[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ga] votebot available



Please forgive the length of this post.

For those that may be interested, I have developed a simple email
votebot, freely available under standard open source conventions. 
While it is simple, it has a number of features that I consider
useful and interesting -- it works with any email client with no
additional software, it automatically tallies the votes, provides for
auditing facilities, allows for people to be in different roles
(voters, registrars, and auditors), and is resistant to spoofing. 
While it isn't cryptographically secure, it does authenticate the 
votes, and, if desired (and if the votebot is run by a trusted 
party), can provide some degree of privacy.

It uses files with lists of email address to define the voters,
registrars, and auditors.  These lists may be hand-maintained for
small groups, or managed by a mailing list manager such as majordomo.

It is intended as a candidate for use in Working Groups of the DNSO,
but it is a general tool, and available to anyone.

The source is available as a tar file at 

    ftp://songbird.com/pub/votebot.tar 

I have also set up a working version at votebot@songbird.com.  It is
configured to deal with three majordomo lists: vtest@songbird.com,
vtest_reg@songbird.com, and vtest_aud@songbird.com.

You can subscribe to these lists by sending a message to 
majordomo@songbird.com, with the following contents in the body:

    subscribe vtest_reg
    subscribe vtest
    subscribe vtest_aud

You can unsubscribe by sending

    unsubscribe vtest_reg
    unsubscribe vtest
    unsubscribe vtest_aud

to majordomo@songbird.com.

As a member of vtest_reg you can register ballots to create and manage 
an election

As a member of vtest you can vote in any such election

As a member of vtest_aud you can see the audit records for any such
election

The votebot is fully functional, though there is still some work to 
do -- the logging needs to be fixed up; I want to add support for 
other voting protocols; I want to add support for automatic 
control of the opening and closing of the polls at pre-determined 
times; and a few other features.

I am of course interested in any constructive criticism, or ideas 
for improvements or features.

By its nature, it is hard for one person to meaningfully test a 
votebot, so there are certainly some bugs.

To play with the votebot, join the above lists, cut out the sample
ballot included below, and send mail to votebot@songbird.com, with
a subject "register ballot", and a body with the sample ballot.

Finally, I would like to thank Dan Busarow, who's votebot used on the
PAB list provided the model and the inspiration for this:

Thanks, Dan :-)

================================================================

Here is the current documentation file:


                          Votebot

Votebot provides a method for taking votes among a group of
people on an email list.  It provides several functions --
initializing an election, terminating an election, collecting votes,
tallying the votes, and auditing.  All the data for each election
(all the received votes) are preserved until a system administrator
deletes them.  The votebot uses a very simple security and auditing
model, adequate in many practical cases. 

A primary design goal of the votebot is that it require no client
software except a minimal email client.   The votebot is designed to 
be used in conjunction with standard email list software, in 
particular, majordomo.  

Installation instructions are at the bottom of this document.


                Voters, Registrars, and Auditors

The votebot deals with three sets of email addresses -- the "voters",
the "registrars", and the "auditors".  The voters can vote and see
the results; the registrars can initiate and terminate elections; and
the auditors can see all the votes cast.  Each set is represented by
a file of email addresses, one per line.  The files need not be
distinct -- for example, the voters, registrars, and auditors could
all be the same file.  Note that use of the term "registrar" in this 
document has absolutely nothing to do with DNS.

A more common approach would be to have a large set of voters, the
same set be the auditors, and a small subset be registrars (perhaps
elected officers of the group).  This would imply a completely open 
election in the sense that all the voters could see all the votes, 
but that some elected officers (say the secretary or chair) would be 
in charge of initiating and terminating elections.

Other combinations are possible.


             Security, Privacy, and Authentication

Because email addresses can be spoofed, the votebot uses a simple
"cookie" handshake mechanism to guard against fake votes -- you are
first sent a unique "cookie" or "key" (a string of 26 hex digits, at
this time) that must be returned for each vote or other transaction
with the votebot.  [There are two unauthenticated requests.]

Email is in practice actually very reliable, but can be lost. 
Therefore, the votebot allows each voter to cast multiple votes --
the last one received will be counted.  However, because the order of
delivery of multiple email messages is not guaranteed, it is not wise
to change your mind, because you can't guarantee which vote the
votebot will count.

"Vanilla" email is intrinsically weak from a privacy perspective, so 
the votebot cannot provide high security secret ballot, even if the 
operator of the votebot is trusted completely.  However, some 
privacy can be achieved by having a small set of trusted auditors, 
and a trusted votebot operator.

Note that one of the design goals of this software was to provide a 
voting mechanism that required nothing but a simple email client on 
the part of the voters.  It would, however, be straightforward to 
construct an SSL gateway to the votebot, using a web browser as the 
secure client.


                        Specific Functions

Votebot supports 8 functions: "register ballot", "open" (polls for
voting), "close" (polls), "list" (all votes in summary form), "audit"
(send a file of all ballots received), "tally" (return election
results), "vote" (cast a vote), and "help" (not yet implemented). 
All the functions are activated by being specified in the "subject:"
header of an email message. 

The general flow of processing for an election goes as follows:

    1) One of the registrars creates a ballot (see below) and sends
    it to the votebot address, in a message with "register ballot" 
    as the subject.

