Page 96 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

J.A. Goler and E.J. Selker
88
Alteration of Ballots
Fraudulent Ballot. A paper ballot may be engineered to differ from the origi-
nal ballot, with candidate names swapped, but without changing the coding
on the ballot. This change would result in votes for a candidate A going to a
different candidate B instead. This attack may be implemented on standard
optical scanned ballots, or punch card ballots. This attack would be partic-
ularly successful if the target candidate has a large amount of support in a
particular precinct, the ballot can be tampered with and the votes diverted.
Countermeasures included validation of counts using small sample sets and
verifying manually that each type of ballot mark is counted the same as the
ballot text and markings should indicate.
Scanner Control Cards. Scanner control cards can be manipulated to achieve
the same effect as fraudulent ballots. With control cards, the punches rep-
resenting a vote for a candidate can be reprogrammed to vote for a differ-
ent candidate. Counting testing procedures can be implemented to validate,
using properly marked ballots (assuming they are not compromised), that
control cards are properly marked.
Pre/Post-Voting Ballot Invalidation. After ballots are completed, a nefar-
ious election worker may spoil ballots by adding overvotes or extraneous
marks to the ballot. The opportunity for this attack is present both at cen-
tral counting locations and at precinct counting locations. A ballot worker
out of sight may mark ballots using a writing utensil or in sight could use
even a clump of graphite hidden on the underside of a ring or fingernail to
selectively invalidate ballots [16]. A two-man system where two workers are
required to be present for the counting/moving or deposit of ballots would
help alleviate this attack.

Destruction/Replacement of Ballots
Denial of Service. Pre-election, ballots can be spoiled via a variety of means
including water damage, spilling ink, and surreptitious marking of ballots.
These actions may result in spoiled ballots, and denial of voting rights to
voters. While polling place operations could move voters to another precinct,
the action may cause significant voter falloff for voters who are unable or
unable to make it to an alternate site [23].
Post-Electon. A more direct and effective means of tampering with the ballots
would be simply to lose, ’misplace’ or selectively damage ballots. An election
worker may selectively invalidate (and replace) ballots to keep them from be-
ing counted properly. Effective countermeasures include placing digital sig-
natures and/or serial numbers on ballots and recording those signatures and
serial numbers along with a tally of the ballots passed out. Additional collu-
sion on the part of polling place workers would help invalidate or even take
advantage those countermeasures. Altering the serial numbers on the regis-
ter may cause valid ballots to be invalidated, or altering the count would
make the election appear invalid. Keeping careful records of ballot serial