EP3525182A1

EP3525182A1 - Electronic voting system

Info

Publication number: EP3525182A1
Application number: EP18155970.9A
Authority: EP
Inventors: Michael Seifert
Original assignee: Forty-Two Aps
Current assignee: Forty-Two Aps
Priority date: 2018-02-09
Filing date: 2018-02-09
Publication date: 2019-08-14

Abstract

A voting system for use by voters to cast votes during an election is disclosed. The voting system comprises an input device arranged to receive a voting input from a voter, an electronic storage, a printing device and a ballot box. The electronic storage is arranged to store an electronic record of voting inputs from a plurality of voters, received via the input device. The printing device is arranged to print a hardcopy of a voting input received via the input device, and to display the printed hardcopy to the voter in a tamper proof manner, e.g. behind a transparent shielding, allowing the voter to review and verify the printed hardcopy of the voting input. The ballot box is arranged to receive and store the printed hardcopies of voting inputs. The voting system has a high level of trust while allowing the votes to be counted in a fast, easy and accurate manner.

Description

FIELD OF THE INVENTION

The present invention relates to a voting system for use by voters to cast votes during an election. The voting system generates an electronic record of the votes as well as a physical record of ballots. The invention further relates to a method for casting votes using such a voting system.

BACKGROUND OF THE INVENTION

When conducting elections and/or referenda, it is important that the government and voters trust the voting system, and thereby trust that the election or referendum is conducted in a fair and non-fraudulent manner.
Furthermore, it is desirable to be able to conduct the election or referendum in a smooth and easy manner, and to be able to count the votes fast, easily and with high accuracy. To this end electronic voting systems are very suitable. However, electronic voting systems may be prone to manipulation, and thereby the trust in electronic voting systems is generally lower than the trust in voting systems relying on printed ballots and personal attendance at a polling station.
US 6,968,999 B2 discloses a computer enhanced voting system for creating and recording both an electronic and a printed ballot for each voter during voting. The printed ballot includes only the names of the candidates for whom the voter has voted in a form that is easily readable by both humans and machine. The unambiguous printed ballot makes it easy for voters to verify the accuracy of their intended vote and can subsequently be used to casting the voter's official vote or saved to provide an audit trail for subsequent confirmation of the electronic tally.

DESCRIPTION OF THE INVENTION

It is an object of embodiments of the invention to provide a voting system with a high level of trust and which allows the votes to be counted in a fast, easy and accurate manner.
According to a first aspect the invention provides a voting system for use by voters to cast votes during an election, the voting system comprising:

an input device arranged to receive a voting input from a voter,
an electronic storage arranged to store an electronic record of voting inputs from a plurality of voters, received via the input device,
a printing device arranged to print a hardcopy of a voting input received via the input device, and to display the printed hardcopy to the voter in a tamper proof manner, allowing the voter to review and verify the printed hardcopy of the voting input, and
a ballot box arranged to receive and store the printed hardcopies of voting inputs.

