Of Paper Trails and Voter Receipts Alec Yasinsac* and Matt Bishop+ Abstract questions regarding the magnitude of these limitations. For The Internet pervades virtually every aspect of our these reasons, many voting integrity advocates encourage a daily lives, and it seems there is no area that is immune return to the familiarity of paper records to reestablish public from computing solutions. Computers can do things trust in the electoral process. Even in the absence of rigorous faster, with greater precision, more reliably, etc., etc., study of the security properties of paper records, momentum etc. Ironically, one area that most needs the mechanical builds to capture every vote on paper in some form. rigor offered by computing solutions seems destined to Proposed federal and state initiatives could mandate abandon electronic solutions and return to paper as the paper trails in all elections covered by their jurisdiction. In operating medium of choice. As electronic voting falls the U.S. Congress, HR 811, sponsored by New Jersey from favor across America, we are concerned to hear Democratic Congressman Rush Holt and introduced in the talk of paper receipts provided to voters1. Though the third consecutive session, recently moved from committee to department store receipt model is appealing in its the Congressional floor and could energize a companion bill simplicity, we posit that when this model is applied to in the Senate. voting systems, it introduces a complex combination of One stumbling block to widespread paper trail dangerously conflicting properties. We describe these acceptance is disagreement regarding the type of paper trail properties and offer an alternate framework to address that should be required. Subtle properties such as durability, paper receipt concerns. We then extend this notion into a reliability, lifetime, print clarity, simplicity, privacy discussion of paper records and their contribution to properties, and voter-friendliness have caused some paper forensics for election systems. trail advocates to oppose the otherwise popular Holt bill. These discussions are healthy and will ultimately result in 1. Introduction defining important properties for voting system paper At the end of the day, elections are about counting records that will effect voting system record keeping and votes. Since computers have always been particularly good audit policies and forensics opportunities that the paper at counting, it seems logical that computers offer great records enable. promise in improving vote count accuracy. The now- Another group of voting paper record properties face infamous “hanging chads” of the 2000 presidential election unfortunate misconception in this debate. Many voters, and and the 2002 “Help America Vote Act [1]” triggered a mass even election advocates, mistakenly utilize the term exodus of elections officials transitioning from paper ballot “receipts” when referring to voting system paper records. systems to computer-centric and computer-aided digital vote While some have proposed systems that may provide voter capture and count models. receipts [6, 7, 8], such systems are largely academic Fueled by public reports [2, 3, 4, 5, et al.] that electronic exercises and are not considered for wide spread use. voting machines are prone to malicious manipulation, public In this paper, we address misconceptions about voter discomfort levels are rising. This discomfort is founded in receipts and show that existing voting paper record systems the difficulty of gathering confirming digital evidence do not carry with them properties that are integral to available in Direct Recording Electronic (DRE) voting receipts. We further show how digital evidence and paper systems and in electronic voting systems overall. records can provide complementary parts in the voting Even as the field of digital forensics expands and new systems forensics process. We further show that they lack capabilities emerge at a breakneck pace, digital examination the properties essential for digital forensics information to is bounded by fundamental computing limitations. The reconstruct the events that occur on an electronic voting recent and rapid expansion of electronic voting leaves many system. * Florida State University. This work is funded in part by Department 2. Defining “Paper Receipt” of Defense grant H98230-06-1-0232 and Army Research Office It certainly seems like a simple concept: a receipt is a grant DAAD19-02-1-0235. printed record of a transaction, traditionally a transaction + University of California, Davis 1 e.g. http://www.wired.com/politics/security/news/2003/11/61298 where something is received (usually a payment) by the inherently simple and people are comfortable with them and party that provides the receipt (usually a vendor). When we consider them as near-perfect security items. Their comfort go to the grocery or department store and make a purchase, is reinforced with the pervasive receipt environment, where we are given a paper record of the financial transaction...it’s essentially every transaction is accompanied by a receipt. a