Possible setup for a direct democracy voting system to prevent fraud

Question

My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders.

Some requirements as of now:

• Citizen individual votes shall remain private.
• The system must not be corrupted by (those?) running the system.
• Vote results must not be changed by the system.

Open source code is an obvious part-solution, but how would you ensure that the correct code is used on the production live voting server?

Answer 1

It sounds like you may be asking about in person or online voting, so I will provide some info in both areas.

General

I would read the research from past conferences such as USNIX EVT/WOTE. DefCon had a voting village, this may be another source for research. People often present on voting security at different IEEE conferences as well.

You need to think about not only the software and systems, but also policies and procedures. For example, if the system is secure but there is no process to ensure all votes are collected from offline machines there could be fraud.

From a holistic perspective, you also need to make people trust the system or they may opt-out. If there is a lot of negative publicity that may reduce turnout.

With a physical digital voting system you would also want some type of physical tally print out, punch out that would ensure the total number of votes match those entered in the machine and observed by the observer.

Anonymity is difficult in any online system.

Online

Estonia is well known for its online voting and e-Citizenry in general. You may want to review some of the things that they do and also some criticism:

• Independent Report on E-voting in Estonia: "There were staggering gaps in procedural and operational security, and the architecture of the system leaves it open to cyberattacks from foreign powers, such as Russia. These attacks could alter votes or leave election outcomes in dispute. We have confirmed these attacks in our lab — they are real threats."
• Forbes: How Estonia's E-Voting System Could Be The Future
• The New Yorker: Estonia the Digital Republic
• Wikipedia: Electronic Voting in Estonia

Blockchain

• Follow My Vote: "By casting votes as transactions, we can create a blockchain which keeps track of the tallies of the votes. This way, everyone can agree on the final count because they can count the votes themselves, and because of the blockchain audit trail, they can verify that no votes were changed or removed, and no illegitimate votes were added."
• Kaspersky Polys: ccording to Kaspersky Lab, a robust voting system should ensure voter anonymity, provide protection against trash votes, vote trafficking and voter coercion, and enable voters to check that their votes have been recorded in the blockchain. It’s also important to encrypt the voting results recorded in the blockchain, otherwise intermediate results could become available before voting ends, which is often against the law.

Answer 2

In a perfect way you can't. There is always a group of people that could conspire to rig the system. It isn't feasible to allow every member of the public the opportunity to manually vet and observe each step.

So what you do is form a group made up of representatives from each party. In this way you know the group are extremely unlikely to rig anything because they would be unable to decide on a result to rig it to.

Another feature which can aid is to pubish a full vote log in a way where each voter can verify their own vote is shown correctly. This can be done either by assigning each voter a unique private ID or using cryptographic signatures and assigning each user a private key. The downside of this is voter manipulation (I can threaten you to vote a certain way. In a paper/booth voting system you can vote differently and lie to me) - but with an online system someone can just stand over your shoulder and watch you vote anyway.