Home | deutsch  | Legals | Data Protection | Sitemap | KIT
Contact

KIT Campus Süd
Kollegiengebäude am Kronenplatz (Bld. 05.20)
Kaiserstr. 89
76133 Karlsruhe

   

Newsletter subscription
YouTube subscription

SECUSO Events
Tuesday, 01 Oct 2019
E-Vote-ID 2019
Sunday, 03 Nov 2019
Dagstuhl Seminar: Biggest Failures in Security

Further Events ...
Externe Veranstaltungen
Sunday, 11 Aug 2019
SOUPS 2019
Monday, 26 Aug 2019
ARES 2019
Monday, 02 Sep 2019
INTERACT 2019

Further Events ...

KASTEL

Karlsruher IT-Sicherheitsinitiative

EasyVote (Polling Station-Based Voting)

EasyVote is the concept of an hybrid (electronic/paper) voting system that has been developed within the project "Constitutional Compliant Electronic Voting" (Verfassungskonforme Umsetzung von elektronischen Wahlen ) which is funded by the "DFG - Deutsche Forschungsgemeinschaft". 

Motivation

Elections vary greatly from country to country, but also within each country for different types of elections. Some have very simple ballots with two candidates or just a yes or no question, while other ballots like for local elections in Germany contain more than 500 candidates, allow for more than 70 votes and the system also allows voters to perform cumulative voting, vote splitting and crossing out of candidates which results in huge ballot papers (in Darmstadt in 2006 local elections about 27” x 35”), refer to Figure 1. Manually tallying is very likely to be error prone and time intensive, refer to Figure 2. The tallying for the local elections in Germany usually takes between four to six days. They have computer support for the counting and tallying where they enter vote by vote, refer to Figure 3. Also vote casting is error prone as voters might accidently and without realizing spoil the vote. To improve the current situation the EasyVote concept has been proposed by Volkamer et. al., also refer to [1]. This concept mainly addresses challenges in elections with complicated paper ballots, but it is applicable to any type of election. EasyVote has been developed using the human-centered security by design approach, involving voters and poll workers online as potential end-users of the system throughout the whole development process via a variety of user studies. So far, EasyVote is also the only concept of an electronic voting system that has been analyzed with respect to, and shown to comply with, the German legal requirements for use of electronic voting in the local elections of the state of Hesse, see [3]. Furthermore, a feasibility analysis of various electronic voting systems for complex elections, refer to [7], showed that EasyVote seems to seems to be most the promising and adequate for complex elections with respect to the principle of secret and public nature of elections.

Figure 1: Original ballot used in the local elections of 2006 in Hesse

 

Figure 2: Manually tallying phase for local elections in Hesse

 

Figure 3: Electronic tallying phase for local elections in Hesse

 

Concept Description

Figure 4: Vote Casting Process

 

In the Vote Casting Process, which is animated in the video below and presented in Figure 4, the voter first identifies to the poll workers, similar to traditional paper-based elections. Afterwards, the voter enters the voting booth and uses the electronic voting device to prepare the ballot by selecting candidates. When the voter confirms the selected candidates, the electronic voting device starts the printing process and at the same time deletes all electronic data (voter's selections). At this point in time data are deleted from the vote casting software, i.e. on the software level.

The printout which contains the selections of the voter consists of two parts: a human-readable and a machine-readable (QR-Code) part. Thereby, the QR-Code contains the exact information as the human-readable part, and it serves and enables an automatic tallying of printouts. The voter verifies that the human-readable part contains the candidates selected on the electronic voting device. Finally, the voter folds the printout, leaves the voting booth and deposits the printout into the ballot box.

Figure 5: Tallying Process

 

In the Tallying Process, which is presented in Figure 5 poll workers first open the sealed ballot box, and verify that the number of paper ballots (printouts) matches the number of voters. Note that similar to the paper-based system the four-eyes principle is deployed. 
Afterwards, the poll workers start counting, by scanning each single paper ballot. Thus, they scan the QR-Code and verify that its content, shown on a monitor, matches the human-readable part of the paper ballot. The scanned ballot is added to the intermediate result, shown on a second monitor, when the poll workers have verified and confirmed its content.

Interfaces

Vote Casting Software Interfaces. The components of the vote casting software interface are described in Figure 7. Further examples which represent all different views within the vote casting software are displayed below in Figure 8, 9, 10, 11, 12, 13, 14 and 15.

