WO2007113860A1

WO2007113860A1 - Electronic ballot device e electronic ballot system comprising such a device

Info

Publication number: WO2007113860A1
Application number: PCT/IT2006/000202
Authority: WO
Inventors: Antonio Puddu
Original assignee: Ales S.R.L.
Priority date: 2006-03-30
Filing date: 2006-03-30
Publication date: 2007-10-11

Abstract

An electronic ballot device (1), comprising a support board (2) of a substantially insulating material, apt to visibly carry a plurality of symbols (3) identifying each a respective choice option; a plurality of conducting elements (4), each of the conducting elements (4) having a discontinuity at a respective marking zone (5) associated to a respective identifying symbol (3), apt to be crossed by a user with selection means; a storage device (6) apt to cooperate with each of said plurality of conducting elements (4) so as to define a respective circuit, wherein the circuit remains in an open state until the respective marking zone (5) is crossed by appending of a substantially conductive connecting stroke (7) so as to establish the continuity of the respective conducting element (4), the storage device (6) recording the switching to a closed (made) state of the circuit in connection with the choice carried out by the user.

Description

ELECTRONIC BALLOT DEVICE AND ELECTRONIC BALLOT SYSTEM

COMPRISING SUCH A DEVICE

DESCRIPTION

The present invention refers to an electronic ballot device and to a corresponding electronic ballot system comprising such a device. hi particular, with reference to an implementation thereof as specific as possible, the present invention introduces an electronic ballot paper useful for carrying out voting operations and the subsequent steps of managing, transmitting and processing the collected data.

An electronic ballot paper according to the present invention finds application for the implementation of electronic ballot and scrutiny systems. To date, several polling systems at least partially automated, and even electronic, are present on the market; yet, those often prove not compatible thereamong and anyhow less than adaptable to the normative system of each nation, as well as less than functional in light of their intrinsic complexity, scarce flexibility and reliability.

In modern democratic systems, in order to meet the needs of smooth operation of public affairs and of public opinion information, priorities for institutional bodies are those of reducing the times for carrying out steps of recording and accepting a voter, transmitting turnout data, counting ballot papers, collecting results, concomitantly guaranteeing ballot secrecy, transparency of the scrutiny operations and continuous data traceability. To date, there is no polling system that may be totally computerized, reliable, safe and fast in collecting and transmitting information, such as to allow, in compliance with existing rules, to carry out the scrutiny just after the closing of the ballot session and make available the fruition of the obtained results.

Hence, object of the present invention is to solve said problems, by proposing an electronic ballot device as defined in claim 1.

Further object of the present invention is to provide an electronic ballot system comprising such a device, as set forth in claim 15.

Additional features of the device and system according to the present invention are defined in the dependent claims thereof. Hence, the present invention innovatively meets the demand, felt by a country's institutions as well as by administrative bodies of a general public, of optimizing voting and scrutiny operations, by providing the instruments for enacting elections that may be completely computerized. Concomitantly, ballot formalities are kept substantially unaltered, so as not to give rise to procedural confusion with the entitled individuals, owing to intricacies of the mechanisms of ballot expression and interpretation.

The main advantage of the ballot device according to the present invention lies in that it allows to attain a safe and irrefutable rationalization of the electoral process, so that each step thereof may be checked and assessed, from a voter's access to ballot to the phases of data collection and secured transmission.

Moreover, the adoption of a corresponding ballot system according to the present invention, apt to implement a related ballot method, allows a real-time availability of the turnout data for a ready processing thereof, and, finally, of the definitive results of the ballot, thereby speeding up also the steps of divulging to the mass-media.

Thus, there are allowed: ready voter identification, automatic production of periodical reports on the flow of voters and records, accurate scrutiny of the ballot papers and secured, optionally encrypted, data transmission. Nonetheless, the setting up and the logistics of each polling section are advantageously made simpler.

Moreover, the ballot method according to the present invention is preset to be easily updated and revised periodically, so as to conform to possible normative and/or procedural modifications.

Other advantages, features and the operation modes of the present invention will be made apparent from the following description of a preferred embodiment thereof, given by way of example and without limitative purposes. In particular, in the following discussion reference is made to a specific application of the present invention in the electoral field; however, evidently the present invention could anyhow find application in other scopes, different with respect to the expression of the political will of individuals, in which there be the same technical problem of data collection, counting, processing, attributing, secured transmission and divulging.