Thus, according to the first aspect, the invention provides a voting system, i.e. a system which can be used for handling receipt and counting of votes during an election or a referendum. Accordingly, voters use the system for casting their vote, and an organisation or authority being responsible for conducting the election or referendum uses the system for retrieving and/or counting the cast votes and deriving the result of the election or referendum.
The voting system comprises an input device arranged to receive a voting input from a voter. Thus, the input device is the part of the system which the voter interacts with when he or she casts his or her vote. Accordingly, the voter has access to the input device, at least during a limited time interval when the voter casts his or her vote. The input device should be designed in a manner which allows a voter to cast a vote which is in accordance with the voter's true intensions. For instance, the input device may allow the voter to browse a list of candidates and select the candidate which the voter intends to vote for. In the case of a referendum, the input device may allow the voter to select 'Yes' or 'No'.
The input device may, e.g., be or comprise a touch sensitive display, e.g. applying a capacitive technology. For instance, the input device may be in the form of a tablet or the like. The display may be in the form of a privacy screen. In this case the input device may be located in a public area, such as a polling station, without requiring physical shielding of the input device, while still protecting the privacy of the voter and ensuring secrecy and anonymity of the cast votes.
The input device may, alternatively, be or comprise one or more push buttons, a keyboard, a mouse, or any other suitable kind of input device allowing a voter to enter a voting input indicating the intended vote of the voter.
The voting input could, e.g., be the name of a candidate, the name of a party or list, 'Yes' or 'No' in the case of a referendum, etc. The voting input could comprise several votes or referendums, for example selecting a candidate for an election and maybe additionally casting a 'Yes' or 'No' vote for a referendum.
The voting system further comprises an electronic storage arranged to store an electronic record of voting inputs from a plurality of voters, received via the input device. Thus, the input device is connected to the electronic storage in such a manner that a voting input provided by a voter via the input device is automatically provided to the electronic storage and stored therein. Thereby an electronic record of the voting inputs received in the course of the election is automatically generated and stored in the electronic storage device. When the election has been completed this electronic record can be used for easy, fast and accurate retrieval of the result of the election.
The voting system further comprises a printing device arranged to print a hardcopy of a voting input received via the input device. This printed hardcopy of the voting input represents a physical record of the voting input. The printing device is further arranged to display the printed hardcopy to the voter in a tamper proof manner. Thereby the voter can review and verify that the voting input appearing from the printed hardcopy is in fact in accordance with the intensions of the voter and with the electronic record. Since the printed hardcopy is displayed in a tamper proof manner, neither the voter nor a third party is allowed to modify the printed hardcopy. Thereby it is ensured that the physical record formed by the printed hardcopies originating from a plurality of voters is in fact truly representing the votes cast by the voters. This provides the voting system with a high level of trust.
Finally, the voting system comprises a ballot box arranged to receive and store the printed hardcopies of voting inputs. Accordingly, the printed hardcopies collected in the ballot box represents a physical record of the voting inputs corresponding to the electronic record stored in the electronic storage. The electronic record stored in the electronic storage and the physical record in the ballot box should ideally be identical to each other. However, in the case of discrepancies between the electronic record and the physical record, the physical record may advantageously be regarded as the one which correctly reflects the cast votes, since the voting inputs of the physical record have been reviewed an verified by the respective voters in a tamper proof manner, and it may therefore be assumed that if manipulation or fraud has taken place, this has most likely taken place with respect to the electronic record.
Thus, the voting system according to the first aspect of the invention provides for fast, efficient and accurate counting of the votes, by means of the electronic record of voting inputs stored in the electronic storage, as well as a high level of trust due to the physical record of voting inputs constituted by the printed hardcopies of voting inputs contained in the ballot box.
The input device or a voting booth in which the input device is positioned may be provided with a unique ID identifying the input device or voting booth and a corresponding ballot box. The unique ID may, in this case, be stored along with the electronic versions of the voting inputs forming the electronic record stored in the storage device. Furthermore, the unique ID may be printed on the printed hardcopies of the voting inputs which are collected in the ballot box. This will allow the electronic record and the physical record to be easily compared, and a voting booth or polling station which has been compromised may be identified by detecting a discrepancy between the electronic record and the physical record originating from this voting booth or polling station.
Alternatively or additionally, the voting inputs for each voting system may be provided with a sequence number. In this case the sequence number may be stored along with the electronic versions of the voting inputs and printed on the printed hardcopies. This will make it even easier to confirm that the election has been conducted in a reliable, correct and trustworthy manner, or to detect any discrepancies between the electronic record and the physical record, which could indicate that the votes have been tampered with or the system has in other ways been compromised. The sequence number may include a unique ID identifying the input device or voting booth where the voting input was received.
The voting system may further comprise a transparent shielding arranged between the input device and the printing device. As described above, the voter must have access to the input device in order to allow the voter to cast his or her vote by providing a voting input via the input device. The printing device prints the hardcopies of the voting inputs. Accordingly, the printed hardcopies are provided in a region where the printing device is positioned. The transparent shielding is arranged between the input device and the printing device, and constitutes a physical barrier between the input device and the printing device. Accordingly, the transparent shielding separates the input device from the printing device, and thereby it separates the voter from the printed hardcopy of the voting input. Thus, the transparent shielding prevents the voter from gaining physical access to the printed hardcopy, i.e. the voter is prevented from touching the printed hardcopy. However, since the shielding is transparent, the voter is allowed to view the printed hardcopy through the shielding.
Thus, according to this embodiment, it is the transparent shielding which ensures that the printed hardcopy of the voting input can be displayed to the voter in a tamper proof manner.
The transparent shielding could, e.g., be or comprise a window, e.g. made from glass, plexiglass, or any other suitable transparent material. The window could, e.g., be in the form of a privacy screen, which is only transparent for a person positioned directly in front of the window. Thereby persons positioned displaced from the window will not be able to view the printed hardcopy, and thereby the privacy of the voters can be ensured without requiring that the input device is arranged inside a voting booth, or in other ways visually shielded.
The ballot box may be arranged on the same side of the transparent shielding as the printing device. Thereby the printed hardcopy of the voting input can be transferred from the printing device to the ballot box without leaving the region where the printing device is positioned, notably without crossing the transparent shielding.
