Privacy on ballots is tricky…Digital systems suffer from tempest attacks, and a well hidden camera, fingerprint scanner, or a modified optical scanner could all identify a voter . A voter with a cell phone camera can very convincingly sell their vote, regardless of the system. I imagine if I spent some time writing them all down, I could easily come up with dozens of ways to spy on voters or have them spy on themselves to determine how they voted, and almost all of them would be system independent and hard to detect or prevent. This situation is only going to get worse as technology gets smaller and cheaper.

People, particularly the hand counting crowd, also worry about having identifying marks on ballots. A lot of people confuse identifying with unique and mistakenly believe this means there should not be ballot id’s or similar writings on ballots. In reality, it really depends on how that unique mark is used, and if there’s no relationship made between mark and voter then it would not be an identifying mark.

One thing people may not realize is that there are a lot of things that could be considered identifying marks that they would not have thought of at first look. My favorite example must be write-ins, which, in the world of handwriting recognition, would be identifying. Even if you assume the recognition wasn’t good enough to count, you still might have voter’s identifying themselves with unique write-in candidates (e.g. themselves, or something a coercer tells them to put). So, the way write-ins are handled are important, and I think Ben has come up with a good way to handle write-ins in Punchscan (PS).

Another good identifying mark example is marking your choices in a unique way, perhaps by adding a little tail on the optical scan circle, or (in DRE VVPAT) waiting for the confirm printout and canceling with a certain ballot choice and then changing choices to match what you want to show you voted. I think the most interesting one is the “Italian Attack”, and that is, if there are enough races on the ballot, you could identify yourself by using the races as bits, and choose the race you want to show how you voted on (9 races could conceivably give you 8 bits, more if you had IRV or other election rules in place). This one is important because the regular marks are identifying so long as there’s no process to disassociate the races from each other (by cutting them up, I guess?, we effectively do something similar to that to prevent it in Punchscan).

Not permitting weird marks on ballots presents problems, as it makes it really easy to spoil ballots. All you need to do is find a vote you don’t like and add an illegal mark. So I caution people to take a deeper look into the system before proposing identifying mark rules, as the cure might be worse than the disease, in this case. In PS, we avoid this problem by only showing a reproduction that shows what marks were interpreted, this might be the way to go for more traditional systems.

This entry was posted on Thursday, July 26th, 2007 at 12:35 pm and is filed under Privacy. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.