    2) The votebot verifies the ballot is in correct form, converts
    it to a canonical form, and sends a message to each registrar
    with subject "open <key>" (where <key> is one of the above
    mentioned 26 hex digit "cookies").  The registrars verify that
    the canonicalized ballot is as they expect.  In general, the 
    votebot deals with the common email quoting convention (some 
    combination of ">" and " " characters prepended to lines), and 
    modifications to subject lines are handled fine, as long as the 
    original string appears somewhere in the line.  Thus, 
      "Subject: RE: Vote  33d80d6162b599e74b41a07b0b (was Re: blat)"
    works just as well as 
      "Subject: Vote  33d80d6162b599e74b41a07b0b"

    3) When it is time to start voting, one of the registrars replies
    to the votebot, with exactly that same "open <key>" string in the
    subject of the reply message (the body of this reply is ignored 
    by the votebot).

    4) The votebot receives the "open <key>" message, and 
    
        a) Sends copies of the ballot to each address in the "voters"
        list.  The subject of this message reads "Vote <key>".  The
        voter fills out the ballot and returns the message, with the 
        same "Vote <key>" string somewhere in the subject.  This 
        vote may be returned any number of times -- all votes will 
        be recorded, and the last one received will be the one that 
        is counted.

        b) Sends a "Close <key>" message to each registrar.  If a 
        registrar returns this message to the votebot, the polls 
        will close.  This is irreversible -- once an election is 
        closed, it is closed.

        c) Sends a "List <key>" message to each auditor.  If an
        auditor returns this message, a list of all votes cast so far
        will be returned.  If the auditor changes the "List <key>" 
        to "Audit <key>" (that is, changes "List" to "Audit" in the 
        subject line), a full audit will be returned, with the full 
        text and headers of every email ballot submitted for the 
        election. 

    5) The votebot collects votes.  A receipt with a unique checksum
    is sent for each received vote.  (The checksum is *not* a cookie,
    though it looks like one.)

    6) One of the registrars closes the election.

    7) Anytime after the election is open, "tally <key>", "list
    <key>", and "audit <key>" messages may be sent.  Note that the
    "<key>" used in "tally" and "audit" messages is just the precise
    same key that the votebot returned for the "vote", "list", and
    "close" messages.


                            Ballots

Ballots are quite free-form, and just depend on a few syntactic
features for recognition.  Reserved words on the beginning of a line
are used to delimit sections; two characters are reserved for use on
the ballot, the left and right square brackets '[' and ']'.

Text in the ballot is divided into two classes: single lines of
syntactic importance, which always have a keyword or symbol as their
first non-blank characters, and "noise" -- everything else, which may
be important explanatory text, but is ignored by the votebot. 

Examples of keywords are: 'ID:', 'Question:', 'Polls Open:', 'Polls
Close:', 'voters:', 'Created by:' and 'Protocol:'.  Case is not
significant.  Leading whitespace is OK.  The 'ID:' and 'Created by:' 
keywords are added by the software.

Ballot choices are indicated by '[]' as the first non-blanks on a 
line.  For concreteness, here is an example ballot, as it would be 
submitted in a "register ballot" message:

    ================================================================
    Voters: test
    Polls open:  Mon Sep  6 00:00:01 GMT 1999
    Polls close: Wed Sep  8 00:00:01 GMT 1999

    Sample ballot
    Question: "We believe you, Anita"
    protocol: select one
       [] Yes
       [] No
    
    Question: William Jefferson Clinton should be impeached
       [] Absolutely!
       [] Are you crazy?
    ================================================================

After the ballot is processed by the votebot, it is returned to the
registrars for approval.  A registered ballot has
more fields added.  Concretely, this is the mail message that was
returned for the above ballot:

    ================================================================
    From: votebot
    Date: Sat, 6 Nov 1999 09:08:13 -0800
    To: kent@songbird.com
    Subject: Open  defff0884450598834770278cd
         
    ID:  defff08844
    Voters: test
    Created by: kent@songbird.com
         
    Polls Open:  Mon Sep  6 00:00:01 1999 UTC  (Sun Sep  5 16:00:01 PST)
    Polls Close: Wed Sep  8 00:00:01 1999 UTC  (Tue Sep  7 16:00:01 PST)
    
    Sample ballot
    QUESTION: "We believe you, Anita"
    PROTOCOL: select one
    [] Yes
    [] No
      
    QUESTION: William Jefferson Clinton should be impeached
    [] Absolutely!
    [] Are you crazy?
    ================================================================

The "subject:" line of the above message is 

    Subject: Open  defff0884450598834770278cd

At this point in the election cycle the ballot has been registered,
but the polls are not open.  A reply to the above message, with that
same subject line, will open the polls, and send individual ballots
to every member of the "voters" list.  The parsing is relatively 
forgiving of "Re:" prefixes and so on in the subject line.  The content 
of the message is ignored in processing an "open".

In a future version the votebot will only accept votes cast within the 
window defined by the "polls open" and "polls close" keywords, if they 
are present.  Currently, all that is done is to generate a GMT version 
of the times.

Also, in a future version, the "protocol:" keyword will be parsed,
and individual questions may be tallied through different voting 
protocols. 

           Legalities, Installation, and Configuration

Votebot is released as open source -- the license is at the top of 
the code.  If you make useful improvements, please send them to me:
kent@songbird.com. 

The votebot is extremely simple to install, but you must have a 
functioning perl5 installation with the Digest::MD5 and Date::Manip 
modules installed.  (It also requires Fcntl and POSIX, but I believe 
these are part of the base installation of perl5.)  For perl and 
perl modules, see http://cpan.org.

Put the votebot code somewhere appropriate, then set up an email 
alias to run it.  For example, with sendmail an alias like this works:

    votebot: "| /home/kent/votebot/votebot"

The votebot currently is configured by editing the variable
assignments in the "config" subroutine at the bottom of the
code.  The comments there describe each configuration variable.

-- 
Kent Crispin                               "Do good, and you'll be
kent@songbird.com                           lonesome." -- Mark Twain