Trusted Logic Voting S

with

OASIS EML 4.0

(Election Markup Language) 

C

http://www.oasis-open.org
Contents

• Trusted Voting Logic

– Needs, Approach and Implementa

• Using OASIS EML

– History, Overview, Processes, Tra

• Applying OASIS EML

– Example process steps and action– Supporting US-style elections

• Summary
Trusted Logic Voting 

•

How can we ensure the voting machin

cheat on the human operator who caninside”?

•

How can we know that every vote is co

• If you have two parties that you canno

you create a process that works betwea way that if either cheats you will know

•

How can you create an audit trail that 

crosschecking while keeping voter priv

•

Use existing work in the field on multi-

logic process 

(e.g. MIT approach using the 

*see: http://www.vote.caltech.edu/media/documents/vtp_WP2.pdf
Trusted Logic Conce

Party A Party B

Take whatParty A tells yo

u

ask Party B to tellyou what that information says

Compare the two

Keep secure copy Keep secure copy

1

2

3
Trusted Logic Applied to 

• First party creates record of the voters’• Voter selection information transferred • Second party then confirms what the fir

displays that information for the voter to 

• Confirmation uses write-once technolog

– paper ballots (pr

eferred medium today)

–

or “digital-paper”

– liquid crystal plastic that machine “writes

–

or write-once digital chips that insert into a computer slot (

M

• Process completes with three records r

–

What the first party said they did

–

The copy they passed to the second party

–

What the second party displays to the voter (pri

• Auditor can compare all three records –

match

* too costly today –

but may

be within fifteen years tim

e will be as cheap and ea
US Voting System Ex

DRE device

Voter

• Printed ballot• Voter Verified • Hand Cast

e-Vote record

Digital stor

a

g

e

Media (

write once)

Pa

Digital ballot recorde

d

e-Print record

2

1

4

Printproces

s

Storage pro

c

e

s

s

Actions:-choo

s

e

-print-confir

m

-compl

ete

-cast VVPB

Party A

Party B

XML XML

Send Vote Details

3

printing 

device

Party A

Print record stored

-

Trusted Logic Voting in actio
Core Trust Princip

•

Verifiable paper ballots

•

Matched e-Vote electronic reco

•

Electoral roll of voter participat

•

Private and anonymous

•

Secure 100% tallying and cros

•

Easy for citizens to understand 
Three Pillars of Tr

•

Electoral Roll 

–

managed by election officials and 

administered by voting staff

–

process designed to ensure anon

•

Electronic voting records

– generated by voter using voting s–

digitally recorded and stored by v

•

Matching Paper voting records

– generated by voter using voting s–

manually cast or mailed by voter 
Fundamentals of T

• 100% audit and comparison every ti

Trusted Pillar counts to produce a ceelection result

•

Separation required between each s

process; the trusted logic process is between the electronic and paper vo

•

No single system can control or acce

one of the Trusted Pillars processing to be distinct

•

Every paper vote record is scanned 

every matching electronic vote is stoseparately tallied
Balancing information c

•

A trusted logic process allows the 

effective information collection to secure voting process

•

Too much information compromis

anonymous voting in subtle ways

•

Too little information prevents eff

trails

•

Example: stamping votes with ma

good idea or bad idea?

•

Next we look at how OASIS EML 

on the information exchange deta
Quick Overview of EML

• His

t

o

r

y

–

Work begun in May 2001 

–

Charter: To develop a standard for the struct

data among hardware, software, and service pengage in any aspect of providing election or vpublic or private organizations 

–

UK government has implementations:

•

UK Local Election pilots held in May 2003. 

– http://www.oasis-open.org/committees

•

Council of Europe Endorsement

–

Council of Europe Ministers have endo

voting recommendations and with that http://europa.eu.int/ida/en/document/3294/358

•

EML 4.0 is a committee draft for review an

other countries in Europe now exploring u

Overview of EML and processing: http://www.idealliance.org/papers/xmle03
Category Overview o

One or more XML schemas series ar

support each general process area

•

Pre election

– Ele

c

tio

n (100)

–

Candidates (200)

–

Options (600)

–

Voters (300)

•

Election

–

Voting (400)

•

Post election

– R

e

s

ult

s (500)

