NL1019120C2 - Voting system provides possibility of remote voting and enables voter to make vote and then with authorization cancel that vote and replace it with one for another candidate - Google Patents

Abstract

The voting system provides the possibility of remote voting and enables a voter to make a vote and then with authorization cancel that vote and replace it with one for another candidate. Apart from storage in an electronic memory, each vote is also physically stored by being printed on paper, provided with a graphic background, which can be observed by a voter via a camera. Identification of the voter can occur on the basis of biometric characteristics, such as an iris scan, or a PIN code which can be made visible by scratching on the card summoning the voter to vote. At a distance, by telephone, Internet, e-mail, registered votes are fixed by a control number or a control text printed on the summoning card.

Description

-1- 5 Election system with possibility of remote selection

The invention relates to a system for casting and totalizing votes in national, provincial or municipal elections, with the possibility of 10 votes at a distance, for example at any polling station, or from home via a telephone line, via the internet, via e-mail, or can be delivered to a station with the help of voting columns. It is important in such a system for democratic elections, where 15 votes are cast from outside a polling station, that these votes were not cast by force or that the voter did not sell his or her vote to the highest bidder.

If we take a closer look at the history of the electoral process in the Netherlands, it is striking that a certain evolution has taken place, whereby certain aspects of this process have been somewhat forgotten. For example, the electoral process was originally fairly transparent due to the following process characteristics: 25 - Supervision of the electoral process by various stakeholders (political parties) with conflicting interests; - Votes cast remain physically available; - Separation between the choice of a vote (filling in 30-ballot paper) and casting a vote (throwing ballot paper in ballot box); - Recovery of physically present votes possible; - Voter knows that his or her voice is included; - No forced choice due to monitoring of the process; 35 - Not too much influence on one central location, because the -2 votes were spread over all polling stations or electoral districts.

With the introduction of mechanical voting machines, which was done to speed up the counting process, there was another externally visible relationship between pressing a button next to a candidate's name and increasing the counter reading of a mechanical counter, which with this button was connected.

However, when, to increase reliability, the electronic voting machines were introduced, there was no longer any visible relationship between the contents of an electronic counter and the operation of the aforementioned button. The voter is asked by the government to have confidence in the proper functioning of these machines, whereby in the best case, as in the Dutch situation, the government instructs an independent body (TNO) to check the proper functioning of these machines and to provide a certificate for this, whereby no changes may be made to these machines without renewed certification.

The situation is different in the United States of America, where after the debacle of counting and recounting the votes cast for presidential elections in the state of Florida in December 2000, it turned out that every manufacturer of 25 voting machines changed the software of the can install voting machines supplied by it.

In order to give the electorate more freedom in choosing the location for casting a vote, expecting to achieve greater participation in elections, other or at least additional electoral processes are needed. The optimum is seen that a voter can cast his or her vote at home via the telephone, via the internet, via e-mail or possibly via an election column.

-3-

The present invention has for its object to provide a solution to this problem, in which the original process properties of the election process remain guaranteed and will be described below, with reference to Figure 1, in which a schematic overview of the election process according to the invention is shown.

The present election system provides for maintaining the known polling station, whereby every voter can cast his or her vote at any polling station and is therefore not exclusively bound to the polling station mentioned on his or her calling card. Each voter can also cast his or her vote remotely, for example with the aid of a personal computer (PC) via the telephone, via the internet, via e-mail or with the aid of an election column, for example at a station.

An important feature is that in order to avoid coercion or the sale of votes, any voter, in the election system according to the invention, can revoke his or her remote or proxy vote, whereby no calling card has to be shown. In this way, a person who forces a voter to vote for a particular candidate, or, for example, buys a vote from a voter through an authorization, can never be sure that this vote has not been revoked and replaced by another vote.

To simplify the equipment for entering, casting and counting votes in the election system according to the invention, a separation is made between a number of functions. The following definitions apply to a vote: 30 Generation - The recording of a vote by the voter or his proxy, who then wishes to have this voter count towards the election in question; (comparable to ticking the ballot paper) 35 By proxy - Generating a vote for another person, who has given permission for this with the help of the calling card, to generate a vote that this other person then wants to count towards the relevant person election; 5 Casting - Allowing the voting computer to include a previously generated vote in the election in question; (similar to putting the ballot in the ballot box) 10 Submitting - Sending a vote generated outside a polling station via a telephone, via the internet, via e-mail or via an election column in encrypted form to a polling station or electoral circle ; 15 Withdrawal - Changing at any polling station an already generated by proxy, a yet to be generated by proxy, an already submitted or a still to be submitted vote into a vote for another candidate; 20 Sending - Sending in encrypted form between a polling station and another polling station or another constituency both the identity of the voter and a generated or revoked vote for this voter.

