EP2120217A2 - Electronic voting apparatus and corresponding method and computer program product - Google Patents

Abstract

The apparatus (14) has a reading and processing unit (16) for reading an electronic ballot paper (12). A vote validity control unit delivers a command for transferring the paper to a secured ballot box (15) after considering vote information in the paper, when the paper and/or vote conditions are valid. The unit (16) processes the vote information. An automatic transfer unit automatically transfers the paper to the box after receiving a confirmation signal to permit double recognition of the information by using data from the reading unit and by withdrawing the paper conserved in the box. Independent claims are also included for the following: (1) a secured electronic voting method (2) a computer program product comprising program code instructions for implementing the electronic voting method.

Description

1. Field of the invention

The field of the invention is that of electronic voting. More specifically, the invention relates to techniques implementing electronic ballots, for example in the form of smart cards, able to be read by suitable electronic readers.

2. Prior Art

For the past ten years, many voting machines have appeared.

These machines are of particular economic interest for election organizers, especially local authorities, since they require much lower human needs than the organization of traditional elections.

They also make voting operations more reliable, by limiting the potentially malicious manipulations of ballots and by avoiding or reducing counting errors.

In addition, these solutions allow for a much faster counting of votes.

In practice, although they offer many advantages, the voting machines are however little used, and with more or less success.

Existing voting machines generally include a conventional smart card reader, in which the voter inserts his card (electronic voting ballot) that he has previously configured, or programmed, according to his voting intentions. The reader reads the voting data on the card, then returns the card read, to proceed to the next vote. Often, it is expected that the card read is then re-initialized, to be used by another user. This approach limits the number of cards needed to conduct an election.

This procedure, however, does not correspond to the usual practices in of voting, and thereby defeated most voters and assessors. This therefore induces reluctance to use such types of machines.

Moreover, and although the voting machines in use are subjected to a severe control before approval, many are worried about the risk of failure of such systems, or even fraud, and also criticize the opacity of the possible controls.

Unlike the traditional voting method, the electronic voting machines in use do not allow an elector to follow the voting operations and thus ensure the proper conduct of the election. In particular, counting or recounting votes is beyond the control of voters.

3. Objectives of the invention

The invention particularly aims to overcome this disadvantage of the prior art by proposing a technique offering at least some of the advantages of voting machines, particularly in terms of speed and reliability, while respecting certain common practices.

More specifically, an objective of the invention, according to at least one embodiment, is to provide a technique to reassure voters, and facilitate voting and control operations for them.

Yet another object of the invention is to secure and increase the reliability of the voting and control operations, where appropriate.

Yet another object of the invention is also to speed up the counting of votes and, for at least some applications, to provide various information, including statistics, on the vote and its progress. For example, if a timestamp is associated with the voting information, it is possible to track how the vote has changed over time.

Finally, a particular objective of the invention is to propose a method for saving paper, with a view to sustainable development.

4. Presentation of the invention

• des moyens pour l'insertion dans lesdits moyens de lecture d'un bulletin de vote, coopérant avec des moyens empêchant le retrait dudit bulletin ;
• des moyens de contrôle de la validité d'un vote, délivrant une commande de transfert dudit bulletin de vote vers ladite urne, après prise en compte de la ou des informations de vote qu'il contient, lorsque ledit bulletin de vote et/ou les conditions du vote sont considérés valides ;
• des moyens de traitement de la ou des informations de vote lues par lesdits moyens de lecture ;
• des moyens de transfert automatique dudit bulletin de vote, après réception d'un signal de confirmation de prise en compte et sans intervention humaine, vers une urne sécurisée,

de façon à permettre une double comptabilisation desdites informations de vote, d'une part à l'aide des données lues par lesdits moyens de lecture, et d'autre part de façon différée, par retraitement des bulletins conservés dans ladite urne.The invention proposes a new solution that does not present the limitations of the prior art in the form of a secure electronic voting device, comprising means for reading electronic ballots containing at least one voting information previously entered by an elector using appropriate registration means , comprising:

• means for insertion in said reading means of a ballot, cooperating with means preventing the withdrawal of said ballot;
• means for checking the validity of a vote, issuing an order for transfer of said ballot paper to said ballot box, after taking into account the voting information or information it contains, when said ballot and / or voting conditions are considered valid;
• means for processing the one or more voting information read by said reading means;
• means for automatic transfer of said ballot, after receiving a confirmation signal for taking into account and without human intervention, to a secure ballot box,

so as to allow double counting of said voting information, firstly with the aid of data read by said reading means, and secondly in a deferred manner, by reprocessing the ballots kept in said ballot box.

