diff --git a/pages/decisions.md b/pages/decisions.md index ec69967..2f92e2c 100644 --- a/pages/decisions.md +++ b/pages/decisions.md @@ -164,6 +164,58 @@ Machines used by all non-mail voters Cons: _[Question & answer edited: Feb. 8, 2018 meeting.]_ +### 8.4. If voters use machines to print ballots, should the machine store CVRs of ballots printed? + +Background: When a machine is used by voters to select choices that are +then printed on a voter verified ballot, the machine could save the +printed choices as a Cast Voter Record and used as an audit record +or for unofficial election night results. (Actually the machine might +record vote records with uncertain cast status, so would need to be linked +to a scan of an ID for a ballot when cast and inserted into the ballot box.) + +The recommendation is for the voter-verified paper ballot to be the +official record counted. However, machine-stored CVRs could be used as +official data if validated by a 100% scan of the cast paper record, or +else a reliable audit of the paper record. + +Voting machine stored CVRs Pros: +* Provides a separate audit record created election day +* Digital signatures can prove data was created by that machine on election day +* Preliminary results can be obtained without needing to scan ballots +* Most secure data records electronic+paper, both authenticate each other + +Voting machine stored CVRs Cons: +* Need ballot ID scan to distinguish a cast CVR from discarded CVR +* Need to collect data from each machine, possible extra hardware +* Extra high-sensitivity software might be needed +* Discrepancy doesn't prove paper is wrong +* Hacking CVR storage in voting machine software could disrupt elections + +### 8.4. Should a machine-printed ballot contain a bar code with a digital signature and/or CVR? + +Background: Machines that record voter selections and print a ballot can +easily add a bar code (e.g. 2D QR code) that could contain a digital +signature of the electronic representation of the printed choices, +possibly with the electronic CVR. A digital signature would function +as a check for accurate interpretation of a scanned ballot, and also +could validate the printout as being created on a particular machine +on election day (or early voting period). The signature prevents anyone +from replacing the paper ballot with a substitute, provided appropriate +digital signature protocols are implemented. + +The electronic CVR could be printed as a bar code as well, either as +a separate check or to assist the optical scan interpretation. + +\[Note, a digital signature could be printed as text, e.g. base64 letters +and numbers, but a pile of numbers is no more human readable than a bar code.] + +Ballots with digital signature bar codes Pros: +* Prevents tampering of paper ballots, either alterations or substitution +* Proves this paper was printed by a particular machine on particular day(s) + +Ballots with digital signature bar codes Cons: +* Some people dislike (do not trust) printing that is not human readable and verifiable + ### 8.5. If voting machines are used at a precinct, should there be one printer per voting station? Background: Each electronic voting station could be configured with a