Page 33 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

The Witness-Voting System
25
to any other available choice, at will, for any race and for any number of times,
before casting their votes. This is equivalent to receiving a new blank ballot.
12. Allow undervote (abstain). SHOULD allow voters to abstain to vote
in any or all choices (undervote). An undervote MAY be represented by a spe-
cific choice, such as Abstain or No Vote. The voter MAY receive a warning of
undervoting. However, such a warning SHOULD NOT be public.
13. Overvote warning. To prevent mistakes and post-voting fraud: if over-
voting is detected, SHOULD warn the voter that a vote has to be cleared in order
to proceed. Any warning SHOULD be made known only to the voter, without
public disclosure. MAY prohibit overvoting.
14. Provide for null ballots. MAY allow voters to null races or even the
entire ballot as an option (e.g., to counter coercion; to protest against lack of
voting options). Overvoting MAY be used as a mechanism to provide for null
ballots.
15. Technology independent. SHOULD not depend on any specific tech-
nology to support any Requirement.
16. Open review, open code. SHOULD allow all source code to be publicly
known and verified (open source code, open peer review).

8 A Conforming Voting Means: The WVS

The Witness-Voting System (WVS) is a physical device that follows the optimal
design of section 6.3 and the Requirements, both physically and conceptually.
The significant aspect of the optimal design is the Error-Free Condition C ≥ E
(hereafter, EFC). As a non-limiting example, Table 4 shows an implementation
class of the WVS where the EFC is divided in two parts. 31

Table 4. WVS Implementation Using a Four-Step Program

I EFC 1: Optimal casting and counting of votes, in order to
II assure voters that their ballot choices are private and
III assure election outcome trustworthiness.
IV EFC 2: If (II) and (III) are satisfied, SUCCESS; else improve (I).

A first EFC is used to optimize accuracy and reliability in the casting and
counting of votes, and operates primarily within the first and second boundaries
(see boundary definitions in Section 6). A second EFC is used to optimize voter
privacy and election outcome trustworthiness, where operational feedback at step
(IV) is used to provide physical (e.g., witness configuration) and conceptual (e.g.,
Requirements) correction channels by the election operators, the stakeholders,
the voters, and other elements within the third boundary.
The following features result by applying Table 4 to Sections 2 and 8.1.
31
The optimal design does not specify how the EFC should be implemented; for exam-
ple, one could use an open-loop, a closed-loop with feedback, or a mixed approach.