Running head: ROCK THE BLOCKCHAIN 1 Rock the Blockchain: Next Generation Voting Nikolas Roby, Patrick Gill, Michael Williams University of Maryland University College (UMUC) Author Note Thanks to our UMUC Faculty mentor, Jesse Varsalone Thanks to The Economist and Kaspersky Lab for providing the case study
ROCK THE BLOCKCHAIN 2 Table of Contents Author Note... 1 Abstract... 3 Overview... 4 The Problem... 4 Overview of the Setup Steps... 6 Establishing Polling Stations on the Blockchain... 6 Issuing a Voting Wallet to Voters... 7 Setting up the Election... 8 The Voting Process... 9 Voting Under Duress... 11 Undecideds... 12 Availability of Interim Results... 12 Voting Aftermath... 14 Vote Traceability... 14 Conclusion... 16 References... 17
ROCK THE BLOCKCHAIN 3 Abstract Current voting systems used in today s election systems contain many flaws. These flaws stem from the ability of both the users and the monitors of the system being able to inject additional votes. These votes land in the system through a variety of different approaches, but the end goal is for the person they want elected to win. Due to these issues, the citizens of countries across the globe need and want a system they can trust and rely on. A trusted election system would grant those people the ability to be heard while feeling like their voice was loud within the many. Within this paper the writers will discuss a new system, and how to implement it with the use of blockchains. Keywords: Blockchain, Voting, Smart Contract, Sidechain, Etherium, Bitcoin
ROCK THE BLOCKCHAIN 4 Overview The Problem With the current systems of voting, there are flaws that are core to the design of the electoral system. Voters go to a polling place, present an ID, and are issued a card to vote. There is a possibility that someone could cast multiple votes by going to multiple locations, or by voting for deceased voters. The biggest problem with the current generation of voting system is the lack of trust in the election process. The voting population needs to be able to trust the system, the processes, and understand that their voice is not lost. The people need to feel heard, counted and be able to verify their voice. Finally, the citizens need to be able to trust the counting process, and without bias. The next generation voting system, how would that look? The system would need to start from a foundation of trust. Paper voting is not preferred because of the human aspect of injecting additional tallies, but it does provide a trail. Recent elections in Russia have possibly shown corruption that can occur with the addition of the human element. Digital voting, however, is essentially new but needs to be built around a trust model. With voting people expect the process to be anonymous, but individuals should be able to verify the vote. Votes should be impossible to tamper with, nor, should the system note be able to be flooded with illegitimate votes. All vote counting would be performed in a publicly observable way. With the essential design of a modern voting system, the core tenet would be to remove all need for trust, and place strong emphasis on open verification of the process and the votes. Several years ago, a similar problem was addressed with digital currency using a concept called the blockchain.
ROCK THE BLOCKCHAIN 5 The blockchain, at its essential level, is a distributed ledger of groups of transactions. Each group of transactions is hashed together, along with a hash of the previous block, and anybody can have a copy of the entire blockchain (Nakamoto, 2008). This means that all transactions can be traced, and false transactions are dropped because they don't match what other blockchain users copies indicate. For digital voting using a blockchain, it could record ID for both voter, person voting for, and time. Everybody can get a copy of the blockchain and verify the votes cast! A critical part is the voter IDs are not an actual name, but a random wallet ID, not reversible to an actual voter s identity. With a blockchain, each block in the blockchain is a set of transactions that are hashed together, and the blockchain miners are essentially trying to find a hash with a number of leading zeros, by manipulating a nonce. Eventually one of the miners gets a block and it is called the proof of work, which is incorporated into each block in the blockchain. If someone manipulates the blockchain, by trying to change the amount of the transaction, it would invalidate the block, as well as all subsequent blocks. This part of which makes verification of the blockchain straightforward.
