EP0419335B1 - Voting method and means for carrying out this method - Google Patents

Abstract

The subject of the present invention is a voting card characterised in that it is of the chip card or microprocessor card type and contains areas capable of receiving identification data and areas for storing voting rights, or voting areas, able to be activated, to be identified and to permit the validation of a vote and the neutralisation of the area concerned. It also concerns a method of voting by the abovementioned card comprising an initialisation phase, a phase of choice of the candidate and of validation of the choice effected by the elector, the choice validated by the elector being stored in an area chosen at random and a phase of reading and of recording by the electronic ballot-box of the datum or data validated in the storage area or areas, this or these storage areas being neutralised. <IMAGE>

Description

The present invention relates to a new method of voting and relates to the means allowing the implementation of this new method.

We know the methods currently used in democratic countries to ensure maximum security both at the level of voters and at the level of the ballot count. These procedures must also provide effective protection against fraud or sabotage.

• a) identification de l'électeur tant sous l'angle de son identité que sous l'angle de la vérification de ce qu'il s'est adressé au bureau de vote concerné;
• b) remise à l'électeur ainsi identifié de l'enveloppe destinée à contenir le bulletin de vote et assurer le secret du vote;
• c) mise à disposition de l'électeur des différents bulletins parmi lesquels il devra, dans l'isoloir, choisir celui qui lui convient;
• d) passage de l'électeur dans l'isoloir où l'électeur peut introduire le bulletin de vote choisi dans l'enveloppe;
• e) passage de l'électeur devant l'urne où, préalablement au vote, le même contrôle qu en a) ci-dessus est effectué, l'enveloppe étant déposée alors dans l'urne;
• f) en fin de vote, comptabilisation des différents bulletins déposés;
• g) introduction des données dans les moyens de comptabilisation générale au plan local, régional et/ou national;
• h) possibilité de conservation des bulletins pour un comptage ultérieur de contrôle.

In fact, the methods currently followed involve several operations at each polling station:

• a) identification of the voter both in terms of his identity and in terms of verifying that he addressed the polling station concerned;
• b) return to the voter thus identified of the envelope intended to contain the ballot paper and to ensure the secrecy of the vote;
• c) making available to the voter the various ballot papers from which he must, in the voting booth, choose the one that suits him;
• d) passage of the voter through the voting booth where the voter can introduce the chosen ballot into the envelope;
• e) passage of the voter in front of the ballot box where, before voting, the same check as in a) above is carried out, the envelope then being deposited in the ballot box;
• f) at the end of the vote, accounting of the various ballots deposited;
• g) introduction of data into general accounting systems at local, regional and / or national level;
• h) possibility of keeping the bulletins for a subsequent control count.

It is all of these operations that are generally implemented, although some of them may differ depending on the electoral laws of each country.

It is clear that the cost of preparing and counting the votes has prompted some countries to consider mechanical or electronic methods to streamline and speed up voting procedures. This basically involves reducing and even deleting the current paper ballots and speeding up the counting of votes. It is however necessary to ensure the maximum security of the vote, the secrecy of the vote, an effective protection against fraud or sabotage, a centralization and a rapid consolidation of the overall results avoiding any interference and obtaining a flexibility of the operating mode allowing the adaptation to the specific electoral laws of each country.

• des solutions faisant emploi de la lecture optique, centralisée ou décentralisée de bulletins conçus spécialement. Ces solutions présentent l'inconvénient de nécessiter des coûts importants pour la réalisation de bulletins optiques et l'emploi de lecteurs optiques;
• des solutions "tout électronique" du type machines à voter. De tels systèmes existent en général dans des buts de vote impliquant des réponses du type oui ou non sur des réseaux limités, par exemple du type de vote mis en oeuvre à l'Assemblée Nationale de la République française. Au plan d'un vote national nécessitant un matériel en réseau, se posent des problèmes de coût, de fiabilité et de sécurité des informations enregistrées. Par ailleurs, se pose le problème de l'éducation de l'électeur; quand on connaît les difficultés de certains usagers du métropolitain à faire fonctionner correctement les machines délivrant les tickets, on comprend que des systèmes trop sophistiqués puissent provoquer une gêne dans le vote et même pour certains présenter un aspect dissuasif, ce qui n'est par recherché. L'électeur doit en fait retrouver dans tout vote les habitudes acquises pour que le vote se passe sans heurt et harmonieusement.