Figure 7: The components of the vote casting software interface

 

Figure 8: Welcome Interfaces

 

Figure 9: Voting Interface

 

Figure 10: Displaying candidates of the "CDU" party

 

Figure 11: Casting Vote to a specific Candidate

 

Figure 12: Actual Selections

 

Figure 13: Searching for Candidate by Name

 

Figure 14: Preview of the Ballot

 

Figure 15: Ballot is being printed

 

Tallying Software Interfaces. The components of the taylling software interface are described in Figure 16 and 17, while Figure 16 represents the current scanned ballot (Monitor 1) and Figure 17the intermediate result (Monitor 2). Further examples which represent most important different views within the tallying software are displayed below in Figure 18, 19, 20 and 21.

Figure 16: Components of the interfaces on Monitor 1

 

Components of the interfaces on Monitor 2

 

Figure 18: Poll workers logging in

 

Figure 19: Scanning ballot

 

Figure 20: Scanned ballot

 

Figure 21: Editing ballot

 

EasyVote Ballot


The components of the EasyVote ballot are described in Figure 22. The EasyVote ballot is printed in a Din A4 paper ballot. Figure 23, 24 and 25 provide further examples of EasyVote ballots.  A larger image is shown by clicking on it.

Figure 22: EasyVote Ballot (Din A4)

 

Figure 23:Party header selected "Grüne"

 

Figure 24:Cumulating, splitting votes and crossing out candidates

 

Figure 25:Invalid vote by selection option "invalid"

 

Proof of Concept

Proof of concept alongside universtiy's elections in June 2013 at Technische Universtität Darmstadt. The goal of this case study was to evaluate the technical approaches used for implementing a prototype based on EasyVote. The focus of the study was to evaluate the voting phase, while an implementation and evaluation of the tallying phase is left for future work. In order to cover as many participant as possible we designed a simple test election. In this test election participants voted by expressing their satisfaction regarding their supervisor. For the rating we used a Likert scale of five steps (always satised - mostly satised - sometimes yes sometimes no - rarely satisfied - never satised). Furthermore, we developed protocols for the election board (e.g. Create a LiveCD with the Vote Casting Software) and for poll workers (e.g. Election's Begin, Devices and Materials, Election's End, Electoral Register, Filling Printouts and Changing Cartridges, Complaint). Figure 26 and 27 show the setting used in the user study. Figure 28, 29, 30 and 31 show the adapted interfaces for the test election.
The results of the study are presented in [4]. 

Figure 26: Inside the voting booth

 

Figure 27: Poll workers' area

 

Figure 28: Welcome

 

Figure 29: Options

 

Figure 30: Preview

 

Figure 31: Finish

 

User Studies

The user studies regarding the EasyVote concept  are divided into two categories; those investigating the "Vote Casting Process" and those investigating the "Tallying Process".

Vote Casting Software:
  • Developing and finding the adequate time and location for providing voters with instructions to verify the content of the EasyVote printed ballot (VV-PAT). The goal of this study is to motivate voters to verify the content of the printed ballot, in order to ensure ballot integrity. As in EasyVote the printed ballots are tallied, verifying the content has an impact on the final election result. The results of our study show that with the instruction we developed and integrated, the number of voters verifying the content of printed ballots (VV-PATs) increased highly significant. Figure 32 presents the developed instructions, while Figure 33 presents the time and place where instructions have been integrated.

The results of the study are presented in [5].

Figure 32: Instructions for verification

 

Figure 33: Instructions on the front side of the ballot (printout)

 

Voters' concern with respect to vote secrecy when using QR-Codes. Based on a previous study voters have concern reagarding vote secrecy when Paper Audit Trails (PATs / ballots) containing information other than the plaintext vote are used. Motivated by this previous study and fact that the EasyVote ballot contains the QR-Code we conducted a user study with three approaches. In the first approach (Proof of Concept) participants were not given any instructions about the ballot containing the QR-Code. In the second approach by using an online questionnaire voters were presented with a technical solution to ensure vote secrecy when QR-Codes are used. Finally, in the third approach, similar to the second, participants were presented with the effort for an attacker to succeed violating vote secrecy. The goal of this study is to analyse if voters have concerns regarding their secrecy of the vote when QR-Codes are used to encode the cast vote. The results of this study showed that some voters voters, independent of the approach we used, are concerned with respect to vote secrecy when QR-Codes are printed on the ballots. In general, these studies show that there is little research on analyzing privacy concerns of PATs even though all electronic voting systems provide them (although in different ways). In particular, more research is needed to better understand voters’ mental models regarding privacy concerns and provide an adequate solution that would fit their models.
The results of the study are presented in [6].