• l'urne peut ne pas être ouverte avant le recomptage éventuel, et on supprime le risque d'ajout ou de suppression de bulletins ;
• le dispositif permet de disposer de deux sources, ce qui permet des comparaisons éventuelles ;
• il permet également de transférer à distance les informations lues, et les conserver de façon sécurisée ;
• il est possible de disposer du résultat du vote dès la fermeture des bureaux de vote, tout en conservant la possibilité de contrôle (qui est même améliorée, puisque l'urne n'a pas été ouverte) ;
• des statistiques peuvent être générées en temps réel ou en temps différé, notamment en fonction d'un horodatage ;
• le dispositif permet de choisir de supprimer les bulletins nuls ou blancs.

Thus, the invention offers numerous advantages over the prior art in terms of efficiency and safety:

• the ballot box may not be open before the eventual recount, and the risk of adding or deleting ballots is eliminated;
• the device makes it possible to have two sources, which allows possible comparisons;
• it also makes it possible to remotely transfer the information read, and keep it securely;
• it is possible to have the result of the vote as soon as the polls close, while retaining the possibility of control (which is even improved, since the ballot box has not been opened);
• statistics can be generated in real time or in deferred time, in particular according to a time stamp;
• the device allows you to choose to delete blank or blank ballots.

The device is designed to protect the ballot from any possible access during its processing and / or storage. This is a protection against any manipulation of the ballot (the device comprises for example a hermetic cover). In a preferred embodiment of the invention, adapted to the use of ballots equipped with an RFID chip, for example, said device is also provided to protect the ballots from any remote access. For example, it may be made of a material forming an electromagnetic barrier and / or emit interference signals.

Thus, in a preferred embodiment of the invention, said control means take account of at least one identification and / or authentication information of an elector and / or at least one assessor responsible. said vote.

• des moyens d'obtention d'au moins une information biométrique ;
• des moyens de lecture d'au moins un support de données d'identification et/ou d'authentification ;
• un clavier d'introduction d'un code d'identification et/ou d'authentification ;
• des moyens d'enregistrement et/ou de reconnaissance vocale d'au moins un mot-clé ;
• des moyens d'enregistrement et/ou de reconnaissance d'une signature manuscrite.

For example, said control means comprise at least one of the elements belonging to the group comprising:

• means for obtaining at least one biometric information;
• means for reading at least one identification and / or authentication data medium;
• a keyboard for introducing an identification and / or authentication code;
• means for recording and / or voice recognition of at least one keyword;
• means for recording and / or recognizing a handwritten signature.

Said means of checking the validity of a vote may also include means for verifying the voting rights of said elector.

For example, they include a means of reading a voter's card, a means of verifying the voter's affiliation to a set of expected voters and / or a means of verifying the voter's previous participation in the same vote. . Thus, the use of the device may for example be restricted to the voters registered on this device.

According to a particular embodiment, wherein the means for verifying the right to vote comprise at least one identification information of said voter, the device can store locally, in a secure memory, at least one identification information relating to each voter whose it counts the vote to ensure, when introducing a new ballot, that the associate voter has not already voted.

In another embodiment, the device can communicate at least one identification information relating to each voter who voted to a remote server and / or query this server to determine the right to vote of an elector.

According to the embodiments of the invention, said control means can also check the validity of the voting information or information present on said ballot, with respect to at least one predefined validity criterion.

This may be, for example, the success and / or failure of the reading of said ballot by said reading means and / or the comparison of at least one initialization data or timestamp stored on said bulletin with at least one characteristic of the election parameterized at said device.

