| Automation
Of An Election In Cyberspace
Tran Thong
Introduction
VACETS was organized in March of
1994 as a non-political Internet-based association of Vietnamese professionals
in the computer, engineering and sciences fields. By April 1995 we have
grown rapidly to a registered membership world wide of 342 and an active
mailing list of over 500 professionals. Our activities during this first
year have been focused on providing various electronic forums for our members
and weekly newsletters. We also launched a number of technical projects.
During this period, VACETS was run
by an ad-hoc committee. I joined VACETS in June 1994 as its Chairman to
help organize it. Since then we have increased the number of electronic
forums and our bylaws were approved. We held an e-mail vote, on the rather
emotional issues of non-email contact with technical organizations in Viet
Nam in the Fall of 1994. The motion was approved by the members.
This vote pointed out a major weakness
in our e-mail voting system that reported only the names of the voters
and the final results, as would be the case in a paper ballot. The issue
centers around the fact that most of us do not personally know who the
vote counters were. It is essentially a matter of trust, or actually the
lack thereof. This is further compounded by the ease in which an electronic
vote could be altered without leaving any trace. In the Fall vote, after
a two month long debate, at time very heated, we ended up releasing the
actual votes but without associating the names with them. We had to post-
voting, assign everybody who voted a random number and the vote associated
with this random number was published. This is at best a cumbersome procedure.
Thus, for our April general election,
we needed a better procedure that should meet the following two criteria
* preserve the anonimity of the
vote
* provide all members a means for
verifying their vote
These two requirements, on the surface,
appear to be contradictory.
In this general election we had
11 candidates running for 6 open positions on the new Executive Committee.
A registered member can vote for up to 6 different persons in his ballot.
Electoral Campaign - first check
of our software
An electoral campaign forum was
made available by reassigning one of our non-public channels for the two
week period prior to the voting. This was a closed majordomo mailing list
that we opened up to anybody who wanted to monitor the Q&A from the
members to the candidates. We started by subscribing all our members and
friends to this campaign forum. Each person can subsequently remove his/her
name by sending an unsubcription message to the majordomo program. He/she
can also subscribe him/herself by going through the majordomo program.
Since we expected a large volume
of mail, we decided to restrict posting to this forum to registered members.
This was accomplished by using the restrict_post option available in majordomo.
Thus, unless the e-mail address of a poster matches exactly the name on
the membership list, the posting will be bounced to the owner of the mailing
list, in this case to me. I then can decide whether to allow it through
or not. One of the problems that became clear to me right then is that
a small number of people, about 10%, have mail aliases that they are not
even aware of. These mail aliases caused their posting to bounce and I
had to resubmit them manually. I did, of course, modify the authorization
list whenever I discovered an alias. In some case the aliases are cryptic,
like [email protected] instead of [email protected]. In other cases the difference
is obvious, like [email protected] as opposed to name@company.
Each candidate, as part of the candidate
form, has submitted a position statement. They were published in our general
forum at the start of the campaign. They were the basis for a number of
the Q&A's.
During this two week debate we received
closed to 500 KB of mail. The questions were very appropriate and were
answered diligently by the candidates.
The last two days of the debate
period were reserved for the candidates to make closing statements and
wrapping up any outstanding question. Thus on those days, the restrict_post
list was shortened to just the list of candidates.
At the end of the debate period,
the forum was turned off by unsubscribing all members and restoring it
as a closed mailing list.
The Ballot
The format for the ballot is shown
below. The order of the names was according to the order in which the candidate
forms were received. [BALLOT] replace.this.with.your.personal.id
Hoang Viet-Dung
Le V. Tin
Anson Binh
Vu L.
Thanh Tran
V. Hai
Le M. Thao
Vo K. Phong
Nguyen V Diem
Lap T. James
Tran Vu-Bich
Pham T. Phiet
The voter writes a personal private
identification in the [BALLOT] line that will enable him/her to recognize
his/her vote, and hopefully private enough that others will not be able
to identify the voter. To vote for a candidate, the voter will put an asterisk,
"*", next to the name at the beginning of the line. From 0 to
6 asterisks will be accepted. A ballot with more than 6 asterisks will
be considered invalid.This part of the ballot will be made public after
the election to enable all members to verify that their votes have been
properly recorded. The ballot will be published sorted according to the
[BALLOT] line and without any reference to who the voter is. Sorting the
ballot effectively randomizes it because a ballot can no longer be associated
with when it was posted or who the voter is.
With this procedure we can meet
the two requirements presented above of confidentiality and verificability.
Since the above part of the ballot is published, provided the voter has
chosen a good private identificaiton phrase, an observer should not be
able to determine who voted. By making the ballot public, any voter can
verify the results. This is complemented by the publication of the list
of voters who cast their ballots. So, an observer could spot check by asking
the voter
1. whether he/she has voted and
2. he/she has verified that his/her
ballot has been published correctly.
