Reply #5: This doesn't protect the secret ballot, opening the door to vote buying and...

[meldroc]

Ballots used to be cast openly in the 19th century, so this became a serious problem. The Australian Secret Ballot was invented to put a stop to this.

Ron Rivest (cryptographer, security guru, the R in RSA) came up with a system that addresses these concerns, called the ThreeBallot system.

http://theory.lcs.mit.edu/~rivest/Rivest-TheThreeBallotVotingSystem.pdf

In a nutshell, it's designed to be used as an optical scan system, but there's no reason why you can't use a friendly touchscreen system that simply prints out ballots in the ThreeBallot way instead...

Basically, instead of casting one ballot, you cast three. To vote for a candidate, you fill the bubble for that candidate on two of the ballots, and it doesn't matter which two. You also have to vote against everyone else, to do that, you fill in the bubble on one of the ballots. In short, you can vote for one guy, but produce a ballot that makes it look like you voted for the other guy. The scanner at the ballot box will reject your ballots unless they're filled out just like this. When you submit your ballots, all three of them are printed with completely random serial numbers, which are hidden from you. You get to pick one of your three ballots, and the one you pick gets copied, and you get the copy, with the serial number, which you can take home with you, as all three of your ballots go in the box. Like I said, having a copy of one of the three ballots in your hand doesn't enable you to prove to vote buyers or extorters that you voted a certain way.

Once the election's over and tabulation begins, all the ballots are scanned and put on a web site like the OP suggested. This means that not just the county can tabulate the ballots, EVERYONE CAN. Not only that, you can look up your ballot using the serial number on the copy you took home, so you can make sure that ballot was counted correctly. You also get a list of the people who voted, though names are not associated with ballots, that way you can make sure your dead grandmother didn't vote a la Chicago.

Pretty clever - 100% transparent, but still preserves the secret ballot. There are still a few potential security issues even with this - you still have to have physical security for the ballot boxes, and poll watchers should be physically present during tabulation. There are also some potential attacks specific to this protocol that can be made by a bad guy who has access to the ballots before counting. But it does make election fraud significantly harder.