sources,
destinations, and communication channels in terms of providing acceptable proof
to a verifier, the concept of qualified reliance on information is introduced in the
VITM based on our previous definition of trust in a communication process
(Gerck, 1997 [15]), which is compatible with Information Theory.
Accordingto[15], trust has nothing to do with feelings or emotions. Trust is
communicable. However, trust cannot be communicated by self-assertions (e.g.,
saying “Trust me” does not make one more trustworthy). Formally stated, Trust
is that which is essential to a communication channel, but cannot be transferred
using that channel. From this abstract definition, applied definitions can be de-
rived such as Trust is expected fulfillment of previously observed behavior and
Trust is qualified reliance on information, based on factors independent of that
information. In short, trust is defined by at least two channels of communication
and the channels need to be at least partially independent. In plain English, the
greater the number of independent ways one can verify something, the greater
reliance one may have.
Section 6.3 showed that with more channels, more redundancy, we can reduce
interference. Now in terms of a trust requirement, the desirability of multiple
communication channels again enters our framework.
Multiple communication channels can use any media for information trans-
fer, such as electric signals, magnetic and optical disks, paper, and microfilm.
24
For example, by using operational feedback; see Table 4, Section 8.