[Paper Review] Secure and Verifiable Electronic Voting in Practice: the use of vVote in the Victorian State Election

Craig Burton, Chris Culnane+1 more|arXiv (Cornell University)|Apr 27, 2015

Internet Traffic Analysis and Secure E-voting10 references10 citations

TL;DR

This paper presents the first real-world deployment of an end-to-end verifiable electronic voting system, vVote, in a state-level political election—Victoria, Australia’s 2014 state election. The system enabled blind and partially sighted voters to cast secret, verifiable ballots using accessible interfaces, achieved 98.13% formal ballot rate, and demonstrated practical usability and security in a high-stakes, complex preferential voting environment with 1,121 votes cast.

ABSTRACT

The November 2014 Australian State of Victoria election was the first statutory political election worldwide at State level which deployed an end-to-end verifiable electronic voting system in polling places. This was the first time blind voters have been able to cast a fully secret ballot in a verifiable way, and the first time a verifiable voting system has been used to collect remote votes in a political election. The code is open source, and the output from the election is verifiable. The system took 1121 votes from these particular groups, an increase on 2010 and with fewer polling places.

Motivation & Objective

• To develop and deploy a secure, verifiable, and accessible electronic voting system for a state-level political election.
• To address the challenge of providing end-to-end verifiability in complex preferential voting systems with large numbers of candidates.
• To ensure ballot secrecy and software independence while maintaining usability for disabled and non-English-speaking voters.
• To evaluate the practicality and user experience of verifiable electronic voting in a real-world, high-consequence election environment.
• To demonstrate that verifiable electronic voting can be implemented in a way that is both secure and usable for all voters, including those with disabilities.

Proposed method

• Adapted the Prêt à Voter split-ballot model into a practical electronic system with randomized candidate lists and verifiable receipt mechanisms.
• Implemented a client-server architecture where votes are cryptographically signed and posted to a public bulletin board for auditability.
• Integrated accessibility features including audio, screen reader compatibility, and multilingual support to serve blind, partially sighted, and non-English speakers.
• Designed the system to ensure software independence: undetected software errors cannot alter election outcomes.
• Used open-source code to enable transparency and independent verification by election authorities and the public.
• Conducted a two-week early voting period with electronic voting available at multiple polling places across 96 districts.

Experimental results

Research questions

• RQ1 Can an end-to-end verifiable electronic voting system be practically deployed in a complex, state-level political election with preferential voting and large numbers of candidates?
• RQ2 Can such a system ensure ballot secrecy while providing verifiable auditability for voters and election officials?
• RQ3 How does the usability of a verifiable electronic voting system compare to traditional paper ballots in real-world conditions, especially for disabled and non-English-speaking voters?
• RQ4 What is the impact of verifiability features on voter confusion and trust in the system?
• RQ5 Can a verifiable electronic voting system achieve high formal ballot rates and operational efficiency in a real election setting?

Key findings

• The vVote system successfully collected 1,121 electronic votes in the 2014 Victorian State Election, exceeding the 2010 electronic vote count despite fewer polling locations.
• The formal ballot rate for electronic votes was 98.13%, significantly higher than the 95.7% formal rate for paper ballots in the same election.
• The average time to complete a voting session was 9.5 minutes (570.4 seconds), with the longest session lasting just over an hour (3,895.8 seconds), indicating strong usability for most voters.
• Blind and partially sighted voters were able to cast fully secret and verifiable ballots for the first time in a statutory election, demonstrating the system’s accessibility success.
• Only six cases of voter confusion regarding verification receipts were reported, all resolved satisfactorily, indicating that verifiability features did not significantly hinder usability.
• The system achieved software independence and verifiability through cryptographic receipts and public bulletin board posting, with no evidence of tampering or undetected software errors affecting outcomes.