Reference will be made to the figures of the annexed drawings, wherein: figure 1 is a plan view apt to schematically reproduce the structure of an electronic ballot device according to the present invention; figure 2 is a plan view apt to visualize a putative configuration, substantially comb-shaped, of a marking zone of a conducting element comprised in the electronic ballot device of figure 1, figure 3 is a schematization of the specifically electric structure of the electronic ballot device of figure 1, apt to highlight the interconnection of a plurality of conductive circuit tracks traced on said device, as well as a transmitting and receiving storage device cooperating with each of said, conducting elements so as to define a respective circuit; figure 4 is a plan view apt to display a portion of a circuit as depicted in figure 3, in which it is shown the marking zone of figure 2, having an associated symbol superimposed thereon; figure 5 is a schematization apt to illustrate a user's operation of selecting by appending a sign astride of a marking zone as depicted in figure 2; figure 6 is a schematic depiction of the allocation of an information unit in the storage device of figure 3, concomitantly to a user's selection of a symbol; - figure 7 is a schematic depiction of the steps of reading and acquiring the information allocated in the storage device of figure 3; figure 8 is a perspective view of a preferred embodiment of a device for reading the information contained in the electronic ballot device of figure 1; figure 9 is a flow chart schematizing the operation steps of the operating system, loadable from an external mass storage device, for managing the reading device of figure 8 and the programs executable thereby; figure 10 is a flow chart schematizing the operation steps of a program suitable for carrying out the electronic scrutiny operations of the electronic ballot device of figure 1 ; - figure 11 is a schematization of a ballot system directed towards the electronic scrutiny of a plurality of electronic ballot devices as depicted in figure 1, apt to illustrate the components thereof and the interaction modes among said components; figure 12 is a flow chart apt to illustrate a sequence of steps for the operations of activating the reading device of figure 8, such a device being associated to each polling section, respectively; figure 13 is a schematization of the system of figure 11, apt to further illustrate the transmission modes of the information contained in said electronic ballot device; - figure 14 is a schematization of the processes for initializing the components of the ballot system of figure 11 and for securing information exchanges among said components.

To describe the present invention, hereinafter reference will be made to the above- indicated figures. Referring to figure 1, the electronic ballot device 1 according to the present invention comprises a support board of a substantially insulating material and a plurality of conducting elements 4 applied to said support board. Onto the support board there are visibly carried a plurality of symbols 3, each identifying a respective choice option. hi particular, such symbols 3 may be those filed by lists and/or parties on the occasion of elections such as ballots or referendums. The support board is preferably undistinguishable from a normal paper, it being actually manufacturable so as to still have the same dimensions, the same features of ease of handling, tactile and visual perception of a traditional ballot paper.

As it is evident from figure 3 in an overall view of the ballot device, and more specifically from figure 2, each of the abovementioned conducting elements 4 has a discontinuity at a respective marking zone 5.

Such a marking zone 5, exhibiting substantially infinite resistance, is positioned on the board so as to be associated to a respective identifying symbol.

Preferably, the conducting elements 4 are conductive circuit tracks, traceable on said support board, interconnected thereamong, in an arrangement substantially in parallel.

Such tracks may be superimposed on the board by printing, e.g. with a conductive polymer ink, preferably clear like the commercially known PEDOT.

A storage device 6 is apt to cooperate with each of said plurality of conducting elements 4, so as to define a respective circuit. hi figure 1, the ballot device disclosed by way of example comprises twenty circuits, each comprising a respective marking zone 5, interconnected by twenty-one polymer tracks closing on a storage device 6 common to all circuits.

Preferably, the storage device 6 integrates a radiofrequency (RF) system for remote identification, which can be activated upon receiving a reading signal. For this purpose an RFID chip may be used, equipped with a receiving and transmitting element such as an antenna and insertable in a small plastics casing such as a Tag.

The chip introduced in the Tag in figure 1, beside the pins for connecting to an antenna, has other (20+1) pins for connecting to the polymer tracks. According to the hereto-disclosed preferred embodiment of the invention, the marking zone 5 is substantially open comb-shaped and exhibits substantially infinite resistance.

