The New York times has an interesting opinion editorial on voting that talks about Rivest and Smith’s Twin protocol. The author, William Poundstone, has a new book on elections coming out that might be worth reading. He was also recently interviewed by Mother Jones.

There seemed to be some misconceptions in the comments that Twin is/is not an “electronic system”. It’s a protocol, and an implementation of it would likely be mixed. The piece outlines the most obvious implementation: it would use a website for ballots, and requires a “ballot randomizer” that will give you a
copy of someone else’s ballot. I also found this claim from the article to be interesting:

Yet another opportunity for fraud, perhaps more likely than outright vote buying, would be created if voters were given paper records of their own ballots. Many voters would ditch their receipts in the first trash can they see. Then, crooked election workers could retrieve the discarded receipts and change the corresponding electronic votes, confident that there would be no evidence of their fraud.

I think this was meant to be a jab at Punchscan and other receipt-based systems, but It should be noted that the same opportunity exists for fraud in Twin, you just have to game the ballot randomizer. You deal with the problem by giving copies of the receipts to any observers who want a copy.

At least one commenter asked about its relationship to Punchscan. One difference is that in Punchscan, the receipt never indicates who you voted for, but one commenter noted that in the other system:

Ballot images are secret for good reason:
It is easy to buy or coerce votes if ballots can be recognized by combinations of downballot contests, patterns of zig-zag oval filling, or “stray” marks.
See scantegrity.org for a real solution.

I also add that, if you write down your serial number and call it in before it is posted you can pretty convincingly sell your vote. The crypto can really help in the confidentiality department, but it also helps with integrity, because, unless you’ve broken the cryptography, you can’t know what data to
change until after the results are posted (also note that, even if you break the crypto, you can’t rig the counting process, you can only change the publicized data that is entered into the counting process). At that point, observers have already downloaded all the ballot data and there’s many people who could catch you changing the data.

Smith also has responses to comments on the article.

This entry was posted on Monday, January 7th, 2008 at 3:59 pm and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.