Thus, said means of control may restrict for example the validity of the ballot according to criteria such as the municipality of the voter, the polling station, the polling date, a reference and / or approval of said means of registration .

Said control means may also comprise means for controlling the completeness of the voting information.

It can, for example, invalidate ballot papers not containing information, so as to refuse "blank" votes.

In addition, in certain embodiments of the invention, said control means may also comprise means for validating the vote as a function of at least one validation action performed by said elector and / or by an assessor.

If said validation means are intended for voters, it may for example involve pressing a key, an action on a touch screen or the pronunciation of a keyword. If said validation means are used by an assessor, they may require the provision of a password, a fingerprint or other biometric information.

• des moyens d'effacement des informations de vote d'un bulletin de vote ;
• des moyens de restitution d'un bulletin de vote ;
• des moyens de stockage sécurisée d'un bulletin de vote dans une zone distincte de ladite urne sécurisée ;
• des moyens de comptabilisation d'un échec, ou d'un bulletin de vote non pris en compte ;
• des moyens de marquage d'un bulletin de vote ;
• des moyens de destruction d'un bulletin de vote ,

mis en oeuvre lorsque ledit bulletin de vote et/ou les conditions du vote sont considérés non valides par lesdits moyens de contrôle.According to the invention, said device comprises at least one of the means belonging to the group comprising:

• means for erasing the voting information of a ballot;
• means of returning a ballot;
• means for securely storing a ballot in a separate area of said secure ballot box;
• means of accounting for a failure, or a ballot not taken into account;
• means of marking a ballot;
• means of destroying a ballot,

implemented when said ballot and / or the conditions of the vote are considered invalid by said means of control.

In another complementary embodiment, said means implemented may differ according to the validity criteria not respected. Thus, certain ballot papers may be returned by said device, for example if the voter is not one of the voters expected by the device, and others kept in said separate area of said ballot box, for example if the ballot is not readable.

The invention provides that said control means deliver at least one visible and / or audible signal indicative of the validity or invalidity of the vote.

In certain particular embodiments, intended to reassure voters, said means of control also include means for marking the validated ballots before they are transferred to said secure ballot box.

According to the embodiments of the invention, said processing means may be various. In a preferred embodiment of the invention, said processing means comprise means for storing and / or accounting for the one or more voting information.

• la nature de l'élection ;
• la commune dudit électeur ;
• le bureau de vote ;
• la date du scrutin ;
• une référence desdits moyens d'inscription ;
• un agrément desdits moyens d'inscription ;
• le nom dudit électeur ;
• un identifiant dudit électeur ;
• le contenu du vote dudit électeur ;
• la date et/ou l'heure dudit vote.

Said processing means may in particular comprise storage means in a secure memory and / or transfer means to at least one remote server of at least one of the information belonging to the group comprising:

• the nature of the election;
• the municipality of said elector;
• the polling station;
• the polling date;
• a reference of said registration means;
• an approval of said registration means;
• the name of the elector;
• an identifier of said voter;
• the content of the vote of the said voter;
• the date and / or time of the said vote.

Said processing means may further comprise means for determining statistics, taking into account, for example, timestamp data associated with said voting information. It may be, for example, means of calculation and presentation of voting statistics as a function of time in order to obtain in particular the evolution of the results of the vote during the poll.

Said processing means may also include means for transferring voting information and / or statistics to at least one remote server.

According to the implementations of the invention, said means of transfer to a remote server may be implemented during and / or after the voting process, for example to have real-time voting results and / or reconstruct an evolution of voting results over time and / or perform a remote verification of voting results.

Thus, the counting of the votes can for example be performed both by the device and at least one remote server for a consolidation of the results.

In a preferred embodiment of the invention, said reading means, said transfer means and said ballot box are at least partially transparent, so that an elector can see his ballot permanently until he either in said urn.

Thus, the device has the advantage of allowing a visual control by those present. For example, they can ensure that the ballot entered in the device is the ballot paper read and transferred into the ballot box.

