![](bg4.png)
understanding, different impairments, such as blind-
ness, etc. In short, the population they are targeted to
is very heterogeneous in many aspects, but the system
should not disfranchise any voter because of their dif-
ference. This means that the usability of voting sys-
tems must be very carefully evaluated to detect and
eliminate their disfranchising potentials.
Second, usually voters are not trained to use spe-
cific voting devices. Many voters effectively deal with
voting devices the first time they have to use them in
real elections. This may create many usability prob-
lems, which are amplified by the reluctance of asking
for help (because of privacy concerns), the pressure
of long waiting queues, etc.
Its now time to comment our proposal regarding
usability issues. First, we are not proposing a per-
fect voting terminal for being used by everybodyin all
elections. We are proposingan enhanced, visual inter-
face for a portable, voting terminal. The advantage of
using the terminal is that voters may potentially vote
anywhere, but that is not mandatory, only possible.
Therefore, we do not advocate the use of this terminal
for all voters, but only for those willing to get some
advantage out of it (such as mobility). And, of course,
we assume they can read the ballot’s text.
Second, this paper presents only one possible in-
terface for the portable terminal, using text. Further-
more, the interface uses images and colors for text
authentication, which is not suitable for blind peo-
ple and creates problems to people with visual im-
pairments, such as color blindness. However, other
interfaces may be addressed in the future for helping
people with difficulties in using this one (using pic-
tures, audio, braille output interfaces, etc.).
Third, a portable, personal voting terminal allows
voters to get used to it, to learn very well how it works
and to customize its behaviour in order to facilitate the
participation in elections. Therefore, in our work it is
relevant to discuss several interface possibilities and
their pros and cons, and configuration options, instead
of proving a single, inflexible and well-studied inter-
face. This thus not mean that we do not need to carry
on a detailed usability study with real voters in real-
istic elections. However, unlike other voting systems,
customization is relevant and should be considered in
the interface proposal and also in the training of vot-
ers, something that was not considered in (Bederson
et al., 2003; Byrne et al., 2007).
Finally, in the interface here presented we deal
with the visual authentication of ballot contents. As
far as we know, no voting system until now did that;
voters assume the system provides them the right bal-
lot, and not a false one. Visual authentication is a task
that is natural to increase the cognitive workload of
voters, therefore making even more difficult to evalu-
ate the usability of the system. In this document we
anticipate some cognitive workload problems, some
of them detected with practical experience with users,
and we draw some possible solutions to deal we them.
Again, our goal was to provide flexibility to the con-
figuration of the interface in order to better adapt it to
the terminal owner. Nevertheless, we assume that vot-
ers willing to use this interface for some reason (such
as mobility) are aware and comfortable with the extra
workload it may introduce in voting processes.
5 ENHANCED INTERFACE
We will now present our contribution, a solution for
improving the interface of the FINREAD voting ter-
minal without reducing its security. First we describe
how filled ballots are presented to voters using the dis-
play of hosting computers but without disclosing vot-
ers’ choices. Next we discuss alternatives for enforc-
ing the integrity control of the presented ballot and we
present our preferred solutions.
5.1 Non-disclosure of Voters’ Choices
The presentation of filled ballots without disclosing
voters’ choices forced us to look for some way to
represent a filled ballot other than traditional ones
(e.g. with crosses inside boxes or completed arrows).
We used the fact of having two separate displays – the
terminal display and the display of the hosting com-
puter – to present complementary contents conveying
useful information to the voter only. Naturally, the se-
curity of this approach requires that attackers cannot
monitor both displays simultaneously.
The link between the information presented in
each display is done with numbers. Each possible an-
swer to a question is given a number (hardcoded in
the ballot XML or dynamically given by the termi-
nal). When a question and its possible answers are
displayed at the hosting computer, the numbers are
displayed as well. Simultaneously, on the terminal
display are presented only the numbers corresponding
to the answers chosen by the voter for that question.
For clarification, here is an example. Let’s assume
that a question in the ballot has 3 alternatives: YES,
NO or none of them (blank), numbered from 0 to 2 (0
for blank). If the voter chooses option NO, the image
presented on the screen and the information presented
on the terminal will look like shown in Fig. 3.
Multiple choices may be expressed using the same
model, requiring only displaying on the terminal more
than one number. Considering the question presented
SECRYPT 2008 - International Conference on Security and Cryptography
532