Election - really working the
software
There was a request for absentee
ballot since that particular voter was going to have his Internet access
turned off. This was accomodated by having him sent his ballot in early
and storing it aside, and resubmitting it when the polls open. The absentee
ballot was clearly marked as such in the e-mail address field.
For voting we had set up a special
mailing list. It is just another majordomo mailing list like our others.
The difference is that it is a closed list and it has only two subscribers,
the vote counters. The restrict_post option was also used to screen voters.
This worked pretty well since 90% of the votes got through without manual
intervention.
When a vote bounces, i.e. majordomo
refuses to post it and sends a copy to me for posting confirmation, I check
the actual e-mail address of the voter against my list of authorized voters
and most of the time I am able to find a match. The most common problem
is that a subhost name has been added or deleted from the authorized e-mail
address list. There were a few that I could not find, in which case I had
to write back to them for more information, or in the case I suspected
a possible match, I would either write or telephone the most likely member
to confirm. I was able to resolve almost all bounced ballots. Note that
an incorrect e-mail address will bounce the ballot prior to it being sent
out. Thus, my partner in the vote counting team will not see these votes
until I resubmit them. This saves him from having to check the eligibility
of the voter.
Now, the ballot can be sent out
to the two vote counters : Phuong and I.
Phuong's task was to automate the
daily results. Each night he will send me two files. The first file contains
the following information about each ballot received:
1. "From:" field, i.e.
the identity of the voter
2. "Date:" field, including
the time the ballot was sent from the originating host,
3. "Message-Id:" field.
This can further identify the host and provide other reference information.
This first file is part of the verification
process. The second file is a tabulation of the results to date. This is
for Phuong's and my consumption only.
Each night, I will compare Phuong's
results with my own. In my case I use an e-mail filter to store all the
votes in a daily log file, which I then at night will archive into a larger
vote file. I use the Unix "egrep" to generate a rawer version
of the file that Phuong sent me. I also had a paper copy of the list of
eligible voters to check off the voters. Paper is always a good backup!
With regard to filtering, I had
a false start. Since I indicated to voters that the "Subject:"
field was not going to be used, a number of them submitted their ballots
with a blank field, which the e-mail system deletes. I was counting on
the majordomo mailing list adding the prefix [vacets-vote] to the subject
line to help the filter program steer the ballot to my daily vote log file.
Of course Murphy's law did strike! I had to go back and alter the filter
to look for the address instead!
On one occasion I found I had one
more vote than Phuong did. Something must have happened during the transmission.
Any way, this was resolved.
The list that Phuong sent me every
night was sorted according to the "From:" field, making it easy
for somebody to look up his vote header. Using this file, I posted each
night the list of voters that day. I added annotation on any discrepancy
between the actual and authorized e-mail addresses, any resubmission for
correction.
There were a number of reasons we
had a voter resubmit his ballot. The most frequent one is that the voter
has forgotten to create a personal identification in the [BALLOT] line
of the ballot, or his/her e-mail address was listed there. The second one
is that a name was added (the write-in syndrome!).
155 members voted during the week
long election. Of these there was one blank ballot. This corresponds to
45% of elegible voters. The interesting fact is that this is almost equal
to the number of votes in the Fall vote, 150 at that time.
Phuong, being more automated than
me, sent me the results the night of closing. It consisted of 3 files,
the summary voter list, the result summary and the actual ballots.
The next day, I went manually through
Phuong's ballots and compared them with my own list. Two discrepancies
came up
1. One ballot did not have any "*"
but had less than 7 names. We agreed to accept those names as voted in.
2. There was one ballot where the
"*" was at the end instead of the beginning of the line.
These were resolved and some late
minute ballots were included (the deadline for voting was that the ballot
be mailed just prior to midnight local time) since they were delayed on
their way to us. The results were then posted after the candidates were
informed. The actual (modified) ballots were posted and anybody could verify
them with a series of Unix egrep commands. The modification were to make
the ballot format conform to our model:
1. an asterisk at the beginning
of the line for the candidate voted, 2. the [BALLOT} line with the proper
title and the personal ID.
Unlike the vote in the Fall, we
received no complaint this time around, making it a successful election.
Election Results
As we have reported the list in
order of decreasing number of votes is Binh, Dung, Thao, Tin, Hai, Bich,
James, Phong, Phiet, Bruce, Diem
As per our Bylaws, anh Binh was
offered the position of 1995-96 President. He declined. Anh Dung, the next
person in line accepted. Anh Thao also accepted to be the President-elect.
Anh Hai, due to other personal commitment,
asked that his candidature be withdrawn.
As a result, the 1995-96 Executive
Committee will consist of: Binh, Dung, Thao, Tin, Bich, James, Thong. I
am the hold-over as past-President.
|