• une date et heure de fin de scrutin ;
• une date et heure de fin de période de recours ;
• une information d'authentification et/ou d'identification d'au moins une personne autorisée.

According to the embodiments of the invention, said urn is equipped with locking means whose opening is only possible according to at least one of the predetermined criteria belonging to the group comprising:

• a date and time of the end of the poll;
• a date and time of the end of the appeal period;
• authentication and / or identification information of at least one authorized person.

For example, the opening of said urn can be limited to authorized persons. According to the embodiments, said opening can be validated following the provision of a password, an imprint or through a biometric identification method.

In other implementations of the invention, said opening may also be refused before a time set at the ballot box, such as the end time of the vote, for example.

According to the embodiments, said urn is made to guarantee the unalterability of said bulletins, in particular because of physical or remote manipulation, at least until the exhaustion of the time limits for appeal against the results. In its manufacture, it will thus take into account criteria such as the use of impact-resistant material, electromagnetic insulation or sealing treatments for example.

Thus, in a preferred embodiment of the invention, adapted to the use of ballots provided with an RFID chip, for example, said urn carries shielding means for protecting the ballots against an attempt to erase, to reading and / or writing of data by emitting electromagnetic waves.

For example, it may be made of a material forming an electromagnetic barrier and / or emit interference signals.

• insertion dans les moyens de lecture d'un bulletin de vote, coopérant avec des moyens empêchant le retrait dudit bulletin;
• contrôle de la validité d'un vote, délivrant une commande de transfert dudit bulletin de vote vers ladite urne, après prise en compte de la ou des informations de vote qu'il contient, lorsque ledit bulletin de vote et/ou les conditions du vote sont considérés valides ;
• traitement de la ou des informations de vote lues par lesdits moyens de lecture ;
• transfert automatique dudit bulletin de vote, après réception d'un signal de confirmation de prise en compte et sans intervention humaine, vers une urne sécurisée,

The invention also relates to a secure electronic voting method, using the device described above, comprising the following steps:

• insertion in the reading means of a ballot, cooperating with means preventing the withdrawal of said ballot;
• checking of the validity of a vote, issuing an order for transfer of said ballot paper to said ballot box, after taking into account the voting information or information it contains, when said ballot paper and / or the conditions of the vote are considered valid;
• processing the voting information or information read by said reading means;
• automatic transfer of said ballot, after receiving a confirmation signal for taking into account and without human intervention, to a secure ballot box,

so as to allow double counting of said voting information, firstly with the aid of data read by said reading means, and secondly in a deferred manner, by reprocessing the ballots kept in said ballot box.

Finally, the invention relates to a computer program product downloadable from a communication network and / or recorded on a computer readable medium and / or executable by a processor, characterized in that it comprises program code instructions for the implementation of the electronic voting method described above.

5. List of figures

• la figure 1 présente un synoptique fonctionnel de l'invention dans un mode de réalisation ;
• la figure 6 détaille une mise en oeuvre du dispositif de vote selon l'invention ;
• la figure 7 présente un vue en coupe du dispositif présenté en figure 6 ;
• la figure 2 illustre le fonctionnement dynamique de l'invention, basé sur le synoptique statique de la figure 1, lors du déroulement du vote ;
• la figure 3, basée sur le synoptique présenté sur la figure 1, détaille le type de données mémorisées dans le bulletin de vote électronique ;
• la figure 4 décrit le fonctionnement dynamique de l'invention lors du dépouillement des votes ;
• la figure 5 présente un autre mode de réalisation du procédé de l'invention pour la prise en compte du vote.

Other characteristics and advantages of the invention will appear more clearly on reading the following description of a preferred embodiment, given as a simple illustrative and nonlimiting example, and the appended drawings, among which:

• the figure 1 presents a functional block diagram of the invention in one embodiment;
• the figure 6 details an implementation of the voting device according to the invention;
• the figure 7 presents a sectional view of the device presented in figure 6 ;
• the figure 2 illustrates the dynamic operation of the invention, based on the static synoptic of the figure 1 , during the course of the vote;
• the figure 3 , based on the synoptic presented on the figure 1 , details the type of data stored in the electronic ballot;
• the figure 4 describes the dynamic operation of the invention during the counting of votes;
• the figure 5 presents another embodiment of the method of the invention for taking the vote into account.

