Scantegrity is a security enhancement for optical scan voting systems, providing such systems with end-to-end (E2E) verifiability of election results. It uses confirmation codes to allow a voter to prove to themselves that their ballot is included unmodified in the final tally. The codes are privacy-preserving and offer no proof of which candidate a voter voted for. Receipts can be safely shown without compromising ballot secrecy.[1]
Scantegrity II prints the confirmation codes in invisible ink to improve usability and dispute resolution. As the system relies on cryptographic techniques, the ability to validate an election outcome is both software independent as well as independent of faults in the physical chain-of-custody of the paper ballots. The system was developed by a team of researchers including cryptographers David Chaum and Ron Rivest.
Optical scan voting systems produce an electronic tally, while maintaining the original paper ballots which can be rescanned or manually hand-counted to provide an ostensibly corroborative tally. However, the correctness of each of these tallies requires the voter to either trust that the software is error-free and has not been hacked, or that the physical chain-of-custody of the ballots has not been broken at any point.[2] Other E2E voting systems such as Punchscan and ThreeBallot, address these issues but require existing polling place equipment and procedures to be greatly altered or replaced.[3] In contrast, Scantegrity is an add-on meant to be used in conjunction with existing optical scan equipment, thereby requiring fewer hardware and software and procedural modifications.[1]
For all other voters, the ballot marking procedure is essentially identical to conventional optical scan paper-ballots. Similarly, the underlying system still produces both an electronic tally as well as a human readable paper trail through which manual recounts can still be conducted.
Methodedit
Scantegrity II ballot and decoder pen. Left: Unmarked optical scan bubble. Right: Marked optical scan bubble revealing confirmation code "FY"
The Scantegrity II voting procedure is similar to that of a traditional optical scan voting system, except that each voting response location contains a random confirmation code printed in invisible ink.[4] The voter marks the location using a specially provided "decoder" pen, which activates the invisible ink causing it to darken, revealing a confirmation code.[5]
Voters wishing to verify that their vote is unmodified may write down the confirmation codes for each race on a detachable chit that contains the ballot's serial number.[6] Otherwise, the voter can simply ignore the code and continue to mark and cast their ballot as normal.
The confirmation codes are randomly assigned to the ballots, allowing voters to freely share their codes while keeping their votes secret. The codes are also pre-committed to a committee of mutually-distrustful entities (such as representatives of each political party) so that the confirmation codes cannot be changed or misprinted without detection. Voters may request additional ballots to audit—they ensure the ballots are properly printed by revealing all the codes and comparing these to the codes committed to.
Checkingedit
After the election is finished, the election authority publicly posts a list of confirmation codes for the positions marked on each ballot it received. Voters who wrote down their codes can verify that the codes are correct for their ballot number and that no codes were added or removed.[6] If the posted record is incorrect, the voter may file a dispute. Spurious disputes can be excluded from consideration by comparing the claimed codes to the set of possible codes for a given contest on a ballot—the probability of randomly guessing a code that actually appeared on the ballot is low.
Verificationedit
After the election, the trustees generate an independent tally from the voter-verifiable list of ballots and confirmation codes. Since the link between a confirmation code and the candidate voted for must remain secret, the tally is generated using an anonymity-preserving backend. Many such backends have been proposed for tallying votes, including the ones used by Punchscan and Prêt à Voter. Steps in the tally can be recalculated by anyone to ensure its correctness. For this reason, the system is more accurately described as mathematical voting than electronic voting. The security of the system does not require any software to operate correctly, only that the mathematical operations are independently corroborated by all interested parties.[7]
Use in public electionsedit
The city of Takoma Park, Maryland used Scantegrity II for its November, 2009 election.[8][9] Scantegrity was used again in Takoma Park for its November, 2011 election.