Furthermore, the ballot box may be positioned in such a manner that the voter is able to view the ballot box, or at least an opening of the ballot box through which the printed hardcopies of the voting inputs are received, through the transparent shielding. This will allow the voter to see that the reviewed and verified printed hardcopy of his or her voting input is actually received in the ballot box. This even further increases the level of trust of the voting system.
The voting system may further be arranged to receive a verification input from the voter, and the printed hardcopy of the voting input may only be transferred to the ballot box upon receipt of a verification input.
According to this embodiment, when the voter has provided his or her voting input via the input device, the printing device prints the printed hardcopy of the voting input, and the printed hardcopy is displayed to the voter. The voter then reviews the printed hardcopy of the voting input and ensures that it reflects the true intensions of the voter, including that it corresponds to the voting input provided via the input device and that the voting input is correct. Once the voter has ensured that the printed hardcopy truly reflects his or her intentions, the voter can provide a verification input, thereby indicating that the printed hardcopy is correct and has been verified by the voter. Upon receipt of this verification input, the printed hardcopy of the voting input is transferred to the ballot box. If no verification input is received, the printed hardcopy of the voting input is not transferred to the ballot box, and the voting input will therefore not count as a valid vote.
The verification input may be provided via the input device. In this case the input device may comprise a button, input field or the like which allows the voter to input the verification input. In the case that the input device is or comprises a touch sensitive display, a list of candidates, 'Yes'/'No' fields, etc. may initially be displayed on the touch sensitive display, allowing the voter to input a voting input. Once the voting input has been provided the 'voting input view' may be replaced by a 'verification view' in which a verification field is displayed. The voter may then provide a verification input by touching the verification field.
Alternatively, the verification input may be provided by means of a separate device, e.g. by pulling a handle, pushing a physical button, etc.
The voting system may further be arranged to receive a cancellation input from the voter, and the printed hardcopy of the voting input may not be transferred to the ballot box if a cancellation input is received. Preferably, the printed hardcopy in this case receives a permanent mark, e.g. ink, holes, or is shredded.
According to this embodiment, the voter is allowed to cancel or discard his or her vote. This could, e.g., be relevant if the voter observes that the printed hardcopy of his or her voting input is not in accordance with the voting input provided by the voter. It could also be relevant if the voter realises that he or she has made an error during input of the voting input, and the voting input, including the printed hardcopy thereof, therefore does not reflect the true intensions of the voter. Finally, it could be relevant if the voter changes his or her mind.
Similarly to the verification input described above, the cancellation input may be provided via the input device or via a separate device, such as a handle, a push button, etc.
Thus, according to this embodiment, if the voter inputs a cancellation input after having reviewed the printed hardcopy of the voting input, the printed hardcopy is marked and/or not transferred to the ballot box, and accordingly the voting input does not count as a valid vote. Instead the printed hardcopy may be discarded.
For instance, the voting system may further comprise a cancellation ballot box, and the printed hardcopy of the voting input may be transferred to the cancellation ballot box upon receipt of a cancellation input. According to this embodiment the cancelled or discarded printed hardcopies of voting inputs are collected in the cancellation ballot box. Thereby these cancelled votes can be accounted for after the election has been completed.
When a printed hardcopy representing a cancelled voting input has been transferred to the cancellation ballot box the voter may be offered a new opportunity to cast his or her vote. Thereby it is ensured that each voter is allowed to cast one, and only one, vote.
The voting system may further comprise means for providing the printed hardcopy of the voting input with a cancellation mark upon receipt of a cancellation input. According to this embodiment, each printed hardcopy representing a cancelled vote is marked appropriately in order to indicate that this should not count as a valid vote. Accordingly, in the case that one or more of the printed hardcopies representing cancelled votes are mixed with the valid votes received in the ballot box, these cancelled votes can be identified and removed prior to or during counting of the votes. This also allows all of the cancelled votes to be transferred to the ballot box, since they can easily be identified and discarded during counting of the votes.
The cancellation mark is preferably a permanent cancellation mark, and the cancellation mark may be of a kind which is visible as well as machine readable, thereby allowing the cancelled votes to be identified by visual inspection as well as by means of an automatic counting process.
Upon cancellation, if sequence numbers are used, it is preferable that the electronic record is marked with cancellation, and that the printed hardcopy receives a permanent mark and is subsequently transferred to the ballot box. The mark should be visible to the voter before the printed hardcopy is transferred to the ballot box. Upon verification, the electronic record may be marked with a verification identifier.
According to one embodiment, the voting system may be arranged to receive a verification input as well as a cancellation input from the voter. In this case the voting process may be performed in the following manner. Initially the voter provides a voting input via the input device, in the manner described above. Next the printing device prints a hardcopy of the voting input and this is displayed to the voter in a tamper proof manner, e.g. behind a transparent shielding as described above. The voter then reviews the printed hardcopy, and in the case that the voter finds that the printed hardcopy is in accordance with the provided voting input and with the true intensions of the voter, the voter provides a verification input, and the printed hardcopy is transferred to the ballot box. On the other hand, in the case that the voter finds that the printed hardcopy is not in accordance with the provided voting input and/or with the true intensions of the voter, the voter provides a cancellation input, and the printed hardcopy is discarded, e.g. by transferring it to a cancellation ballot box. The voter may then be offered a new opportunity to cast a vote.
The verification input and the cancellation input may, e.g., be provided via separate fields on a touch sensitive display of the input device or via two separate push buttons. Alternatively, the verification input may be provided by pushing a handle in one direction, and the cancellation input may be provided by pushing the handle in an opposite direction.
The voting system may further comprise a second printing device arranged to print a second hardcopy of the voting input, the second hardcopy of the voting input being accessible for the voter. According to this embodiment, an additional hardcopy of the voting input is generated. This additional hardcopy is accessible for the voter, and the voter may therefore retrieve this additional hardcopy and bring it out of the voting booth. For instance, this may be used for allowing the voter to exit a voting booth with the additional hardcopy and slip the additional hardcopy into a conventional ballot box, e.g. in order to allow for press photographs.
As an alternative, the voter may bring the additional printed hardcopy of the voting input home, e.g. as a receipt for the cast vote.
If the second printed hardcopy works as a receipt rather than a duplicate of the vote, then the receipt could contain information that could allow a voter to verify that his or her vote has been registered. It is possible that such retrieval allows verification both with and without knowing what vote was cast by the voter.