receipt; what’s hard about that? If we can get a receipt This confidence is a fundamental element provided by when we buy a pair of shoes, why not when we cast a ballot, receipts. particularly since the vast majority of ballots are cast on, or In addition to providing transaction confidence, receipts into, computers that could easily print ballot receipts? also provide evidence that can be used to correct errors in 2.1. Paper Receipts and Voter Privacy the transaction that may be detected after the fact. It is not At face value, it seems reasonable to many that we uncommon to find an overcharge among items listed on a should simply print a copy of each voter’s paper ballot, and long receipt and to use the receipt to return to the store for a let them take it with them as receipt for their votes. The refund (or to find an undercharge and be faced with a canonical reason that a voting receipt cannot be given is that common moral dilemma: to pay it back or not to pay it the receipt may allow a voter to prove how they voted to back). some third party. Preventing such proofs protects against Perhaps the most common use of a paper receipt is to two related voting irregularities: vote selling and voter allow a valid purchase transaction to be reversed, possibly coercion. In the former, the theory is that if a voter cannot due to change of heart (or maybe when the buyer recognizes prove how they voted, there is no viable model for wide- that the color just doesn’t work for her after all). Few scale (or wholesale) vote selling. Conversely, if each voter vendors will provide a refund without the paper receipt. received a receipt complete with their name and their ballot In each of these cases, the paper receipt provides selections, an unscrupulous operative may simply offer to evidence of a transaction involving a buyer, a seller, the pay for receipts that reflect a pre-designated voting selection 2 specific merchandise that changes hands, and the transaction pattern . amount. Each of these items is essential to the transaction. Similarly, voter receipts can also facilitate vote Presentation of the corresponding paper receipt by the buyer coercion. If official receipts exist, a corrupt government to the seller along with the subject merchandise constitutes official, employer, or other miscreant may demand to see the verification of the transaction at the source. The receipts under threat of harm, job loss, or other coercive foundational notion is that the parties to the transaction are method. able to fully validate both the occurrence and the precise Traditionally, voting system developers have gone to nature and terms of the transaction. Thus, the adjustments great lengths to prevent any mechanism that allows voters to are enabled by the precise transaction record and prove how they voted, though the rapid expansion of vote- reconstruction of its primary elements. by-mail systems challenges this fundamental voting If we draw a parallel between the voting transaction and principle. Still, several scientists continue to propose receipt a purchase, the natural correlation is that the voter serves the mechanisms, largely based on cryptography, that allow buyer’s role, the supervisor of elections is the vendor, the voters to verify that their votes were properly cast, while not currency is the voter selections, and receipt is the ballot, facilitating voter coercion or vote selling [6, 7, 8]. paper trail, or other perpetual voter selection record. 2.2. Foundation for a Valid Receipt: Connecting a We point out that these two models diverge Person to a Transaction substantially here. In the purchaser/vendor model, the Receipts are ubiquitous in society today. With a rich vendor collects the information (and/or cash) that they need history in documenting cash financial transactions, paper at the point of sale in order to ensure payment, while the receipts are now used to record document payments of all purchaser retains the paper receipt. In the present voting types, including electronic credit and debit payments. While model, the elections official captures the voter selections at many institutions advocate a transition to electronic receipts, the point of sale (in the voting booth) and then the elections smart card entries, and other electronic acknowledgements, official also retains the paper receipt. paper receipts are still the dominate mechanism for 2.3. Paper Trails as Constrained Data Items documenting financial transactions. In any integrity-critical system (hereafter “critical From a standpoint of societal acceptance, paper receipt system”), there are sensitive documents and mechanisms ubiquity is a self-perpetuating situation. Paper receipts are that embody the vital protected-system aspects. In information integrity theory, these sensitive items are termed Constrained Data Items, or CDIs. 2 While the voting pattern itself could be used as a signature that unscrupulous elections workers could identify among collected ballots, There are many different types of sensitive information this attack requires insider cooperation and, comparatively, limits the in elections systems.