1. Ronald L. Rivest MIT NASEM Future of Voting Meeting June 12, 2017
Post-Election Audits
Ronald L. Rivest
MIT
NASEM Future of Voting Meeting
June 12, 2017

2. Who Really Won?

3. What happened? Who knows? How would you tell?
Recounts in WI, MI, PA stymied.
Did ``Patriotic Russian Hackers” corrupt the election??

4. Evidence-Based Elections
An election should not only accurately figure out who won, but should also provide convincing evidence that the winner really won. (Stark & Wagner 2012)

5. Outline Security Requirements Software Independence
Auditing Paper Ballots

6. Security Requirements

7. Security Requirements
Only eligible voters may vote, at most once.
Cast votes are secret (= secret ballot) even if voter wishes otherwise! No vote-selling! No receipt showing how you voted!
Final outcome is verifiably correct.
No ``trusted parties’’ – all are suspect! Vendors, voters, election officials, candidates, spouses, other nation-states, …

8. Software Independence
(Rivest & Wack, 2006)

9. And Who Do You Hope You Voted For?

10. Software Independence
Software is not to be trusted!
A voting system is software independent if an undetected error in the software can not cause an undetectable change in the election outcome.
Strongly software-independent if it is possible to correct any such outcome error
Example: Voter-verified paper ballots, with possible hand recount.

11. Paper Ballots

12. 1893 – “Australian” Paper Ballot

13. What is used now? Answer: 70-80% paper ballots
(Verified Voting)
(DRE = Direct Recording by Electronics (Touch-Screen)
VVPAT = Voter Verified Paper Audit Trail)

14. Election Process (paper ballots)
Print ballots; setup
Mark Choices; Verify Vote; Cast Vote!
Optical scanners give initial (“reported”) outcome
Statistical audit of cast paper ballots by hand to confirm/disprove reported outcome
“Brush your teeth; eat your spinach; audit your elections!” Vora

15. Auditing of Paper Ballots

16. Two auditing paradigms
Ballot-polling audits: Uses the cast paper ballots only. Like ``exit poll’’ of ballots…
Comparison audits: Compares paper ballot with corresponding electronic ``cast vote’’ records (CVRs)
Comparison audit more efficient by a factor of roughly (1 / margin-of-victory).

17. General audit structure
Cast Votes
Sample
Draw initial random sample of paper votes.
Interpret them by hand.
Stop if reported outcome is now confirmed to desired confidence level.
If all ballots now examined, you are done.
Otherwise increase sample size; return to 2.

18. Frequentist Risk-Limiting audit
(Frequentist) Risk-limiting audit: chance that an incorrect reported outcome is accepted as correct by audit is at most given risk limit α (e.g. 0.05).
Bravo [LSY’12] ballot-polling audit accumulates, over sampled votes, product of A/2 or B/2 where A, B are reported vote-shares for Alice, Bob. Audit stops when product exceed 1/ α .

19. ClipAudit [R17]
Suppose Alice and Bob are top two candidates, with Alice as reported winner, having a, b votes respectively in current sample.
Audit keeps expanding sample, examining more randomly-chosen ballots by hand, until a > b and ( a – b )2 > 3 ( a + b )
Risk limit α is about five percent.

20. Auditing other outcome rules

21. Other outcome rules Not all elections are plurality
Some are ranked-choice: ballot gives voter’s preferences: Alice > Charles > Dana > Bob
An ``outcome rule’’ maps a set of ballots to an outcome.
Example: IRV (Instant Runoff Voting) – Keep eliminating candidate with fewest first-choice votes until some candidate has a majority of first-choice votes. (Used in San Francisco)
How to audit complex outcome rules??

22. Bayesian risk-limiting audits [RS’12]
(Bayesian) risk-limiting audit: stops audit when chance that reported outcome is wrong is less than given risk limit (e.g. risk limit α = 0.05).
Bayesian audits are ``black-box”: they work for any outcome rule
Bayesian audits:
draw a random sample
produce variations of the sample
find winners of variant samples using outcome rule
iterate if not enough variants give reported outcome

23. ``Many half-samples’’ audit [R17]
Cast Votes
On laptop generate 1,000,000 “variant samples,” each a random half-size sample of the original sample.
Stop audit if >95% of all variant samples yield the reported outcome.
Draw sample
Sample
Variant
Variant
On laptop
Variant

24. Conclusions
We can make elections much more secure with post-election audits.

25. The End
Thanks for your attention!