6. Description of an embodiment of the invention 6.1 General principle

The invention is based on the implementation of a new voting device, combining a reader of electronic ballots, for example under the form of smart cards, and a secure ballot box, collecting the ballots after their reading and their electronic processing (accounting, storage, transfer and / or determination of statistics for example).

Thus, the benefits of electronic voting, including the reduction of the risk of manual counting errors and the immediate provision at the end of the ballot (even in real time during the ballot, for certain applications where this would be desirable or useful ), the results of the vote. But one also retains the advantages of the traditional vote, allowing in particular a later reprocessing of the ballot papers kept in the ballot box, for example in case of dispute, or breakdown appeared during the ballot.

Conversely, it is possible to conduct a public recount, in public, of the contents of the ballot box. In this case, the previously recorded information can be used as a control.

This approach is new, since electronic voting systems are usually based on conventional card readers, which restore the card after reading it, usually so that it is then reused (after re-initialization). The approach of the invention therefore goes against the a priori of the skilled person on the one hand because it imposes a high number of electronic newsletters (equal to the number of voters) and secondly because that it supposes an adaptation of the card readers.

Indeed, these are generally designed to return the card after reading (except, possibly, in cases of attempted fraud, in the field different from bank cards, or a distributor can "swallow" the card in case detected problem). According to the invention, however, the ballot is systematically kept and sent to the ballot box, if the result of the reading is valid. However, if this result is not valid, the card can be returned, or stored in a dedicated area, separate from the ballot box.

The invention therefore makes it possible to propose a way of voting close to traditional ways of voting, for an elector. For this, each elector is given a ballot (for example when he arrives in the polling station). This bulletin is undifferentiated, or blank (as regards the indications relating to the choice of vote, because it may include control information, for example identifying the vote concerned, the polling station, ...). The voter slides classically his ballot in an urn, the player playing the role of the slot of the ballot box, after having set (that is to say having registered his vote).

This approach, although it aims in particular to remain close to the usual behaviors, is not obvious to the skilled person. Indeed, all known electronic voting systems are moving away from conventional methods, for security purposes or efficiency, which ultimately make these systems complex and confusing for users.

6.2 Description of a particular embodiment

An example of implementation of the invention adapted for use by a local authority is then considered, for example for a local, regional or national election. We understand that the same approach can be implemented, and if appropriate adapted, for any type of elections (in business, school or university, ...).

We present, in relation to the figure 1 , a particular embodiment of the method according to the invention, in which the electoral register used 11 is an electronic electoral register. However, according to the embodiments of the method, it can be used a paper or electronic electoral register, or any other suitable means (for example electronic voter cards).

In this embodiment, the electronic voting ballot 12 delivered to an elector consists of a microprocessor and / or memory card, able to record the vote (or the votes, if any). The blank vote may, if desired, be provided. On the other hand, the approach of the invention may make it possible to prevent possible null votes (if the ballot is not legible, it may not be counted, and / or not be sent to the ballot box).

This particular embodiment of the invention provides for ballots 12 reusable between several elections (but not in the same election, since the ballots are kept in the ballot box after the vote), to hold account of the economic impacts of the large-scale elections for which it is designed.

In other modes of use, ballots are instead designed to not be reusable. For example, the selection or the end of the entry of a voting information consists of a non-reversible operation on the bulletin 12, such as the actuation of a fuse.

In this particular embodiment of the invention, a device 13 allows the selection of a voting information and the registration of said information on a bulletin 12. This device is autonomous, that is to say it is not connected to any computer system, to limit the risk of fraud. It can be installed, classically, in a voting booth.

The device 13 is provided with a screen which enables it to display the possible voting options. Its interface may also include a voice synthesis device and headsets for use by visually impaired. In this embodiment, the device 13 also comprises a means for validating a voting information. This is a validation key to activate.