However, the configuration of the marking zone 5 is susceptible of being crossed by a user with selection means, as exemplified in figure 4. The operation of the electronic ballot device 1 according to the present invention is such that each of said circuits remains in an open state until the respective marking zone 5 is crossed by appending of a substantially conductive connecting stroke 7. Thus, it is established the continuity of the respective conducting element and, consequently, a proportional electric signal is sent to the storage device 6 that records the switching to a closed (made) state of the circuit involved by the marking 5, in connection with the choice carried out by the user, as is evident from figure 5. In the case at issue, the specific design of the open-circuit marking zones 5 allows to attain the easy making of the respective circuit with the use of selection means such as a writing instrument equipped with conductive polymer ink, preferably matte, for the appending of a bar or cross sign. The storage device 6 is apt to allocate and record, for each circuit, a respective information unit in accordance with the choice effected by the user.

The RF system for integrated remote identification, preferably of a passive type, may be activated upon receiving a reading signal by a Tag reading instrument, commonly called reader, to which it transmits a bit string apt to represent the information related to the marking zones 5 actually crossed and not crossed. The RFID chip introduced in the Tag in figure 1 may, by way of example, be equipped with an encryption subsystem and preferably it contains no RAM/flash memory of any kind.

Instead, it has a data record of a number of bits matching the number of the symbols 3 on the ballot paper, in order to contain the data to be transmitted when it is active, according to what is illustrated in figure 6.

The RFID chip preferably incorporates a Read Only Memory (ROM) in which there are recorded a Unique Identifier (UID) and a private key for the related Tag. When lit by a reader, the Tag authenticates itself and sets up an encrypted connection with the reader, e.g., according to an asymmetric key scheme in a PKI (Public Key Infrastructure) architecture.

The Tag/reader system exploits anti-collision algorithms for multiple reading and the reader stores the sequence of the Tags read, i.e. the UDD list, corresponding to a plurality of electronic ballot devices according to the present invention. Therefore, a voter could continue to vote traditionally, by appending a sign in correspondence of the selected electoral symbol or element.

The ballot expressed by the voter will match the variable associated to the polymer track shortcut by the voter on voting.

Then the data register of the chip, denotable by the caption RD, is set to 1 if the circuit has been made by marking or to 0 if the circuit remains open. When interrogated with the suitable reader, the Tag responds to the reading request by sending an encrypted packet with an RD content matching the value of the electoral parameter. In the example in figure 6, the content of the data register of the chip corresponds to the string 00010= list b.

The interrogation of the Tags present in each ballot paper concomitantly with the start of the scrutiny by means of a suitable reading device 10 could take place even when ballot papers are still sealed in the dedicated ballot box 100, as schematically depicted in figure 7.

The passive RFDD chip needs no batteries for the power-supplying; it collects power from the same radio signal used for its activation, therefore having a theoretically endless life. For security and transparency reasons, the ballot box 100 is preferably shielded until the end of the voting and as long as it remains sealed. At the stage of scrutiny the shielding is taken off and, with the ballot box being open, the counting process is activated. Thus, the counting of the ballot papers of the entire polling section may take place with the utmost simplicity and in a few seconds, merely by placing the reading device 10, integrating the Tag reading instrument 11, near to the ballot box 100. The reading device 10 suitable for acquiring the information recorded by a storage device 6 may be a small-sized hardware device, preferably shock-resistant, that may be easily carried and put away awaiting subsequent utilization. Moreover, preferably it needs no installing and is susceptible of being used also by those unskilled in Information Technology.

In a preferred embodiment thereof, the reading device 10 comprises screens for displaying the acquired information, e.g. a plurality of opposed displays for a simultaneous vision of election results by plural users. Figure 8 depicts a pair of screens.

The reading device 10 may integrate, beside the Tag reading instrument per se, a microprocessor unit suitable for processing acquired information and a storage medium, preferably purely electronic, for executing computation methods directed at processing said information. The instructions for activating the reading device 10, the management of the interface between a user and hardware means integrated in the reading device 10, as well as the instructions for executing computation methods functional to the scrutiny, are preferably introduced in read-only mode by an external removable mass storage device 80. Each of said external removable mass storage devices 80 is univocally associable to a respective delocalized station 20, substantially installed in each Polling Section Office, in which a respective reading device 10 is integrated. In the case at issue, the reading device 10 is preferably used in cooperation with an

USB-type pen drive 80 in all operative stages.

