| Automation Of An Election In Cyberspace Tran Thong Introduction VACETS was organized in March of 1994 as a non-political Internet-based association of Vietnamese professionals in the computer, engineering and sciences fields. By April 1995 we have grown rapidly to a registered membership world wide of 342 and an active mailing list of over 500 professionals. Our activities during this first year have been focused on providing various electronic forums for our members and weekly newsletters. We also launched a number of technical projects. During this period, VACETS was run by an ad-hoc committee. I joined VACETS in June 1994 as its Chairman to help organize it. Since then we have increased the number of electronic forums and our bylaws were approved. We held an e-mail vote, on the rather emotional issues of non-email contact with technical organizations in Viet Nam in the Fall of 1994. The motion was approved by the members. This vote pointed out a major weakness in our e-mail voting system that reported only the names of the voters and the final results, as would be the case in a paper ballot. The issue centers around the fact that most of us do not personally know who the vote counters were. It is essentially a matter of trust, or actually the lack thereof. This is further compounded by the ease in which an electronic vote could be altered without leaving any trace. In the Fall vote, after a two month long debate, at time very heated, we ended up releasing the actual votes but without associating the names with them. We had to post- voting, assign everybody who voted a random number and the vote associated with this random number was published. This is at best a cumbersome procedure. Thus, for our April general election, we needed a better procedure that should meet the following two criteria * preserve the anonimity of the vote * provide all members a means for verifying their vote These two requirements, on the surface, appear to be contradictory. In this general election we had 11 candidates running for 6 open positions on the new Executive Committee. A registered member can vote for up to 6 different persons in his ballot. Electoral Campaign - first check of our software An electoral campaign forum was made available by reassigning one of our non-public channels for the two week period prior to the voting. This was a closed majordomo mailing list that we opened up to anybody who wanted to monitor the Q&A from the members to the candidates. We started by subscribing all our members and friends to this campaign forum. Each person can subsequently remove his/her name by sending an unsubcription message to the majordomo program. He/she can also subscribe him/herself by going through the majordomo program. Since we expected a large volume of mail, we decided to restrict posting to this forum to registered members. This was accomplished by using the restrict_post option available in majordomo. Thus, unless the e-mail address of a poster matches exactly the name on the membership list, the posting will be bounced to the owner of the mailing list, in this case to me. I then can decide whether to allow it through or not. One of the problems that became clear to me right then is that a small number of people, about 10%, have mail aliases that they are not even aware of. These mail aliases caused their posting to bounce and I had to resubmit them manually. I did, of course, modify the authorization list whenever I discovered an alias. In some case the aliases are cryptic, like [email protected] instead of [email protected]. In other cases the difference is obvious, like [email protected] as opposed to name@company. Each candidate, as part of the candidate form, has submitted a position statement. They were published in our general forum at the start of the campaign. They were the basis for a number of the Q&A's. During this two week debate we received closed to 500 KB of mail. The questions were very appropriate and were answered diligently by the candidates. The last two days of the debate period were reserved for the candidates to make closing statements and wrapping up any outstanding question. Thus on those days, the restrict_post list was shortened to just the list of candidates. At the end of the debate period, the forum was turned off by unsubscribing all members and restoring it as a closed mailing list. The Ballot The format for the ballot is shown below. The order of the names was according to the order in which the candidate forms were received. [BALLOT] replace.this.with.your.personal.id Hoang Viet-Dung Le V. Tin Anson Binh Vu L. Thanh Tran V. Hai Le M. Thao Vo K. Phong Nguyen V Diem Lap T. James Tran Vu-Bich Pham T. Phiet The voter writes a personal private identification in the [BALLOT] line that will enable him/her to recognize his/her vote, and hopefully private enough that others will not be able to identify the voter. To vote for a candidate, the voter will put an asterisk, "*", next to the name at the beginning of the line. From 0 to 6 asterisks will be accepted. A ballot with more than 6 asterisks will be considered invalid.This part of the ballot will be made public after the election to enable all members to verify that their votes have been properly recorded. The ballot will be published sorted according to the [BALLOT] line and without any reference to who the voter is. Sorting the ballot effectively randomizes it because a ballot can no longer be associated with when it was posted or who the voter is. With this procedure we can meet the two requirements presented above of confidentiality and verificability. Since the above part of the ballot is published, provided the voter has chosen a good private identificaiton phrase, an observer should not be able to determine who voted. By making the ballot public, any voter can verify the results. This is complemented by the publication of the list of voters who cast their ballots. So, an observer