ROCK THE BLOCKCHAIN 6 Figure 1 - Proof of work on the blockchain. Another interesting property of using the blockchain is the concept of a smart contract. A smart contract is a set of rules attached to a transaction. If the rules are not matched, then the transaction is not completed. These rules are implemented in a lightweight virtual machine, but essentially they allow for complex rules such as a vote must have a voter, a candidate, a time to vote by, as well as other items such as a co-signer for the vote. All of which are implemented with cryptographic signatures. Smart contracts are self-enforceable and trustless, which make them a perfect candidate to remove likely avenues of corruption. Overview of the Setup Steps Establishing Polling Stations on the Blockchain Each polling station would have a digital wallet ID, owned by polling station. Those polling stations would register their public ID with the district, and the state on a public blockchain. The registered information would include: the physical address of the polling station, phone number, hours, and the public key of the polling station wallet. This will later be used to verify the eligibility of a polling station to have that station s votes counted. Each state will have
ROCK THE BLOCKCHAIN 7 a pool of votecoins with a maximum of one coin possible for each candidate, for each of the actual registered voters. The polling stations will then be issued the amount of coins needed to distribute to the voters. The main blockchain will record a transaction of each of these votecoin being transferred. Figure 2 - Polling station registration on the blockchain. Issuing a Voting Wallet to Voters The voting process begins with an individual traveling to a polling station and providing identification of eligibility to vote. Once there, they will provide proof of eligibility to vote. The eligibility to vote, which include, but is not limited to: their full name, birth date, postal code, and identification number provided from the government. The polling station will then take a picture of the person and generate a Scrypt hash of their details with 100,000 rounds. This hash will be called a VOTERID hash. The Scrypt hashing algorithm will be use of being memory hard, and prevent GPU cracking (Percival, 2009). The polling station will then commit to the blockchain a transaction of the individual who has registered to vote, along with the date and
ROCK THE BLOCKCHAIN 8 timestamp, and the VOTERID hash. At this point, if the VOTERID hash does not already exist on the blockchain, a fresh set of keypairs will be generated. The voter s wallet, which consists of these public and private keypairs, will be provided in the form of printed QR codes to the now registered voter, and the keypair is not saved. This machine used to generate the wallet is completely air-gapped. The air-gapping of the system provides the prevention of internet based tampering and credibility of the system. If a voter does not want the polling station to generate their voter wallet, they may provide a unique one themselves. At this point, there will be another transaction on the blockchain: a valid voter wallet will be added as a transaction, with the property that it may vote at the current polling station. Each voter would have a digital voter wallet, which would be utilized for casting votes and/or authenticating transactions. It is critical that there are no direct connections between the VOTERID hash generated and the voter wallet, to preserve voter anonymity. When a voter wallet is first added to the blockchain, the polling station will transfer one votecoin to the voter wallet for each voting item. Essentially a voter comes to a station and provides proof of eligibility to vote. The station will check that voter hasn t registered at any polling station, by seeing if their VOTERID hash exists already. If not, the voter will receive the generated voter wallet and may leave. Setting up the Election Each candidate will have a digital ID setup that will allow people to cast their votes for them called a ballot item wallet. This will be a universal ID for all polling stations for a given position (e.g. president, senator, etc.). Additionally, for each position being voted on, there will
ROCK THE BLOCKCHAIN 9 be two other ballot item wallets generated, one for undecided and another for write-ins (if write-in ballots are permitted). Possible ballot item wallets will be entered into the main blockchain, along with a smart contract that all eligible votes must occur after a certain date/time, and before a specified date/time as conditions for the voting contract. Each polling station will create a unique sidechain, starting at the start time of the election. A sidechain is a semi-decentralized blockchain that is split from the main blockchain (Croman et al., 2016). This sidechain ID will be publicly split from the main blockchain and then will later be committed after the election. The sidechain process is used to prevent the results of the election from being prematurely released. Figure 3 - Setting up the sidechain The Voting Process One of the advantages of voting digitally is that it is much more convenient to vote, but one of the disadvantages is that the voting may not always occur in a secure space. Under this system of voting on the blockchain, an individual can cast their vote for the candidate of their
ROCK THE BLOCKCHAIN 10 choice by cryptographically signing a votecoin from their voter wallet to the ballot item wallet via the polling station sidechain. The voting district assigns candidate to voters and the voter can cast their votecoin to their choice. If they chose to write in a candidate, the candidate s name will be included in the extra-text of the transaction. A voter may cast a votecoin to a candidate, but it will have a smart contract attached to it. The contract will state that in order for the vote to be valid, it must be signed by the voter wallet and the polling station. Should the polling station be unavailable, the voting district will act as a backup to the polling station. This is important because it adds the ability for a polling station to certify only valid voter wallets, as there is a chance that illegitimate attempts to vote could be made from invalid wallets. For all contracts, there will be an additional stipulation in the smart contract, that there must be exactly one coin, no more, no less to be transferred. This prevents an individual that has 10 coins, for example, from using all of them to vote for a single candidate. For ballot propositions, such as voting for Proposition 8, three wallets will be created, for example, Proposition_8_YES, Proposition_8_NO, and Proposition_8_undecided. Tallying votes for a candidate or a ballot proposition is a simple as counting the number of votecoins that were transferred. A smart contract limiting vote to one coin is also applied to these transactions.