– A

u

dit

–

Analysis

Some functwhole procespecific part•

Administra

•

Help Desk
Selected EML 4.0 Trans

Schema Name PurposeEML 110 –

election event Information about an election or set of el

communicate information from the electio

EML 210 –

candidate nomination Used to nominate candidates or parties, 

EML 230 –

candidate list Contest and candi

dates details

EML 310 –

voter registration Used to register voters for an election

EML 420 –

voter authentication Used for voter authentication during a vo

EML 440 –

cast vote Actual record of vote cast

EML 460 –

votes group Group of votes being transferred for coun

EML 480 – audit log Documents access t

o voting records and 

EML 510 -

count Results of election contest(s) and counts

EML 520 - result Communicating specific result details on 

EML 330 –

voter election list Details of actual voters for an election

EML 340 –

polling i

nformati

o

n Notification to voter of an election, their e

EML 410 –

ball

ot Describes the actual ballot to be used fo
OASIS EML 4.0 transac

•

Electoral Roll (EML 310, 330, 340)

–

managed by election officials and admin

staff

–

process designed to ensure anonymous 

•

Electronic voting records (EML 440, 4

– generated by voter using voting system–

digitally recorded and stored by voting s

•

Matching Paper voting records (EML 

– generated by voter using voting system–

manually cast or mailed by voter

– scanned electronically (EML 440, 480, 510
EML and US Voting E

2 Digital ballot recorded

-

Using EML formats in action -

Voting

• Printed ballot• Voter Verified • Hand Cast

e-Vote record

Digital stor

a

g

e

Media (

write once)

e-Print record

1

4

Printproces

s

Storage pro

c

e

s

s

Actions:-choo

s

e

-print-confir

m

-compl

ete

-cast VVPB

Printing device

XML XML

3

EML 440, 

Print record stored

EML formats:310, 330, 340,410, 420

EML formats:440, 480

EML format440, 480, 41
Reality of real-world 

•

Good solutions have to be adaptive and s

complex unpredictable world; they have t

•

Today’s paper-based voting have a cultu

and years of operational lessons learned

•

Need to have formalized documented pro

–

Council of Europe Ministers have endorsed th

steps for e-voting recommendations and with 

http://europa.eu.int/ida/en/document/3294/358

•

Expecting 100% perfection is unrealistic; 

has to be a best case –

that allows peopl

diagnose events and occurrences, e.g.:

–

someone forgot a voting card left in a voting m

–

the machine jammed; the disk is unreadable

–

someone keyed in the wrong setup code

–

the computer hardware failed
EU Procedures* (Processi

Items covered:•

Electoral roll and voter registrat

•

Voting process

•

Counting process

•

Verification and Certification

•

Equipment deployment, setup a

*see:

http://w

w

w.coe.int/T/e/inte

grate

d

_

projects/d

emocrac

y/02_Activities/02_ev

otin

g/01_Recomm
EU Procedures –

clarifying 

These trusted logic items should be a

1. Explicit reference to the importance of using writ

vote recording -

either paper or digital

2. Need for voters to be able to physically verify t

he

via paper ballot or equivalent physical representballot -

not an electronic ephemeral representati

that physical representation by hand

3. Need to separate the layers of the process -

so t

component provider is not doing all vote creatingcounting the total votes (no single solution provid

4. Need to use trusted logic principle so that the vo

the digital voting choice recorded matches the pchoice they selected
EU Procedures –

clarifying 

These ballot processing items should 

5. Need to compare 100% of all counts -

electronic 

counts and electoral record counts to ensure the

6. Explicit call-out of the need to avoid sequential p

information compromising vote privacy and anon

7. Explicitly call-out that overall election counts sho

independently for each of the sources -

electora

and voter verified (paper) ballot counts (after scaElectronic Ballot Imaging**).

* More indept

h technical o

peration level discussio

ns here: 

http://gnosis.cx/publish/voting/privacy-electronic-v

oting.

pdf

** Electronic Ballot I

maging - http://www-12

8.ibm.c

om/developer

w

orks/xml/library/x
How 

OASIS EMLviews process steps andseparationsElection:• Candidates• Ballot / Referendum• Voters• Voting• Results• Audit
Procedural requirem

•

One implementer cannot suppl

across more than one layer or 

•

Each layer must be autonomou

passes information to next layeformats that can be inspected a

•

Software involved must be pub

open source

•

Physical separation of layers a

associated with them
Process Overvie

Electoral roll and 

Confirm v

oter eligibility and verification

Maintain i

ndependent voter electoral roll

Provide lists of voter

s for a

c

c

ess to polls

Voting 

Dual path: paper and e-voting records

Processing uses open exchange formats

Not sole vend

or sol

uti

o

n

Counting proce

Scans pap

er ballots; tallies e-votes media

Verifies e-vote signatures and status lo

g

s

Compares counts from all three sources: paper, e-votes, electoral roll

Verification an

Artifacts storage to o

pen p

u

blic spec’s

Each comp

o

nent lab’ tested for interop’