In a variant of this embodiment, the device may be equipped for example with a keyboard or a touch screen to allow the entry of at least one voting information.

The invention also relies on a voting device 14 comprising means 16 for reading and processing, in particular for counting, ballot papers 12 and a ballot box 15. It is designed so that any ballot paper introduced into the reading means 16 can not be removed, and is automatically (that is to say without human contact, or particular operation) directed to the urn 15, in which it is kept in a secure manner (the urn being locked to prevent the addition or removal of ballots).

The device 14 may be provided with a human-machine interface enabling it, on the one hand, to send messages to the users. These messages can be issued in various forms (voice synthesis, on-screen display, printing for example) and multiple to accommodate people disabled people who may be present. On the other hand, the device described here also provides means for validating the vote, following the reading of the ballot by at least one assessor and / or the voter. It may be, for example, a biometric sensor, another card reader, a keyboard, etc.

Some embodiments of the device 14 include additional means allowing it, after the end of the poll, to read and return the voting information of said ballots in order to facilitate the manual recount of votes. The implementation of these additional means may include means for verifying the authorization of the operator and various rendering means (voice synthesis, on-screen display, printing for example, etc.) in particular in order to render transparent and public the recount of the votes in the event of litigation and this even to a public including persons with disabilities,

Periodic or systematic transfers of information read on the ballots to one or more secure servers can be implemented.

The figure 6 illustrates a particular embodiment of the invention.

In this embodiment, the device 14 comprises means 16 for reading an electronic ballot 12. These reading means are provided with an insertion slot 640, thus allowing the insertion of said ballot by a elector. The ballot 12 once inserted in said reading means 16 is inaccessible to any user. Specific means (valves, anti-intrusion elements, ...) can be provided for this purpose. It is also possible that the assessor has an order to return a ballot, as long as he considers that the vote has not been made (for example, until he has indicated "voted").

The device may also comprise control means composed, in the particular embodiment of the invention described here, on the one hand of means 620 for validation of the vote by the elector and on the other hand means 630 for validation of the vote by an assessor. As indicated above, various validation means can be implemented. In the particular embodiment illustrated in figure 1 These are biometric sensors: the elector places a finger on the reader 620 and the assessor on the reader 630.

When the two readers confirm the identity of the two persons, the vote is possible, and the reading means read the voting information, and transmit it to means of treatment provided for this purpose. The device can be equipped with means for sending itself the message "voted", and / or indicate by a light signal that the vote has been taken into account.

The biometric means may be replaced by, and / or combined with, any suitable means for identifying and / or authenticating persons, such as electronic ID or voter ID readers, keypads for entering a PIN, means of recognition of writing, ...

According to a particular embodiment of the invention, the device may comprise, or be associated with, means for recording an electronic signature of the voter, in an elector's register. Validation of the vote may impose this parallel operation.

The device comprises means for transferring the electronic voting ballot 12 to the ballot box 15. For example, according to the figure 7 it may be a drive mechanism adapted to slide the card 12 into the urn 15.

Moreover, to avoid any dispute and allow the voter to control his vote, it is preferable that the ballot box (classically), but also the reading means and the transfer means are at least partially transparent, so that the ballot remains permanently visible, since its insertion in the reader until its transfer in the ballot box.

6.3 Examples of Implementation of the Device of the Invention

• mise à disposition d'un électeur d'un bulletin de vote électronique indifférencié comprenant une mémoire ;
• inscription par ledit électeur d'au moins une information de vote, saisie ou sélectionnée parmi au moins deux informations de vote possibles, dans la mémoire dudit bulletin de vote électronique, à l'aide d'un dispositif d'écriture prévu à cet effet ;
• lecture et comptabilisation immédiates, par ledit dispositif de vote, de la ou desdites informations de vote inscrites dans la mémoire dudit bulletin de vote électronique ;
• insertion dudit bulletin de vote électronique dans ladite urne dudit dispositif, en vue d'un éventuel contrôle différé.

