End-to-end auditable or end-to-end voter verifiable (E2E) systems are voting systems with stringent integrity properties and strong tamper resistance. E2E systems often employ cryptographic methods to craft receipts that allow voters to verify that their votes were counted as cast, without revealing which candidates were voted for. As such, these systems are sometimes referred to as receipt-based systems.
Overview
Electronic voting systems arrive at their final vote totals by a series of steps: each voter has an original intent, voters express their intent on ballots (whether interactively, as on the transient display of a DRE voting machine, or durable, as in systems with voter verifiable paper trails), the ballots are interpreted, to generate electronic cast vote records, cast vote records are tallied, generating totals where counting is conducted locally, for example, at the precinct or county level, the results from each local level are combined to produce the final tally.
Classical approaches to election integrity tended to focus on mechanisms that operated at each step on the chain from voter intent to the final total. Voting is an example of a distributed system, and in general, distributed system designers have long known that such local focus may miss some vulnerabilities while over-protecting others. The alternative is to use end-to-end measures that are designed to measure the integrity of the entire chain.
The failure of conventional optical scan voting systems to meet
an end-to-end standard was pointed out in 2002.
Comprehensive coverage of election integrity frequently involves multiple stages. Voters are expected to verify that they have marked their ballots as intended, recounts or audits are used to protect the step from marked ballots to ballot-box totals, and publication of all subtotals allows public verification that the overall totals correctly sum the ballot-box totals.
While measures such as voter verified paper audit trails and manual recounts measure the effectiveness of some steps, they offer only weak measurement of the integrity of the physical or electronic ballot boxes. Ballots could be removed, replaced, or could have marks added to them without detection (i.e.,to fill in undervoted contests with votes for a desired candidate or to overvote and spoil votes for undesired candidates). This shortcoming motivated the development of the end-to-end auditable voting systems discussed here, sometimes referred to as E2E voting systems. These attempt to cover the entire path from voter attempt to election totals with just two measures: Individual verifiability, by which any voter may check that his or her ballot is correctly included in the electronic ballot box, and Universal verifiability, by which anyone may determine that all of the ballots in the box have been correctly counted.
Because of the importance of the right to a secret ballot, some E2E voting schemes also attempt to meet a third requirement, usually referred to as receipt freeness: No voter can demonstrate how he or she voted to any third party.
A researcher has argued that end-to-end auditability and receipt-freeness should be considered to be orthogonal properties. Other researchers have shown that these properties can co-exist, and these properties are combined in the 2005 Voluntary Voting System Guidelines promulgated by the Election Assistance Commission. This definition is also predominant in the academic literature.
To address ballot stuffing, the following measure can be adopted:
Eligibility verifiability, by which anyone may determine that all counted ballots were cast by registered voters.
Alternatively, assertions regarding ballot stuffing can be externally verified by comparing the number of ballots on hand with the number of registered voters recorded as having voted, and by auditing other aspects of the registration and ballot delivery system.
Support for E2E auditability, based on prior experience using it with in-person elections, is also seen as a requirement for remote voting over the Internet by many experts.