[E-voting] CEV submission -- non-technical draft

Dr J Pelan J.Pelan at gatsby.ucl.ac.uk
Mon Mar 15 16:10:26 GMT 2004

I don't want to be accused of causing fragmentation but I think my
stubborn penchant for the non-technical VVAT argument is well established.

Here is something along those lines in plain-text, hastily typed format.

John P.

Accuracy and the Nedap/Powervote System ?

This submission contends that the Nedap/Powervote electronic voting system
cannot be said to be accurate. By this, we mean that it is impossible to
verify whether the votes have been accurately recorded and counted by that
system. This is not a technical issue per se but is a result of two
fundamental weaknesses in the system - the lack of voter-verification and
the lack of a paper audit trail.  These issues are now discussed;

Weakness 1 - No Voter Verification means No Accuracy
In the course of a ballot, voters make decisions which are privately
recorded as votes. The essence of each vote is the *recording of it*
because it is the recordings which are subsequently counted and acted
upon. It is clearly vital then that each of these recordings is precise -
they must reflect the true selection of the voter. Therefore, it is
self-evident that only the voter, or equivalently their appointed proxy,
can verify that their particular vote has been recorded accurately. In
other words, a vote cannot be said to be accurate if the voter has only
been assured of this by an intermediary.

In a traditional paper ballot, the voter makes the recording themselves
and so the verification process takes place at the same time without an
intermediary. With the proposed electronic system, the voter cannot
directly verify that their vote has been accurately recorded - they are
merely assured by a device that the recording is correct. In other words,
an intermediate element has been introduced, the direct verification
process no longer takes place and the vote ceases to have any confirmed

It may be suggested that if this intermediary is always exact and
incorruptible then it is acceptable. However, the voter must then be
assured of this element's trustworthiness by someone and so the issue of
trusting the intermediate is replaced by a question of trusting the party
providing the assurances, and so on, ad infinitum. With the proposed
electronic system, the voter is forced to trust the accurate recording of
their vote with an intermediary. This cannot be legally or morally

Weakness 2 - No Paper Audit Trail means No Accuracy

When important systems are constructed, safe-guards are built-in so that
errors or problems that may arise do not have serious consequences. In the
financial world, for example, the records of transactions are subjected to
external audits to verify that the checks and balances are in place and
working correctly. This does not mean that these systems are assumed to be
corrupt or faulty but merely that the possibility of failure is recognised
and the chances of detection are increased by an independent examination.

The voting process is no less important and it should be possible to audit
the entire process to verify that it is working correctly. The traditional
paper ballot permits recounts and examination by multiple, independent
people. The proposed electronic system cannot be audited in this way as
there is no external mechanism for detecting all failures that may occur
within the system. It may well be error-free but in the absence of a paper
audit trail to prove it one cannot legitimately say that is accurate.

(Trademarks are acknowledged etc.)

More information about the E-voting mailing list