The voting booth

The first steps consist in going into a voting booth with voting material. The booth is designed such that any one can count the number of people inside (usually by leaving part of the legs visible). The voter brings all the voting material inside the booth. When there is no one inside, anyone can inspect the booth. This ensure the voter can select its ballot alone, without any external pressure. I hardly see how this can be done with online voting.

The ballot envelope

Once the ballot is put in its envelope, the secrecy of the vote is ensure by the opacity of the envelope. The integrity of the vote is guaranteed by the properties of the paper and the ink used for the ballot.

Here is a point a failure. Although anyone should be familiar with paper, envelope and ink and thus easily trust this old school technology, it is easy to imagine envelope whose opacity vary over time or a combination of invisible ink that appears over time and other ink that disappear over time. A ballot whose printing change between the voting booth and unpacking is imaginable.

Envelopes are all identical so that it is hard to distinguish votes from each other, and thus trace back an envelope to a voter.

The ballot box

The ballot box is locked with multiple keys (usually two). Each key is held by an assessor. There are usually two assessors. Opening the box require both assessor to agree.

Once the voting period is open, the box is visible to anyone. Anyone can then see the box, anytime during the whole voting period. At least two assessors have a constant view over the box. Thus it is hard to recover a specific envelope from inside the box (whatever the goal).

The ballot box is transparent. This way, the voter can see its envelope falling into the box. Moreover, anyone can see (any time during the whole voting period) the voting box filing level. This make it hard to add, modify or remove envelopes that have been put in the ballot box.

The best way to check the filing of the voting box for electronic method is to display publicly the number of votes in live.

The box opening

The box is open publicly. To be open, the two assessor must agree. This ensure no single person can corrupt the content of the box while opening it.

Envelopes are put on large table at once. This process (kind of) shuffle the envelopes. Envelopes are then grouped by piles, each pile containing a specific number of envelopes (e.g. 100). It is hard to predict in which pile a specific envelope will be located, making harder the possibility to trace back a vote to a voter.

For electronic methods, this shuffle can be done but requires no one can access the partial ballot results (even in case of reboot – which requires some persistent storage –, even remotely). I let the reader imagine what happen if someone has access to partial results (in the extreme case, just before and just after a vote, for example at startup and just after the first vote of the day)

Envelopes are opened one by one, read and counted by at least two different persons. If there is not anomaly detected, the result of the box it forwarded to higher level.

For electronic voting methods, the step is quite faster but trust must be given to at least:

• people writing the software (avoidable with open source software)
• people checking the code (requires skills only few people have)
• people deploying the software (the software running must be the one foreseen)
• the hardware (bugs can be caused by unforseenable hardware problems)