Page 35 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

The Witness-Voting System
27
elements in the slide we will use their three-digit number tags, such as (230) for
the witness device.
Slide 13 in [14] exemplifies a conventional electronic voting machine (also
called DRE, Direct Recording Electronic voting machine) with a first imple-
mentation of the witness device (230) within dotted lines, containing the beam-
splitter module 32 (212), camera (216), computer (220) and cartridge B.
A voter (200) provides input voting data through an input device (202) which
provides an interface to a first computer (204). The computer (204) comprises
an electronic voting machine such as a DRE and includes an optical projector
(206) for projecting voter selection data on a touch screen or other display device
(208) which displays a ballot and receives a voter’s selections. The touch screen
(208) provides an image of the voter’s selections to the voter (200).
The image on the touch-screen (208) is created from a projector (206) that
transmits a light beam along path (210) to a beam-splitter module (212). Part of
the light continues along a path to the screen (208). Light deflected by the beam
splitter module (212) is provided to a digital camera such as a charge coupled
device CCD (216). Device (216) makes an image record of pixel data representing
the voter’s selections. The image record is communicatively coupled by data link
or lead (218) to computer (220). Computer (220) thus provides an unparsed
record of pixel data corresponding to the image on the screen (200) at the time
the voter confirms the ballot. Computer (220) may compress, authenticate and
encrypt the pixel image data, but does not parse or otherwise interpret the
optical image captured by element (216).
The “magic moment” occurs when the voter confirms the ballot selections by
accepting the data through an accept/reject interface (224); the accept interface
actuates the computer (220) to store the pixel data corresponding to a voter’s
ballot selections in a storage device, Cartridge B (ballot box B) at (222). Data are
stored in random fashion in Cartridge B to safeguard voter privacy. One method
for enabling the accept interface to actuate computer (220) to store the pixel
data representative of the voter’s confirmed selections could be for the voter’s
“accept” action, such as the click of a mouse over a predefined image area, a
hyperlink color change or a button changing color, or a screen border change
or other readily discernible video actuator, to intrinsically trigger an activation
event such as which the module (216) would record and thereby trigger the
computer (220) to store the pixel data at the time of the activation event. That
is, computer (220) would be responsive to a video event activated by the voter
which would indicate confirmation of the voter’s selections. If the voter rejects
the selections, the video event is not activated and the image data are not stored.
The voter, who following a procedure defined by an election official may notify
and be authorized by an election official, may repeat the voting process.
Witness record capture can also be used for audio events or for any other type
of output or assistive device, as in the case of voters who are visually impaired,
or other data, such as for example, the data used to create and record a voter’s

32
A beam splitter is a simple optical device that splits a beam of light in two. An
ordinary piece of glass can split a beam of light in two beams.