EPIC Audits First Public Election to use Scantagrity Voting System (Takoma Park, MD)

1 view
Skip to first unread message

Kathy Dopp

unread,
Nov 10, 2009, 9:57:08 AM11/10/09
to ElectionIntegrity digest subscribers
Notice several things in this article below:

The voter can do a "a post-voting verification of the capture of their
ballots for the tabulation phase of the election"

However, if the voter can verify his/her cast choices online, then
what is to prevent vote-buying? If the voter cannot verify his/her
cast choices then how does the voter *know* that the e-ballot is
displayed correctly on-line? Even if the voter sees his/her e-ballot
displayed correctly on-line, how does the voter know that the same
ballot was included in the vote tally?

There is apparently not provided a way for the voters to check that
*all* other votes have been cast correctly.

There is not a way for the voters to know if *all* the ballots were
cast and counted correctly.

Therefore, even if *all* voters checked and found an online matching
ballot, there is no way provided for voters to know that the same set
of ballots was used to tally the election results.

This system depends on the security of a web site that allegedly
serves up the exact same set of ballots that were used to tally the
results, and were all tallied correctly even though the system does
not provide a way for anyone to check that this is the case.

This system depends for its accurate functioning on the security of a
complex ballot definition file that the voters are provided no way to
oversee the security of, and which if manipulated can be used to alter
the winners of the election.

This article below does not describe a publicly verifiable
post-election audit of the accuracy of election outcomes of the type
that I've been recommending. It seems that it does provide another
song and dance that may fool some members of the public into thinking
that a post-election check of the election outcome accuracy has been
done.

Correct me if I'm wrong anyone. Takoma Park, MD is the home of Fair
Vote. Does Fair Vote support this voting system?

=======================================================================
[5] EPIC Audits First Public Election to use Scantagrity Voting System
=======================================================================
The city of Takoma Park Maryland’s Clerk of Elections sought EPIC's
assistance in conducting a manual audit of their November 3, 2009
election. The city chose the Scantagrity voting system for its biannual
election for mayor and city council. Scantagrity is an original concept
developed by David Chaum and has been refined for use in elections
through the collaboration of Ron Rivest, MIT and Poorvi Vora, Computing
Science Department at George Washington University.

Scantagrity’s implementation for the Takoma Park election allowed
voters the option of performing a post-voting verification of the
capture of their ballots for the tabulation phase of the election.
Takoma Park voters also had the option of second chance voting, which
allowed the selection of primary and secondary choice for the public
offices on Tuesday’s ballot.

This marked the first time in the U.S. that voters had the option to
check that their private votes are correctly recorded and included in
the election results. Selections on each ballot used unique codes for
each possible selection on the ballot. The codes correspond to the
ballot number. It is important to note, however, that ballots are not
associated with a specific voter. Poll book registration logging of
voters participating in the election was separate from the issuance of
ballots to voters.

Voters were given ballots in a privacy sleeve. They then voted using
optical scan ballots behind privacy screens, which allowed voters the
option of noting the codes and ballot numbers on a form they could take
with them. Voters then deposited completed ballots into one of two
scanners. Later, voters could verify that their ballot was included in
the final results by going to the City Election Office’s web site and
entering the ballot number. The process was not as accessible for
unassisted voting for persons vision related disabilities, when
compared with touch screen voting systems. However, the ability of
voters with a wide range of disability challenges were able to vote
independently, or with little assistance with their privacy sleeve
enclosed ballot’s insertion in the scanner.

EPIC was asked to randomly select ballots from the choice of ballots
provided to voters from each of the 6 wards. Over 1600 Takoma Park
voters participated in the election. The audit ballots were selected
at varying times throughout the Election Day, under the supervision of
election officials. Takoma Park elections officials voided each audit
ballot and marked ballots stubs to indicate that they were part of the
manual audit. Then EPIC processed each manual audit ballot by revealing
all possible selections for each ballot, then a copy of the original
manual audit ballot was made. The original ballots were placed in a
spoiled manual audit ballot envelope held by another election official
stationed in the polling location. Each ballot copy was then endorsed
by the Chief Election Judge, which will aid in authentication of the
copies when they are submitted to the City Clerk’s office. The manual
audit ballots and their selections will be verified and the results
reported to the Takoma Park Clerk’s office.