ROCK THE BLOCKCHAIN 11 Figure 4 - Digital ballot example Voting under duress If a voter is forced to cast a vote under duress, such as at a hostile workplace or under the threat of violence, they may do so. They can vote for all the candidates that they are forced to vote for. The way these threats are handled is to allow for the ability to cast a vote multiple times. When voting has closed, only the latest vote cast by a voter will be tallied and certified by the polling station. These certified counts will then be sent to the voting district for counting. This means an individual can cast votes under duress, and once the threat is no longer present, vote again for their candidate of choice. In fact, this removes the incentive to cause people to force votes under duress as it is so easy to change a vote, prior to it being certified by the polling station at the close of voting.
ROCK THE BLOCKCHAIN 12 Figure 5 - Example of multiple votes being cast by voters under duress There is a chance that voters under duress, at the close of voting time, will be forced to vote for somebody, but the ability to do this at scale is limited because individuals can vote from their homes. Wide physical distribution of voters and limited time for a threat to force votes means that even if there is a percentage of voting under duress, it will be minimal. Undecideds The options for voting are to vote for a candidate, abstain from voting, and to vote for a write-in. If a voter wishes to abstain from voting on a particular ballot item, then that vote will be counted as UNDECIDED for that specific ballot item wallet. Undecided votes are handled in the smart contract for the given ballot item. Each voter can vote as many times as they like, but only the most recent vote at the close of voting will be signed by the smart contract and the polling station. Availability of Interim Results Using a blockchain provides many benefits for democracy, including the most important aspect of public verification. This means that as votes are added to the blockchain, they are published to all. Even without an individual s ID attached to them, it is possible to see how many votes each candidate received by independently reviewing the blockchain. However, some
ROCK THE BLOCKCHAIN 13 voting districts may not want these votes to be immediately available. The constraint is solved with a private blockchain, which is also known as a sidechain, which was created by each polling station at the beginning of the election. Using a sidechain for each polling station will allow for each voting district to be handled independently, and when the votes are integrated back into the main blockchain, to see the votes cast in a verifiable way. Votes will be counted from a district or polling station in the manner that each vote requires a votecoin from the voter and a signature from the where that voter wallet was issued (such as a polling station). Once these multiple signatures have been applied to a vote, the smart contract will automatically count the vote. At the close of the voting period, the polling station will sign only the most recent votecoin for each voter. If there are more votes cast than were allocated to the polling station, an inspection of the sidechain of that polling station will be triggered. It should not be possible for illegitimate votes to be cast at because the polling station will have a record of all issued voter wallets. Any votes not coming from one of these registered wallets can be disregarded. As all voter wallet creation times are added to the main blockchain, it would be difficult to conceal dumping hundreds or thousands of illegitimate wallets to the blockchain. Another control measure is that polling station will only get enough votecoins to account for their registered voters for that district. This property for the vote to require multiple valid signatures for the transaction is called MULTISIG and is not a new concept, but part of many cryptocurrencies including Bitcoin, and can also be built with an Ethereum smart contract (Peters & Panayi, 2015).
