Keynote Speech: David Chaum - Volume 3

Summary form only given. Scantegrity II, an enhancement for optical scan voting systems, achieves a level of integrity unprecedented in scalable elections. It uses unique confirmation codes that are printed on ballots in invisible ink. Voters mark their ballots just as with conventional fill-in-the-oval, but a special pen makes the ink visible so that voters can note the confirmation codes if they wish. Verifiability of election integrity is complete: voters can check that their confirmation codes are correctly posted by looking them up online by ballot serial number; voters can check that codes correspond correctly to candidates by keeping a voided ballot; and anyone online can check that the tally is computed correctly from all posted codes by performing a simple computation. Even those running the election, and even if they had unlimited code breaking computational resources, would be detected if they tried to alter the outcome. Resistance to vote buying or coercion and the privacy provided are similar to that of the underlying optical scan system. Scantegrity II works with scanners located in polling places, as in some countries, or at central locations, as would be practical in most other countries. Vote-by-mail, provisional ballots, and voters with disabilities can be accommodated. It is implemented in Java, is open-source, and includes sample programs to verify the proof that the outcome is correct. The system has been tested in small elections using off-the-shelf printers and scanners. A municipal election is planned for November 2009. The novel techniques for in-person verification and unconditional transparent integrity will hopefully be applicable even beyond elections.