Scantagrity:
http://www.scantegrity.org/

Links: Takoma Park Election’s Office:
http://www.takomaparkmd.gov/clerk/election/2009/index.html

Takoma Ballot verification Web page:
http://scantegrity.org/takoma/checkcodes

EPIC’s Voting Privacy Page:
http://epic.org/privacy/voting/


--

Kathy Dopp

Town of Colonie, NY 12304
phone 518-952-4030
cell 518-505-0220

http://utahcountvotes.org
http://electionmathematics.org
http://kathydopp.com/serendipity/

Realities Mar Instant Runoff Voting - 18 Flaws and 4 Benefits
http://electionmathematics.org/ucvAnalysis/US/RCV-IRV/InstantRunoffVotingFlaws.pdf

Voters Have Reason to Worry
http://utahcountvotes.org/UT/UtahCountVotes-ThadHall-Response.pdf

Checking election outcome accuracy --- Post-election audit sampling
http://electionmathematics.org/em-audits/US/PEAuditSamplingMethods.pdf

Kathy Dopp

unread,
Nov 10, 2009, 11:18:17 AM11/10/09
to ElectionIntegrity digest subscribers
Respected computer science professor Doug Jones responds with some
enlightening corrections and additional information to some of my
criticisms of the Scantegrity voting system. Worth reading.


---------- Forwarded message ----------
From: Douglas W. Jones <jo...@cs.uiowa.edu>
Date: Tue, Nov 10, 2009 at 10:49 AM
Subject: Re: EPIC Audits First Public Election to use Scantagrity
Voting System (Takoma Park, MD)
To: kathy...@gmail.com



On Nov 10, 2009, at 4:23 AM, Kathy Dopp wrote:

> However, if the voter can verify his/her cast choices online, then
> what is to prevent vote-buying? If the voter cannot verify his/her
> cast choices then how does the voter *know* that the e-ballot is
> displayed correctly on-line? Even if the voter sees his/her e-ballot
> displayed correctly on-line, how does the voter know that the same
> ballot was included in the vote tally?

You need to read up on Scantegrity. The voter verification scheme
allows the voter to see proof that his ballot is in the system and
scanned correctly, without allowing vote selling. When you vote, the
invisible ink pen causes a 3 letter code to appear in the bubble you
fill. Vote for Bush, you get AYK. Other votes for Bush on other
ballots get other random 3-letter codes, same as votes for Gore or
anyone else. When you look up your ballot on the web, you get AYK,
proof that your ballot was scanned, but not proof that you voted for
Bush.

Now, as a separate proof, there is a public proof that the decryption
from AYK to Bush is valid and that the vote totals are correct. That
proof is done in a way that hides individual votes while giving
excellent assurance that both the decryption and totals are correct.
Of course, you have to be a cryptographer to believe it. That's a bit
of a problem if you're not a cryptographer.

I want to emphasize. Chaum's ideas focus on using crypto to allow
voters to prove that their votes were counted without allowing vote
selling.

> There is apparently not provided a way for the voters to check that
> *all* other votes have been cast correctly.

I can check that my vote made it into the ballot box, and I can check
that all the votes in the ballot box were correctly counted. If I could
check that your vote made it into the ballot box, that might allow vote
selling, so Chaum's schemes don't let me do that. Instead, they bed that
enough voters will verify that their own votes made it that cheating
becomes impossible.

> There is not a way for the voters to know if *all* the ballots were
> cast and counted correctly.
>
> Therefore, even if *all* voters checked and found an online matching
> ballot, there is no way provided for voters to know that the same set
> of ballots was used to tally the election results.

Not true. If you understand the crypto (which few people do), then you
can prove that all votes were counted correctly.

> This system depends on the security of a web site that allegedly
> serves up the exact same set of ballots that were used to tally the
> results, and were all tallied correctly even though the system does
> not provide a way for anyone to check that this is the case.

Wrong.

> This system depends for its accurate functioning on the security of a
> complex ballot definition file that the voters are provided no way to
> oversee the security of, and which if manipulated can be used to alter
> the winners of the election.

Note that unlike its predecessors, the Scantegrity II system also allows
classical hand recounts. So, it's as good as paper ballots, with the
crypto stuff added to allow yet another approach to election verification.

I do have one big quibble with Scantegrity II and with its proponents.
Each ballot in this and all related crypto voting schemes has a printed
serial number on the ballot. If an election insider has access to the
paper ballots or to electronic scans of the paper ballots, I can sell my
vote to the insider using that serial number. That's an old-fashioned
approach to vote selling that is forbidden in many states (all states that
forbid printing a unique identifier of any kind on the ballot). England,
on the other hand, requires all ballots to be serial numbered and then
makes it a crime to abuse the numbers. Scantegrity II ought to work just
fine under English law, but in most US states, it wouldn't pass muster.
Furthermore, note, the English election official I asked about this said
that English law is not in conformance with international election law,
and if anyone ever challenges it, England will fold and stop printing
serial numbers on their ballots.

There may be a way to use these crypto voting schemes under international
election law, but it will require carefully written enabling legislation
that is neither the classical British serial number scheme nor the absolute
ban on identifying marks that is in most US election law.

