Rivest invented the 3-ballot voting protocol (see https://en.wikipedia.org/wiki/ThreeBallot)

The trick to the 3-ballot voting protocol is that not everyone can validate their vote. However, when a group of voters band together, they should be able to validate that a subset of their votes (1/3) were registered with high probability.

With a sufficiently large group of voters checking results, the law of large numbers comes into play and they can statistically detect the presence of voting fraud.

It's an interesting idea whose utility depends on whether you think turning casting a valid vote for the intended candidate into a logic puzzle is a good thing

I like how the example ballot on that wikipedia page has Alex Jones running for president.

One can dream

Zero-knowledge \o/

Perhaps with asymmetric key encryption? So someone can validate that a vote was theirs, but you can't pin a vote to a person without them doing so. It would require that everyone understood key management, which is probably untenable

That doesn't guard against the lead pipe decryption strategy. The point is that you need a way to prove that a vote was yours, without any possible way to prove which vote was yours, whether you want to or not. I'm not a cryptography expert, but that sounds difficult if not logically impossible.

How about this: when you get into the booth you're given an ID. You then cast your vote for Ms A and you can see on the block chain that it was recorded for A. After you cast, the system shows you a bunch of ids on the chain which voted for other candidates and you can memorise the id shown that voted for Mr B. When people come round, you tell them that other id. When they look it up they see that it voted for B and leave you alone.

That doesn't solve the potential problem of vote stuffing... Still thinking about that one.

> When people come round, you tell them that other id.

That doesn't work if someone else has already told them the same ID.

However in this setup, anyone can bring a smartphone in and take a picture of the screen when it displays anything that separates your id from a fake one.

Sounds like you might be on the right track if you can get over that hurdle somehow.

The smartphone problem exists currently with paper ballots. You're not supposed to be allowed to bring a camera into the voting booth, but this is not enforced particularly well.

One approach to this problem is to make it easy to cancel a previous ballot and submit a new one, so you can get your evidence that you voted the way e.g. your employer wanted you to, but then you can cancel it and vote with your conscience.

In the Brazilian voting machine this is often done. You type the numbers and it loads the candidate info in the screen. Once you click [Confirm] the screen gets blank with the message of success. Therefore the only way to take a picture is before the vote is actually processed. You have a [Reset] button to re-enter the numbers.

As far as I can remember from the instructions last time I voted, in Britain you can do this, just return the ballot to the person handing them out and say that you made a mistake, and they should issue you a replacement.

How is lead pipe coercion currently handled?

There is no way to prove you voted one way or another with anonymous ballots, so there is no incentive to bribing or threatening violence to influence your vote.

The desired outcome is to prove that each vote came from a valid voter, while being impossible to prove which vote came from whom.

There is a cryptographic primitive that does just this allowing of plausible deniability whilst ensuring that only persons able to vote voted: Using Linked Ring Signatures.

> There is no way to prove you voted one way or another with anonymous ballots.

The coercing party can insist that you take a mobile phone picture of your ballot. This kind of coercion is common in some regions of Russia where civil servants and teachers are told by their superiors that they must vote for the preferred party “or else”, and a mobile phone picture is demanded as proof.

We try to combat this in two ways in Germany (not that it currently poses a problem but still): 1. Voters can destroy their ballot before putting it into the box and get a new one for any reason thus making it possible to create fake proof. 2. Taking pictures inside the booth is explicitly prohibited (which stated on signs in the booth) and if the poll workers notice you taking a picture they require you to destroy the ballot and fill out a new one. I actually had to do this to a women last election who wanted to post a picture on social media – and didn't turn off the shutter sound.

This requires the poll workers to be somewhat impartial. If they are not all bets are off. In the German Democratic Republic voters where socially pressured (by official policy) to not use the booths at all.

Taking pictures in the booth isn't actually prohibited. You can do it but the helpers will probably take your ballot and destroy it, then give you another one.

(An exception is when you are a government delegate voting for chancellor, in which case you pay a fine of 1000€, especially after the president has clarified this rule to new delegates repeatedly)

We've actually had members of parliament in the Netherlands proudly show of the selfies they took in the ballot booth with their ballot on Twitter, encouraging people to take selfies (nicknamed 'stemfies'; a portmanteau of vote ('stem') and selfie) to show that (and how!) you voted on social media.

The election council and a lot of privacy-conscious citizens weren't amused to say the least, but a subsequent ruling by a judge turned out that it isn't strictly speaking illegal, because the law doesn't explicitly prohibit photography in the ballot booth. So until parliament enacts a law that forbids it (like Germany), we are stuck with this rather dubious phenomenon.

At least we've banned voting computers for a good while — the ones we had ran closed source software and the votes cast couldn't be verified by the voters or the election council — so there's that.

It depends on your definition (there is no fine or anything) but it's now explicitly prohibited and poll workers are required to reject such voters (and give them a new ballot), see § 56 Abs. 2, 6 Nr. 5a BWO.