The electronic storage may be offline. According to this embodiment, the electronic storage is not connected to a computer network, such as a Wi-Fi network, the Internet, a local wired network, etc. This considerably reduces the risk of unauthorized access to the voting system, notably to the electronic storage. This increases the reliability and the level of trust in the electronic part of the voting system, and thereby of the electronic record of voting inputs.
According to this embodiment, the voting system may correspond to a single voting booth, i.e. each voting booth may have its own input device, electronic storage, printing device, ballot box, etc. When the polling stations have been closed and the votes are to be counted, the electronic records and the printed hardcopies of the voting inputs collected in the ballot boxes of the respective voting booths may either be counted separately on site, or the electronic storages and the ballot boxes may be transferred physically to a central location where the counting is performed.
Thus, the electronic storage may be removable, in which case the electronic storage can be set to a read-only mode upon removal from the voting system. According to this embodiment, when the polling station has been closed, the electronic storage may be physically removed from the voting system in order to physically transfer the electronic storage, and thereby the electronic record of voting inputs stored therein, to a central location. Upon removal from the voting system, the electronic storage is set to a read-only mode in order to ensure that the electronic record received at the central location is identical to the electronic record generated at the voting system. The electronic storage may be automatically set to the read-only mode when it is removed from the voting system. Such electronic records can then easily be connected to a local computer network and uploaded to a central authority for quick counting of all cast electronic votes.
The electronic storage may further be provided with a storage ID identifying which voting system the electronic storage has been arranged in. Thereby the electronic record stored in a given electronic storage can always been traced back to the voting system where the electronic record was generated. In the case that the ballot box of this voting system is provided with the same ID, a correspondence between a given electronic record and a ballot box containing the corresponding printed hardcopies of voting inputs can always be established. Thereby it is possible to check whether or not the electronic record and the physical record of voting inputs originating from a given voting system, e.g. from a given voting booth, are identical, and in case of fraud or irregularities, a compromised voting booth can be identified.
The removable electronic storage may, e.g., be in the form of a universal serial bus (USB) stick or a similar portable memory device.
The voting system may further comprise a vacancy indicator indicating whether or not the voting system is vacant and ready to receive a new voting input. The vacancy indicator may, e.g., be in the form of a light indicator signalling whether or not a given voting booth or input device is ready to receive the next voter. Thereby a voter entering a polling station can readily see which voting booths are vacant and which are occupied.
The vacancy indicator may be provided with one or more sensors. This could, e.g., include a proximity sensor detecting whether or not a voter is present in the vicinity of the input device. In this case the vacancy indicator may signal that the voting booth is occupied as long as the presence of a voter is detected, and the vacancy indicator may signal when the presence of a voter is no longer detected, or when a predefined time interval has elapsed since the presence of a voter was detected. Such a proximity sensor may also be used for ensuring that only one vote is cast per session, and thereby per voter. For instance, the voting system may be arranged to only allow a new voting input to be provided when the proximity sensor has detected that the previous voter has left the voting booth.
In the case that the voting booth is provided with one or more doors through which the voter must enter and exit the voting booth, the door(s) may be provided with sensors for detecting opening and/or closing of the door(s). This can be used for determining whether or not a voter is present in the voting booth.
The voting system may further comprise a voter identification device for identifying an identity of a voter prior to receiving a voting input from the voter. According to this embodiment, a voter casting a vote is subject to appropriate identification of the voter. Thereby it can be ensured that a given voter is in fact entitled to vote, and that each voter is only allowed to cast one vote. The voter identification may take place prior to allowing the voter access to the voting system.
The voter identification device may comprise a biometric reader. The biometric reader may, e.g., be in the form of an iris scanner, a fingerprints scanner, a facial recognition device, or any other suitable kind of biometric reader. According to this embodiment, the voter is uniquely identified on the basis of relevant biometric information, such as the iris, fingerprint, etc. of the voter.
The biometric information obtained by means of the biometric reader may be sent to a central storage facility, possibly along with a photo of the voter, and/or possibly including time stamp and/or location information. Thereby the biometric information may be compared to stored information regarding the identities of persons being entitled to vote, and thereby the voter can be identified based on the biometric information. Furthermore, the biometric data may also be compared to biometric data previously obtained from the voting system or from a similar voting system arranged in a different place. Thereby a voter attempting to cast more than one vote can be detected, and the voter can be prevented from casting the second vote. Additionally, because biometric readers are not perfect, when a duplicate is detected, the image of those two duplicate voters can be displayed to a central authority. If the images reveal that this is two different persons, then the voter can be cleared to proceed. If the images reveal that it is the same person in both instances, then the voter can be denied this second attempt to cast a vote.
Alternatively or additionally, the voter identification device may comprise an input device arranged to receive a password from a voter. According to this embodiment, the voter identifies herself or himself by means of a username and password. Alternatively or additionally, the voter may be identified by means of a token or the like, e.g. in the form of a social security card or an identity card.
The voting system may further comprise at least one camera for monitoring the input device, the printed hardcopy of the voting input and/or the voter. According to this embodiment, a camera captures the input device, the printed hardcopies of the voting input and/or the voters during the course of the election. This may be used for subsequently identifying irregularities of the election. If the voting system is disconnected from networks, the cameras can still be network connected.
In the case that a camera monitors the input device, it can subsequently be investigated whether or not the vote registered for a given voter corresponds to the voting input which the voter provided via the input device. It can also be investigated whether or not a given voter is casting more than one vote.
In the case that a camera monitors the printed hardcopy of the voting input, it can subsequently be investigated whether or not the printed hardcopies of voting inputs contained in the ballot box when the polling station has been closed correspond to the hardcopies of voting inputs which have been printed during the course of the election. It can also be monitored whether or not the printed hardcopies of voting inputs are in fact transferred to the ballot box. The camera could also count each vote cast by identifying the cast vote. This would then allow for a voting system which is fully offline combined with an online camera system for also counting the votes.
In the case that a camera monitors the voter, it can be investigated whether or not the same voter has attempted to vote more than once, e.g. at different polling stations.
According to a second aspect the invention provides a method for casting a vote using a voting system according to the first aspect of the invention, the method comprising the steps of:

