On November 8, 2011, absentee voters in Takoma Park, Maryland, will have the option to verify their votes for mayor and city council using a new Internet voting system called Remotegrity. Internet voting has been used to elect government officials before (for example, in Switzerland, Estonia, and Norway), but what is new here is that voters mail in paper ballots and use the Internet to independently verify that their votes have been received by the city and recorded correctly. Anyone can check online that the recorded votes were tallied correctly.

Dr. Filip Zagorski, computer scientist at The George Washington University, explains “Through the hybrid use of paper ballots and Internet verification, Remotegrity combines the best of both worlds to provide a very high degree of security even against malware and insider attack.” Portions of the underlying research in cryptography and secure server design were supported by the National Science Foundation and the Polish Ministry of Science and Higher Education.

Voters who have requested to vote by mail receive a ballot which they mark and mail in, but they can also verify their vote on-line in the Remotegrity system, without revealing how they voted. In future elections, the same online procedure may cast votes and physical mailing of paper ballots may be optional or omitted.

The city will also use the Scantegrity voting system for voters who cast their ballot in person, as it did in 2009. The integrated Scantegrity and Remotegrity systems offer full end-to-end voter-verifiability, in which voters casting ballots from home or in person can verify that their votes were correctly cast, collected, and counted.

Additionally, this year, the city will provide an audio interface for marking ballots. The interface, named Audiotegrity, developed by researchers at The George Washington University, will enable voters with difficulty marking paper ballots to mark ballots independently using an electronic interface. Mr. Noel Runyan, a usability and accessibility expert, provided pro bono design advice to the Audiotegrity team.

With a grant from the federal Election Assistance Commission, and support from the non-profit Voting Systems Institute, researchers from UMBC will survey voters and election officials as well as conduct focus groups around their experiences using these new voting systems.
__________________________________________________
For more information:
Dr. David Chaum, Voting Systems Institute, david@chaum.com, mobile 818 512 1024
Prof. Poorvi L. Vora, Department of Computer Science, GW, poorvi@gwu.edu, mobile 202 262 1101
Dr. Alan T. Sherman, Dept. of CSEE, UMBC, sherman@umbc.edu, mobile 410 963 4779

http://www.scantegrity.org
http://www.usenix.org/events/sec10/tech/full_papers/Carback.pdf
http://web.mit.edu/newsoffice/2009/rivest-voting.html
Video – How to vote using Scantegrity: http://vimeo.com/31647826

Our team made this video for the upcoming election:

We are happy to announce the following independent auditors for the 2011 Election:

• Dr. Roberto Araújo—He will be performing audits of the election data. He is a professor at Universidade Federal do Pará
  (Brazil). He holds a Ph.D. in Informatics from Theoretical Computer Science group at TU-Darmstadt (Germany) and is electronic voting researcher.
• Lillie Coney—Also an auditor during the last election, she will be performing random ballot audits. She is the Associate Director of the Electronic Privacy Information Center, a public interest research organization in Washington, DC. EPIC was established to focus public attention on civil liberties issues. Ms. Coney joined EPIC in 2004 to head up the organization’s voting and privacy project.
• Neal McBurnett—Founder of the ElectionAudits software package, a former distinguished member of the technical staff at Bell Labs, an Ubuntu Linux member, and a prolific supporter of open systems and free software. He will be performing audits of the election data.
• Marco Ramilli—A security researcher who has helped us fix several problems with our websites, Marco will be performing security review of our software. He is a Ph.D. student working with the UC Davis E-Voting Research Group.

The auditors from 2009 have moved on to other exciting work. Dr. Ben Adida is now working for Mozilla. Dr. Filip Zagorski is working with us as a postdoc at GWU, and is head of the work for Remotegrity. Their code will still be available for anyone to use to audit the election this year:

• Ben Adida’s Audit Website
• Filip Zagorski’s Audit Website

Additionally, all of the data will be signed, and the public key that will be used can be found on our subversion repository, on the mit pgp keyserver, and below:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.17 (Darwin)