ROCK THE BLOCKCHAIN 14 Voting Aftermath After the votes have been cast, each virtual polling station will auto countersign the latest votecoin transaction for each registered voter wallet, releasing the coins to the respective wallet for each candidate or ballot measure. Each of these transactions occurs on a sidechain, also known as a private blockchain. When the eligible votes are countersigned, which occurs within the smart contract, the polling station will merge the sidechain back into the main blockchain. After merging, the full record of transactions becomes published, and inspected as any part of the blockchain. Figure 6 - Countersigning valid votes Vote Traceability Each vote cast is traceable. The voting authority, such as the voting district, issues a certain number of votecoin to each polling station, and each transaction is noted on the blockchain. The polling station issues the eligible votes to verified voters wallets on a sidechain. An individual vote as many times as they would like, but only the most recent vote will be countersigned. Each vote will also be recorded on the blockchain, including ones that never get countersigned. The votes which are countersigned will result in votecoins being transferred to the
ROCK THE BLOCKCHAIN 15 respective wallets of the candidate or ballot measure. From creation, to being deposited in the voter s wallet, to being deposited in the candidate s wallet, every transaction is part of the public record of the blockchain. Anonymity is preserved as each voter wallet is randomly generated, so it is not possible to tie an individual to a vote based on the public key. However, the opposite is not true. If an individual wants to verify their vote counted, it is easy to see a transaction with their public ID casting a votecoin to the candidate of their choice. The public key is a matter of record, but only the individual who receives the wallet ID will know. Figure 7 - Multisignature process Voters can see how many votes were cast for a ballot item and how many votecoins were issued to each polling station. If the results are contested, each polling station has its own private sidechain, which includes the full history for analysis. In a worst case scenario, where there was a high number of detected illegal votes, there could be a call for a revote of the election for that
ROCK THE BLOCKCHAIN 16 specific district. Each voting district has its own sidechain, so it doesn't have the ability to invalidate the entire election. The mechanism to address the claims of contested results is to review the blockchain, and in doing so verifying that the votes issued to each district match the votes received from each district. Conclusion The system that has been described is a voting system for the modern world. It has the benefits of being open, verifiable, and traceable. Voters are anonymous in the blockchain but are able to verify that their own vote actually counted. Polling stations are able to keep the votes off the main blockchain for the purposes of keeping the totals hidden until they should be released. Each vote is verified in a smart contract before being sent to the candidate or ballot measure. In our system, the smart contract is that a vote is given to a candidate if it satisfies certain conditions, such as the amount being cast is equal to exactly one vote, verification that the polling station concurs that the voter wallet is valid, and that the vote occurred in a valid date range. The smart contract includes multisignature element, meaning that both the polling station and voter need to sign before release to the blockchain. By combining elements of the cryptographic hashes, blockchain, smart contracts, multisignature, and sidechains, it is possible to build an open, verifiable, and anonymous voting system for the modern world.
ROCK THE BLOCKCHAIN 17 References Croman, K., Decker, C., Eyal, I., Gencer, A. E., Juels, A., Kosba, A.,... Wattenhofer, R. (2016, February 16). On Scaling Decentralized Blockchains. Financial Cryptography and Data Security Lecture Notes in Computer Science, 106-125. doi:10.1007/978-3-662-53357-4_8 Percival, Colin. (2009). Stronger key derivation via sequential memory-hard functions. Selfpublished, 1-16. Retrieved from https://www.tarsnap.com/scrypt/scrypt.pdf Peters, G. W., & Panayi, E. (2015, November 18). Understanding Modern Banking Ledgers Through Blockchain Technologies: Future of Transaction Processing and Smart Contracts on the Internet of Money. SSRN Electronic Journal SSRN Journal. doi:10.2139/ssrn.2692487 Satoshi Nakamoto. (2008) Bitcoin: A Peer-to-Peer Electronic Cash System. Retrieved from https://bitcoin.org/bitcoin.pdf Vitalik Buterin. (2016). Privacy on the blockchain. Retrieved from https://blog.ethereum.org/2016/01/15/privacy-on-the-blockchain/ Wood, G. (2014). Ethereum: A secure decentralised generalised transaction ledger. Ethereum Project Yellow Paper. Retrieved from http://gavwood.com/paper.pdf