The software of the operating system, preferably open-source, and the applicative programs, as well as the scrutiny data such as the database and the log files, preferably reside in said pen drive 80.

Thus, the system is completely transparent and absolute security in data acquisition is guaranteed.

The starting of the operating system occurs in read-only mode and takes place from the USB key. The applicative executes data backup in real time during the scrutiny.

The scrutiny data input mode is supported by reading, with a suitable reader, of the

RjFID Tags present in the electronic ballot device 1.

There is the option of combining to this primary input mode a secondary mode, implementable by further associating to the symbols 3 on the ballot papers respective bar codes, which could be read manually or automatically, e.g. by optical scanning.

The scrutiny steps can be displayed on the monitors of the reading device 10 of figure 8, for a total control with visual checking of the operations by the users prepared for the scrutiny.

The protection of the system from any external menace is assured by the fact that preferably the reading device 10 for counting the votes has no connection to wire or wireless network infrastructures.

All other protection-related aspects are anyhow safeguarded, and the continuity and rapid reset of the system and information in case of accidental damages are guaranteed. The read-only operating system and the lack of hard disk prevent any form of tampering.

Moreover, the scrutiny and vote counting databases may be encrypted, e.g. with a

256-bit AES (Advanced Encryption Standard) algorithm.

In order to guarantee the safeguard and the tallying of the scrutiny data acquired at a specific Polling Section Office, preferably the USB pen drive 80 is strictly constrained to the personal encrypted key in possession of the Chairperson of said

Office, so that the reading device 10 could be started by the Chairperson only upon inputting the encrypted code paired with the USB pen drive 80.

Once scrutiny has ended, the encryption key can be automatically eliminated from the pen drive 80 and the reading device 10 turns off.

As a consequence, the ballot counting database may not be opened in clear or modified anymore by the operators employed in the Polling Section. At the end of the scrutiny and after the collecting by the pen drive 80, a total absence of data on the reading device 10 is guaranteed.

Preferably, the file system of the USB pen drive 80 is characterized by having two partitions, a first partition containing the operating system, e.g., Linux, and a second partition containing the applicative software, in clear, and the scrutiny data, encrypted.

With regard to the preferred embodiment introduced, the system is entirely contained in the removable mass storage device 80 and exploits a cloop (compressed loop image) technology to run as an installed system, it actually being always in read-only mode.

The boot occurs from the removable mass storage device 80 and, once the loading of the operating system has ended, the applicative software for carrying out the electronic scrutiny starts automatically. The operation process of the operating system in a configuration with a single USB pen drive 80 is schematized in the flow chart of figure 9.

The applicative software is, e.g., a Java application storing on the USB pen drive 80 the log file of the encrypted system (timestamp, description of activities carried out, anomalies and messages) the data summarizing list votes and preferential votes, the general data of the Polling Section Office (Section ID, enrolled voters, returned ballot papers, authenticated ballot papers) as well as the elementary data of encrypted vote (univocal ID number and encrypted vote).

At the start, the applicative shows on video the guided initialization procedure that will request the reading of the activation code, e.g., a bar one, related to the Section. Subsequently, it is requested the insertion of data matching the: Section ID; Section Chairperson ID and/or Section operator ID; voters enrolled in the section, subdivided into males and females; number of ballot papers returned; number of authenticated ballot papers; system date.

Upon confirmation, the system records the information in the encrypted file INITDS stored in the pen drive 80. Such data could be reused in case a system restart is required.

At each restart, the state of the scrutiny is assessed by means of the LOG file, and the Section Chairperson is allowed to express whether he/she wishes to resume the counting session from the beginning or continue from the last vote inserted in the preceding session. Further object of the present invention is to provide an electronic ballot system, comprising a plurality of electronic ballot devices as defined in one of the claims 1 to 7; at least one delocalized station 20, installable in each Polling Section Office, apt to acquire information contained by said plurality of electronic ballot devices, comprising a reading device 10 as introduced in one of the claims 8 to 13; as well as a telematic transmission terminal 30 for transmitting said information, cooperating with the delocalized station 20 via means for transferring data; and a central station 40 for collecting information, in bidirectional communication with the telematic transmission terminal 30.