mQINBExM1SUBEACpbiV4gGFowhqYiDgqlc9ymQCPZruesEPLcc0pb4SNtOIBU/Fp
eV3xaliSTzJdF7Vx40eYsPyaak8byhf/L1ObCwwEJYR3tgdEv36rAy8dkGXk+y3R
TgvPA9Jlxr3a7kFaFvNJLsx9DmmERBk7wPfXWpz4AfPxnpJs8YoV/8owZCAe4k+b
spMoyAJFik5cQgWhVFvACdEePgDGKR3x7gQ84wwMP+MIVvwGs6KV56FWDSNKKrfP
32TASXfke8Cr5V+5drLLi7jxGwTE8Wgy814FVhcI6L6BZVDutmkeSEwEgDifyAl5
IvzICsPshKw9+45VurE6973HlbDcm5zdWebghdfyhMbS/jWTVYIbnQh/2KqogKdK
tMqdNUbtn1HPpm81kDvQsTSokSSnZxYD5vPnsqh3UofVMwUSpqbAlH3SR1VSZvxI
lCn8SrXbWBSMFZA6UG78NOGKMS8t9/+BqW94FweEbTBRl7mYR6kBPgTu3MGDr8Ye
LvTxN6SyYfqvzJu6pCxQJy2d+i+fkVXOEwCc+YclDzlexzboqVeaNG/j8HfbbGsG
rMXG1aFZO+kGpo6aatBw4oQKTkmreSoJx7xyr73gFcey+AiKhVeE96+N+V9cq2HQ
dgV5uN/WoVnMrWWcMSPeMU8SRmm2uiFwK0Vk4sNBulfF+QIEbKh0Anu9VwARAQAB
tEFSaWNoYXJkIFQuIENhcmJhY2sgSUlJIChQZXJzb25hbCBFLW1haWwpIDxyaWNr
LmNhcmJhY2tAZ21haWwuY29tPokCPAQTAQgAJgUCTEzVJQIbAwUJA8JnAAQLCQgH
BRUKCQgLBRYCAwEAAh4BAheAAAoJEIcuaucUO1vCXMcP/1ISCmPjIZdNuzOdxmG+
THtro8eXi5K31H/FhNQfI4eT6d7etTdZ8+O83SPUGUtX9V7CYPl7qmT/BjWN7pj0
7fLZ+5xYLLFSl/LW9pg9CtH2DGADKw7wDYdbNLAgex02PkudmlEje6cNoFUjdFYL
wzbC30C/+BI9xASog8u2NALAHJttYz1IRVwMEJl9ii6ylgyGW7Rb7jnXaMx+/NVH
gvIuofBDqptybXiE9WAGHyWENnZhHncjdd5fI3v/qGfTylBJs44h+KJjaNM0ZdVm
h9AGNZmSQUbD0/uKnnb/Wx7JRnbsOdYKDMDkyu1Pab5vz/1z0FNeqvrMOgsxHjC1
mK35eoNSXhbGffhILNiPTqFuK03hODx5lje+NWAkVaNi6Lws54Rr1gmJpmTL1y/a
hWiMysBTDPS0ZblaF1SUaaXadyfxBvv95T78/rJUzFDSaokoxyLUrnqQSi9yQoO6
8v8YqjvjNG2i8GyiuzkKE/3Q5CC8+LPUMw0bBenbASO7Wg+W+yK+MEFcP/LbyTvd
5ha0df2EYIQCuoca+yK7PpAnmC2zUmO5nIWyb681gJh/7c26DuruDRAtGqZNLspM
PWC1du2Mm9oSNPMUNYd+hOEca1ic/gbQp9EYHJszhDIUdniNMPqxBuc5n0E4eOtK
87+G1wUUp6PSNFQoXKw/S/TIiEYEEBEIAAYFAkxM3oQACgkQuNYC9N1cDZ5W8wCe
Mu3m1VWvhZJFBKJYC/uqZ/vINGwAoIwE4Qz6u9OHTnKaBv90vfGxArQkuQINBExM
1SUBEACz7HPAaDEVd3bbX4TsYIcxt69VW4HNA4jyE0UcrhRVFo1BpH8+m+f5Z1o4
jVo0UZ/NWpIDFkXhsuqjUIp/kYOUdJZO4P09BPvXWiSXXPiuyQUhZiH+NPJXk+0l
Q1WeIE6m4sC90+5Fl2oJMAm/0RhtH1Jycx2jxEnmTgXvPfQs3dBVxHQhYAGipP7v
c7Sq46W3+o47QgIVw2muFnYWQONo/Xp8FwstIvfDMR/OZJGEDL3gWJFHO7hWi+f/
KNVAfjrG6HXlzHQWBiH0bX0hT7Pz2Hduvq/fir5Qohfa25rO9ra2cuoQ1c1Oj+D+
M54IqmlSDJAepAJ0Oo58Hg2ZVjFfHpg1HTDkZsUMzkgJ7/5EnkaOBTkiCavGORrr
BQI8iGj5+QSqk99l6dptqdpwJvmXF5AG1oiuehQi8M+9EIvOB+cD+KX9xh5VmJpE
CUe8L/4I/AchjsknYWyl+noCNkrq7chgdlyGIM5EWVQf43ZslN5cwwR8JSnqx0ER
AznALdhtc/3ZVDpAm93tI8/8gAMcWiVE7a5+kg9vWeA7Gnc61mVXDX/g2L2ST6dq
6tccMHwI5IwKByxsoQpOrUxleTMeL+NKDxMb+fh01k4Szd7x2xjMBy9nZXCiwDOc
sx58f3xSXKjSfJrXhBtmFoDz3BuhqdZc7JltlnilzZWrumJ7rQARAQABiQIlBBgB
CAAPBQJMTNUlAhsMBQkDwmcAAAoJEIcuaucUO1vCIJYP/i6mKZuURb8xhafmq7dz
bnh9wv4RJ9gOJTLssHPcBTqp7bvBL9iuj+8Wt4fNnSLEakkRstQz0mkkp0a2HJkj
MbLto7jAT6Bph/AoivUvBjwJ+X+/bUlJLsMAmsWR/no06ugNdPcad+qLnY0If9FB
YK9a7oaEK9yk3D9vEA2Q+0oNhe70xYTVGVIkekczm4nDiV1MjC839SRfJ0CjCPFU
uFH4DXR8a21kYmXT3q80HmfxT6eY8sIvG2CHs/Gtw1Nk6RI3nfxgKGSmw9UgYQ4e
ECxtBPth138CtwmDyviiiKqNm9VJCTzMa61RGct0PkCLGxuJJK7GLfDCr/Hl7mCI
OeyNMsNniU6Mw6XTaCcTxSEYiC5Buc0Ayw47ioMMubBwHKag7ngeiaK86VypZLmw
S/q3V5n0UpQ160Pn39a/wRg8y8b791HAE9JOpl9pZmNE4Zj6B+eTxULBS1DbcPW4
NJ2wEhA228qsGje/GZqSkf7nYkCGJLGwhVMrCBU7K+ht10m3vi8u4e//rIBAlG7C
KwWliFeyfCQcJYjU45buVRk0us+FQh5tID2DQBTabFNa3/gf/4R8gn8Od12CJUne
koCwViVSqF48xBnWq6mwut+YYTadHix/SdMCjmLXzWnBptP0ajgqn4MCb8IWD1M6
wnsNb8/yUAQUxDX4BLBg9hBu
=lgdW
-----END PGP PUBLIC KEY BLOCK-----

We received a lot of questions about Remotegrity, and in response I
posted a Remotegrity FAQ (written by Drs. Vora and Zagorski) to the wiki:

https://scantegrity.org/wiki/index.php/Remotegrity_Frequently_Asked_Questions

If we are missing something, please let us know by adding it to the Talk page on the wiki.

From the article:

A small group of students, led by George Washington University computer science professor Poorvi Vora, spearheaded a test for online absentee voting in Takoma Park in partnership with Scantegrity and Remotegrity.

Remotegrity is the name given to the absentee return over internet option.

From the article:

FairVote’s home city of Takoma Park, Md., hosted a test on Thursday of an innovative new interface for absentee voters that would allow them to verify that their voted were counted in the final tally of this November’s citywide elections, which use instant runoff voting. To be clear, the absentee voting interface tested would NOT necessarily involve casting ballots via the Internet. A potential add-in tested alongside the verification system could provide that option in the future, however. That option effectively addresses concerns about voter anonymity, but the potential for virtual shenanigans by hackers who know more about the electronic frontier than any election official endures as the fiberglass ceiling for any Internet voting system.