The way around this is to give each person 1 ballot for each of N candidates. 1 ballot goes into an envelope and into the vote box. N-1 ballots go into envelopes and into the discard box. It's trivial to show a photo of your ballot for Dr. Evil, but it would take a video of you going into the voting booth, closely following your hands to prevent three-card-monty, and continuing to follow you into the public lobby containing the vote and discard boxes. If you strictly enforce no recording in the public lobby, then there's no way for you to prove to your boss which box got your ballot for Dr. Evil in the end.

Edit: Perhaps I wasn't clear. Each of the N ballots is already filled out for a different candidate. The envelopes are all identical and sealed by you inside the voting booth. That way an existence proof of a ballot for the given candidate leaks absolutely no information. There are no empty paper ballots, and none of the paper ballots can leave the polling station. Ballots need to be counted both from the "vote" and from the "discard" boxes. Ballots missing from the discard box prove vote tampering.

Well there's no need for an elaborate scheme like this, certainly no need for video. The buyer gives a paper ballot that's already marked for Dr. Evil, and asks the vote seller to bring back the empty paper ballot to get paid. It's that simple :( and being done in the places which still uses paper ballots.

There are no empty paper ballots, and if a ballot is brought back, then it's not in the discard box. Since votes in the discard box are still tallied, if someone leaves the polling station with a ballot, it will be obvious that someone has tampered with the election.

You could just avoid counting any vote in the "count" box that doesn't have a matching vote in the "discard" box.

So you just need to take N photos with the correct voteon every ballot. No matter which will be discarted.

But each ballot is pre-filled out for a different candidate. The vote fixer already knows what's on all of your ballots, they just don't know which goes into which box. Photos showing what's on the ballot don't disclose any information. The attacker already knows that you have one ballot pre-filled for each candidate. The only secret is which ballot goes in which box.

You go into the voting booth, seal the N ballots in the N identical envelopes, being sure to keep track of where the ballot for your desired candidate is. You leave the voting booth and drop the one envelope in the vote box, and the N-1 envelopes in the discard box.

Even if you're forced to videotape inside the voting booth of your sealing the N ballots in the N identical envelopes, you could pull a quick 3-card-monty when leaving the voting booth. Even a quick random shuffle would be sufficient to statistically nullify your vote, or if you're only able to keep track of where the Dr. Evil ballot is, a quick deal from the bottom of the deck would guarantee a vote for a random opposition candidate. As long as there's some spot between the polling both and the ballot boxes that isn't covered by video, there's no way for a third party to know which ballot went where.

You aren't allowed to leave the polling station with any of the envelopes, and a tally of the ballots in the discard box will show what percentage of people have left the polling station with their discarded ballots. Any non-negligible percentage of "discard" ballots leaving the polling station will make the whole vote suspect. (The discard ballot count will also provide circumstantial evidence for which way the tampering is going, although Dr. Evil will always claim it's false flag vote tampering to make him look bad).

If someone is really coerced in sneaking their discard ballots out of the polling station, they could sneak N-1 ballots out and either put the ballot for Dr. Evil in the discard box or burn it right outside the polling station. They then show the jackbooted thugs the other N-1 ballots. They end up not voting, but at least Dr. Evil is denied the vote.

I suspect the envelope with the good ballot is sealed in some way. All they would have to do in that case is force you to take a picture of the sealed ballot with the non-desired ballots next to it.

All of the envelopes are identical. Absolutely the only difference is which envelope goes into which ballot box. Taking a photo of N-1 ballots for non-Dr. Evil next to one sealed envelope only discloses that the Dr. Evil ballot was put into an envelope first. It gives no information as to which box that envelope was placed into later, and therefore leaks no information about how the vote was cast.

Why is that any different from being anonymous on a blockchain?

It isn’t unless you have some way to verify your vote. Lots of blockchain ideas offer that, though.

Presumably you'd want a deniable system. So, something where you have a private key 'k', some function 'f', and the public chain 'p'. So, you compute:

r = f(k, p)

Suppose r may be 1 or 0. The meaning of 1/0 will be randomly distributed among the population, and will be made known to you when you place your vote, but at no other time. So, later on, you understand that a value of 1 means your vote counted for candidate A, but if someone tries to coerce you, you can realistically claim the opposite.

How do you know that the people tallying the vote have the same meaning for r?

(That is, how do you prevent a butterfly-ballot-style situation where people think they're voting for Gore, accurately cast a ballot that appears to them to be a vote for Gore, and actually end up casting an objectively valid vote for Buchanan?)

Maybe you could do a block tallying with verification scheme.

1. Enter your vote and receive an identifier

2. Group n identifiers into a batch ensuring not all votes in the batch are for the same candidate. Record the n identifiers into a block then randomly order the identifiers but don’t record the randomized sort order. Display the index of their identifier to each user but don’t record it. Record the actual vote in this (random) order to the block. Allow each voter to see all votes recorded in the block at each location (including the one only they know represents their vote). Allow the voter to manually tally the block to ensure the sum of symbols reflects their vote intent. Present to each voter cryptographic proof of the existence of the block and the net affect the block as a whole has on the vote tally for each candidate.