In figure 11 it is reported a schematization of a ballot system according to the present invention, directed at the electronic scrutiny of a plurality of electronic ballot devices as depicted in figure 1, apt to illustrate said components thereof and the interaction modes between the components.

The central station 40 integrates the databases for recognizing said identifying symbols 3 carried in the electronic ballot device 1, as well as the electoral data related to each delocalized station 20, so as to interpret the information recorded in each of the electronic ballot devices for each delocalized station 20. The authentication of the delocalized station 20 with said central station 40, the subsequent activation of the delocalized station 20, as well as the transmission of information from the delocalized station 20 to the central station 40 occur via said telematic transmission terminal 30. The means for transferring data between said telematic transmission terminal 30 and the delocalized station 20 comprises a respective external removable mass storage device 80, substantially overlappable to the pen drive 80 already mentioned above and identifiable therewith, univocally associable to a respective delocalized station 20. The electronic ballot system according to the present invention comprises means for initializing each component of the system, as well as means for securing information exchanges among said components.

The LiveUpdate/ Activation steps and the upload of the vote counting databases are entrusted to the Telematic Transmission or Section Terminal (TTS) 30. The transmission to the collecting central station 40, indicated in the drawings as Collection Center, of the polling data acquired with the reading device 10 in each delocalized station 20 and contained, encrypted, in the USB pen drive, occurs by the Telematic Transmission Terminal 30.

The transmission may, e.g., occur by two distinct transmission channels such as a stationary phone line, for sending by means of analog Modern/ISDN/GSM/GPRS in an encrypted file; or a mobile phone line for sending in an encrypted MMS, as exemplified in figure 13. Via the TTS 30 it is possible to: carry out the activation of the delocalized station 20 and the respective reading device 10; update both the operating system and the electoral data related to symbols, lists, candidates, codes and the like with a live- update unloading and installing the latest patches directly from the Collection Centre to the pen drive 80; import the database referring to the electoral data of the Section directly from the Collection Centre.

Via the TTS 30 software, e.g., J2ME (Java 2 Micro Edition)-based, there are managed all of the transactions between the delocalized station 20 in each Polling

Section Office and the Collection Centre. The electoral data, e.g. for national-level elections, is acquired by the Collection

Centre, by direct importing of the databases sent beforehand by Municipalities.

The databases data-entry for managing voters' reception may be performed at the moment of enabling the Section delocalized station 20.

In that context, along with the authorization the Collection Centre sends also the database of the specific Section data.

Alternatively, the Section data database could be inserted in the pen drive 80 directly during the generation phase.

The data related to the managing of voters not enrolled in the Section electoral registers may be inserted by a specific applicative program. In any moment, the turnout data at the ballot box 100 of the Polling Office, directly readable from the screens of the reading devices in each respective Section, may be transmitted to the Collection Centre by means of the Telematic Terminal 30 of the

Section (TTS) with an MMS or with a file.

By way of example, the operative phases to be carried out preliminarily to the scrutiny may be resumed as follows.

The Section Chairperson, assisted by the TTS operator, may insert a Memory Card in a suitable slot of the TTS 30 and thereby activating the system initialization procedure, schematized in figure 14.

During this phase, a wizard guided procedure may exhibit, on a display of the TTS 30, a request of typing an alphanumeric encrypted activation code, contained e.g. in a sealed envelope.

The activation of the TTS 30 is schematized in figure 12.

The encrypted code, packed e.g. in an MMS, arrives to the Collection Centre where it is managed by a suitable procedure that automatically sends to the TTS 30 the database with the electoral data of the Section; the file containing the electoral registers of the district, the images of the Party symbols 3 associated to the electoral registers and any updates. The Chairperson takes the Memory Card from the TTS 30, puts it in the pen drive 80 USB and inserts the latter in the suitable port of the reading device 10 of the delocalized station 20.

At the turning on of the reading device 10, an acquisition program checks the state of the system, stored in the pen drive, and automatically starts the test session.

In case instead the section has already been initialized, the program checks whether a session has already been started previously and, in the affirmative case, exhibits a pop-up in which the operator is asked whether it be desirable to proceed with the preceding session or to start by clearing all previous data. Subsequently the Chairperson is requested to insert the initialization data related to the Section ID, the Section Operator ID and the Section Chairperson ID. The present invention has hereto been described according to a preferred embodiment thereof, given by way of example and without limitative purposes. It is understood that other embodiments could be envisaged, all to be construed as falling within the protective scope thereof, as defined by the appended claims.