Please note that Scantegrity is not affiliated with FairVote. We are a non-profit research organization, and we do not do any political advocacy. We have been accused of various affiliation before, and there is a comment thread where I tried to address specific accusations.

From the article:

“The city Board of Elections is working with Scantegrity, a research group that ran the city’s 2009 elections, to develop a system in which absentee voters could vote online. The city will still be conducting traditional voting at polling places, regardless of whether an online absentee system is implemented, City Clerk Jessie Carpenter said.”

This post is an attempt to provide more information and clarify any misconceptions from an article with the title Takoma Park Voters Will Be Able to Cast Ballots Online for 2011 City Election on May 20th.

Last week we presented an early stage proposal for absentee voting at Takoma Park’s weekly board of elections. Our understanding is that absentee voters will comprise less than 50 people, or .5% of the eligible voting population of approximately 10,000 voters. There are no current plans or agreements in place to deploy it during the election.

We have no intention of using the system without thorough peer review and testing. The board meeting was one of a couple we have attended in order to get feedback from the Board regarding reasonable tasks to expect from absentee voters before we finalize the protocol for review by security experts. Thus, the Board also does not consider this in any way a finalized issue. In particular, any process that is used in the election would have to be finally approved by both the Board and the City Council.

This is not, technically speaking, an internet voting system. This is an option for voters to cast and verify absentee ballots using the internet. Voters voting from the polling booth on election day in the 2009 election were able to verify that their votes were counted. This year we would like to extend this capability to absentee voters. We also want to allow voters who may not have mailed their ballot early enough to vote, and to allow voters to check that the ballot was counted and was not lost in the mail. Voters returning ballots by smail mail can perform the same check. So, we are making an additional feature available—auditability—to absentee voters without making their privacy any worse.

Voters would not be downloading a ballot. As the article describes, they will receive their ballots as usual by the postal mail system. Further, as was demonstrated during the meeting covered in the report, those voters who choose to vote over the internet do not enter their votes, but instead enter a code corresponding to the voter. This code is random per ballot and per candidate and does not reveal the candidate. At no point does any computer system on the internet know for which candidate a voter has voted.

Our team is doing exactly what we did to optical scan voting systems in the absentee voting context:

1. We are not taking away from the original system, this is an add-on only.
2. We are adding auditability. The voter can check that her vote is included in the tally without making privacy worse.
3. We are making it optional—the voter is not asked or required to do anything outside of the normal absentee ballot process. He or she can ignore it.

Note that, because this is absentee voting, there is much less protection available to keep the ballots private. The voter can still choose to give the materials to a coercer, photograph the ballot, etc—just like any absentee balloting system.

Overall, we are extremely pleased with this coverage. At the same time, however, we want to make clear the scope of this project and our approach. As soon as we have finished writing up the proposal, we will post it on this blog. We will also produce a detailed report soon and are also hoping to submit the proposal to a peer-reviewed venue this summer.

Lastly, opinions in our group vary on internet voting, and most are opposed to or extremely cautious about it. This is partly why we are being so conservative with this proposal. You can read more about them in the following links:

1. Thoughts on UOCAVA Voting by Ron Rivest
2. When internet voting ruled the Earth by Aleks Essex

As always, anyone who has questions or wishes to receive updates about what we are doing can use the contact form or join our mailing lists.

Last March, Ron presented at Microsoft Research’s Workshop on Voting Technology. They posted video and an accompanying slide show of the talk.

1. 0b09df11097038ab861d6091e81b83e24f39163a  ./djia-stock-prices-14-Oct-09.txt
2. be7508d86b311b51c5c9cfadea9f23051dd77acb  ./ward1/MeetingFourIn.xml
3. b8913d2f7c3229587b681785c78fd766e45ba213  ./ward1/MeetingFourOut.xml
4. a317ef3f8d3ee5b6c8fbdd81d0b2aa4525536227  ./ward1/PrintAuditBallots.xml
5. 105da835e157419c8c7226c60e4f974c763bdaf6  ./ward1/PrintAuditMixnet.xml
6. 4c2bac2a7375e27ddb72e8107ce460558d5a4a5a  ./ward1/ReplyToContestedCodes.xml
7. 73554e741d69cad7d5264b74ab756305f50c1be0  ./ward1/SpoiledBallotsFromScanner.xml
8. 440d840786f16822dc2c270fcbfaf8113dfa75df  ./ward1/SpoiledBallotsPid.xml
9. adb410a66ae203bfa0b6bbdb963fe4af5e8caf9c  ./ward2/MeetingFourIn.xml
10. 907a1d9dfd180acdd442ae91800a0371537f3d44  ./ward2/MeetingFourOut.xml
11. 09aef26844519771167c15da9e51be4bdf2a2ea0  ./ward2/PrintAuditBallots.xml
12. fa598f86512975723db06e9b9eeceaec92b746f9  ./ward2/PrintAuditMixnet.xml
13. d4564e745258d36a23975e2d5c8839649ab26ec4  ./ward2/ReplyToContestedCodes.xml
14. 5f65f44af911c0caa3e042d2d19f864351ce4923  ./ward2/SpoiledBallotsFromScanner.xml
15. a123007faac80ac9a06a74b6b9fb25f55aa417b9  ./ward2/SpoiledBallotsPid.xml
16. fa4742d5504672dfce6eb2750fd87400f3d32ec8  ./ward3/MeetingFourIn.xml
17. 9a97ebb615f815d1954b6944fc102ad0c49c8bb4  ./ward3/MeetingFourOut.xml
18. afd760d686397aebd0364c8f47da91dbfb44454b  ./ward3/PrintAuditBallots.xml
19. a8b4bee76bdd2a2523cdcc615173e55f744b3e41  ./ward3/PrintAuditMixnet.xml
20. e1c7a061d6abcba0e083e6e68bf40086e2408797  ./ward3/ReplyToContestedCodes.xml
21. be4f5a9c6ddf2f6e3f88795abaa61bd642623f73  ./ward3/SpoiledBallotsFromScanner.xml
22. 82134273bad243f1d2670df04773bf25203c4eeb  ./ward3/SpoiledBallotsPid.xml
23. cf2fca46ac1dfeb48af7f43f2b861f6e686c9c37  ./ward4/MeetingFourIn.xml
24. 0db5580a85566edacd6219943917f122e55a7b53  ./ward4/MeetingFourOut.xml
25. c951619d363aa5db19cf9ad795b40e5519f618cc  ./ward4/PrintAuditBallots.xml
26. c35eff3fb010a5e47ac12a874829f8b0763b2539  ./ward4/PrintAuditMixnet.xml
27. bec616d20e8af1e4cce8efbc5adf48d738147574  ./ward4/ReplyToContestedCodes.xml
28. c4a82715183e665cb106bbcc32b0091e5c20916f  ./ward4/SpoiledBallotsFromScanner.xml
29. 35c749ebe920a547a304159f560d086ad0c3b4ab  ./ward4/SpoiledBallotsPid.xml
30. 968472f25a4ca6c21d9e34d6956e81be0247021a  ./ward5/MeetingFourIn.xml
31. a9df28445efd5a3c7736c94b6036b99542f5d3cf  ./ward5/MeetingFourOut.xml
32. e8d099dfba457e27bcb2e9e53022caba2ec55e20  ./ward5/PrintAuditBallots.xml
33. 57bec2f3f79329a7ab4afc082dcbafd0eeb54541  ./ward5/PrintAuditMixnet.xml
34. 7ef4166284ce4cf131d26591d81102b436fbd244  ./ward5/ReplyToContestedCodes.xml
35. e5e24ad90beeadc3bb42a9f71847b58d5dd97c02  ./ward5/SpoiledBallotsFromScanner.xml
36. e5e24ad90beeadc3bb42a9f71847b58d5dd97c02  ./ward5/SpoiledBallotsPid.xml
37. 2697e021a1f763aa03d42f644e70540660b5cc6c  ./ward6/MeetingFourIn.xml
38. 9c31ff18113798e9d443565d691f5c1cefff5217  ./ward6/MeetingFourOut.xml
39. ae9a132a1e025d7fb5adc884e803ae77fd9e1d7f  ./ward6/PrintAuditBallots.xml
40. b9294c5249eba3e578107263c88b5adb80f9c8fb  ./ward6/PrintAuditMixnet.xml
41. 0b9ba0fd45070d084f88620443356a9f6cc4a947  ./ward6/ReplyToContestedCodes.xml
42. 197ad6baf83146e3afb22e910080d78646c0601b  ./ward6/SpoiledBallotsFromScanner.xml
43. 360ca86dced88a5fa5f52842240316ae10cc1d00  ./ward6/SpoiledBallotsPid.xml