Different solutions have been proposed for this purpose. Thus, we proposed:

• solutions using optical, centralized or decentralized reading of specially designed bulletins. These solutions have the disadvantage of requiring significant costs for the production of optical bulletins and the use of optical readers;
• "all electronic" solutions such as voting machines. Such systems generally exist for voting purposes involving yes or no type responses on limited networks, for example of the type of vote implemented in the National Assembly of the French Republic. In terms of a national vote requiring networked equipment, problems arise with the cost, reliability and security of the information recorded. In addition, there is the problem of voter education; when we know the difficulties of some users of the metropolitan to operate properly the machines delivering the tickets, we understand that too sophisticated systems can cause discomfort in the vote and even for some present a dissuasive aspect, which is not sought. The voter must in fact find in every vote the habits acquired so that the vote goes smoothly and harmoniously.

In this context, in particular, US Pat. No. 4,373,134 describes a method using a voting card of the chip card or microprocessor card type and contains identification data and areas for storing voting rights, or voting zones, likely to be activated, to be identified and to allow the validation of a vote and the neutralization of the zone concerned. In this process, the card used contains voter identification data and is personal to each voter.

The present invention makes it possible to satisfy all the requirements described above which a democratic vote implies and, moreover, to obviate the drawbacks of the systems used until now while having the advantage of not confusing the voter. accustomed to a certain course of the electoral mode on the one hand, and on the other hand to allow counting operations and their verification in conditions of reliability and secrecy that these operations require.

The subject of the present invention is a voting card containing one or more areas for storing identification data and one or more areas for storing voting rights, or voting areas, enabling the validation of a vote and the neutralization of the area concerned, characterized in that it is of the chip card, or microprocessor card, or laser reading card type, in that it is not personal, in that it is capable of receiving during a phase of initialization of the identification data of a polling station in the said identification data storage area (s), and in that the said voting area (s) may be activated randomly and to be identified.

• . au cours de la phase d'initialisation des cartes, des données d'identification du bureau de vote ainsi que du ou des votes concernés sont introduites dans les zones appropriées de la ou desdites cartes, ladite carte étant validée de façon à permettre le stockage de données de vote dans la ou lesdites zones de stockage de droits de vote;
• . au cours de la phase de choix du candidat par l'électeur et de validation du choix effectué par l'électeur, les données de vote sont stockées dans la ou lesdites zones de vote, et en ce que
• . au cours de la phase de vote, lesdites données de vote sont lues et enregistrées par l'urne électronique de la ou des données stockées clans la ou lesdites zones de vote, la ou les zones de vote étant neutralisées, et en ce que le ou lesdites zones de stockage des droits de vote sont choisies de façon aléatoire.

The present invention further relates to a voting method using voting cards, comprising a phase initialization of the cards, a phase of choice of the candidate by the voter and validation of the choice made by the voter, and a phase of voting in an electronic ballot box (3), characterized in that the said card or cards are not personal to a voter, in that:

• . during the card initialization phase, identification data of the polling station as well as of the vote (s) concerned are entered in the appropriate areas of the said card or cards, said card being validated so as to allow the storage of voting data in the said voting rights storage area (s);
• . during the phase of choice of the candidate by the voter and validation of the choice made by the voter, the voting data are stored in the said voting area (s), and in that
• . during the voting phase, said voting data are read and recorded by the electronic ballot box of the data or data stored in the said voting zone or zones, the voting zone or zones being neutralized, and in that the or said voting rights storage areas are chosen randomly.

According to another embodiment of this method, the voting card after the reading and neutralization phase is brought back to the initialization phase to be reused for a new voter.

According to an embodiment of this process, the random choice of the storage area for the vote (s) is made during an activation phase.