Notesedit
^ abChaum, David; Aleks Essex; Richard T. Carback III; Jeremy Clark; Stefan Popoveniuc; Alan T. Sherman; Poorvi Vora (May–June 2008), (PDF), IEEE Security & Privacy, 6 (6:3): 40–46, doi:10.1109/MSP.2008.70, S2CID 1149973, archived from the original (PDF) on 2016-01-16, retrieved 2016-11-23
^Rowell, Laurie (March 2008), , ACM NetWorker Magazine, no. 12:1, pp. 17–23, archived from the original on December 5, 2008
^Hunter, Adam (2008), , MSN Tech & Gadgets, archived from the original on 2008-09-10
^Chaum, David; Richard Carback; Jeremy Clark; Aleksander Essex; Stefan Popoveniuc; Ronald L. Rivest; Peter Y. A. Ryan; Emily Shen; Alan T. Sherman (2008), "Scantegrity II: End-to-End Verifiability for Optical Scan Election Systems using Invisible Ink Confirmation Codes" (PDF), Proceedings of USENIX/ACCURATE EVT
^Lafsky, Melissa (October 2008), "Protecting Your Vote With Invisible Ink", Discover Magazine
^ abMahoney, Matt (September–October 2008), "Flawless Vote Counts: Cryptography lets voters confirm that their ballots were tallied correctly", Technology Review
^Lombardi, Rosie (March 27, 2008), , InterGovWorld.com, archived from the original on 2008-05-16
^(PDF), archived from the original (PDF) on 2011-07-19
^Hardesty, Larry, (PDF), MIT news, archived from the original on 2011-07-19, retrieved 2009-11-30
Further readingedit
Scantegrity II: End-to-End Verifiability for Optical Scan Election Systems using Invisible Ink Confirmation Codes. 2008.
Canadian voting machine enters American political machine (InterGovWorld).
Maryland Voters Test New Cryptographic Voting System (Wired News)
External linksedit
video presentation
Ben Adida's Takoma Park election blog
January 01, 1970
scantegrity, security, enhancement, optical, scan, voting, systems, providing, such, systems, with, verifiability, election, results, uses, confirmation, codes, allow, voter, prove, themselves, that, their, ballot, included, unmodified, final, tally, codes, pr. Scantegrity is a security enhancement for optical scan voting systems providing such systems with end to end E2E verifiability of election results It uses confirmation codes to allow a voter to prove to themselves that their ballot is included unmodified in the final tally The codes are privacy preserving and offer no proof of which candidate a voter voted for Receipts can be safely shown without compromising ballot secrecy 1 Scantegrity II prints the confirmation codes in invisible ink to improve usability and dispute resolution As the system relies on cryptographic techniques the ability to validate an election outcome is both software independent as well as independent of faults in the physical chain of custody of the paper ballots The system was developed by a team of researchers including cryptographers David Chaum and Ron Rivest Contents 1 Advantages 2 Method 2 1 Checking 2 2 Verification 3 Use in public elections 4 Notes 5 Further reading 6 External linksAdvantages editOptical scan voting systems produce an electronic tally while maintaining the original paper ballots which can be rescanned or manually hand counted to provide an ostensibly corroborative tally However the correctness of each of these tallies requires the voter to either trust that the software is error free and has not been hacked or that the physical chain of custody of the ballots has not been broken at any point 2 Other E2E voting systems such as Punchscan and ThreeBallot address these issues but require existing polling place equipment and procedures to be greatly altered or replaced 3 In contrast Scantegrity is an add on meant to be used in conjunction with existing optical scan equipment thereby requiring fewer hardware and software and procedural modifications 1 For all other voters the ballot marking procedure is essentially identical to conventional optical scan paper ballots Similarly the underlying system still produces both an electronic tally as well as a human readable paper trail through which manual recounts can still be conducted Method edit nbsp Scantegrity II ballot and decoder pen Left Unmarked optical scan bubble Right Marked optical scan bubble revealing confirmation code FY The Scantegrity II voting procedure is similar to that of a traditional optical scan voting system except that each voting response location contains a random confirmation code printed in invisible ink 4 The voter marks the location using a specially provided decoder pen which activates the invisible ink causing it to darken revealing a confirmation code 5 Voters wishing to verify that their vote is unmodified may write down the confirmation codes for each race on a detachable chit that