TAKOMA PARK BOARD OF ELECTIONS

MOCK ELECTION

Saturday, April 11, 10 a.m. to 2:00 p.m., in the Community Center Azalea Room

(during the City’s Arbor Day Celebration)

Join the Takoma Park Board of Elections in testing the Scantegrity voting system on Saturday, April 11.  [Map it]

Who can vote in the Mock Election?

Anyone can vote. Voters in the mock election do not need to be registered voters, although Takoma Park registered voters are especially encouraged to test the system:

• City residents, family and friends
• Non-residents
• High school students
• Election advocates
• Anyone interested in testing the new voting system

How long will it take?

The Mock Election will be structured like a regular election. Voters will check in, receive a voter authority card, receive a ballot, mark the ballot, scan the ballot and deposit it in the ballot box. Participants in the mock election may stop in to vote any time between the hours of 10:00 a.m. (polls open) and 2:00 p.m. (polls close).

Just like a regular election, the time it takes to vote depends upon how many people are there. Since this is a mock election, we don’t expect long lines; it will probably take just a few minutes to cast a vote.

After casting their vote in the Mock Election, voters may leave or, if they wish, voters may stay a bit longer to fill out a questionnaire and chat about the system with members of the Scantegrity Voting System Group and members of the Takoma Park Board of Elections.

Light refreshments will be served throughout the day.

Source: Takoma Park City website.

The Arbor day mock election results are now available!

Thanks to everyone who came out to vote, and be sure to check your ballots!

From Gazette.net:

Ron Rivest discusses Scantegrity during the 2009 RSA Conference Cryptographers Panel (starting at 13:’30″):

I think voting is the core of our democracy, and it’s (also) a security problem–one of the hardest ones to solve because of voter privacy. There’s (actually) a novel coming out called Cassandra Chanting about the risks of voting, (written) by Anonymous–we don’t know who wrote it! (But) voting is making progress: cryptography is starting to become more used within voting. We had a wonderful mock election in Maryland–the board of elections in Takoma Park, Maryland had a mock election on Arbor Day where you could vote for your favorite tree. This is preparatory to running a real election in November with the Scantegrity system which has cryptography behind the scenes, but to the voter it looks very much like an optical scan system (but) with confirmation codes you get that you can look up on the web later to see that your vote counted. We’re trying to take the tools we’ve developed in cryptography–and the mindset–and integrate it into one of our most important democratic processes. And we’re making progress there.

I just got back from a test of Scantegrity for Maryland Day this year. If you’re interested, please go check the results! Special thanks to Dr. Paul Herrnson for providing the exposure and the space to make this possible!

Help us win a donation to build our optical scanners for the Takoma Park election.

Vote for our entry on the Ideablob website

The data was uploaded after the meeting yesterday. The Upload completed at 12:13am last night (according to the commits mailing list). Links to mirrors at GWU and Takoma Park will be posted as soon as they are available.

Here is a sha1sum for the files in the directory:

