Re: smartcards, electronic ballots

[William Allen Simpson]

-----BEGIN PGP SIGNED MESSAGE-----

David Honig wrote:
> From "Ballot Proposal" version 1.3
> 
> 10 B DISPLAY
>     (5) Election software shall print the selected choices on a fixed
>         visible medium (such as paper), and shall require the voter to
>         affirm those choices prior to electronic registration of the
>         completed ballot.
> 
> I took this to mean that "what the machine thinks the voter chose
> is printed on paper" (for feedback/trust reasons).   Am I totally off?
> 
That's correct.  All the considered systems require some permanent 
audit record of the ballots.  This draft requires that the voter 
approve the record.  Thus, the printed record is primary, since the 
voter actually sees it and approves it.  Any electronic fudging can be 
detected and eliminated.

But, nobody is suggesting that the voter takes home the paper.  On the 
contrary, designs mentioned in meetings have the paper behind glass, 
not even touchable by voters.


> I wasn't clear on the architecture you have in mind ---I eventually
> figured out that you're requiring an online system with local and
> central real time reporting (mirroring) of votes.
> 
The Internet is big in legislators' eyes these days.  The network 
connection to a central (state) system is really the main motivation, 
as it allows the eRate funds to be used to run elections. 

Also, central state servers are needed to allow overseas electronic 
voting.  Too many trust relationships to have each base/embassy try 
to interact with every city or precinct.

And the mirroring keeps the locals from fudging the ballot counts.

Basically, I was asked, "Can the Internet be used to carry the votes, 
while still remaining secret?"  My answer is, "Yes, we already have 
SSL/TLS for confidentiality."  "What about ensuring votes only come 
from authorized places?"  "Easy, issue credentials for each machine, 
and use digital signatures on the ballots."  Etc, etc.

I've found a lot of support for open source software, because the 
politicians don't trust vendors or clerks.  They want lots of review. 
Especially with machines programmed by clerks.  And especially with all 
the campaign money that came in this cycle from so-called high-tech 
firms.  A compromised vendor would be a real problem for one party or 
another....


> (Other architectures include standalone or LAN-only machines acting only as
> better voting-acquisition-machines; or a pure central server scheme like
> home internet voting.)
> 
There have been a lot of problems with stand-alone machines.  For 
example, in Florida, the recounts were supposed to actually re-run 
the ballots.  Instead, many places just looked at the counters without 
doing any real counting.  Also, elsewhere, machines have been found to 
be mis-programmed.  Etc, etc.

Home internet voting has a lot of problems, too, and is not being 
considered.  Just incremental improvements on the existing polling 
places and absentee ballots.  As you say, better vote acquisition -- 
evolution, not revolution.

The other thing is cost, cost, cost....

Anyway, I've basically been answering a lot of questions for free, 
just as most of you are doing.  Admittedly, I've been given access to 
some reports and internal committee documents, but mostly I'm just 
trying to help them add security language.

I really think we've gone pretty far afield for this list.  Just send
messages to me privately, and I'll reply as I have time and interest.  
Thanks again.

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1

iQCVAwUBOn4xmtm/qMj6R+sxAQElswQAwoZh8ZJ1sJFeQvpagdh2hJijtRNIONzD
Pae1EeCndFJwFfNHQFR87tOoNMNHCw+0Hf/IgUnYNrJVTr4WP8UJ1DAqdKS6Fw19
oLZ05hsaLvLgSwcGoR8WTkcr2emlkRzQ3vczGViPjlbNVPSptklN9nopQxFKe8HO
pGV9vquALz4=
=lZRn
-----END PGP SIGNATURE-----