ThreeBallot

From Wikipedia, the free encyclopedia

A sample ThreeBallot multi-ballot, with a first race for President with candidates Jones, Smith, and Wu and a second race for Senator with candidates Yip and Zinn.

ThreeBallot is a voting protocol invented by Ron Rivest. ThreeBallot is an end-to-end (E2E) auditable voting system that can in principle be implemented on paper. The goal in its design was to provide some of the benefits of a cryptographic voting system without using cryptography.

A vote cannot be both verifiable and anonymous. ThreeBallot attempts to solve this problem by giving each voter three ballots: one verifiable, and two anonymous. The voter chooses which ballot is verifiable and keeps this secret; since the vote-counter does not know, there is a 1/3 chance of being discovered destroying or altering any single ballot. The voter is forced to make two of his three ballots cancel each other out, so that he can only vote once.

This theoretical system's goals include:

Each voter's vote is secret, preventing vote-selling and coercion.
Each voter can verify that his vote was not discarded, and was correctly used and not altered, in the computation of the election result. (And if not, the voter is in a position to prove the vote counters cheated.)
Everybody can verify the election result was computed correctly.
Everybody can verify that extra fake "voters" were not added, and the full list of voters is publicly known.
The method is designed for use with paper ballots and requires primarily low-tech devices, but is compatible with more advanced technologies.

In the ThreeBallot Voting System voters are given three identical blank ballots. To vote for a candidate the voter must select that candidate on two of the three ballots. To vote against a candidate (the equivalent of leaving a ballot blank in other systems) the voter must select that candidate on exactly one ballot. No candidate can be left blank in the ThreeBallot Voting System, and no candidate can be selected on all three ballots — this must be enforced by a trusted authority, which might be some mechanical apparatus, to prevent multiple-vote fraud.

At the polling station, the voter makes a copy of any one of his three ballots. Then, all three original ballots are dropped into the ballot box. The voter keeps the one copy as a receipt.

At the end of the election, all ballots are published. Each ballot has a unique identifier. Each voter may verify that his votes were counted by searching for the identifier on his receipt amongst the published ballots. However, because the voter selects which of his ballots he receives as a receipt, he can arrange for his receipt to bear any combination of markings. Thus voters cannot prove to another party who they voted for, eliminating vote-selling, coercion, etc. Rivest discusses other benefits and flaws in his paper.^[1]

A field test has found ThreeBallot to have significant privacy, security and usability problems.^[2]