1. 560ee468d9dbde07b2a9bb0c2f2c8630b34312d9  ./PUBLIC/PUBLIC/get_latest_djia_stock_prices.py
2. a5258eac1018e827b132a25029f4e5146be2ef6a  ./PUBLIC/PUBLIC/post_election_audit.bat
3. a3e315e00a3e4c3d9a3a2cbcd34759da9f5c37f9  ./PUBLIC/PUBLIC/post_election_audit.py
4. 2268498e536c339d9b2aaefc0f2124a5fb33e55e  ./PUBLIC/PUBLIC/pre_election_audit.bat
5. d543c66ff076926f9d412ea96662c3735143465b  ./PUBLIC/PUBLIC/pre_election_audit.py
6. 3ebd1fa4ae4ffad0c2787b1f35d877767b349407  ./PUBLIC/PUBLIC/ward1/background.pdf
7. 80c6b04eb7ea35b90d5ffea6550c81a897a447f8  ./PUBLIC/PUBLIC/ward1/election.log
8. 26431928c2b279ab5ce3dd80121253e9248dd2f4  ./PUBLIC/PUBLIC/ward1/ElectionSpec.xml
9. 21670c785c9a167e52e91f350b7b7fe9671a56a3  ./PUBLIC/PUBLIC/ward1/geometry.xml
10. 482a9cfdd4175bea5e213aa06d46b428fa5624dc  ./PUBLIC/PUBLIC/ward1/MeetingOneIn.xml
11. 9667b274ca0eab76b6e3ebc125ac3aa81327e415  ./PUBLIC/PUBLIC/ward1/MeetingOneOut.xml
12. ad568b7a8981797be6826813d036e9aa447d1f69  ./PUBLIC/PUBLIC/ward1/partitions.xml
13. 0b5cb004df38138e5ba06555890cd5ea2044c2f6  ./PUBLIC/PUBLIC/ward1/pubkey
14. f5fee3d1cfc2a58e2110d54200b2f398b8f094f9  ./PUBLIC/PUBLIC/ward2/background.pdf
15. 767dd7af75841efb83496a672c5366338cff41b3  ./PUBLIC/PUBLIC/ward2/election.log
16. 26431928c2b279ab5ce3dd80121253e9248dd2f4  ./PUBLIC/PUBLIC/ward2/ElectionSpec.xml
17. 21670c785c9a167e52e91f350b7b7fe9671a56a3  ./PUBLIC/PUBLIC/ward2/geometry.xml
18. ff5cb5026951d4be848af66404fe9c26645ac03e  ./PUBLIC/PUBLIC/ward2/MeetingOneIn.xml
19. 3b17b932950b865dd2bd48cbbbd18ed947243f1c  ./PUBLIC/PUBLIC/ward2/MeetingOneOut.xml
20. ad568b7a8981797be6826813d036e9aa447d1f69  ./PUBLIC/PUBLIC/ward2/partitions.xml
21. 63bbc89729fe56a1fe1e03a84151d78e6bef3a96  ./PUBLIC/PUBLIC/ward3/background.pdf
22. 4d0acd99e40d26dd5dd5f91fd29ea9f5ad3d1fe4  ./PUBLIC/PUBLIC/ward3/election.log
23. 26431928c2b279ab5ce3dd80121253e9248dd2f4  ./PUBLIC/PUBLIC/ward3/ElectionSpec.xml
24. 21670c785c9a167e52e91f350b7b7fe9671a56a3  ./PUBLIC/PUBLIC/ward3/geometry.xml
25. cdd3e729b9df39182c354e3b4de0adfdf3fb65b1  ./PUBLIC/PUBLIC/ward3/MeetingOneIn.xml
26. 70f78f0267f6f17125d06edee525a6edd0f39f37  ./PUBLIC/PUBLIC/ward3/MeetingOneOut.xml
27. ad568b7a8981797be6826813d036e9aa447d1f69  ./PUBLIC/PUBLIC/ward3/partitions.xml
28. 773b2cce25d55df4b78d2d7f5936ddcddccbf0ed  ./PUBLIC/PUBLIC/ward4/background.pdf
29. 5f1e28af55edd26ff70028f0a28ab14cadc12dd5  ./PUBLIC/PUBLIC/ward4/election.log
30. 26431928c2b279ab5ce3dd80121253e9248dd2f4  ./PUBLIC/PUBLIC/ward4/ElectionSpec.xml
31. 21670c785c9a167e52e91f350b7b7fe9671a56a3  ./PUBLIC/PUBLIC/ward4/geometry.xml
32. 1983012f84f3705406935851757e036f74537ac7  ./PUBLIC/PUBLIC/ward4/MeetingOneIn.xml
33. 44679c49318ff3de066f349e411fef400dd527b3  ./PUBLIC/PUBLIC/ward4/MeetingOneOut.xml
34. ad568b7a8981797be6826813d036e9aa447d1f69  ./PUBLIC/PUBLIC/ward4/partitions.xml
35. f275395b9d5b22be75f19d0197c0ba989f9090b0  ./PUBLIC/PUBLIC/ward5/background.pdf
36. 68cfc18857396c2dd3b3bc8599f8e997b4388477  ./PUBLIC/PUBLIC/ward5/election.log
37. 26431928c2b279ab5ce3dd80121253e9248dd2f4  ./PUBLIC/PUBLIC/ward5/ElectionSpec.xml
38. 21670c785c9a167e52e91f350b7b7fe9671a56a3  ./PUBLIC/PUBLIC/ward5/geometry.xml
39. ab90f2a7c850d9f3a81e2ecd1bbb9da6169bd577  ./PUBLIC/PUBLIC/ward5/MeetingOneIn.xml
40. 1ca7973d8d8fcef65299cccab9aa14381772ff20  ./PUBLIC/PUBLIC/ward5/MeetingOneOut.xml
41. ad568b7a8981797be6826813d036e9aa447d1f69  ./PUBLIC/PUBLIC/ward5/partitions.xml
42. 9a50a5fefb10b90d8c344292932f5b5317bd13fc  ./PUBLIC/PUBLIC/ward6/background.pdf
43. 9504fbd2861189afa04ee4abf43f1a19f854f07e  ./PUBLIC/PUBLIC/ward6/election.log
44. 70f41bc40f0aa37d8500dab919230c7d25e90199  ./PUBLIC/PUBLIC/ward6/ElectionSpec.xml
45. 61323501a2acf2837e34e4d3464b9aea51aa1db1  ./PUBLIC/PUBLIC/ward6/geometry.xml
46. 0233180cb7547382ce7080a4bb1f50a6b129ff4e  ./PUBLIC/PUBLIC/ward6/MeetingOneIn.xml
47. b9ba5551ec679d5ede0e6014be958978f5a9b2c2  ./PUBLIC/PUBLIC/ward6/MeetingOneOut.xml
48. ad568b7a8981797be6826813d036e9aa447d1f69  ./PUBLIC/PUBLIC/ward6/partitions.xml

Ben Adida has an excellent post with his take on describing how the audit process works. I highly encourage readers to check it out.

Here are the sha1sums for the new files. They were added last night @ 8:19 according to the commits list.