could spot check by asking the voter 1. whether he/she has voted and 2. he/she has verified that his/her ballot has been published correctly. Election - really working the software There was a request for absentee ballot since that particular voter was going to have his Internet access turned off. This was accomodated by having him sent his ballot in early and storing it aside, and resubmitting it when the polls open. The absentee ballot was clearly marked as such in the e-mail address field. For voting we had set up a special mailing list. It is just another majordomo mailing list like our others. The difference is that it is a closed list and it has only two subscribers, the vote counters. The restrict_post option was also used to screen voters. This worked pretty well since 90% of the votes got through without manual intervention. When a vote bounces, i.e. majordomo refuses to post it and sends a copy to me for posting confirmation, I check the actual e-mail address of the voter against my list of authorized voters and most of the time I am able to find a match. The most common problem is that a subhost name has been added or deleted from the authorized e-mail address list. There were a few that I could not find, in which case I had to write back to them for more information, or in the case I suspected a possible match, I would either write or telephone the most likely member to confirm. I was able to resolve almost all bounced ballots. Note that an incorrect e-mail address will bounce the ballot prior to it being sent out. Thus, my partner in the vote counting team will not see these votes until I resubmit them. This saves him from having to check the eligibility of the voter. Now, the ballot can be sent out to the two vote counters : Phuong and I. Phuong's task was to automate the daily results. Each night he will send me two files. The first file contains the following information about each ballot received: 1. "From:" field, i.e. the identity of the voter 2. "Date:" field, including the time the ballot was sent from the originating host, 3. "Message-Id:" field. This can further identify the host and provide other reference information. This first file is part of the verification process. The second file is a tabulation of the results to date. This is for Phuong's and my consumption only. Each night, I will compare Phuong's results with my own. In my case I use an e-mail filter to store all the votes in a daily log file, which I then at night will archive into a larger vote file. I use the Unix "egrep" to generate a rawer version of the file that Phuong sent me. I also had a paper copy of the list of eligible voters to check off the voters. Paper is always a good backup! With regard to filtering, I had a false start. Since I indicated to voters that the "Subject:" field was not going to be used, a number of them submitted their ballots with a blank field, which the e-mail system deletes. I was counting on the majordomo mailing list adding the prefix [vacets-vote] to the subject line to help the filter program steer the ballot to my daily vote log file. Of course Murphy's law did strike! I had to go back and alter the filter to look for the address instead! On one occasion I found I had one more vote than Phuong did. Something must have happened during the transmission. Any way, this was resolved. The list that Phuong sent me every night was sorted according to the "From:" field, making it easy for somebody to look up his vote header. Using this file, I posted each night the list of voters that day. I added annotation on any discrepancy between the actual and authorized e-mail addresses, any resubmission for correction. There were a number of reasons we had a voter resubmit his ballot. The most frequent one is that the voter has forgotten to create a personal identification in the [BALLOT] line of the ballot, or his/her e-mail address was listed there. The second one is that a name was added (the write-in syndrome!). 155 members voted during the week long election. Of these there was one blank ballot. This corresponds to 45% of elegible voters. The interesting fact is that this is almost equal to the number of votes in the Fall vote, 150 at that time. Phuong, being more automated than me, sent me the results the night of closing. It consisted of 3 files, the summary voter list, the result summary and the actual ballots. The next day, I went manually through Phuong's ballots and compared them with my own list. Two discrepancies came up 1. One ballot did not have any "*" but had less than 7 names. We agreed to accept those names as voted in. 2. There was one ballot where the "*" was at the end instead of the beginning of the line. These were resolved and some late minute ballots were included (the deadline for voting was that the ballot be mailed just prior to midnight local time) since they were delayed on their way to us. The results were then posted after the candidates were informed. The actual (modified) ballots were posted and anybody could verify them with a series of Unix egrep commands. The modification were to make the ballot format conform to our model: 1. an asterisk at the beginning of the line for the candidate voted, 2. the [BALLOT} line with the proper title and the personal ID. Unlike the vote in the Fall, we received no complaint this time around, making it a successful election. Election Results As we have reported the list in order of decreasing number of votes is Binh, Dung, Thao, Tin, Hai, Bich, James, Phong, Phiet, Bruce, Diem As per our Bylaws, anh Binh was offered the position of 1995-96 President. He declined. Anh Dung, the next person in line accepted. Anh Thao also accepted to be the President-elect. Anh Hai, due to other personal commitment, asked that his candidature be withdrawn. As a result, the 1995-96 Executive Committee will consist of: Binh, Dung, Thao, Tin, Bich, James, Thong. I am the hold-over as past-President. |