Tallying Software:
  • Efficiency and accuracy comparison of traditional v.s. EasyVote tallying for local elections in Hesse. The goal of this study is to show that tallying with EasyVote is more efficient and accurate than the traditional tallying for local elections in Hesse. The result of our study show that tallying with EasyVote is more efficient and accurate in comparison to the traditional tallying. "a < b" defines that case "a" is faster and more accurate than "b", while "a ≤ b" defines that "a" is approx. as fast and accurate as "b". This is an abstract overview of the study results: "Tallying all ballots (EasyVote ballots) with EasyVote ≤ Tallying only changed ballots (EasyVote ballots) with EasyVote < Tallying only changed ballots (EasyVote ballots) with PC-Wahl < Tallying only changed ballots (original local election ballots) with PC-Wahl." PC-Wahl is an electronic tallying systems, where changed ballots (ballots where voters has cast votes to at least on candidate directly) are entered and recorded in the PC-Wahl, as cast on paper by voters. For this study we developed corresponding training and education material for poll workers, which is based on the orignal material used by the electoral board in the city of Darmstadt. Poll workers were trained one day before the tallying for about 30 mins. The tallying itself took place the next day after training. 
    The results of this study will be submitted to conference and are currently under review. Figure 34 and 35 present pictures taken during the tallying with the implemented EasyVote prototype.
Figure 34: EasyVote tallying phase 1

 

Figure 35: EasyVote tallying phase 2

 

Publications

Vote casting device with VV-SV-PAT for elections with complicated ballot papers External Link.
Volkamer, M.; Budurushi, J.; Demirel, D.
2011. International Workshop on Requirements Engineering for Electronic Voting Systems (REVOTE 2011) : Trento, Italy, 29th August, 2011, 1–8, IEEE, Piscataway, NJ. doi:10.1109/REVOTE.2011.6045910 External Link

Elektronsiche Wahlen durch Stimmzettelbelege? Untersuchung möglicher Umsetzungen des Öffentlichkeitsgrundsatzes bei elektronischen Wahlen External Link.
Henning, M.; Budurushi, J.; Volkamer, M.
2014. Multimedia und Recht, 154–158

Elektronische Kandidatenauswahl und automatisierte Stimmermittlung am Beispiel hessischer Kommunalwahlen
Henning, M; Volkamer, M; Budurushi, J.
2012. Die Öffentliche Verwaltung (DÖV), no. 20.

Vote Casting in Any Preferred Constituency: A New Voting Channel External Link.
Budurushi, J.; Henning, M.; Volkamer, M.
2013. E-Voting and Identity: 4th International Conference, Vote-ID 2013, Guildford, UK, July 17-19, 2013, proceedings. Ed..: S. Schneider, 61–75, Springer, Berlin. doi:10.1007/978-3-642-39185-9_4 External Link

Implementing and evaluating a software-independent voting system for polling station elections External Link.
Budurushi, J.; Jöris, R.; Volkamer, M.
2014. Journal of information security and applications, 19 (2), 1–10. doi:10.1016/j.jisa.2014.03.001 External Link

Introducing Precautionary Behavior by Temporal Diversion of Voter Attention from Casting to Verifying their Vote External Link.
Budurushi, J.; Woide, M.; Volkamer, M.
2014. Workshop on Usable Security, USEC 2014, San Diego, California, 23.02.2014, Internet Society, Reston, VA. doi:10.14722/usec.2014.23037 External Link

Paper Audit Trails and Voters’ Privacy Concerns External Link.
Budurushi, J.; Stockhardt, S.; Woide, M.; Volkamer, M.
2014. 2nd International Conference on Human Aspects of Information Security, Privacy, and Trust, HAS 2014 - Held as Part of 16th International Conference on Human-Computer Interaction, HCI International 2014, Heraklion, GR, June 22-27, 2014. Hrsg.: T. Tryfonas, 400–409, Springer, Cham. doi:10.1007/978-3-319-07620-1_35 External Link

Feasibility Analysis of Various Electronic Voting Systems for Complex Elections External Link.
Budurushi, J.; Volkamer, M.
2014. CeDEM14 : proceedings of the International Conference for E-democracy and Open Government 2014, 21-23 May 2014, Krems, Austria. Hrsg.: Peter Parycek, Noella Edelmann, 141–152, Edition Donau-Universität, Krems

Implementation and Evaluation of the EasyVote Tallying Component and Ballot External Link.
Budurushi, J.; Renaud, K.; Volkamer, M.; Woide, M.
2014. 6th International Conference on Electronic Voting: Verifying the Vote (EVOTE) : Lochau/Bregenz, Austria, 29 - 31 Oct. 2014. Hrsg.: Robert Krimmer, Melanie Volkamer, 1–8, IEEE, Piscataway, NJ. doi:10.1109/EVOTE.2014.7001140 External Link

An Investigation into the Usability of Electronic Voting Systems for Complex Elections External Link.
Budurushi, J.; Reanaud, K.; Volkamer, M.; Woide, M.
2016. Annals of telecommunications, 71 (7-8), 309–322. doi:10.1007/s12243-016-0510-2 External Link

Flyer

The EasyVote flyer is available here.