Because making a well-arranged and easily operable user interface yields an extremely complex device, the election system according to the invention has opted for a separation between the user interface to generate or revoke the vote and the voting computer. The voting computer is the device that stores the votes in a memory. This separation corresponds to the original separation between the music desk with curtain to fill in the ballot and the ballot box.

The connection between the user interface, for example as described in the applicant's Dutch patent application No. 5,345,438, and the voting computer is a line over which the votes to be cast are sent in the form of messages readable and interpretable by persons.

The voting computer, which must be trusted and certified, can in this way become a relatively simple device whose design and software can possibly be published.

Because information at the output of the user-10 interface is legible and controllable for the voter, this device does not have to be certified and several manufacturers can compete to produce a simple and clearly operable device.

According to the diagram of Figure 1, the voter can decide whether or not to go to a polling station. If the voter goes to the polling station with the calling card, identification can take place manually on the basis of a passport or driver's license, but also automatically on the basis of biometric information, such as for example an image of the iris, with which automatic identification is possible and for which the parameters are possibly stored in the calling card in the form of a chip card. Subsequently, the voter list is used to verify whether the voter is entitled to vote and the calling card is taken. For this purpose, in the election system according to the invention, this national election list must be available or accessible at every polling station, as well as the composition and content of all ballot papers for all possible electoral circles.

If the voter is in the polling station or possibly in the electoral circle according to the calling card, then the appropriate ballot paper can be selected and the user interface released to generate a vote sent to the voting computer to be physically recorded and stored in the electronic memory, so that this vote counts for the result. Physical recording is thereby effected by printing the voice on paper in readable and interpretable form for the human eye.

In addition to this form that can be read by the human eye, the voice or a code for this can also be additionally printed in the form of, for example, a barcode, so that an automatic recount is also possible solely on the basis of the printed and thus physically present information.

If a vote is generated by proxy, then in the present election system this vote is not immediately cast, but is instead stored in a cache, so that this vote may, as described below, be revoked, or perhaps already revoked. .

If the voter comes to a random polling station without a calling card, the voter can, after his or her identity, for example manually been verified on the basis of a passport or driver's license, and after the election list has been consulted to determine the voting rights of the voter concerned to ascertain, a voice that has already been generated or to be generated, that has been or is still being stored in the aforementioned intermediate memory, revoked and replaced by another voice. A condition for this is that the vote that is revoked is already or, during the opening of the polling station, still generated by proxy, or that the vote that is revoked is already or, during the opening of the polling station, still being generated , via for example a PC and a telephone line, internet, e-mail or election column, from outside a polling station. With the election system according to the invention, it is possible to revoke a vote 30, possibly several times, the last revocation being valid.

An extension of the possibility of revocation could be offered by making this revocation possible also at the town hall of the municipality where the voter resides, or perhaps even at any random house, in the period between sending the calling cards and election day.

In the present election system, both the identity of the voters and all generated or recalled votes stored in the aforementioned cache are encrypted with an asymmetric encryption technique, this encryption taking place with two public keys of this encryption technique, one for the identity of the voter and one vote generated or revoked for the corresponding 10.

If a vote is generated or recalled which, according to the election list, belongs in another polling station or in a different electoral circle, then this vote, together with the identity of the voter, for example via a government network, is sent in encrypted form to this other polling station or to this other constituency. To protect this transmission and to prevent the voter's privacy and electoral secrecy from being disrupted, the same asymmetrical encryption technique is also applied here, and both the identity of the voter and his generated or recalled voice are encrypted with two different data provided for this purpose. public cryptological keys of the polling station or constituency of destination.

After the cryptologically encrypted message has been received at the polling station or in the destination constituency, after the receipt of the message is confirmed, the identity of the voter is first determined by decrypting it with the appropriate secret key of the relevant polling station or constituency.

