Scantegrity III: Automatic Trustworthy Receipts, Highlighting Over/Under Votes, and Full Voter Verifiability

Scantegrity III: Making Voting More Trustworthy and User-Friendly

Imagine casting your vote with confidence, knowing it’s recorded correctly and can be independently verified, while also receiving a receipt that doesn’t compromise your privacy. That’s the promise of Scantegrity III, an advanced voting system designed to address critical flaws in earlier electronic voting technologies. This research paper outlines significant improvements to the Scantegrity II system, which was successfully used in Takoma Park, Maryland’s 2009 election, but revealed key limitations that needed solving.

The Problem: Scantegrity II’s Limitations Scantegrity II represented a major leap forward in secure voting by using invisible ink. When voters marked their optical scan ballots, hidden confirmation codes (Scantegrity II codes) became visible, allowing them to later verify their vote online without revealing who they voted for. However, real-world use exposed three major issues:

1. Manual Record-Keeping Burden: Voters had to manually write down these codes for verification, which many forgot or found confusing.
2. Complex Print Audits: The system required pre-election checks (print audits) to ensure ballots were correctly printed, adding cost and complexity.
3. HAVA Non-Compliance: The scanners didn’t notify voters of over-votes (marking too many candidates) or under-votes (not marking any), violating the Help America Vote Act.
   Voters and officials overwhelmingly requested one feature: automatic, trustworthy receipts.

The Solution: Three Receipt Printer Designs The paper proposes three innovative receipt printer designs, with Scantegrity III being the most advanced:

1. Image Duplicator: A simple scanner-printer that copies marked ballot ovals (in scrambled order) plus a digital signature. Voters compare the receipt to their ballot visually.
2. Mark Sense Translator: Connects to the official ballot scanner, reads marked positions, and prints corresponding codes. The ballot is locked under glass during verification.
3. Scantegrity III Casting Station (The Star): Integrates scanning, printing, and verification. Key innovations:
   • Dual Receipt Types: Randomly prints one of two receipt styles (inspired by Punchscan) that together confirm the vote but separately hide it.
   • Backlighting: Highlights ballot features (e.g., over/under votes) using LEDs.
   • Eliminates Print Audits: Combines Scantegrity II (invisible ink codes) with Scantegrity I (conventional ink codes) to verify ballot integrity without pre-election checks.

Why Scantegrity III Matters: Key Improvements Scantegrity III directly tackles the original problems:

• Automatic Receipts: Voters get a verifiable receipt without manual effort, boosting confidence and accessibility.
• HAVA Compliance: Backlighting instantly flags errors like over-votes, helping voters correct mistakes.
• Full Verifiability: By using dual codes and random receipt types, it eliminates print audits. Voters can verify online using unlocked commitments posted after polls close, ensuring privacy.
• Security Enhancements: A Trusted Platform Module (TPM) safeguards keys, ensures software integrity, and prevents unauthorized printing. Even if compromised, malicious changes would be detectable.

The Impact: Trust and Accessibility These changes make voting more trustworthy and user-friendly. Receipts reduce voter confusion, enable easier audits (e.g., publishing receipts online), and protect against post-casting ballot tampering. The TPM adds a layer of security without compromising the system’s core verifiability. For voters, it means a smoother experience; for democracy, it means stronger integrity. Scantegrity III isn’t just a technical upgrade—it’s a step toward making every vote both secure and verifiable by the people it affects most.