SOBA: Secrecy-preserving Observable Ballot-level Audit

TL;DR

SOBA is an election verification method that ensures result accuracy and privacy by combining contest-specific vote record publication, cryptographic ballot mapping, and risk-limiting audits to detect discrepancies and prevent incorrect outcomes.

Contribution

It introduces a novel combination of contest-specific CVR publication, cryptographic ballot shrouding, and risk-limiting audits for secure, privacy-preserving election verification.

Findings

Provides high-confidence election result verification

Ensures privacy through cryptographic ballot shrouding

Guarantees detection of incorrect outcomes with high probability

Abstract

SOBA is an approach to election verification that provides observers with justifiably high confidence that the reported results of an election are consistent with an audit trail ("ballots"), which can be paper or electronic. SOBA combines three ideas: (1) publishing cast vote records (CVRs) separately for each contest, so that anyone can verify that each reported contest outcome is correct, if the CVRs reflect voters' intentions with sufficient accuracy; (2) shrouding a mapping between ballots and the CVRs for those ballots to prevent the loss of privacy that could occur otherwise; (3) assessing the accuracy with which the CVRs reflect voters' intentions for a collection of contests while simultaneously assessing the integrity of the shrouded mapping between ballots and CVRs by comparing randomly selected ballots to the CVRs that purport to represent them. Step (1) is related to work by the Humboldt County Election Transparency Project, but publishing CVRs separately for individual contests rather than images of entire ballots preserves privacy. Step (2) requires a cryptographic commitment from elections officials. Observers participate in step (3), which relies on the "super-simple simultaneous single-ballot risk-limiting audit." Step (3) is designed to reveal relatively few ballots if the shrouded mapping is proper and the CVRs accurately reflect voter intent. But if the reported outcomes of the contests differ from the outcomes that a full hand count would show, step (3) is guaranteed to have a large chance of requiring all the ballots to be counted by hand, thereby limiting the risk that an incorrect outcome will become official and final.