"Vote Word" and Encrypted Receipts
No, this isn't about the contemporaneous paper record or "voter verified paper audit trail." A company called Voteword is marketing a system that purports to give voters a means by which to check that their votes were not only correctly captured, but also correctly counted. Their website describes this method of verifiability as follows:

State governments are poised to spend an enormous amount of money on the next generation of electronic voting booths. Many are considering systems that require printers in the voting place. This would be a good idea if printed ballots actually gave voters the ability to audit an election. But only one approach does this: the use of a "Vote Word".

Not only does a Vote Word give you the ability to check that your vote was registered correctly, it also allows you to look up your ballot days or weeks after the election to make sure that your vote hasn't been changed. And it does this without the need for scanners, "Smart" cards or printers.

Here's how it works. After you cast your vote, the electronic voting booth says:"Thank you for voting! Your Vote Word is... house"

That simple word, "house", is then recorded along with your selection(s). No one else gets that word at your polling location. Also, no one knows what your word is, just as you don't know anyone else's Vote Word.

Later, at home, you get on the Web, look up your polling location and scroll through everyone's votes (yes, everyone's). You'll find, listed alphabetically, the word "house" - along with your vote. You confirm that your selections were recorded correctly - and you can even check again after a re-count.

As described, the system sounds similar, though not identical, to the encrypted receipts proposed by David Chaum and Votehere (see here).

The problem with a plain old receipt showing all a voter's choices, of course, is that such a receipt could easily be used as proof of how the voter voted. They could thus be used in vote-buying or vote-selling schemes, or for purposes of voter intimidation (e.g., employers demanding that their employees provide proof that they voted for the correct candidate). Thus, no one seriously suggests using receipts showing the voter's actual choices that voters could take home with them. The idea behind these methods, if I understand them correctly, is to allow the voter -- but no one else -- to verify his or her choices.

The challenge, it seems to me, is to develop something that will both (a) be understandable enough to the voter that it will provide confidence that their votes were accurately counted, and (b) protect the anonymity of the ballots, so that votes can't be bought and sold. The question I still have is whether these receipts might not still be used for vote-buying and selling. For example, with the "Voteword" technology, couldn't a hypothetical vote-buyer demand to see the voter's "receipt" after she leaves the polling place, check it on the web to make sure that she voted for the right candidate, and then provide payment if so?

Still, these are intriguing ideas, worthy of further exploration.

Update: Paul Pazniokas who runs the voteword site writes in with two clarifications:

The most important is that there's no receipt whatsoever when you get your Vote Word. It's just something that displays on the screen. This tremendously cuts down on the possibility of vote selling, since you cannot prove who you voted for.

Some people have said, though, that you could still sell your vote: as you exit the polling location, you're the only who knows your Vote Word (it hasn't yet been posted to the web). But the simple addition of a display terminal at the polling site would permit people to see all the Vote Words and the associated votes. Thus, a person exiting the polling location could no longer claim to "prove" who he/she voted for because everyone has access to the list of votes before leaving the building....

The second point is that I'm not a company. I'm just one guy trying to figure out how to get this very simple solution into as many hands as possible.

Thanks for the clarification, Paul, and apologies for the original misunderstanding.

Maybe this will work, though I can still imagine means of sophisticated vote buyers defeating the system. For example, the would-be vote buyer could give each would-be vote seller a list instructing her on exactly what choices to make, from the top of the ballot all the way down to the bottom. Then, if the vote seller's reported "vote word" didn't match all of those choices, the vote buyer would know that the seller is lying and could deny payment. Of course, the vote seller could go through the list of all "vote words" and associated votes while at the polling place, until she found one that's a "match" for all the choices she'd been been instructed to make. But there might not be such a match among those who've previously voted and, in any event, trying to find that match for the appropriate ballot permutation would be very time-consuming where there's a lengthy ballot.

Thus, it seems to me, one could develop an almost foolproof system of vote-buying. On the other hand, it might be difficult to carry off in practice without being detected. And in any event, pulling off such as scheme would probably be more difficult than is the case with absentee ballots in their present form. This is the place in our system that's most suseptible to vote-buying, given that the anonymity of the ballot can be compromised -- i.e., someone can watch you mark your absentee ballot and sign the envelope, then can pay you $X and then place it in the mailbox for you. It's probably a whole lot easier to buy and sell absentee votes than it would be with the "Vote Word" system. So, the argument might go, if we tolerate absentee ballots, then we should be more than willing to bear the risks associated with this type of verification system, if the payoff is greater security and public confidence. - posted by Dan Tokaji @ 11:54 PM