Doug Jones
jo...@cs.uiowa.edu

Mark Adams

unread,
Nov 10, 2009, 11:16:37 AM11/10/09
to Kathy Dopp, Election Integrity
More great questions from Kathy Dopp.  In my opinion, this is big test which will show whether or not there is an honest debate with defensible positions on these issues.  I can hardly wait to hear the answers.  
 
Mark A. Adams JD/MBA
 
> Date: Tue, 10 Nov 2009 09:57:08 -0500
> Subject: [ei] EPIC Audits First Public Election to use Scantagrity Voting System (Takoma Park, MD)
> From: kathy...@gmail.com
> To: Election...@googlegroups.com
> --
> To post, send email to Election...@googlegroups.com. Please review the "Posting Guidelines" page.
>
> Please forward EI messages widely and invite members to join the group at http://groups.google.com/group/ElectionIntegrity/members_invite.
>
> If you're not a member and would like to join, go to http://groups.google.com/group/ElectionIntegrity and click on the "join" link at right. For delivery and suspension options, use the "Edit my membership" link.


Hotmail: Trusted email with powerful SPAM protection. Sign up now.

voternm

unread,
Nov 10, 2009, 11:50:10 AM11/10/09
to Election Integrity
The "secret ballot" is the problem because it is a violation of the
voter's ability to verify their own vote was counted correctly. The
secret ballot is a violation of our Constitutional Right to hold the
government accountable with elections. Definitions have been
corruption centered since the Civil War. Before the mid 1800's voters
could vote in open meeting rooms by hand on issues, as they do in
congress, and later with ballots counted by hand with the voter's name
on it. This became a problem as Kathy cites with vote buying or
selling, so the secret ballot became the law of the land. What is
wrong with this is that the voter is made the criminal and loses their
right to verify how their vote was counted. Protected special
interests can claim the voter is the problem, but anybody who buys or
sells their vote should be the criminal. Evidence of vote tampering by
anyone trying to coerce, influence, or obligate a person to vote a
certain way, or to bribe an employer to spouse or community leaders or
politician of how one voted should be the crime. Honest voters should
have the right to check how their vote was counted, just as we can
check how debit and credit events occurred in our bank accounts or
credit cards.

If there was a print out of all votes cast with random numbers
associated with a table of voted issues, each voter could take a copy
of their ballot with the random number issued to the post office,
library, or school, or online and check their vote record to see if it
was tabulated correctly. Further, any voter could add up all the votes
with a spread sheet form of the election and check the totals used
that determined the election results. But this would empower the voter
and make the Constitution's declaration of power over the government
that resides in the hands of the people real. Democracy would break
out and special interests would be governed instead of dominating our
government, media, and policies, as they do today.

Anyway, the idea is make it criminal to buy or sell votes and end the
secret ballot, so voters can use the internet or polls to vote and
then check how their vote was counted in a published data base.

Casey Reed,
Material Insight

--------------------------------------------
> http://utahcountvotes.orghttp://electionmathematics.orghttp://kathydopp.com/serendipity/
>
> Realities Mar Instant Runoff Voting - 18 Flaws and 4 Benefitshttp://electionmathematics.org/ucvAnalysis/US/RCV-IRV/InstantRunoffVo...
>
> Voters Have Reason to Worryhttp://utahcountvotes.org/UT/UtahCountVotes-ThadHall-Response.pdf

Rob Richie

unread,
Nov 10, 2009, 1:48:41 PM11/10/09
to ElectionIntegrity digest subscribers
Doug's comments look important, and he knows much more about this than I do. I wasn't part of Takoma Park's board of elections that decided to go with Scantegrity, but I thought it was an interesting trial. From my dealings with Scantegrity people over the years at various conference, they seem very sincere and I'm sure open to any suggestions from those who have questions about their system. Their academics, primarily -- see:
http://www.scantegrity.org/about.php

Note that in 2005 we took the lead in encouraging the Takoma Park city council to stop using the county DRE's and instead doing a hand-count, showing it would save money and be easy to do. They did a hand-count that fall and in a January 2007 election, and have tried a couple different optical scan systems since.

Rob
--
To post, send email to Election...@googlegroups.com. Please review the  "Posting Guidelines" page.

Please forward EI messages widely and invite members to join the group at http://groups.google.com/group/ElectionIntegrity/members_invite.

If you're not a member and would like to join, go to http://groups.google.com/group/ElectionIntegrity and click on the "join" link at right. For delivery and suspension options, use the "Edit my membership" link.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Respect for Every Vote and Every Voice"

Rob Richie
Executive Director

FairVote  
6930 Carroll Avenue, Suite 610
Takoma Park, MD 20912
www.fairvote.org r...@fairvote.org
(301) 270-4616

Please support FairVote through action and donations -- see
http://fairvote.org/donate. For federal employees, please consider
a gift to us through the Combined Federal Campaign (FairVote's
CFC number is 10132.) Thank you!



Reply all
Reply to author
Forward
0 new messages