offer new ways to ensure privacy and secure audit trails.

Punchscan is described as a “vote capture system.” What it offers is a means for counting encrypted OpScan ballots that are auditable, secure, and private. The voter can verify his or her vote, and it provides for a transparent count. The system was used successfully in a student election at

allows the computer program to decode the order candidates appeared so the vote can be computed accurately. The scanned ballot is then kept by the voter as a receipt.

Since the order of letters is scrambled separately on the top and bottom sheets, neither one alone is enough to say how the vote was cast. “You have an encrypted receipt,” Essex explains.

So is it going to be possible to have totally electronic
voting that is PRIVATE when cast, TRANSPARENT
when counted, and RELIABLE when reported?

the University of Ottawa and subsequently won the grand prize last year in the VoComp University Voting Completion.

For an explanation of how Punchscan works, David Chaum had me talk with Aleks Essex, currently a doctoral candidate at the University of Ottawa, who organized the field trial there.

Essex explains that Punchscan voters are handed a two-layer ballot and a bingo dauber (one of those foam-tipped inking devices used to mark the called numbers in a bingo game). The process involves multiple-choice selection for candidates where the A, B, C, D beside their names is printed in random order. Beneath the names, holes in the top layer show A, B, C, D printed on the bottom one—again in random order.

Voters mark the letter for the chosen candidate, and because the bingo dauber is a bigger than the hole, both layers get inked. The layers are ripped apart and one is fed to the shredder and the other to the scanner. A serial number on the ballot

After the election, the voter can go online and look up the serial number to see what Essex calls a “cartoon version” of the scanned ballot to check against the receipt so the voter can ensure the ballot was recorded as marked.

There are other safeguards, and those interested will want to check the Punchscan site, but the system isn’t perfect.

Chaum and his team have since released their work on Scantegrity, an updated system that addresses some of the issues that were raised with Punchscan.

“Scantegrity was born out of the Ottawa election,” explains Essex. “We achieved what we wanted to, but how could we make it better?” The team decided the bingo-daubers and two-page ballots had to go.

Scantegrity uses a more traditional fill-in-the-bubble optical scan ballot with a tear-off receipt that halves a bar code. Voters can mark the tear-off portion with the letters of the chosen candidates.