Claims

1. An electronic ballot device (1), comprising:

• a support board (2) of a substantially insulating material, apt to visibly carry a plurality of symbols (3) identifying each a respective choice option; • a plurality of conducting elements (4), each of said conducting elements (4) having a discontinuity at a respective marking zone (5) associated to a respective identifying symbol (3), apt to be crossed by a user with selection means;

• a storage device (6) apt to cooperate with each of said plurality of conducting elements (4) so as to define a respective circuit, wherein said circuit remains in an open state until said respective marking zone (5) is crossed by appending of a substantially conductive connecting stroke (7) so as to establish the continuity of said respective conducting element (4), said storage device (6) recording the switching to a closed (made) state of said circuit in connection with the choice carried out by said user.

2. The electronic ballot device (1) according to claim 1, wherein said conducting elements (4) are conductive circuit tracks traceable on said support board (2), interconnected thereamong, in a substantially parallel arrangement.

3. The electronic ballot device (1) according to claim 1 or 2, wherein said marking zone (5) is substantially open-comb shaped and exhibits substantially infinite resistance.

4. The electronic ballot device (1) according to one of the claims 1 to 3, wherein said selection means comprises means for appending a substantially conductive bridge (7) astride of said marking zone (5).

5. The electronic ballot device (1) according to one of the claims 1 to 4, said selection means comprises means for marking out substantially conductive signs (7) astride of said marking zone (5).

6. The electronic ballot device (1) according to one of the claims 2 to 5, wherein said circuit tracks (4) are of conductive polymer ink.

7. The electronic ballot device (1) according to one of the claims 1 to 6, wherein said storage device (6) apt to allocate and record, for each circuit, a respective information unit in conformity with the selection operated by said user, integrates a radiofrequency system for remote identification, which can be activated upon receiving a reading signal.

8. A reading device (10) suitable for acquiring information recorded by a storage device (6) as defined in one of the claims 1 to 7.

9. The reading device (10) according to claim 8, comprising screens (12) for displaying acquired information.

10. The reading device (10) according to one of the claims 8 or 9, integrating a microprocessor unit suitable for processing said information.

11. The reading device (10) according to claim 10, comprising a purely electronic storage medium for executing computation methods directed at processing said information.

12. The reading device (10) according to claim 10 or 11, wherein the instructions for activating a reading instrument (11), the management of the interface between a user and hardware means integrated in said reading device (10), as well as the instructions for executing said computation methods, are introduced in read-only mode by an external removable mass storage device (80).

13. The reading device (10) according to claim 12, wherein each external removable mass storage device (80) is univocally associable to said reading device (10).

14. An electronic ballot system, comprising:

- a plurality of electronic ballot devices (1) as defined in one of the claims 1 to 7;

- at least one delocalized station (20) apt to acquire information contained by said plurality of electronic ballot devices (1), comprising a reading device

(10) as introduced in one of the claims 8 to 13;

- a telematic transmission terminal (30) for transmitting said information, cooperating with said delocalized station (20) via means for transferring data; and - a central station (40) for collecting said information, in bidirectional communication with said telematic transmission terminal (30).

15. The electronic ballot system according to claim 14, wherein said central station (40) integrates databases for recognizing said identifying symbols (3) carried in said electronic ballot device (1) as well as the electoral data related to each delocalized station (20), so as to interpret said information recorded in each of said electronic ballot devices (1) for each delocalized station (20).

16. The electronic ballot system according to claim 14 or 15, wherein the authentication of said delocalized station (20) with said central station (40), the subsequent activation of said delocalized station (20), as well as the transmission of said information from said delocalized station (20) to said central station (40) occur via said telematic transmission terminal (30).

17. The electronic ballot system according to one of the claims 14 to 16, wherein said means for transferring data between said telematic transmission terminal (30) and said delocalized station (20) comprises a respective external removable mass storage device (80), univocally associable to a respective delocalized station (20) 18. The electronic ballot system according to claim 17, comprising means for initializing each component of said system, as well as means for securing information exchanges among said components.