30 Subsequently, on the basis of the election list, it is again verified whether the voter is entitled to cast or revoke a vote. If the vote in question has been generated with the submission of the calling card, then this vote will be treated in the same way as every vote that is cast in the relevant polling station or in the relevant electoral circle itself. The same procedure also takes place in the case of revocation, which means that these revoked votes are stored in an intermediate memory.

If the voter decides not to go to a polling station 5 but to generate a vote using, for example, a home PC, then the software needed to generate a vote, as well as the composition and content of all possible ballot papers can be loaded via internet. The generation of the aforementioned voice is then possible with the aid of this software, wherein the identity of the voter is determined on the basis of an identification number stated on the calling card, together with a, for example, scratching off a cover layer, Personal Identification Number or 15 PIN, which is also stated on the relevant calling card. The voting ballot that applies to the voter concerned is also selected with the help of the software on the basis of the ballot number stated on the calling card. In order to avoid errors, comparable to bank account numbers, some redundancy can be made in the aforementioned numbers, so that verification of input is possible.

After the voter has generated a vote, this vote as well as the identity number and the PIN are encrypted using the software program and the public encryption keys mentioned on the calling card or already present in the software and then, via a telephone line, via the internet , sent by e-mail or via an election column, to the polling station or electoral circle designated for this vote. Thus, in the election system 30 according to the invention, decentralized processing of the votes not generated at a polling station takes place. As a result, communication is spread over the entire country and there is no concentration with possible blockage on a central computer system. In addition, not too much power and possibility of influencing are placed in one central location in this way, and the system is also optimally suited for local municipal elections, but also less vulnerable.

After the cryptologically encrypted message has been received via a telephone line, via the internet or via e-mail at the polling station or in the constituency of destination, the identity of the voter and the PIN used is first determined by decrypting it with the appropriate secret key of the relevant polling station or electoral circle. Subsequently, on the basis of the election list, it is verified whether the PIN sent is part of the identity of the voter, whether the voter is entitled to cast a vote and whether the correct ballot paper has been used. If the verification process has been positive, the receipt of the generated vote is confirmed as valid, together with a different check number or check text that is also stated on the calling card. To prevent the PIN code from becoming known by sending in many messages in this way, the number of attempts that can be made by a voter to send in a vote is limited to, for example, five.

If the vote thus received according to the electoral list has not yet been cast and has not been revoked, then this vote is stored in encrypted form together with the identity of the associated voter in the aforementioned intermediate storage, for which it applies that the data stored therein votes can still be withdrawn. If the vote has already been cast or withdrawn, then this vote will be saved to get a record of the trial, but this vote will then not count towards the election in question.

After the opening time of the polling station, any pending submissions, which arrive from outside a polling station or electoral circle, will be processed and any outstanding shipments between the final polling stations or electoral circles will be processed via the government network, after which the reception option for the relevant polling station or constituency is broken. Subsequently, all recalled and non-recalled votes are sent from the interim store to the voting computer, where these votes are decrypted via a so-called mixed network (Chaum 1981) with the secret key (s) of the relevant polling station or constituency concerned and simultaneously in placed a random order, so that no relationship can be established between the voter and the vote cast by this voter. After it has been checked that a vote occurs on the ballot paper that applies to the relevant voting office or the relevant electoral circle, this vote is physically recorded by printing this vote out and also stored in the electronic memory of the voting computer to count for the relevant election results.

In order to give the voter the confidence that the vote cast by him or her actually counts in the election results, in the election system according to the invention, this vote is not only stored physically and legibly with the aid of a printer coupled to the voting computer, but the printing of this voice is also recorded with the aid of a camera and fed back in real-time to the selector during printing via a display on the user interface. The votes are printed on a large number of columns on the printer, the chosen column within the line being determined randomly per vote, so that no relationship can later be established between the printed votes and the order in which these votes were cast by voters . It should be noted that in the meantime votes from another polling station or constituency can also be printed. This control option does not apply to the encrypted votes and the revoked votes that are temporarily stored in the interim storage. There is a possibility here to publish a list of voters whose valid vote has been received (via the internet), either via the government network or via a telephone line, via the internet, via e-mail or via an election column where revocations remain invisible. It is noted that a blank vote is also a valid vote.

In order to create even greater confidence among the voter, the paper for printing the votes can be provided with a random graphic background in advance so that it is visible to the voter what this background looks like at the vote that has been cast and how or her voice is printed on this. By publishing the printed list of votes, each voter can then determine whether his or her vote in relation to the background also occurs therein without having to reveal his or her identity in relation to the vote.

