Punchscan in Practice: An E2E Election Case Study Aleks Essex Jeremy Clark Rick Carback Stefan Popoveniuc School of Information School of Information Dept. CS Dept. CS Technology and Engineering Technology and Engineering University of Maryland George Washington University University of Ottawa University of Ottawa Baltimore County Washington, D.C., 11022 Ottawa, Ontario, K1N 6N5 Ottawa, Ontario, K1N 6N5 Baltimore, Maryland, 11022 [email protected] [email protected] [email protected] [email protected] Abstract— This paper presents a case study of the E2E voting • The voter has the option to check that his or her ballot system Punchscan and its first use in a binding election. The selections were included in the election count, e.g., by election was held in March 2007 at the University of Ottawa for checking a web site of values that should match the several offices within the university’s graduate student associa- tion. This case study presents a walkthrough of the election and information on the voter’s paper receipt. offers discussion as to how the voters and poll workers responded • Such a system may provide an assurance not only that to the Punchscan system, with implications to E2E systems in their ballot choices were correctly recorded (cast-as- general. intended), but that those selections were included in the election count (counted-as-cast). I. INTRODUCTION The University of Ottawa’s Graduate Students’ Association A. Punchscan in the scope of E2E / Association des etudiant(e)s´ diplomˆ e(e)s´ (GSAED)´ voted The EAC found that the range of proposed E2E systems unanimously to adopt the Punchscan [6][3] voting system for have points of commonality, and they attempted to summarize their 2007 executive election. Among the reasons they cited these in a list of properties. Here we present some of them for their decision was the desire to speed up the tally process, and briefly explain how Punchscan does or does not exhibit increase the integrity of election results, provide a means their properties. Note that this is not a list of requirements to identify double-voting, and, at an academic level, play a for a system to be classified as E2E but rather a preliminary leading role in voting systems research. sketch of the typical of properties of these systems. The GSAED’s´ chief returning officer (CRO) in conjunction with the Punchscan team proceeded to conduct one of the first Property 1. Voters’ ballot selections are encrypted for later end-to-end cryptographic (E2E) votes in a binding election. counting by designated trustees. This paper presents the details and findings of this event A Punchscan ballot consists of two pages. The top page and is organized as follows; Section 2 defines the notion contains a list of contests and candidates with set of randomly of an E2E election, the criteria that make a voting system ordered symbols beside the candidate names. There are E2E, and briefly explains how the Punchscan voting system holes in the top sheet that display a corresponding (but satisfies these criteria. Sections 3-6 will chronicle the steps independently and randomly ordered) set of symbols. To taken leading up to, during, and after the election. In Section 7, vote on a Punchscan ballot, the voter observes the symbol we present our findings and discuss the reactions of voters and appearing beside their chosen candidate’s name, and locates pollworkers to Punchscan. In Section 8, we offer concluding the matching symbol in the holes. The voter then marks that remarks with proposals for future directions in research. hole with an implement such as a bingo-style dauber. The implement is sized slightly larger than the hole such that the II. E2E: END-TO-END CRYPTOGRAPHIC INDEPENDENT ink mark will be made on both sheets. One of these sheets is VERIFICATION VOTING SYSTEMS destroyed in a cross-cut paper shredder. The remaining sheet In 2005, the American Election Assistance Commission represents the voter’s receipt and is now “encrypted.” 1 Only (EAC) released a set of voluntary voting system guidelines the threshold number of trustees (aka the election authority) [1] that includes a description of what they refer to as “End to have the ability to reconstruct the information contained on End Cryptographic Independent Verification” (E2E) systems. the destroyed sheet. According to the EAC, typical distinguishing features of an E2E voting system are as follows: Property 2. Voting will produce a receipt that would enable • A paper receipt is issued to the voter that contains the voter to verify that their ballot selections were recorded information that permits the voter to verify that their correctly and counted in the election. choices were recorded correctly. The information does 1Since both sheets contain random but independent orderings of the not permit the voter to reveal his or her selections to a symbols, possessing only one of the sheets does not give you information third party. about the corresponding symbol on the other sheet. Punchscan uses a robust audit procedure, including a process other documentation available from the Punchscan website 2. by which a voter can visit the election website and look up their ballot using the serial number contained on their receipt Property 8. Vote capture stations used in end to end systems and verify what they hold in their hand matches what was must meet all the security, usability, and accessibility require- recorded by election authority. ments. The security of the vote capture station in a Punchscan Property 3. The receipt preserves voter privacy by not election is similar to that of a paper ballot voting station. containing any information that can be used to show the Two additional security measures are taken: one is to lock voters selections. the ballot to a clipboard and the second is to ensure a high- Because one of the sheets is shredded, and assuming that the integrity paper shredder. The purpose of this case study, in ordering of symbols contained on that page were uniformly part, is to examine the usability of Punchscan and will be random and independent from the page that was retained (aka discussed further in later sections. the receipt), then no information about the destroyed sheet is Property 9. Reliability, usability, and accessibility contained on the retained sheet, and therefore the vote cannot requirements for printers in other voting systems apply be guessed with any advantage. as well to receipt printers used in end to end systems. Punchscan can be easily implemented with inexpensive off-the-shelf equipment. As will be examined further in this Property 4. No one designated trustee is able to decrypt the case study, reliability and usability issues emerged. However records; decryption of the records is performed by a process Punchscan is largely hardware independent and could be that involves multiple designated trustees. adapted to use proprietary voting-dedicated equipment. Punchscan employs a threshold based password scheme whereby a pre-designated number of trustees must correctly Property 10. Systems for verifying that voter ballot selections enter their passwords before the records can be reconstructed. were recorded properly and counted are implemented in a robust secure manner. Property 5. End to end systems store backup records of voter Punchscan allows the voter to verify the proper scanning of ballot selections that can be used in contingencies such as their ballot at the polling station before it is cast, in addition damage or loss of its counted records. to their ability to check the receipt online. The security Punchscan in its original form relies on voter receipts of the Punchscan tallying process is dependent on well- to reconstruct an election should the counted records be studied cryptographic primitives [6] and no implementation destroyed. However, as will be discussed in the next section, vulnerabilities have been discovered to date. the implementation of Punchscan used in this case study expanded the originally proposed system to include a paper- III. ELECTION REQUIREMENTS based backup of the ballot receipts. In consultation with GSAED,´ several requirements for this election were arrived upon. GSAED´ required there to be five Property 6. The backup records contain unique identifiers polling stations located on the University of Ottawa campus, that correspond to unique identifiers in its counted records, which were to be operated during normal business hours across and the backup records are digitally signed so that they can a three day period. Two poll workers were to be present be verified for their authenticity and integrity in audits. at all times. Being a fully bilingual university, the ballot The backup ballot receipts used in this election contained was required to be worded in both English and French, and a serial number which matched the serial number of the it was decided that this would be accomplished through a ballot. While the ballot receipts themselves were digitally single bilingual ballot, as opposed to separate ballots for each signed, the paper backups were not as it was agreed that the language. The offices, candidate names, as well as French backup records were very unlikely to be needed. Should they translations were provided by GSAED.´ have been used, they would have been published and thus In addition to these basic requirements, it was agreed that their integrity would be ensured through voter verification. several other additions over the basic Punchscan system would In future elections, consideration will be given to digitally be implemented to provide greater security and robustness. signing the backups as well as the receipts. They are as follows: Property 7. The documentation includes extensive discussion A. Ballot Receipt Digital Signatures of how cryptographic keys are to be generated, distributed, An E2E ballot receipt allows a voter to verify their vote managed, used, certified, and destroyed.