According to another embodiment of this method, the activation phase is carried out during the initialization phase.

According to yet another embodiment of this method, the activation phase is carried out during the validation of the choice made by the voter.

According to yet another iodine of execution of the invention, the phase of choice of the candidate, and validation of the choice made by selector, are carried out by the voter in a voting booth, his choice being validated in one or more zones (s ) of storage, the data or data (s) thus validated being capable of being read (s) by an electronic ballot box and recorded (s) at the same time as the said storage area (s) is / are neutralized.

According to another embodiment of this process, the activated storage area (s) can only be located and / or read over the transition time between the validation phase and the reading phase by the urn.

According to yet another embodiment of this process, the voting card can be subjected to a verification count allowing a verification of the results of the ballot by comparison between the results of the electronic ballot box and those of the various cards used in the vote place.

According to yet another embodiment of this process, the voting booths can be subjected to a verification count allowing a verification of the results of the ballot by comparison between the results of the electronic ballot box and those accumulated from the different voting booths used in the polling station

According to one embodiment of this process, the electronic ballot boxes keep their data for the duration of the vote and their content is not transmitted to the central unit until the close of the vote.

The present invention also further relates also to an installation for implementing the voting method according to any one of claims 2 to 11, comprising voting booth units (2) to allow a voter to choose a or of the candidate (s), to validate this choice by recording this choice on a voting card, at least one electronic ballot box (3) for reading this choice on said voting card and recording this choice, characterized in what it includes initialization and / or activation units (1) capable of storing on a voting card identification data of the polling station as well as of the vote (s) concerned, and / or activating randomly at least one voting area of said card, in that said voting booth units (2) are able to introduce into each of said activated areas specific data of the candidate (s) chosen for each vote, and in that the initialization and / or act units ivation (1) and said electronic ballot boxes (3) are controlled by a central unit (5) and connected to a monitor (6).

According to one embodiment of the installation according to the invention, the central unit controls all of the units connected to the monitor, as well as the destination of the dialogue, for example by switching, to a Minitel.

Preferably, the validation units are microprocessor card readers / writers having memories of the non-volatile type, electrically erasable (EEPROM).

According to one embodiment of the installation, the voting booth units are independent of the rest of the installation and also include non-volatile memories (EEPROM).

According to another embodiment of the installation, the voting booth units are electronic urns directly connected to the central unit.

According to another iodine of execution of the installation, the various constituent elements of the installation can be powered by rechargeable batteries.

• la figure 1 représente une configuration ou architecture du système pour la mise en oeuvre du procédé de l'exemple 1 par exemple;
• la figure 2 représente une configuration ou architecture du système pour la mise en oeuvre du procédé de l'exemple 4;
• la figure 3 représente une configuration ou architecture du système pour la mise en oeuvre du procédé de l'exemple 5 par exemple.

Other objects and advantages of the invention will appear on reading the following description and the appended figures given by way of illustration and in no way limitative.

• FIG. 1 represents a configuration or architecture of the system for implementing the method of example 1 for example;
• FIG. 2 represents a configuration or architecture of the system for implementing the method of example 4;
• FIG. 3 represents a configuration or architecture of the system for the implementation of the method of example 5 for example.

FIG. 1 represents a configuration or architecture suitable for the mode of implementation satisfying the requirements of French legislation as regards voting. This configuration comprises, in the embodiment shown, three validation and / or initialization units 1, three voting booth units 2 and two voting or concentration units 3, consisting of electronic ballot boxes.

The validation and / or initialization units 1 and the voting units or ballot boxes 3 are connected via an electronic switch 4 to a central unit 5, which controls them on the one hand and to a monitor 6, preferably Minitel type.

FIG. 2 represents a configuration where the voting booth units 2 function as ballot boxes and are connected to the central unit which controls them as well as the validation and / or initialization units.

FIG. 3 represents a configuration similar to that of FIG. 1 but where the isolator units 2 are temporarily connectable to the network.

In Figures 1 to 3, the same reference numbers have been given to the corresponding units.