a voter entering a voting input via an input device,
storing an electronic record of the voting input in an electronic storage,
printing a hardcopy of the voting input by means of a printing device,
displaying the printed hardcopy to the voter in a tamper proof manner, and
transferring the printed hardcopy of the voting input to a ballot box.

The method according to the second aspect of the invention is performed using a voting system according to the first aspect of the invention. The remarks set forth above with reference to the first aspect of the invention are therefore equally applicable here.
Thus, in the method according to the second aspect of the invention, a voter wishing to cast his or her vote initially approaches the input device and enters a voting input via the input device. This may be subject to an identification of the voter, as described above.
An electronic record of the entered voting input is stored in an electronic storage, thereby forming part of an electronic record of the voting result, and a printing device prints a hardcopy of the voting input. The printed hardcopy of the voting input is displayed to the voter in a tamper proof manner, i.e. in a manner which allows the voter to view the printed hardcopy in order to verify it, but not to gain physical access to the printed hardcopy. The printed hardcopy of the voting input is finally transferred to a ballot box, thereby forming part of a physical record of the voting result. The transfer of the printed hardcopy of the voting input may be subject to the voter verifying the printed hardcopy of the voting input.
The electronic records and/or the printed hardcopies may contain encrypted information that further allows for verification of validity and that no fraud has taken place. Such information can also be used in a system where voters can later verify that their vote has been registered and/or what their cast vote was.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will now be described in further detail with reference to the accompanying drawings in which

