Reconciling Post-Election Auditing with the Secret Ballot

在电子投票中，透明度和隐私之间存在着根本性的紧张关系。选举透明度要求获得初选选民的记录，因此观察员可以确保选举运行得当。选票隐私——将选票内容与可以识别选民身份的信息分开——是防止胁迫和出售选票所必需的。如果我们放弃透明度或隐私，投票就会变得简单得多：没有透明度，投票可以完全保密；由于没有隐私要求，选举可以完全透明。该项目旨在协调电子投票系统中的透明度和选票隐私。该项目有几个目标。该项目正在确定增加隐私的法律和技术障碍，包括基本限制和技术限制。该项目还查明了运动为提高选举透明度所带来的脆弱性，例如使用选民标记和指纹识别选票的实际风险。这使得研究人员能够设计出保护隐私的方法来发布透明的工件，例如扫描的选票图像。该项目正在审查各种选举后审计模式所固有的选票隐私丧失问题，目前的趋势是更多地披露记录，这可能涉及选票隐私问题。该项目正在创建选举后审计过程模型，以识别和比较选票隐私泄露，并开发方法以更好地确定在审计批次中真正有多少选票，这是选举后审计中一个至关重要但被忽视的数学元素。

A fundamental tension exists between transparency and privacy in electronic voting. Electoral transparency requires access to primary voter records, so observers can be sure that the election was run appropriately. Ballot privacy---keeping ballot contents separate from information that can identify the voter---is required to prevent coercion and vote-selling. If we discard either transparency or privacy, voting becomes much simpler: without transparency, ballots can be perfectly private; with no privacy requirement, elections can be perfectly transparent. The project aims to reconcile transparency with ballot privacy in electronic voting systems.The project has several goals. The project is identifying legal and technical barriers to increased privacy, both in terms of fundamental limits and limits imposed by technology. The project is also identifying vulnerabilities enabled by the movement for increased electoral transparency, for example the practical risks of identifying ballots using voter marks and paper-fingerprinting. This enables research to design privacy-preserving methods for publishing artifacts of transparency, such as scanned ballot images. The project is examining the loss of ballot privacy intrinsic to various models of post-election audits, where the trend has been toward greater disclosure of records, which may implicate issues of ballot privacy. The project is creating process models of post-election audits to identify and compare ballot privacy leakage and developing methods to better determine how many ballots are truly in an audit batch, a crucial but overlooked element of the mathematics in post-election audits.