The ATHENA Class of Risk-Limiting Ballot Polling Audits
Authors:
Filip Zagórski,
Grant McClearn,
Sarah Morin,
Neal McBurnett,
Poorvi L. Vora
Abstract:
The main risk-limiting ballot polling audit in use today, BRAVO, is designed for use when single ballots are drawn at random and a decision regarding whether to stop the audit or draw another ballot is taken after each ballot draw (ballot-by-ballot (B2) audits). On the other hand, real ballot polling audits draw many ballots in a single round before determining whether to stop (round-by-round (R2)…
▽ More
The main risk-limiting ballot polling audit in use today, BRAVO, is designed for use when single ballots are drawn at random and a decision regarding whether to stop the audit or draw another ballot is taken after each ballot draw (ballot-by-ballot (B2) audits). On the other hand, real ballot polling audits draw many ballots in a single round before determining whether to stop (round-by-round (R2) audits). We show that BRAVO results in significant inefficiency when directly applied to real R2 audits. We present the ATHENA class of R2 stop** rules, which we show are risk-limiting if the round schedule is pre-determined (before the audit begins). We prove that each rule is at least as efficient as the corresponding BRAVO stop** rule applied at the end of the round. We have open-source software libraries implementing most of our results.
We show that ATHENA halves the number of ballots required, for all state margins in the 2016 US Presidential election and a first round with $90\%$ stop** probability, when compared to BRAVO (stop** rule applied at the end of the round). We present simulation results supporting the 90% stop** probability claims and our claims for the risk accrued in the first round. Further, ATHENA reduces the number of ballots by more than a quarter for low margins, when compared to the BRAVO stop** rule applied on ballots in selection order. This implies that kee** track of the order when drawing ballots R2 is not beneficial, because ATHENA is more efficient even without information on selection order. These results are significant because current approaches to real ballot polling election audits use the B2 BRAVO rules, requiring about twice as much work on the part of election officials. Applying the rules in selection order requires fewer ballots, but kee** track of the order, and entering it into audit software, adds to the effort.
△ Less
Submitted 21 February, 2021; v1 submitted 5 August, 2020;
originally announced August 2020.
STAR-Vote: A Secure, Transparent, Auditable, and Reliable Voting System
Authors:
Josh Benaloh,
Mike Byrne,
Philip Kortum,
Neal McBurnett,
Olivier Pereira,
Philip B. Stark,
Dan S. Wallach
Abstract:
In her 2011 EVT/WOTE keynote, Travis County, Texas County Clerk Dana DeBeauvoir described the qualities she wanted in her ideal election system to replace their existing DREs. In response, in April of 2012, the authors, working with DeBeauvoir and her staff, jointly architected STAR-Vote, a voting system with a DRE-style human interface and a "belt and suspenders" approach to verifiability. It pro…
▽ More
In her 2011 EVT/WOTE keynote, Travis County, Texas County Clerk Dana DeBeauvoir described the qualities she wanted in her ideal election system to replace their existing DREs. In response, in April of 2012, the authors, working with DeBeauvoir and her staff, jointly architected STAR-Vote, a voting system with a DRE-style human interface and a "belt and suspenders" approach to verifiability. It provides both a paper trail and end-to-end cryptography using COTS hardware. It is designed to support both ballot-level risk-limiting audits, and auditing by individual voters and observers. The human interface and process flow is based on modern usability research. This paper describes the STAR-Vote architecture, which could well be the next-generation voting system for Travis County and perhaps elsewhere.
△ Less
Submitted 8 November, 2012;
originally announced November 2012.