contains the ballot s serial number 6 Otherwise the voter can simply ignore the code and continue to mark and cast their ballot as normal The confirmation codes are randomly assigned to the ballots allowing voters to freely share their codes while keeping their votes secret The codes are also pre committed to a committee of mutually distrustful entities such as representatives of each political party so that the confirmation codes cannot be changed or misprinted without detection Voters may request additional ballots to audit they ensure the ballots are properly printed by revealing all the codes and comparing these to the codes committed to Checking edit After the election is finished the election authority publicly posts a list of confirmation codes for the positions marked on each ballot it received Voters who wrote down their codes can verify that the codes are correct for their ballot number and that no codes were added or removed 6 If the posted record is incorrect the voter may file a dispute Spurious disputes can be excluded from consideration by comparing the claimed codes to the set of possible codes for a given contest on a ballot the probability of randomly guessing a code that actually appeared on the ballot is low Verification edit After the election the trustees generate an independent tally from the voter verifiable list of ballots and confirmation codes Since the link between a confirmation code and the candidate voted for must remain secret the tally is generated using an anonymity preserving backend Many such backends have been proposed for tallying votes including the ones used by Punchscan and Pret a Voter Steps in the tally can be recalculated by anyone to ensure its correctness For this reason the system is more accurately described as mathematical voting than electronic voting The security of the system does not require any software to operate correctly only that the mathematical operations are independently corroborated by all interested parties 7 Use in public elections editThe city of Takoma Park Maryland used Scantegrity II for its November 2009 election 8 9 Scantegrity was used again in Takoma Park for its November 2011 election Notes edit a b Chaum David Aleks Essex Richard T Carback III Jeremy Clark Stefan Popoveniuc Alan T Sherman Poorvi Vora May June 2008 Scantegrity End to End Voter Verifiable Optical Scan Voting PDF IEEE Security amp Privacy 6 6 3 40 46 doi 10 1109 MSP 2008 70 S2CID 1149973 archived from the original PDF on 2016 01 16 retrieved 2016 11 23 Rowell Laurie March 2008 Down for the Count ACM NetWorker Magazine no 12 1 pp 17 23 archived from the original on December 5 2008 Hunter Adam 2008 Click Here For President The Future of Voting in America MSN Tech amp Gadgets archived from the original on 2008 09 10 Chaum David Richard Carback Jeremy Clark Aleksander Essex Stefan Popoveniuc Ronald L Rivest Peter Y A Ryan Emily Shen Alan T Sherman 2008 Scantegrity II End to End Verifiability for Optical Scan Election Systems using Invisible Ink Confirmation Codes PDF Proceedings of USENIX ACCURATE EVT Lafsky Melissa October 2008 Protecting Your Vote With Invisible Ink Discover Magazine a b Mahoney Matt September October 2008 Flawless Vote Counts Cryptography lets voters confirm that their ballots were tallied correctly Technology Review Lombardi Rosie March 27 2008 Canadian voting machine enters American political machine InterGovWorld com archived from the original on 2008 05 16 Pilot Study of the Scantegrity II Voting System Planned for the 2009 Takoma Park City Election PDF archived from the original PDF on 2011 07 19 Hardesty Larry Cryptographic voting debuts PDF MIT news archived from the original on 2011 07 19 retrieved 2009 11 30Further reading editScantegrity II End to End Verifiability for Optical Scan Election Systems using Invisible Ink Confirmation Codes 2008 Scantegrity End to End Voter Verifiable Optical Scan Voting 2008 A Really Secret Ballot The Economist Clean Elections Communications of the ACM Protecting Your Vote With Invisible Ink Discover Magazine Flawless Vote Counts Technology Review Click Here For President The Future of Voting in America MSN Tech amp Gadgets Shift Back to Paper Ballots Sparks Disagreement Morning Edition Down for the Count ACM netWorker Canadian voting machine enters American political machine InterGovWorld Maryland Voters Test New Cryptographic Voting System Wired News External links editScantegrity org Scantegrity II video presentation Ben Adida s Takoma Park election blog Retrieved from https en wikipedia org w index php title Scantegrity amp oldid 1152763491, wikipedia, wiki, book, books, library,
