Scantegrity III: Automatic Trustworthy Receipts, Highlighting Over/Under Votes, and Full Voter Verifiability

No Thumbnail Available

Links to Files

https://cisa.umbc.edu/files/2017/09/ShermanEVTWOTE2011.pdf

Permanent Link

http://hdl.handle.net/11603/12822

Collections

UMBC Center for Information Security and Assurance (CISA)
UMBC Computer Science and Electrical Engineering Department
UMBC Faculty Collection

Author/Creator

Author/Creator ORCID

Date

2017

Type of Work

conference papers and proceedings
Text

Department

Program

Citation of Original Publication

Rights

This item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.

Subjects

applied cryptography
End-to-End (E2E) election systems
print audit
punchscan and scantegrity voting systems
receipt printers
security engineering
trusted platform module (TPM)
trustworthy computing

Abstract

Building on lessons learned from the November 2009 Scantegrity II election in Takoma Park, MD, we propose improvements to the Scantegrity II voting system that (1) automatically print trustworthy receipts for easier on-line verification, (2) highlight ballot features including over/under votes to comply with the Help America Vote Act, and (3) achieve full voter verifiability by eliminating print audits. We call the improved voting system Scantegrity III, which features a new ballot style and a special casting station that highlights ballots and prints receipts. Scantegrity III addresses the major limitations of Scantegrity II and delivers the feature most requested by voters and election officials at the Takoma Park election: printing receipts automatically. We present, analyze, and compare three designs for a Scantegrity receipt printer: a simple image duplicator available to voters in an optional separate station before casting; a mark sense translator, connected to the official ballot scanner, which reads encrypted codenumbers printed on the ballot; and the Scantegrity III casting station, which is an embellished mark sense translator. At the Scantegrity III station, voters cast ballots that include both Scantegrity II codes in invisible ink and Scantegrity I codes in conventional ink; this combination of codes enables print audits to be eliminated. We also design a Trusted Platform Module (TPM) enhancement to bolster privacy, to store keys and verification codes, and to ensure that the correct software is booted. Election integrity does not depend on the correct operation of the TPM. Receipt printers reduce the amount of special voter instruction required, improve accessibility, enable each voter to detect if any additional mark is added to her ballot after casting, and make vote verification easier.