The initialization and / or validation units 1 and the voting or concentration units, or electronic ballot boxes 3, consist of readers / writers of smart cards or microprocessor cards containing a non-volatile type memory (EEPROM) .

The voting booth units 2 consist of readers / writers of smart cards or microprocessor cards containing a non-volatile type memory and allowing the recording of data corresponding to the choice made on the unit.

EXAMPLE 1 Voting procedure in France

The voter goes to the polling station to which he is attached and presents his voter card to an auditor. The latter verifies the identity of the voter and checks the list of voters at the polling station to determine if this voter is actually registered on the lists of this polling station.

The voter is given a smart card or microprocessor card. The verifier beforehand validates this card in a validation unit (zone 1; figure 1) which introduces in memory an identifier code of the polling station and / or the vote on the one hand, and on the other hand, active with a hazard a voting area, which gives the voter the right to vote.

This validation unit can be a reader / writer of microprocessor cards of the "Pushmatic" type having a memory of the non-volatile, electrically erasable type (EEPROM).

The voter then goes to the voting booth (zone 2; Figure 1) where voting booth units are located, operating on rechargeable batteries and comprising non-volatile memories. The voter introduces the smart card into an ad hoc area of the voting booth unit, for example a slot. The voting booth unit then checks whether the identifier code of the polling station and / or the identifier code of the vote corresponding to the polling station and / or the vote concerned respectively and checks whether the right to vote has not been exhausted. If this verification proves favorable, the elector is informed that he can vote. The voting booth unit has a voting area for each candidate and a push button next to each of these areas. A voting area and a push button for white voting are also provided. The voter makes his choice and presses the corresponding push button. If the voter changes his mind and wishes to change the candidate, he can either cancel his first vote by action on an ad hoc press button, or any simply by pressing another button. When the choice is made, the voter "confirms" his vote by actuating means of confirmation. The activated zone of the smart card then receives information corresponding to the vote at the same time as the activated zone is canceled. The voter then collects his smart card.

Although it was indicated above that only one area of the map was initialized, it is quite obvious that, in the case of multiple votes, for example a municipal vote and a national vote scheduled on the same day, several zones could be initialized, each one obviously being validated for the corresponding vote. The voting booth units will be programmed accordingly.

The voter having recovered his card containing the information of the vote (s) made then goes to the ballot box where the President of the Polling Station again verifies the identity of the voter and if he is entitled to vote with from this office. It is of course an electronic ballot box (zone 3; Figure 1); this is identical to the validation units. The smart card is then introduced by the voter into the ballot box and his vote recorded in the ballot box at the same time as the voting area is neutralized. The information corresponding to the vote taken remains in memory, however. The ballot boxes keep their data for the duration of the poll. The data are not sent to the central unit until the close of the election, so that there is no flow of information on the network during the course of the election.

When the voting is finished, the card is collected by the President of the Polling Station who hands it to the aforementioned verifier. This card can then be reused by the verifier. It is indeed a recyclable and reusable card that the verifier resets and reactivates for a new voter. The zone (s) previously activated having been transformed into a voting zone and then into a neutralized zone and having lost the voting power cannot be reactivated at this stage.

In fact, depending on the number of memory areas, generally around 48 per card, around thirty cards suffice for an average polling station of 1,000 to 1,200 voters.

Obviously, the cards are kept after the vote and, in the event of possible disputes, a new count can be made.

A so-called "minute card" or "collection card" can be provided for the purpose of allowing the storage of all the data contained in the voting booths, in the case where the booths have been programmed to keep and total the votes dedicated. This card allows the conservation and compact archiving of the voting data of each voting booth unit and even of all the booth units of the same polling station for a given poll.

It should be noted that the President of the Polling Station has a special card which, after interconnection of the various devices, allows the configuration or architecture of the system for a new vote and in particular the introduction of specific validation and activation data.

Beforehand, the supervisory authorities carry out initialization, that is to say the resetting to zero of the different memories of the system units (INIT card).

It is clear that these special cards can have a secret access code (password) to allow access to the various menus and associated questions.