Fig. 1 is a perspective view of a voting system according to a first embodiment of the invention,
Fig. 2 is a perspective view of a voting system according to a second embodiment of the invention,
Fig. 3 is a diagrammatic view of a voting system according to an embodiment of the invention,
Figs. 4-7 illustrate an input device for a voting system according to an embodiment of the invention while performing a method according to an embodiment of the invention, and
Figs. 8-11 illustrate an input device for a voting system according to an embodiment of the invention while performing a method according to an alternative embodiment of the invention.

DETAILED DESCRIPTION OF THE DRAWINGS

Fig. 1 is a perspective view of a voting system 1 according to a first embodiment of the invention. The voting system 1 can be used by voters for casting votes during an election or referendum, and the voting system 1 keeps an electronic record as well as a physical record of the votes cast by the voters.
The voting system 1 comprises an input device 2 arranged to receive a voting input from a voter. The input device 2 could, e.g., be in the form of a touch sensitive display allowing the voter to select a desired voting input by touching a part of the touch sensitive display where the desired voting input is displayed. Alternatively, the input device 2 could be of any other suitable kind, such as a keyboard, a computer mouse, push buttons, etc. The voting input could be in the form of the name of a candidate, the name of a party, 'Yes' or 'No' in the case of a referendum, etc.
When a voter has entered a voting input via the input device 2, an electronic version of the voting input is sent to an electronic storage (not shown). Thereby the electronic storage stores an electronic record of voting inputs provided via the input device 2, i.e. an electronic record of the result of the election or referendum.
Furthermore, the voting input is communicated to a printing device (not shown). In response thereto the printing device prints a hardcopy 3 of the voting input. The printed hardcopy 3 is positioned behind a transparent shielding in the form of a transparent screen 4, via a slit 5. The transparent screen 4 allows the voter to view the printed hardcopy 3 of the voting input, but the voter is not able to gain physical access to the printed hardcopy 3. Thereby the voter, as well as third parties, is prevented from tampering with the printed hardcopy 3.
The printed hardcopy 3 of the voting input is positioned on a pivotal tray 6 which is connected to a handle 7 which can be manipulated by the voter. When the voter has viewed the printed hardcopy 3 of the voting input, he or she can decide whether the printed hardcopy 3 of the voting input is to be verified or cancelled.
In the case that the voter finds that the printed hardcopy 3 corresponds to the voting input which the voter provided via the input device 2, and that it reflects the true intensions of the voter, the voter can verify the printed hardcopy 3 by moving the handle 7 in the direction indicated by arrow 8. This causes the pivotal tray 6 to pivot in such a manner that the printed hardcopy 3 of the voting input falls from the pivotal tray 6 and into a ballot box (not shown). The voter may be able to see the printed hardcopy 3 falling from the pivotal tray 6 into the ballot box.
Similarly, in the case that the voter finds that the printed hardcopy 3 does not correspond to the voting input which the voter provided via the input device 2, and/or that the printed hardcopy 3 does not reflect the true intensions of the voter, e.g. because the voter made an error while entering the voting input or because the voter changed his or her mind, the voter can cancel the printed hardcopy 3 by moving the handle 7 in the direction indicated by arrow 9. This causes the pivotal tray 6 to pivot in an opposite direction, and the printed hardcopy 3 is not transferred to the ballot box. Instead the printed hardcopy 3 may fall into a cancellation ballot box (not shown).
The handle 7 or the part of the voting system 1 near the handle 7 should preferably be clearly marked to indicate to a voter if movement of the handle 7 in a given direction will result in a verification or a cancellation of the printed hardcopy 3.
The handle 7 could be replaced by another suitable device, such as a push button, or the verification and/or cancellation input may be provided via the input device 2.
A camera 10 is arranged behind the transparent screen 4 and directed towards the pivotal tray 6. Accordingly, when a printed hardcopy 3 of a voting input is arranged on the pivotal tray 6, as illustrated in Fig. 1, the camera 10 captures an image of the printed hardcopy 3. The captured images can subsequently be used for determining whether or not the contents of the ballot box corresponds to the printed hardcopies 3 of voting inputs which were transferred to the ballot box during the election or referendum. This provides an additional option for validating the result of the election, and for identifying ballot boxes which have been compromised. The images captured by the camera 10 may be stored electronically.
Since an electronic record, in the storage device, as well as a physical record, in the ballot box, of the voting inputs is generated, the cast votes can be counted in a fast and accurate manner, while the result of the election or referendum is obtained with a very high level of trust.
Fig. 2 is a perspective view of a voting system 1 according to a second embodiment of the invention. The voting system 1 of Fig. 2 is very similar to the voting system 1 of Fig. 1, and it will therefore not be described in detail here.
However, the voting system 1 of Fig. 2 comprises an opening 11 formed in a front panel of the voting system 1. The opening 11 is in communication with an additional printing device (not shown) or with the printing device which prints the printed hardcopy 3 of the voting input. Thereby a second hardcopy 12 of the voting input can be printed and made accessible for the voter via the opening 11. This will allow the voter to bring the second hardcopy 12 along, e.g. in order to place the second hardcopy 12 in a second ballot box (not shown), for instance with the purpose of allowing traditional photographs of celebrities casting their vote to be taken, or simply in order to allow the voter to obtain a printed receipt for the voting input.
Fig. 3 is a diagrammatic view of a voting system 1 according to an embodiment of the invention. The voting system 1 comprises an input device 2 which is accessible for a voter casting his or her vote, essentially as described above with reference to Fig. 1.
The input device 2 communicates with an electronic storage 13 and a printing device 14 arranged within a physical shielding 15 preventing the voter from gaining access to the electronic storage 13 and the printing device 14.
When the voter has provided a voting input via the input device 2, an electronic copy of the voting input is communicated to the electronic storage 13 where it is stored. Accordingly, the electronic storage 13 keeps an electronic record of the voting inputs provided by voters via the input device 2.