In order to be able to easily check the total number of votes cast per polling station or electoral circle, the aforementioned paper can also be provided with a numbering next to the rows and possibly also above the columns. However, this numbering should never come into the picture when printing a vote because then control by third parties would be possible over the votes cast.

After all votes have been decentrally collected in the manner described above, they can be totaled per candidate, per party and per constituency and sent to a central collection point. In the case of local municipal elections within the electoral district, the seat distribution can also be calculated, taking into account the residual seat distribution.

In the case of national or provincial elections, this last calculation will have to be made more centrally.

Claims (16)

1. An election system with the possibility of remote voting, characterized in that a vote that is or is still being cast from a distance, that is to say from outside a polling station, to avoid coercion or sale, and can be withdrawn and changed to a vote for another candidate. 2. An electoral system with the possibility of remote selection according to the preceding claim, characterized in that a vote can only be canceled by the voter personally, wherein this voter must appear at a polling station during the opening time and must provide sufficient identification , but does not have to show or issue the calling card sent to this voter. 3. An electoral system with the possibility of remote voting according to claim 2, characterized in that, except during the opening time at a polling station, a vote can also be revoked under the same conditions at the town hall of the municipality in which the voter resides in the period between sending the calling cards and election day. 4. An electoral system with the possibility of remote selection according to claim 2, characterized in that, except during the opening time at a polling station, a vote can also be recalled under the same conditions at any town hall in the period between sending of the calling cards and election day. -. - η v.r- '· 1 -13- 5. An election system with the possibility of remote voting according to one or both of the preceding claims, characterized in that also votes cast by another person for a voter or still being cast during the opening time of the polling stations with an authorization from the relevant voter, can be revoked by this voter. An election system with the possibility of remote selection according to one or more of the preceding claims, characterized in that the often complex function of generating a vote and the simpler function of physically or electronically storing this vote is separated into two different devices, wherein the voice during the transfer from one device to the other has a human readable and interpretable format. 7. An election system with the possibility of remote selection according to one or more preceding claims, characterized in that the votes cast are not only stored in an electronic memory, but are also stored physically by printing these votes on paper, so that possibly manual recounting is possible. 8. An election system with the possibility of remote selection according to one or more of the preceding claims, characterized in that in addition to printing the name and possibly the party of the candidate, a code is also printed, such as for example a barcode, which is an automatic makes recounting possible based on the printed votes. -14- 9. An election system with the possibility of remote selection according to one or more preceding claims, characterized in that the paper on which the votes cast are physically recorded in printed form is provided with a graphic background printing. 10. An election system with the possibility of remote selection according to one or more of the preceding claims, characterized in that, in order to increase the trust of the voter in the election system, the printing and thus the physical recording of his or her vote by means of from a video camera is fed back to a display on the user interface of the device with which the voice is generated, whereby possibly also the position of the printed voice with respect to the graphic background mentioned in the preceding claim is perceptible. 11. An election system with the possibility of remote selection according to one or more of the preceding claims, characterized in that the votes cast are printed in the form of rows and columns on the paper on which these votes are physically recorded, wherein the column for printing the vote within a row is chosen randomly, so that no relationship can be established between the order of the printed votes and the order in which these votes were cast. 12. An election system with the possibility of remote selection according to one or more of the preceding claims, characterized in that the votes cast are printed in the form of rows and columns on the paper on which these votes are physically recorded, wherein the rows and optionally the columns are also provided with -15 'a row numbering and possibly a column numbering, so that the total number of votes cast can easily be determined on the basis of this numbering. 13. An election system with the possibility of remote selection according to one or more preceding claims, characterized in that the identification of the voter takes place in an automatic manner with the aid of biometric features, such as, for example, a scan of the iris. 14. An election system with the possibility of remote selection according to one or more of the preceding claims, characterized in that identification of the dialer 15 takes place with the aid of a PIN code on the call card, which is made visible by scratching off a cover layer. 15. An election system with the possibility of remote selection according to one or more of the preceding claims, characterized in that some redundancy is built into the identification numbers on the calling card, so that errors in taking over these numbers can be signaled. 25 16. An election system with the possibility of remote selection according to one or more of the preceding claims, characterized in that the receipt of a vote sent via a telephone line, via the Internet, via e-mail or via an election column is confirmed by means of a different control number or control text for each dialer, which is also printed on the calling card.