The system "monitor" is constituted in France by the Minitel which includes a particularly economical keyboard, screen and modem. For each of the operations carried out by the President of the Polling Station, there is a specific menu displayed by the Minitel which guides the operator.

• mise à l'heure du système,
• description du scrutin,
• description de l'architecture du système,
• heures d'ouverture et de clôture du scrutin,
• opération de clôture du scrutin,
• édition des résultats,

étant entendu que les autorités de tutelle ont déjà mis à l'heure le système, remis à zéro l'unité centrale et les unités de validation, les urnes et les isoloirs.The menu of the President of the Polling Station includes the following choices:

• setting the system time,
• description of the ballot,
• description of the system architecture,
• poll opening and closing hours,
• poll closure operation,
• edition of results,

it being understood that the regulatory authorities have already set the system time, reset the central unit and validation units, ballot boxes and voting booths.

• par description du scrutin:
  • . l'entrée des données relatives au type d'élection, au lieu du bureau de vote et au numéro d'identification du bureau de vote, à l'identité du Président du Bureau de vote et à son numéro d'identification, au jour du scrutin (éventuellement au premier jour et au dernier jour) et le nombre d'inscrits,
• par description de l'architecture du système:
  • . le nombre d'unités de validation (1 à 5),
  • . le nombre d'unités d'isoloir et donc d'isoloirs (1 à 8);
  • . le nombre d'unités de vote ou urnes électroniques (1 à 2);
  chaque unité employée doit faire l'objet d'une vérification qui assure que l'architecture annoncée est bien en état de fonctionner, contrôle effectué à l'aide de la carte personnelle du Président où sont inscrits les paramètres du nouveau vote ainsi que le compte-rendu d'initialisation des isoloirs;
• par heures d'ouverture et de fermeture du scrutin:
  • . les heures d'ouverture et de fermeture du vote pour la journée en cours.

In the menu of the President of the Polling Station, we hear:

• by description of the poll:
  • . the entry of data relating to the type of election, the location of the polling station and the identification number of the polling station, the identity of the President of the Polling Station and his identification number, on the day of ballot (possibly on the first day and the last day) and the number of registered voters,
• by description of the system architecture:
  • . the number of validation units (1 to 5),
  • . the number of voting booth units and therefore of booths (1 to 8);
  • . the number of voting units or electronic ballot boxes (1 to 2);
  each unit used must be the subject of a verification which ensures that the architecture announced is in good working order, control carried out using the personal card of the President where the parameters of the new vote are entered as well as the account - rendering of initialization of the booths;
• by poll opening and closing hours:
  • . the opening and closing hours of the vote for the current day.

• un bip sonore 5 minutes avant l'ouverture ou la clôture,
• 5 bip sonores au moment précis de l'ouverture ou de la clôture.

This series of menus provides the parameters necessary for the smooth running of the poll. The start and end times are monitored by the system which transmits:

• a beep 5 minutes before the opening or closing,
• 5 beep sounds at the precise moment of opening or closing.

• du nombre de droits de vote émis,
• du nombre de votes exprimés,
• du taux de participation,

ainsi que tout message d'anomalie, tel que:

• tentative de vote avec une carte non validée ou non chargée d'un choix effectué dans l'isoloir,
• tentative de voter 2 fois avec la même carte, etc.

During polling, the system displays the time and progress:

• the number of voting rights issued,
• the number of votes cast,
• the participation rate,

as well as any anomaly message, such as:

• attempt to vote with a card not validated or not charged with a choice made in the voting booth,
• attempt to vote twice with the same card, etc.