Furthermore, the voting input is communicated to the printing device 14, and in response thereto the printing device 14 prints a hardcopy 3 of the voting input. This hardcopy 3 of the voting input is displayed to the voter in a tamper proof manner, e.g. behind a transparent screen as described above with reference to Fig. 1. The printed hardcopy 3 of the voting input is then transferred to a ballot box 16, possibly subject to a verification input provided by the voter. The ballot box 16 is also arranged within the shielding 15 and is therefore inaccessible for the voter.
The input device 2 is further arranged to communicate with a second printing device 17 being arranged to print a second hardcopy 12 of the voting input. The second printing device 17 is arranged outside the shielding 15, and thereby the second hardcopy 12 is available to the voter. The voter may therefore bring the second hardcopy 12 along and either position it in a second ballot box or bring it home, as described above with reference to Fig. 2.
The electronic storage 13 is removable, i.e. it can be removed from the voting system 1. Thereby the electronic record of the voting inputs provided via the input device 2 during the course of the election or referendum held by the electronic storage 13 can be transferred to a central location with the purpose of counting votes which have been cast by voters in several locations and using several voting systems 1. The electronic storage 13 may advantageously be automatically be set to a read-only mode when it is removed from the voting system 1, thereby minimising the risk that the electronic record of the voting input is tampered with.
Figs. 4-7 illustrate an input device 2 for a voting system according to an embodiment of the invention while performing a method according to an embodiment of the invention. The input device 2 illustrated in Figs. 4-7 comprises a touch sensitive display 18 and may, e.g., be or form part of a tablet or the like.
In Fig. 4 a list of candidates running for an election is displayed on the touch sensitive display 18. The voter can thereby provide a voting input by touching a part of the touch sensitive display 18 where the name of the candidate which the voter wishes to vote for is displayed.
In Fig. 5 the name of 'Candidate C' has been highlighted, indicating that the voter is touching this part of the touch sensitive display 18 because this is the candidate the voter wishes to vote for. Accordingly, the voter is in the process of entering a voting input corresponding to casting a vote on Candidate C.
In Fig. 6 the voting input 'Candidate C' has been registered by the voting system. In response thereto the registered voting input, i.e. 'Candidate C', is displayed on the touch sensitive display 18 along with a 'Verify' field and a 'Cancel' field. The voter may then either verify the voting input by touching the part of the touch sensitive display 18 displaying 'Verify' or cancel the voting input by touching the part of the touch sensitive display 18 displaying 'Cancel'. A printed hardcopy (not shown) of the voting input is also displayed to the voter in a tamper proof manner, and by selecting 'Verify' or 'Cancel' the voter also verifies or cancels, respectively, the printed hardcopy of the voting input.
In Fig. 7 the voter has verified the voting input, and the vote has therefore been duly registered by an electronic copy of the voting input being stored in an electronic storage and a printed hardcopy of the voting input being transferred to a ballot box. The input device 2 notifies the voter regarding this by displaying a message indicating that the vote has been accepted.
Figs. 8-11 illustrate an input device 2 for a voting system according to an embodiment of the invention while performing a method according to an alternative embodiment of the invention. Similarly to the embodiment illustrated in Figs. 4-7 the input device 2 illustrated in Figs. 8-11 comprises a touch sensitive display 18 and may, e.g., be or form part of a tablet or the like.
The embodiment illustrated in Figs. 8-11 is performed after the steps illustrated in Figs. 4 and 5. Thus, initially a list of candidates is displayed on the touch sensitive display 18, as illustrated in Fig. 4 and described above, and candidate C is selected, as illustrated in Fig. 5 and described above. However, in the embodiment illustrated in Figs. 8-11 a referendum is also conducted in addition to the election. Accordingly, once a candidate has been selected, the voter is allowed to cast a vote regarding the referendum. Therefore the proposition which the referendum relates to is displayed on the touch sensitive display 18 of Fig. 8, i.e. 'Proposition 472' along with the possibilities 'Yes' and 'No'. The voter can thereby provide a voting input by touching either the part of the touch sensitive display 18 showing 'Yes' or the part of the touch sensitive display 18 showing 'No', corresponding to the voter casting a vote in favour of or against, respectively, the proposition.
In Fig. 9 'Yes' has been highlighted, indicating that the voter is touching this part of the touch sensitive display 18 because the voter wishes to vote in favour of the proposition. Accordingly, the voter is in the process of entering a voting input corresponding to casting a vote in favour of the proposition.
In Fig. 10 both of the voter's voting inputs, i.e. 'Candidate C' as well as 'Yes' have been registered by the voting system, and these are displayed on the touch sensitive display 18 along with a 'Verify' field and a 'Cancel' field. The voter may then either verify the voting inputs by touching the part of the touch sensitive display 18 displaying 'Verify' or cancel the voting inputs by touching the part of the touch sensitive display 18 displaying 'Cancel'. The voter thereby verifies or cancels that these are the voting inputs which the voter wishes to provide, i.e. that this is in accordance with the true intensions of the voter.
In the case that the voter verifies the voting inputs, a printed hardcopy of the voting inputs is printed and displayed to the voter in a tamper proof manner. This may either be in the form of a single printed hardcopy including both of the voting inputs or in the form of two separate printed hardcopies.
Next, the voter is requested to verify that the printed hardcopy is in accordance with the entered voting inputs, i.e. that the printed hardcopy reflects that candidate C was selected and that a 'Yes' to the proposition was entered. This is illustrated in Fig. 11.
The voter may then either verify or cancel the printed hardcopy of the voting input by touching the part of the touch sensitive display 18 displaying 'Verify' or 'Cancel', respectively. In the case that the voter verifies the printed hardcopy, the printed hardcopy is transferred to a ballot box and the vote is registered. In the case that the voter cancels the printed hardcopy, the printed hardcopy may be discarded, i.e. it is not transferred to the ballot box. Alternatively or additionally, the printed hardcopy may be marked with a cancellation mark indicating that this is not a valid vote. The printed hardcopy may then either be transferred to the ballot box, transferred to a cancellation ballot box or discarded. The voter may then be allowed to cast a new vote.
Finally, the input device 2 may communicate to the voter that the vote has been duly accepted, as illustrated in Fig. 7.