Version control an

d sig

nature o

n software

Equipment ope

Gui

deli

nes for equipment behaviours

Access and deplo

yment needs
OASIS EML process 

•

The OASIS EML provides deta

part of voting process (see spefor exact details)

•

Next few slides show how thes

applied to a trusted logic voting 

more process details –

NIST / HAVA: http://vote.nist.gov/TGD

C/Process%20Model%202005
Projected US implementat

Digital stor

a

g

e

Media (

write once)

Se

n

d

Se

n

d

DRE device

display ballot;make choices

Printed ballot

e-Vote record

digital ballotrecorded

paper ballotcast

Polls close

Digital stor

a

g

e

Media (

write once)

e-Print record

Med

tallyi

Media

deliver

tallying

cent

2

1

3

4

5

RD

8

Printproces

s

St

ora

g

e process

Actions:-choo

s

e

-print-confir

m

-compl

ete

-cast VVPB

Precinct levelconsolidations(canvassing)

Precinct levelconsolidations(canvassing)
Action Process : Vo

DREentry

e-Vote

capture

ballot

printing

Records of what printe

e-Vote records

Dual-track trusted logicvoting

Printed ballot

Process A

Process 

XML XML

Confirm print done

Submit request

Digital stor

a

g

e

Media (

write once)

Digital stor

a

Media (

write 

1

2

4

Actions:-choo

s

e

-print-confir

m

-compl

ete

-cast VVPB

XML XML

XML XML EML f

440, 4

EML formats:440, 460, 48

0

EML 440

Local StorageDevice
Action Process : Cou

Review 

Process

e-Vote

tallying 

sc

Print ballot records

e-Vote records

Digital stor

a

g

e

medi

a

Digital stor

a

g

e

medi

a

Count Ver

Provisional

results

Compare

Vote records

and cou

nts

Rejectedballots

Acceptedballots

Verified Results

Initial Counting

1

3

4

Retrieve from storagedevices collected

Retrieve from storagedevices collected

Revie

w /

deferredballots

*Electronic Ballot Imaging - http://www-128.ibm.com/developer

w

orks/x

ml/library/xm

att
Action Process : Voter Ve

Electoral

Roll

Electoral records

Digital stor

a

g

e

medi

a

Depos

Provide random

voting token

Proceed to

Voting boot

h

1

2

3

Recycle vot

token

Token enabli

device

4

Digital voting 

KEY FACTOR: Avoid inadvertentsequential local information imprinting! D

m
Creating an open mark

•

Open trusted logic process that und

in the digital age

•

A healthy and open marketplace wh

range of service providers can delivto citizens, using off-the-shelf cost-ecomponents, that support and enhavoting system and experience

•

Based on open specifications that h

licensing and not encumbered by anproprietary technology

• Inform and guide legislators and ad
Summary – What EML 

• Allows implementation of truste

process combining paper and dballots 

• Details of the core elements an

interactions, safeguards and co

• Mechanisms and separations t

process and provide audit cros

• XML required to run all the exc• Open international public spec
Useful Resource

•

Website of Professor Rebecca Mercuri - http:

//www.notables

•

Brookings Institute Report -

Agenda for Election Reform -

http://www.brook.edu/comm/policybriefs/pb82.htm

•

CalTech site on ensuring voting integrity - http://vote.caltech.ed

•

NYVV -

Advantages of ballot scanners over DREs -

http://www.nyvv.org/paperballotVsDRE.htm

•

Analysis of counting irregularities in US elections - http://ide

•

MIT Study on accuracy of voting systems - http://vevo.verifiedvoting.org/vendors/studies/20040601_Ansolabe

•

Verified Voting site http://www.verifiedvoting.org

•

West Virginia procedures for optical scanning ballots -

http://www.wvsos.com/elections/eday/procedureselectronic.htm

•

Administration and Cost of Elections (ACE) - http://ww

w.acepr

•

Anecdotal reporting on 2004 US elections - http://www.lionsg

•

NIST Glossary of Ter

ms document – http://vote.nist.gov/TGDC/voting 

• IEEE P1622 - http://grouper.ieee.org/groups/scc38/1622/p1622_documen•

Overview of EML: http://www.idealliance.org/papers/xmle03/slides

•

Technical aspects vote processing: http://gnosis.cx/publish/voting

•

Trusted Logic Voting: http://drrw.net/backup/Trusted-Ballot-Proces