1. bbb90bdd671222552968a3bc827def7ca2a12623  ./PUBLIC/PUBLIC/ward1/MeetingTwoIn.xml
2. 8def140117b0f2d3e3862036764f0c91b2e16e1a  ./PUBLIC/PUBLIC/ward1/MeetingTwoOut.xml
3. e4f174e593f6074fcaea4775dbef4b8e153598ca  ./PUBLIC/PUBLIC/ward1/MeetingTwoOutCommitments.xml
4. f1aaa1222ba5a451879ce1a8e9a6807cd4f2a07e  ./PUBLIC/PUBLIC/ward2/MeetingTwoIn.xml
5. 15670e64944007b8b672f761f9b268cd0a7c807b  ./PUBLIC/PUBLIC/ward2/MeetingTwoOut.xml
6. cb60de60802ec2989a40fe844264f0ab6f807ed8  ./PUBLIC/PUBLIC/ward2/MeetingTwoOutCommitments.xml
7. 52ac82dbaaca18457ba20e02034c2d7ca5a936ed  ./PUBLIC/PUBLIC/ward3/MeetingTwoIn.xml
8. 4d7be21a36e434ed42eaebcd7a80bbe1a8023a57  ./PUBLIC/PUBLIC/ward3/MeetingTwoOut.xml
9. bc2eb0fdd8b2f212d4af4f795865d2e94a5a0cde  ./PUBLIC/PUBLIC/ward3/MeetingTwoOutCommitments.xml
10. 45d59993b931b0570339e7c5a9f61dce811d8c1c  ./PUBLIC/PUBLIC/ward4/MeetingTwoIn.xml
11. 3bd294c002c50ab8f78a614cda2bd597fc2e9519  ./PUBLIC/PUBLIC/ward4/MeetingTwoOut.xml
12. b87f42562a7734f3f4bac4348ba83d66df9de236  ./PUBLIC/PUBLIC/ward4/MeetingTwoOutCommitments.xml
13. c848141539ed590158f48841cea2e79ff07c2d27  ./PUBLIC/PUBLIC/ward5/MeetingTwoIn.xml
14. f9c0012b2218aa8566516765fe318bf5222918e5  ./PUBLIC/PUBLIC/ward5/MeetingTwoOut.xml
15. 4d0c272dcc3bd0b21d1cb302e5d24722181b4bf3  ./PUBLIC/PUBLIC/ward5/MeetingTwoOutCommitments.xml
16. 5ff8cedb572d53031ceafa3cb1aebf5c278ec97a  ./PUBLIC/PUBLIC/ward6/MeetingTwoIn.xml
17. 0d7c3da02b6d0b6e79e99656f7c05abe400b93d1  ./PUBLIC/PUBLIC/ward6/MeetingTwoOut.xml
18. 568db7ba3a1756669771479928e8bb2c4fd11716  ./PUBLIC/PUBLIC/ward6/MeetingTwoOutCommitments.xml
19. d7e9d4bd64580025515c5acb9adfa057e48560b7  ./PUBLIC/PUBLIC/ward1/PrintCodes.xml
20. d7e9d4bd64580025515c5acb9adfa057e48560b7  ./PUBLIC/PUBLIC/ward2/PrintCodes.xml
21. d7e9d4bd64580025515c5acb9adfa057e48560b7  ./PUBLIC/PUBLIC/ward3/PrintCodes.xml
22. d7e9d4bd64580025515c5acb9adfa057e48560b7  ./PUBLIC/PUBLIC/ward4/PrintCodes.xml
23. d7e9d4bd64580025515c5acb9adfa057e48560b7  ./PUBLIC/PUBLIC/ward5/PrintCodes.xml
24. d7e9d4bd64580025515c5acb9adfa057e48560b7  ./PUBLIC/PUBLIC/ward6/PrintCodes.xml

Those following along with our blog have likely noticed that we have run two meetings for the Takoma Park election. Here is a quick recap of these meetings and a preview of the remaining meetings.

Meeting One (Election Setup). This was held Monday, October 12. The purpose of Meeting One is to establish a group of trustees for the election, and a minimum number of trustees need to conduct the rest of the meetings. Cryptographers will recognize this a threshold scheme. The trustees supply passphrases, which are used to generate all the cryptographic data needed to provide verification. Since this same data can be regenerated any time the same passphrases are supplied, we do not have to retain any secret data about the election in between meetings. To prevent the data from being changed, it is locked in time by posting a cryptographic commitment to it.

Meeting Two (Electronic Ballot Creation and Audit). This was held Wednesday, October 14. Once the data has been created and committed to, a universally-verifiable audit is performed to detect any problems with it. Any errors, faults, or fraud would be caught after the election regardless of this step; however this allows us to catch any problems before printing the ballots and running the election. To make sure the problems aren’t cleverly hidden, the data is first committed to so the locations of any problems can’t be changed (the first meeting) and then the data is checked at random locations (this meeting).

However, how do we choose the random locations? And furthermore, how can you at home be sure that they were truly random? Flipping a coin or rolling dice would give us random numbers but there is no way for you, the reader, to know we actually did that, instead of cleverly choosing the exact numbers needed to avoid exposing any problems with the data. To address this, we use stock market data to do the selection for us. Stocks are nice because they are accepted to have a degree of randomness, they are hard to manipulate on a large scale, and closing prices are available in most daily newspapers or readily online. The reason for holding Meeting One a day before Meeting Two is to ensure that the difficulty of getting away with cheating is on the order of predicting, to the cent, the exact closing price (and closing volume) of a large selection of stocks one day in advanced. The stock data is then run through a hash function, which assures that excellent predictions, even ones off by only a single value, are of no use (the same as a prediction that is completely wrong).

Meeting Three (Results Posting). This will be held Tuesday, November 3rd (the night of the election). The meeting will allow a tally to calculated and posted, as well as psoting the status of each ballot in the election (voted, provisionally voted, spoiled, or unused/audited for printing errors). For voted ballots, the confirmation codes will be posted online so voters can verify they match what they selected in the voting booth. Since codes are randomly assigned, knowing someone else’s code doesn’t allow you to determine how they voted.

Meeting Three-B (Provisional Ballots). If necessary, this will be held Wednesday, November 4rd. It will add to the tally the votes from any provisional ballots deemed acceptable.

Meeting Four (Final Audit). This is scheduled to be held Monday, November 9 (subject to change). The final audit will resolve any issues that voters raise about confirmation codes not matching what they wrote down. Once these are resolved, the election data committed to in the very first meeting will be again checked against the posted confirmation codes to make sure it is consistent with the final tally of the election. This check is much like the check done in meeting two, and requires random selections using stock data.