Claims

A voting system for use by voters to cast votes during an election, the voting system comprising:
- an input device arranged to receive a voting input from a voter,

- an electronic storage arranged to store an electronic record of voting inputs from a plurality of voters, received via the input device,

- a printing device arranged to print a hardcopy of a voting input received via the input device, and to display the printed hardcopy to the voter in a tamper proof manner, allowing the voter to review and verify the printed hardcopy of the voting input, and

- a ballot box arranged to receive and store the printed hardcopies of voting inputs.
A voting system according to claim 1, further comprising a transparent shielding arranged between the input device and the printing device.
A voting system according to claim 2, wherein the ballot box is arranged on the same side of the transparent shielding as the printing device.
A voting system according to any of the preceding claims, wherein the voting system is further arranged to receive a verification input from the voter, and wherein the printed hardcopy of the voting input is only transferred to the ballot box upon receipt of a verification input.
A voting system according to any of the preceding claims, wherein the voting system is further arranged to receive a cancellation input from the voter, and wherein the printed hardcopy of the voting input is not transferred to the ballot box if a cancellation input is received.
A voting system according to claim 5, further comprising a cancellation ballot box, and wherein the printed hardcopy of the voting input is transferred to the cancellation ballot box upon receipt of a cancellation input.
A voting system according to any of the preceding claims, further comprising means for providing the printed hardcopy of the voting input with a cancellation mark upon receipt of a cancellation input.
A voting system according to any of the preceding claims, further comprising a second printing device arranged to print a second hardcopy of the voting input, the second hardcopy of the voting input being accessible for the voter.
A voting system according to any of the preceding claims, wherein the electronic storage is offline.
A voting system according to any of the preceding claims, wherein the electronic storage is removable, and wherein the electronic storage can be set to a read-only mode upon removal from the voting system.
A voting system according to any of the preceding claims, further comprising a vacancy indicator indicating whether or not the voting system is vacant and ready to receive a new voting input.
A voting system according to any of the preceding claims, further comprising a voter identification device for identifying an identity of a voter prior to receiving a voting input from the voter.
A voting system according to claim 12, wherein the voter identification device comprises a biometric reader.
A voting system according to claim 12 or 13, wherein the voter identification device comprises an input device arranged to receive a password from a voter.
A voting system according to any of the preceding claims, further comprising at least one camera for monitoring the input device, the printed hardcopy of the voting input and/or the voter.
A method for casting a vote using a voting system according to any of the preceding claims, the method comprising the steps of:
- a voter entering a voting input via an input device,

- storing an electronic record of the voting input in an electronic storage,

- printing a hardcopy of the voting input by means of a printing device,

- displaying the printed hardcopy to the voter in a tamper proof manner, and

- transferring the printed hardcopy of the voting input to a ballot box.