no peeking bill

[cleopatraxigalia]

"No Peeking" 2008

During the period when CDS polls are open, no individual shall be permitted to examine any files or data streams containing data generated by CDS voting machines. All such data shall be kept strictly confidential until the polls are closed and the results are certified by the Scientific Council and announced by the Chancellor.

Discussion:

In democratic societies one of the most important privileges of citizenship is the right to a secret ballot. Most democratic societies go to great lengths not only to ensure that an individual can cast an anonymous ballot, but that the security of the ballot box itself is maintained from the opening of the polls through the announcement of the official results. It is generally agreed (and specified by election laws in most democratic countries) that if any person were to be permitted to examine incoming voting data at any time during the polling there would be enormous potential for misuse of the information and serious impact on the final result. History and even current events are rife with examples of compromised "democratic" voting processes throughout the world that involve access to polling data prior to official certification.

To ensure that the voting process is not compromised either by manipulation of the data or by sharing of incomplete data, the CDS voting process should not require or allow any individual to access aggregate voting data while the polls are open. The current process provides every individual voter with a receipt, and in the event of a voting system failure, those receipts could be used to reconstruct any lost data.

[Beathan]

I can support this (with one caveat on timing), but I also want a sunshine in voting provision added to it, such as:

However, after the voting, but before certification, the voting data, including individual votes with the voter identification information redacted, shall be publically available to all citizens and shall be posted, as a historical document, on the CDS Wiki. This information should be in a form that can be used by citizens and factions to analyze the history of voting over time and in detail such that citizens and factions can discover (1) voting trends during an election (2) the "natural coalitions" of parties that share support among voters, (3) whether factions primarily enjoy support as a primary party or as a support or secondary party, and (4) whether there were voting improprieties or confusion that should be considered by the SC prior to certification of the result.

Beathan

[Jon Seattle]

There are several serious problems with this bill:

* Our elections are supervised by the Scientific Council, and so assuming “no persons” to include members of that body and those who volunteer for election work under their supervision, this would have to be a constitutional amendment.

* Right now a copy of every vote (without the voter identified) is sent to the Dean of the SC as soon as it is cast. The Dean is also able to compare his or her own tally against the aggregate reports. This provides an independent control insuring that the software is working and that vote counting is correct. This basic monitoring would be disallowed by this act.



The result of removing such monitoring would be to make vote manipulation by anyone with access to the server much easier than it is today.

* There is no technical way for someone running the election software to be kept from accessing the data if they wish, so implementation of this act is impossible.

* Any software system must be monitored to insure that it works as intended. This is especially true of our election software which does not yet include a complete user interface useable by a non-technically qualified person, requires extensive setup, and may require software changes dependant on changes in article 2 of the constitution.



In our case Borda counts and seat allocations were computed by two separate and independent programs and compared to make sure the system was able to produce the correct results after the polls closed. There would be no way to spot errors in the software without such monitoring.

* In case of any problem, either a technical error such as a storage or network failure, or a logic error such as a citizen who is unable to log in to vote, a developer must be able to examine system and transaction logs to determine what happened and how to correct the problem. This bill would disallow such examination.

Jonathan A. Smith
Software Architect, IT
Northwestern University

[Jon Seattle]

However, after the voting, but before certification, the voting data, including individual votes with the voter identification information redacted, shall be publically available to all citizens and shall be posted, as a historical document, on the CDS Wiki. This information should be in a form that can be used by citizens and factions to analyze the history of voting over time and in detail such that citizens and factions can discover (1) voting trends during an election (2) the "natural coalitions" of parties that share support among voters, (3) whether factions primarily ejoy support as a primary party or as a support or secondary party, and (4) whether there were voting improprieties or confusion that should be considered by the SC prior to certification of the result.

Well, much of the bill is seriously flawed, but I would very much support Beathan's provision. Making the voting data public would help protect against vote manipulation in future elections.

[Beathan]

Jon makes a good practical point. I think we have to add, at a minimum, "The limitations on examination of voting data during an election shall not apply to the Dean of the SC, any member of the SC appointed by the Dean to assist the Dean in administration of the vote, or to any other person who is charged with developing and operating the voting mechanism (software). However, all such people shall keep any information they have seen confidential except as otherwise provided herein."

Beathan

[Bromo Ivory]

I agree with this - and would add that the "sunshine policy" on the ballots cannot have any personally identifying information on it - such as names, time stamps or place where vote was cast.

I really like this.