David Jablon wrote:
I think Ed's criticism is off-target. Where is the "privacy problem" with Chaum receipts when Ed and others still have the freedom to refuse theirs or throw them away?
The privacy, coercion, intimidation, vote selling and election integrity problems begin with giving away a receipt that is linkable to a ballot. It is not relevant to the security problem whether a voter may destroy his receipt, so that some receipts may disappear. What is relevant is that voters may HAVE to keep their receipt or... suffer retaliation... not get paid... lose their jobs... not get a promotion... etc. Also relevant is that voters may WANT to keep their receipts, for the same reasons.
It seems a legitimate priority for a voting system to be designed to assure voters that the system is working.
As long as this does not go against the 'first law' for public voting systems: voters must not be linkable to ballots. The 'second law' also takes precedence: ballots are always secret, only vote totals are known and are known only after the election ends.
What I see in serious voting system research efforts are attempts to build systems that provide both accountability and privacy, with minimal tradeoffs.
There is no tradeoff prossible for voter privacy and ballot secrecy. Take away one of them and the voting process is no longer a valid measure. Serious voting system research efforts do not begin by denying the requirements.
If some kind of tradeoff between accountability and privacy is inevitable,
There is no such principle.
in an extreme scenario, I'd still prefer the option to make the tradeoff for myself, rather than have the system automatically choose for me.
You don't have this option when the public at large is considered, for a public election. You can do it in a private election for a club, for example, but even then only if the bylaws allow it. Cheers, Ed Gerck