• 1. Les cartes à microprocesseur comportent dès leur fabrication un code de contrôle (dit code transport) que le concepteur de l'application doit connaître avant de pouvoir introduire les clés supplémentaires relatives à sa propre application. Après introduction des clés utilisateur, les "fusibles" sont coupés afin d'interdire toute lecture frauduleuse visant à redécouvrir les codes secrets.
• 2. Les cartes de vote ne sont pas personnelles mais le "droit de vote" est activé sur place, immédiatement avant son utilisation. Personne ne peut apporter de l'extérieur des "droits de vote".
• 3. Tout droit de vote émis doit être "consommé sur place" car le système contrôle en permanence:
  • . le nombre de droits de vote émis,
  • . le nombre de votes exprimés.
  La différence entre ces deux chiffres est représentée par les personnes en train d'opérer leur choix dans les isoloirs.
• 4. Les choix des électeurs sont comptabilisés à trois endroits différents:
  • . dans les isoloirs,
  • . dans les urnes,
  • . dans les cartes à microprocesseur.
  Les isoloirs sont des unités indépendantes, alimentées par batteries rechargeables, comportant des mémoires non volatiles du type EEPROM. En cas d'insuffisance de charge, il suffit de brancher les unités sur le secteur et la mémoire EEPROM pourra continuer à recevoir de nouvelles données qui vont se cumuler avec les précédentes.
  De la même façon, les urnes alimentées par le secteur ne peuvent en aucun cas perdre leurs données et lors du retour du courant, il sera possible de reprendre les cumuls au point où ils avaient été interrompus.
  Les cartes à puce sont du type EEPROM (par exemple GPM 416 de GEMPLUS CARD). Chaque carte permet de stocker le vote de 48 votants. Pour éviter tout risque de repérage d'un vote particulier, l'unité de validation attribue à chaque droit de vote un emplacement aléatoire qui n'est "connu" par le système que le temps de transition entre la phase de validation et la lecture par l'urne. Toute identification d'une position de vote particulière avec un électeur particulier est impossible. Seuls les cumuls d'une carte peuvent être analysés (en cas de contrôle ou d'anomalie nécessitant des recherches).
• 5. Des contrôles sonores et optiques (témoins rouges et verts clignotants) et des messages d'erreur sur le Minitel assurent un contrôle permanent du bon déroulement des opérations:
  • une carte n'ayant pas été "validée" est refusée par l'isoloir et, a fortiori, par l'urne,
  • une carte non chargée d'un vote significatif ou au moins d'un vote blanc, c'est-à-dire non passée par l'unité d'isoloir, est refusée par l'urne,
  • une même carte ne dispose à chaque validation que d'un seul droit de vote. Toute tentative de vote supplémentaire est rejetée par le système,
  • toute tentative d'obtention des résultats partiels avant l'heure de clôture officielle du scrutin est strictement impossible,
  • toute modification des paramètres d'un scrutin est impossible pendant son déroulement, même par le Président du Bureau disposant de sa carte de contrôle particulière,
  • la carte du Président comporte un code confidentiel à 4 chiffres empêchant toute manipulation du système par des personnes non autorisées,
  • le paramètrage d'un nouveau scrutin oblige à une initialisation de tous les composants du système. Cette opération nécessite une carte INIT (qui n'est pas à la disposition du Président de vote) mais détenue par les autorités de tutelle.

The system has a very high level of security:

• 1. Microprocessor cards include a control code (known as the transport code) as soon as they are manufactured, which the application designer must know before being able to enter the additional keys relating to his own application. After entering the user keys, the "fuses" are cut to prevent any fraudulent reading aimed at rediscovering secret codes.
• 2. Voting cards are not personal, but the "right to vote" is activated on site, immediately before use. No one can bring in "voting rights" from outside.
• 3. All voting rights issued must be "consumed on the spot" because the system constantly checks:
  • . the number of voting rights issued,
  • . the number of votes cast.
  The difference between these two figures is represented by the people making their choice in the voting booths.
• 4. Voters' choices are counted in three different places:
  • . in the voting booths,
  • . in the ballot box,
  • . in microprocessor cards.
  The voting booths are independent units, powered by rechargeable batteries, comprising non-volatile memories of the EEPROM type. In the event of insufficient charge, simply connect the units to the mains and the EEPROM memory can continue to receive new data which will accumulate with the previous ones.
  In the same way, the ballot boxes powered by the sector can in no case lose their data and when the current returns, it will be possible to resume the accumulations at the point where they had been interrupted.
  Chip cards are of the EEPROM type (for example GPM 416 from GEMPLUS CARD). Each card stores the vote of 48 voters. To avoid any risk of spotting a particular vote, the validation unit assigns to each voting right a random location which is "known" by the system only the transition time between the validation phase and the reading by the urn. Any identification of a particular voting position with a particular voter is impossible. Only the accumulations of a card can be analyzed (in the event of an inspection or anomaly requiring research).
• 5. Audible and optical controls (flashing red and green lights) and error messages on the Minitel ensure permanent control of the smooth running of operations:
  • a card that has not been "validated" is refused by the voting booth and, a fortiori, by the ballot box,
  • a card not loaded with a significant vote or at least with a blank vote, that is to say not passed by the voting booth unit, is refused by the ballot box,
  • the same card has only one voting right at each validation. Any attempt to vote further is rejected by the system,
  • any attempt to obtain partial results before the official election closing time is strictly impossible,
  • any modification of the parameters of a ballot is impossible during its progress, even by the President of the Bureau having his particular control card,
  • the President's card contains a 4-digit confidential code preventing manipulation of the system by unauthorized persons,
  • setting up a new poll requires initialization of all system components. This operation requires an INIT card (which is not available to the returning officer) but held by the regulatory authorities.

Of course, it is possible to obtain, if necessary, a printout of the results and the sending, using the Minitel and an automatic calling card, of the results to a server center.

EXAMPLE 2 Other voting procedure

It is similar to that of Example 1, but the activation with a hazard of one or more storage areas instead of being done during the validation phase, occurs when the voter "confirms" "his vote in the voting booth unit.

EXAMPLE 3 Other voting procedure

It is similar to that of Example 1, but the card initialization phase, during which the identification data of the polling station and of the poll concerned is entered in the appropriate zones of the cards, only takes place 'once for each card; the verifier would no longer need, as in Example 1, to reset a card for each new voter.

EXAMPLE 4 Other voting procedure

We operate according to the method of Example 1, but the voting booth functions directly as an electronic ballot box and directly records the vote that the voter validates.

In this case, the passage from the booth unit to the ballot box described in Examples 1 and 2 becomes superfluous.

EXAMPLE 5

The method described in one of the previous examples would make it possible to vote anywhere in the territory in the case of a national vote and not be limited to voting at a specific polling station. This is important to reduce the number of abstainers (such as those called Sunday fishermen, in France) or to avoid postal or proxy votes and the abuses they can cause.

The voter presents his voter card at any polling station. The verifier verifies the identity of the card holder and, thanks to Minitel, accesses the list voters from the voter's home polling station; the verifier checks whether the voter is actually registered on this list, and whether he has already voted. If he has not yet voted, the elector is authorized to vote, and at the same time, the mention of the use of the right to vote is entered on the list of the office of attachment.

The following operations are similar to those implemented in one of the preceding examples.

Of course, this operating mode requires the interconnection of all the polling stations with each other through a server center separate from the central unit. It is necessary for the central unit of each polling station to be able to connect to this server center, which checks whether the voter has not already used his right to vote. The mention of the use of the right to vote for the election concerned is recorded by the polling station on which the voter depends to avoid that the voter cannot go to one or more polling stations and renew his vote.

EXAMPLE 6

The procedure of Example 5 can be implemented in the case of a vote other than national.

In this case, in addition to the operations described in this example 5, the central unit of each polling station is connected to the voting booth units so as to transfer there the list of candidates from the office of attachment of the voter. The latter then makes his choice and validation according to the aforementioned procedures, indicated in example 1. In this case, the ballot box not only records the vote but also the identification data of the office of attachment.

Of course, instead of chip cards or microprocessor cards, a laser reading card (Drexler process) could be provided; this would in no way change the voting method according to the invention except that the apparatus should be adapted accordingly.