Want to read more? Ben Adida’s ongoing series on auditing the Scantegrity election is a good place for up-to-date information. The Scantegrity “Learn More” page has an introductory video, as well as links to academic papers published about the system. Finally, this paper provides an overview how stock prices can be used for random selections in elections. The idea of using stock prices for public randomness was proposed earlier in this RFC and this paper.

PRESS RELEASE

Breakthrough open-source election system used in official election lets voters audit tally online

Takoma Park, Maryland, November 3, 2009 — For the first time, a government election will allow voters to check that their private votes are correctly recorded and included in the final tally. Takoma Park, Maryland is running its bi-annual election for mayor and city council using a new system called Scantegrity. After casting their optically-scanned ballot at the polling place this Tuesday, voters will be able to check “confirmation codes” for their votes on the city’s website.

The codes are revealed, for each “oval” a voter fills on the ballot, by an “invisible ink” system akin to that used in children’s puzzle books. Voters may, if they wish, note the codes and the ballot serial number while in the booth. Because the codes are separately randomized for each oval and for each ballot, nothing about who a voter has voted for is revealed by the codes on the website.

The cost of the system is significantly lower than that of current systems since it is fully open source, the scanning setup uses commercial off-the-shelf scanners, and all printing is done with office printers.

The Scantegrity technology was developed by cryptographer David Chaum together with researchers from the University of Maryland Baltimore County, The George Washington University, MIT, the University of Ottawa and the University of Waterloo.  The group has run a number of elections for universities and other organizations and also successfully demonstrated the technology last April during a public mock election administered by Takoma Park’s Board of Elections.

Student members of the project won first prize in the National Science Foundation sponsored University Student Voting Competition in 2007, and the Scantegrity system has evolved from there. A broader research community has grown around proposals for such “voter-verifiable” election systems. The number of academic conferences on the subject has seen an increase ¾ from one every two years during the early part of the decade to two every year for the last few years. Also, the National Institute of Standards and Technology had a workshop on the theme in October this year.

Before the election, encrypted items of data are posted on the election website. Some will not be decrypted, but the individual keys needed to decrypt others will be posted after the tallies are declared. Keys are carefully chosen so as to protect ballot secrecy, and the unpredictability of the key selection is based on the impossible-to-predict closing prices and volumes of a set of high-tech stocks. This lets anyone verify a public audit, ensuring that the official election results are consistent with the published confirmation codes while protecting ballot secrecy.

“Something I find particularly exciting about the technology,” says David Chaum, “is that it is robust enough to be used anywhere in the world — scanners at polling places can speed posting of results, but actually a Scantegrity polling place needs only ballots, pens and a ballot box.”

“We learned a lot from working with the Board of Elections and the City Clerk of Takoma Park, who generously shared with us the wisdom obtained from running real elections,” says Prof. Poorvi L. Vora of The George Washington University. “It’s one thing to develop a voting system, it’s quite another to have one that can be used in a real election.”

“This represents a significant step in the evolution of election systems,” says Prof. Ron Rivest of MIT, “and though we’ve worked hard within the constraints of this volunteer project, it is only a first step for a whole range of promising new types of such systems.”

“The secret ballot and voter privacy are central to democratic elections. EPIC’s voting project encourages innovative election technology solutions like Scantegrity when they support voter privacy, while at the same time assuring election integrity,” said Lillie Coney, associate director of the Electronic privacy Information Center (EPIC). “This is one of many solutions being sought by dedicated computing professionals interested in preserving the independent secret ballot for all voters”, concluded Ms. Coney. EPIC is providing election audit services for the Takoma Park Election.

Turnout was higher than we had anticipated (but not more than what we had prepared for)! Results and code checking are available!

Congratulations to the Winners, and special thanks to Takoma Park!

Results files (signed) are uploading to the repository as we speak. The hashes are:

1. cd5fb63bedf65bf4c3c5ad4b72f78f7371bee075  ./PUBLIC/PUBLIC/ward1/MeetingThreeIn.xml
2. 4f198abed5a709f32f1a15e54d0c631f8838d786  ./PUBLIC/PUBLIC/ward1/MeetingThreeIn.xml.asc
3. c81dc2b32cd0f22f91270586bdf75017468f7e95  ./PUBLIC/PUBLIC/ward1/MeetingThreeIn.xml.asc.asc
4. e2ec47f4a453157d943a73ef994b5910bd848605  ./PUBLIC/PUBLIC/ward1/MeetingThreeOut.xml
5. 2b4df6b9fe6f7c6bbbe355373660e1702f7ac542  ./PUBLIC/PUBLIC/ward1/MeetingThreeOut.xml.asc
6. ceb86f0f9da03d01504edd4a2b3e1b12cce765c1  ./PUBLIC/PUBLIC/ward1/MeetingThreeOutCodes.xml
7. 182115227e502a987891973b68bdf3a06f90495b  ./PUBLIC/PUBLIC/ward1/MeetingThreeOutCodes.xml.asc
8. 3f68597f2f7f386e7fa8e2e84eedf96cdebd40f0  ./PUBLIC/PUBLIC/ward2/MeetingThreeIn.xml
9. c0c1c63bd1380c8d32084282fdd0804ad96b0853  ./PUBLIC/PUBLIC/ward2/MeetingThreeIn.xml.asc
10. 4fe4c7fd7e20e9baa1dee0e6b92e8e29a58336e0  ./PUBLIC/PUBLIC/ward2/MeetingThreeIn.xml.asc.asc
11. 481a07ad3c0b36ad398e642d21a78f4b30b90dda  ./PUBLIC/PUBLIC/ward2/MeetingThreeOut.xml
12. 5e210b518b34708bca6d9e52f0abd91a26ba44a2  ./PUBLIC/PUBLIC/ward2/MeetingThreeOut.xml.asc
13. ccb1aa5d53a144ccbad8e24f20fa69d4da408ca6  ./PUBLIC/PUBLIC/ward2/MeetingThreeOutCodes.xml
14. f521f975b02d0b6ffb4075025578ad8900e3fe0d  ./PUBLIC/PUBLIC/ward2/MeetingThreeOutCodes.xml.asc
15. ab9176cdb775a25709dead8120ededa8a06423f3  ./PUBLIC/PUBLIC/ward2/MeetingThreeOutCodes.xml.asc.asc
16. 4c224ee83498d3af224333e02a2a97b307c67381  ./PUBLIC/PUBLIC/ward3/MeetingThreeIn.xml
17. c606b52d97d6485aaf4993a1e206841b8afa9040  ./PUBLIC/PUBLIC/ward3/MeetingThreeIn.xml.asc
18. ca15f4639b093f348dd6fe907c6cf397895cdf3a  ./PUBLIC/PUBLIC/ward3/MeetingThreeOut.xml
19. e153fbd7bd3b2b20d02176471956fbfef1e69469  ./PUBLIC/PUBLIC/ward3/MeetingThreeOut.xml.asc
20. 5bc2ad387b7105a1c717fa1ed3771b315ee28bac  ./PUBLIC/PUBLIC/ward3/MeetingThreeOutCodes.xml
21. 5258f936958b298d336cd9b062fc1dabd1accbe7  ./PUBLIC/PUBLIC/ward3/MeetingThreeOutCodes.xml.asc
22. 5004a15643994d0b24f3f2407c987d44be748f16  ./PUBLIC/PUBLIC/ward3/MeetingThreeOutCodes.xml.asc.asc
23. c7982b3fb935e2d7c5ca5453208b6021a7b86c9f  ./PUBLIC/PUBLIC/ward4/MeetingThreeIn.xml
24. eb33dcbbe23d518e97d7a8a86e41dd7cb87a8090  ./PUBLIC/PUBLIC/ward4/MeetingThreeIn.xml.asc
25. 530ee591c426cf0a5a31530655813e879ce43847  ./PUBLIC/PUBLIC/ward4/MeetingThreeOut.xml
26. aedce657f55c1dd9f045ce4052f3ce4f01809243  ./PUBLIC/PUBLIC/ward4/MeetingThreeOut.xml.asc
27. 51a06c7e46a90b8eba8e9585b91ed697eb9095d2  ./PUBLIC/PUBLIC/ward4/MeetingThreeOutCodes.xml
28. 3acf2e648649b9280a0a7f9bb0a2efa47ff8de28  ./PUBLIC/PUBLIC/ward4/MeetingThreeOutCodes.xml.asc
29. 6b20429c70ff9c18f5a8a4689e70cd520b8ead70  ./PUBLIC/PUBLIC/ward5/MeetingThreeIn.xml
30. 7edc4a6b07329b32fae15fd2012b297ee8ad7698  ./PUBLIC/PUBLIC/ward5/MeetingThreeIn.xml.asc
31. a1a32f657e0978b65e0e902ed85bc231de68687d  ./PUBLIC/PUBLIC/ward5/MeetingThreeOut.xml
32. 55271060591e27bf1e1df72c4d95a10a8c47dc2c  ./PUBLIC/PUBLIC/ward5/MeetingThreeOut.xml.asc
33. 60dd5c407cac14f6b2d5cba1cc2579d0445cebe6  ./PUBLIC/PUBLIC/ward5/MeetingThreeOutCodes.xml
34. 621e2fda4d136c4dc414dbd4192c20ed94f3c6d2  ./PUBLIC/PUBLIC/ward5/MeetingThreeOutCodes.xml.asc
35. b5d4a41c6c40fcd3bf59abc9326c527265fac9ba  ./PUBLIC/PUBLIC/ward5/MeetingThreeOutCodes.xml.asc.asc
36. 73b856db516c76690407c9732cf4dfed75b7a5bf  ./PUBLIC/PUBLIC/ward6/MeetingThreeIn.xml
37. 59160aeb0bf349c2ecb79b2137be37aba6d75fbc  ./PUBLIC/PUBLIC/ward6/MeetingThreeIn.xml.asc
38. 98cf3922a1c9b7509c23e5d49ac8125c7a3b5174  ./PUBLIC/PUBLIC/ward6/MeetingThreeOut.xml
39. 3685d332de49995ccc2105610cbcf063140cd847  ./PUBLIC/PUBLIC/ward6/MeetingThreeOut.xml.asc
40. 09597c195561e88943cf6057afbeb666e23e2942  ./PUBLIC/PUBLIC/ward6/MeetingThreeOutCodes.xml
41. 61393cf3ee063783f6edeca9e432ff79c99e466c  ./PUBLIC/PUBLIC/ward6/MeetingThreeOutCodes.xml.asc
42. 4f73487574f8436acea6ebfc5938f16339c68628  ./PUBLIC/PUBLIC/ward1/election(2).log
43. 3530c14a08ff48178137a4145282214fb1e5bcf6  ./PUBLIC/PUBLIC/ward1/election(2).log.asc
44. 5c7af4ee15dde719240ed2f332ba41e29280d3ca  ./PUBLIC/PUBLIC/ward2/election(2).log
45. eaad9baad5ee665e831ed564a9e4aff3c4fc0c8f  ./PUBLIC/PUBLIC/ward2/election(2).log.asc
46. c544b9b7a109ca08f71ff9fd3081d7ebe0083fd5  ./PUBLIC/PUBLIC/ward3/election(2).log
47. c11a2f64241df411a8846e826dbccc6f30706928  ./PUBLIC/PUBLIC/ward3/election(2).log.asc
48. a543cd1aa09b6391b388dc32a3103da21bf2d077  ./PUBLIC/PUBLIC/ward4/election(2).log
49. 7982972247fee28917a0b9dd778d1d50ca60eecd  ./PUBLIC/PUBLIC/ward4/election(2).log.asc
50. 250a101ff482cb184b42c677bdb4a3b21438da87  ./PUBLIC/PUBLIC/ward5/election(2).log
51. 0ce308edfaf5c854a7d6c83a81fad981af702799  ./PUBLIC/PUBLIC/ward5/election(2).log.asc
52. 8e85924542de763628cd2a16bcb36fa2004dde0e  ./PUBLIC/PUBLIC/ward6/election(2).log
53. e3fed6c89a72364f7918e8dbf0a5e5a140e1b5a0  ./PUBLIC/PUBLIC/ward6/election(2).log.asc

Codes for provisional ballots that were judged valid and ballots that did not initially scan properly have been added to the website.

Setting up the optical scanners for the election in Takoma Park