Each voter leaves with:

1. cryptographic proof of having voted

2. Cryptographic verification of the effect their vote had on vote tally

3. Ability to claim having voted for any candidate represented in their voting block/inability to prove to others who they voted for while being sure of how their vote was counted themselves.

Presumably you could generate some proof that the vote was correctly cast at the moment you cast it, and that 1 corresponds to A and 0 corresponds to B. But that proof would not be accessible after you leave the polling booth (because it'd require some ephemeral value that you could retain or throw away).

Preventing non-registered voters is the easy problem. Some signature systems allow blind signatures: I can create a ballot and encrypt the ballot. The government can sign the ballot, and then knowing my secret encryption key, I can decrypt the ballot and transform the government signature so that it matches the decrypted ballot. The signed but decrypted ballots can then be published using mixnets, Tor, or some other anonymous publishing mechanism.

As I remember, it's still an open problem to set things up (without requiring trusted hardware or trusting the government to destroy a private homomorphic encryption key) so that I can't later prove to Dr. Evil's jackbooted thugs that I voted for Dr. Evil.

Though, maybe there's some mechanism where I actually generate ballots for all candidates and only submit one of the ballots and it's impossible for me to prove which one I actually submitted, and I could cheat by submitting more than one ballot but there's a zero-knowledge proof that my ballots were for all of the N candidates, so in an American-style first-past-the-post voting system, submitting all of my ballots has the same effect as submitting none of my ballots.

There was a relevant discussion on the Bitcoin mailing list recently: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018...

One simple way (basically using Zerocoin/ZCash) is the following.

Every voter is issued one "vote coin" at registration time. There are special addresses for each candidate. Each voter sends their "vote coin" using a zero-knowledge/private transaction to the candidate of their choice. It's totally auditable, not possible to vote more than once, etc.

The main issue is in making it potentially easy to sell your vote, which as the OP was getting at is at the heart of the tension.

Politicians are already buying votes by promising future policies for specific groups before the election. This is supposed to be forbidden yet this occurs constantly.

Voters can sell their votes now. While unethical, it's not illegal and probably not worth combatting since, technically, that is the will of the voter.

But if properly implemented (use metal detectors to keep cameras and phones out of the voting booths), it's difficult to prove how you voted using paper ballots / old fashioned mechanical voting machines.

I don't see much problem in selling your vote if there's no way to verify that you're not ripping off the person buying the vote.

Most people don't vote at all. Find a big group of poor people, give them 10$ each for voting for your candidate and hope that they do what they were paid for.

No need for expensive high tech solutions. Just provide one of each possible ballot and a pen in the privacy of a booth. Fold the ballot, step out of the booth and give it to one of two officials which puts it in the ballot box for you.

Now you can take as many pictures you like of whatever ballot which proves nothing.

Elsewhere in this discussion, I suggested the same thing, except using envelopes instead of folding. You also need to separately tally the other N-1 discarded ballots to make sure they're not being brought out of the polling station. (Discarded ballots brought out of the polling station prove to jackbooted thugs that you didn't vote for the opposition.)

Though, I don't understand the purpose of the pen in the proposal. There's already one of every possible ballot, so you don't use the pen to mark candidates. You don't write your name on the ballot, as that would ruin anonymity. You don't cross-out the ballots that you don't cast, as that would open back up the weakness to photography. So, how is the pen used?

Also, what's the purpose of having the official put the ballot in the box instead of having the voter put the ballot in the box? Is it to prevent multiple votes from being cast? You need to have a discard box for the unused ballots and tally those discarded ballots in order to detect when the jackbooted thugs force people to walk out of the polls with their discarded ballots in order to prove how they didn't vote. Once you have this, you've also got multi-vote detection.

This scheme doesn't allow you to verify your vote was counted at the end of the day though.

If voters can sell their vote, they can also be COERCED to sell their vote at an unfair price. Coercion can disguise itself as "free will" when combined with privacy.

In the U.S., I believe it's illegal to buy or sell votes.

http://www.slate.com/articles/news_and_politics/net_election...

So this basically reduces democracy to "moneycrasy". Whoever has/can promise most money, wins. And then when they in power guess from where (whom) they will get back all the money that they spent? It's like saying, well it's your kidney, it should not be illegal to sell it...

> So this basically reduces democracy to "moneycrasy".

"Plutocracy".

That doesn't answer how the vote is anonymous. Presumably every coin/token has an unique identifier, and the issuer knows who received which coin.

And since it's a public blockchain, you know exactly which token went to whom.

> And since it's a public blockchain, you know exactly which token went to whom.

You don't (well, shouldn't) know with Z-Cash/Zerocoin

Also could use "homomorphic encryption" [1] which allows you to perform arithmetic on encrypted data without decrypting it.

[1] https://en.wikipedia.org/wiki/Homomorphic_encryption

Would zero knowledge proofs work for this?