Claims (17)

1. A voting card containing one or several identification data storage regions and one or several voting entitlement storage regions or voting regions, allowing a vote to be validated and the region concerned to be cancelled, characterised in that said card is of the smart card or microprocessor card or laser-readable card type, in that said card is not a personal card, and is designed to receive, during an initialisation stage data identifying a voting station in said identification data region or regions, and in that said voting region or regions are designed to be activated in a random fashion and to be identifiable.
2. A voting method employing voting cards, comprising a card initialisation stage, a stage in which a voter chooses a candidate and a stage in which the voter validates his choice and a voting stage in an electronic voting box (3) characterised in that said card or cards are not personal cards assigned to one voter and in that:

   - during the card initialisation stage, voting station identification data and data identifying the vote or votes concerned are introduced into appropriate regions of said card or cards, said card being enabled to allow voting data storage in said voting entitlement storage region or regions;

   - during the stage in which the voter selects a candidate and validates his choice, voting data is stored in said voting region or regions, and in that:

   - during said voting stage, said voting data are read and recorded by the electronic voting box from the data stored in said voting region or regions, said voting region or regions being cancelled, and in that said voting entitlement storage regions are selected in a random fashion.
3. A voting method according to claim 2, characterised in that said voting card, after said reading and cancellation stage is returned to its initialisation stage in order to be re-employed by another voter.
4. A voting method according to claim 2 or 3, characterised in that said random choice of the vote storage regions is carried out during an activation stage.
5. A voting method according to claim 4, characterised in that said activation stage is carried out during said initialisation stage.
6. A voting method according to claim 5, characterised in that said activation stage is carried out when the voter validates his choice.
7. A voting method according to any one of claims 2 to 6, characterised in that the stage of choosing a candidate and validating the choice made by the voter are carried out by the voter in a voting booth (2), his choice being validated in one or more storage region(s), the thus validated data being designed to be read by an electronic voting box (3) and recorded at the same time as said storage region or regions is/are cancelled.
8. A voting method according to any one of claim 2 to 7, characterised in that said activated storage region or regions can only be located and/or read during the transition time between said validation stage and said reading stage by the electronic voting box.
9. A voting method according to any one of claims 2 to 8, characterised in that said voting card can be submitted to a counting operation for verification purposes to check the results of the vote by comparing the results obtained from the electronic voting box with the cumulative results from the various cards employed in the voting station.
10. A voting method according to any one of claims 2 to 9, characterised in that the voting booths (2) may be subjected to a counting operation for verification purposes to check the results of the vote by comparing the results from the electronic voting box with the cumulative results from the various voting booths employed in the voting station.
11. A voting method according to any one of claim 2 to 10, characterised in that said electronic voting boxes (3) keep their data throughout the whole duration of the vote and in that their content is only transmitted to the central unit when the vote closes.
12. An installation for carrying out the voting method according to any one of claims 2 to 11, comprising voting booths units (2) enabling a voter to choose one or several candidates to validate this choice by recording said choice on a voting card, at least one electronic voting box (3) for reading said choice on said voting card and recording said choice, characterised in that it comprises initialisation and/or activation units (1) capable of storing on a voting card, voting station identification, data as well as data identifying the vote or votes concerned and/or of activating in a random fashion at least one voting region of said card, in that said voting booth units (2) are capable of introducing into each one of said activated regions, an item of data specific to the candidate or candidates chosen for each vote and in that the initialisation and/or activation units (1)) of said electronic voting boxes (3) are controlled by a central unit (5) and are connected to a monitor (6).
13. Installation according to claim 12, characterised in that said central unit (5) controls all units linked to monitor (6) as well as the destination of the dialogue, for example by switching, towards a Minitel on-line communications terminal.
14. Installation according to claim 12 or 13, characterised in that said validation units (1) are smart card read/write units having non-volatile electrically erasable (EEPROM) type memories.
15. Installation according to any one of claims 12 to 14, characterised in that said voting booth units (2) are independent of the remainder of said installation, and also include non-volatile memories (EEPROM).
16. Installation according to any one of claims 12 to 15, characterised in that said voting booth units are electronic voting boxes (3) directly linked to said central unit.
17. Installation according to any one of claim 12 to 16, characterised in that the various component parts of said installation can be powered by rechargeable batteries.

Images