1) The document presents a classification system called "Just Like Paper" (JLP) for electronic voting machines that ranks systems based on how similar their interfaces are to a paper ballot. 2) The JLP analyzes the interface features of 26 commercial eVoting systems and organizes them into categories. The systems are then ranked based on how many interface features they have in common with a paper ballot baseline. 3) The authors used the JLP classification to help improve the interface of their DualVote system by finding a balance between usability and functionality that was less constrained than the baseline but more so than the most advanced systems.

1. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Just Like Paper: A classification system for eVoting Machines!
Damien MacNamara and Ken Oakley!
Department of Information Technology, Limerick Institute of Technology,
mail@dualvote.com.!
!
Paul Gibson!
Le département Logiciels-Réseaux (LOR) Telecom SudParis,!
paul.gibson@telecom-sudparis.eu.!

2. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Voting is not a joke, it is
a privilege and a
responsibility.
!
It is not to be taken
lightly, it is not
entertainment, it should
require some thought.
Electronic Voting?

3. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Audit (Paper)Trails are Necessary
!
Just Like Paper is the path of least
resistance
!
We can learn from our mistakes/other
peoples’ successes
Premises For Our Work

4. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
DUAL VOTE: Key Components of the Dual Vote UI
Usability Analysis Identified a Validity Problem

5. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
An incorrect interface is a major security threat.
!
A correct interface allows only valid votes to be submitted for
storage and no other information.
C1
C2
C3
C4
C5
C6
!
1
!
3
2
Typical Valid Vote Valid? Valid? Valid? Valid?
C1
C2
C3
C4
C5
C6
!
1
!
3
2
2
C1
C2
C3
C4
C5
C6
!
1
7
3
2
C1
C2
C3
C4
C5
C6
!
1
!
3
C1
C2
C3
C4
C5
C6
4
Validity and Security

6. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
A non-constrained interface is a major risk to anonymity.
!
A correct interface allows only valid votes to be submitted for
storage and no other information.
Valid?
C1
C2
C3
C4
C5
C6
!
1
Paul
3
2
Validity and Anonymity
Question: what is a signature?

7. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Different Elections Have Different Rules Concerning Blank Votes
Valid?
C1
C2
C3
C4
C5
C6
Validity and Blank Votes

8. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
DUAL VOTE Validity Analysis for Spoiled Votes
Coherency Issue - Two situations that should be addressed by
any election process are:
!
• The voter intends to spoil their vote, yet their vote is wrongly
allocated to a candidate.
!
• The voter does not intend to spoil their vote, yet their vote is
wrongly interpreted as being spoilt
1. ok
!
3. feedback may help?
4. feedback may help?
5. feedback may help?
6. feedback may help?
!
8. ok

9. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Our motivation for this work was twofold:
1.examine how to apply additional ‘validity’ functionality to our system without
weakening our ‘just-like-paper’ requirement
2.develop a straightforward classification for commercial eVoting systems which
could ultimately be reused by e-voting system developers and procurers.
!
Contribution of JLP Classification:
1. analysis of the interface features of twenty-six commercial systems
2. organisation into a feature-based classification.
3. ranked in accordance with the number of interface features that it had in common
with a pen and paper baseline
Motivation (and Contribution) for CeDEM14
Improvement to DUAL VOTE interface with feedback feature

10. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Specification of Interface Features
Error-Feedback
.
IF1: No feedback interface features. The voter will receive no feedback if an error is detected on
the ballot;
.
IF2: Basic feedback interface features. The voter will be informed that an error has occurred
without any information concerning the type of error;
.
IF3: Detailed feedback interface features. The voter will be informed that an error has occurred
and is provided with additional information concerning the type of error;
Ballot-Confirmation
.
IF4: No ballot confirmation interface features. The voter is never required to confirm their vote;
.
IF5: Error-related confirmation interface features. The voter is required to confirm their vote only
when an error is detected on the ballot;
.
IF6: Compulsory confirmation interface features. The voter is always required to confirm their
vote;
Machine Activation
.
IF7: No dedicated-activation interface is present or the poll-worker activates the voting machine;
.
IF8: A dedicated-activation interface is present.

11. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Specification of Interface Features
Duality Generation
.
IF9: No duality generation interface features are present;
.
IF10: Interface features support simultaneous vote generation;
.
IF11: Interface features support duality generation with multiple voter actions;
!
Interface Modality
.
IF12: The vote creation interface is uni-modal;
.
IF13: The vote creation interface is multi-modal;
.
IF14: The interface features consist of a non-standard interface technology or
apparatus.

12. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Our baseline is first in the list and
is numbered JSN1.
!
In total there are one-hundred and
sixty-two ‘coherent’
classifications.
The Interface Classification

13. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Specification of Design Decisions
Decisions relating Voter Feedback Features:
D_F_1: The voter receives feedback via an electronic visual display;
D_F_2: The voter receives feedback via an optical scanner / optical
scanner information panel;
D_F_3: The voter receives feedback via a push-button interface;
D_F_4: The voter receives feedback via a printed receipt.
!
Decisions relating to Machine Activation Features:
D_A_1: The voter machine activates using an activation token;
D_A_2: The voting machine activates using the ballot paper;
D_A_3: The voting machine activates using a poll worker interface or is
permanently activated;

14. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Specification of Design Decisions
Decisions relating to Duality Generation Features:
D_P_1: The paper audit trail interface consists of a ballot box;
D_P_2: The paper audit trail interface consists of a printer;
D_P_3: The paper audit trail interface consists of a printer and ballot box;
D_P_4: The paper audit trail consists of an optical scanner with attached ballot
box;
Decisions relating to Interface Modality Features :
D_I_1: The vote creation interface consists of a touch-screen;
D_I_2: The vote creation interface consists of a push-button
D_I_3: The vote creation interface consists of a pen and paper;
D_I_4: The vote creation interface consists of a touch-screen and push-button
D_I_6: The vote creation interface consists of a push-button and pen and paper;
D_I_7: The vote creation interface consists of a pen and paper and non-standard
technology;
D_I_8: The vote creation interface consists of a touch-screen and non-standard
technology;
D_I_9: The vote creation interface consists of a push-button and non-standard
technology.
D_I_10: The vote creation interface consists of a hybrid electronic pen and paper.

15. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Classification of 26 commercial systems
Our next step in our efforts to expand the functionality of DualVote was to find some
middle- ground between JSN2 and JSN162

16. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
The red-orange-green feedback protocol REQUIREMENTS
• Not a full LCD
• Not Active Feedback
• Not just yes/no light
• Not multiple lights
Implementation
A single traffic light

17. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Conclusions
!
The JLP classification shows how twenty-six commercial systems incrementally
differ from each other in terms of functionality and subsequently how each
system differs from our baseline
The JLP was instrumental in helping us to understand how we could build on the
usable but less functional DualVote system.
Further improvements on the JLP may give another perspective on usability as
well as using the established Systems Usability Scale as such scales are not
designed specifically for eVoting machines
The abstract nature of our interface features, abstracts away from the lower
hardware level.We believe that this abstraction ensures a more robust
classification that is less easily affected by technology innovations in electronic
voting user interface design.
The classification is part of a new ontological modelling of the e-voting domain

18. CeDEM14 ! ! ! ! Just Like Paper ! ! May 2014 ! ! ! ! J Paul Gibson
Questions?
« Il est encore plus facile de juger de l'esprit
d'un homme par ses questions que par ses
réponses. »
Pierre-Marc-Gaston, duc de Lévis (1764-1830),
Maximes et réflexions sur différents sujets de
morale et de politique (Paris, 1808): Maxim xvii