Remotegrity: Design and Use of an End-to-End Verifiable Remote Voting System

We propose and implement a cryptographically end-to-end verifiable (E2E) remote voting system for absentee voters and report on its deployment in a binding municipal election in Takoma Park, Maryland.Remotegrity is a hybrid mail/internet extension to the Scantegrity in-person voting system, enabling secure, electronic return of vote-by-mail ballots.It provides voters with the ability to detect unauthorized modifications to their cast ballots made by either malicious client software, or a corrupt election authority-two threats not previously studied in combination.Not only can the voter detect such changes, they can prove it to a third party without giving up ballot secrecy. Introductory RemarksIn 2009, the city of Takoma Park in Maryland, United States, became the first election authority (EA) to use a cryptographically end-to-end verifiable (E2E) voting system in a public election [4].This system, Scantegrity II [7], allows voters to verify their votes were counted correctly, while maintaining ballot secrecy.Scantegrity also provides a dispute resolution mechanism: in the event either the voter or the EA behaves maliciously, parties that follow the protocol should be able to prove their honesty to a third party (such as a democracy watch group).These integrity and dispute resolution protections afforded by the in-person nature of Scantegrity II, however, do not immediately extend to absentee voters submitting ballots by mail or online.Shifting from in-person to remote voting introduces new threats, including the possibility of malicious software on the voter's computer making unauthorized (and potentially undetected) modifications to ballot selections.Although this threat has been well studied in isolation, a major complication arises when simultaneously considering the problem of dispute resolution: a malicious EA caught cheating could spuriously blame the voters' clients for the malfeasance.In this paper we tackle the problem of protecting against malicious software on the voter's computer while simultaneously offering a dispute resolution procedure.To that end we present Remotegrity, a remote voting extension for Scantegrity designed to extend similar protections to absentee voters as those of voters attending the polling place.We propose the Remotegrity protocol and describe an implementation which was fielded in Takoma Park's municipal election in November 2011.Contributions.The main contributions of this paper include:1.The Remotegrity protocol, a remote voting system providing voters with the ability to detect and prove unauthorized changes made to their ballots by malicious client software or a corrupt election authority, 2.An implementation and case study of Remotegrity in a municipal election, 3. Lessons learned from the real-world deployment of voting systems research.