The device described above may in particular be implemented in an electronic voting method comprising the following steps:

• providing an elector of an undifferentiated electronic voting ballot comprising a memory;
• registration by said elector of at least one voting information, entered or selected from at least two possible voting information, in the memory of said electronic ballot paper, using a writing device provided for this purpose;
• immediate reading and counting, by said voting device, of the said voting information or information recorded in the memory of said electronic ballot;
• insertion of said electronic ballot in said urn of said device, for a possible deferred control.

Thus, the elector has a ballot, which is unique to the elector for the election, which he handles as a classic ballot, and which will be kept in an urn. The analysis of the content of this ballot box may allow a subsequent count of verification, and / or a review of the votes, if any.

However, before being transferred to the ballot box (or at the same time in certain embodiments), the ballot is secretly read and counted, which makes it possible to provide, as soon as the voting period ends, the result of the ballot. election.

The ballot is, when given to the elector, undifferentiated, ie it does not include any information relating to the elector (it is not an identity card or a voting card, but a ballot, on which the voter will register his vote, before slipping in the ballot box). It is more individual, that is to say intended to contain the information of a single voter during a poll.

In some embodiments, the method may also comprise, in addition to the steps mentioned above, a step of communicating polling results associated with a voting device to a remote server in order to allow centralization of the polling results.

In preferred embodiments, the method seeks to preserve the traditional public or secret nature of the voting steps so as not to confuse users: for example, the step of making an elector of said ballot available and the voting step through said device can be performed publicly while the step of registration by said voter of at least one voting information will remain secret.

Similarly, in advantageous embodiments, the method provides that, although immediate, the counting of votes is not communicated in any way before the end of the vote.

One of the advantages of the invention is thus to allow an immediate counting of the votes at the end of the poll while offering a possibility of manual recount of the votes in case of disputes through a new reading along the water of said ballot papers e.

• une sous-étape de sélection ou de saisie par ledit électeur de la ou desdites informations de vote ;
• une sous-étape de mémorisation de ladite information de vote dans ledit bulletin électronique ;
• une sous-étape de restitution de ladite information de vote, pour contrôle par ledit électeur de la ou desdites informations de vote mémorisées dans ledit bulletin électronique ;
• une sous-étape de validation irréversible par ledit électeur de la ou desdites informations de vote.

Said step of registration by said voter of said one or more voting information comprises the following substeps:

• a substep of selection or input by said elector of the one or more voting information;
• a substep of storing said voting information in said electronic newsletter;
• a substep of restitution of said voting information, for control by said elector of the one or more voting information stored in said electronic newsletter;
• a substep of irreversible validation by said voter of the one or more voting information.

In particular embodiments, said step of registration by said voter of one or more voting information may further include a substep of initialization of said electronic bulletin.

In this case, said initialization sub-step may for example consist first of all in a deletion (and / or control) of potentially existing data on the bulletin. This offers the advantage of securing the vote against fraudulently pre-filled ballots and allows reuse of ballots for several separate elections.

• la nature de l'élection,
• la commune de l'électeur,
• le bureau de vote,
• la date du scrutin,
• une référence dudit dispositif d'écriture.

According to the embodiments, said initialization sub-step may also comprise a memorization in said electronic bulletin of at least one characteristic of the election belonging to the group comprising:

• the nature of the election,
• the municipality of the voter,
• the polling station,
• the date of the poll,
• a reference of said writing device.

In certain particular embodiments, said step of recording the one or more voting information may also include a substep of storing a vote timestamp datum, such as the date and / or time of the vote. , in said ballot.

• lecture d'un support d'identification dudit électeur, à l'aide d'un lecteur électronique ;
• signature dudit électeur à l'aide d'un écran tactile et/ou d'un capteur biométrique.

The method may further include a step of identifying an elector using an electronic electoral register, comprising at least one of the following sub-steps:

• reading an identification medium of said voter, using an electronic reader;
• signature of said voter using a touch screen and / or a biometric sensor.

The manner in which this verification of the elector's identity is carried out may depend on the embodiments.

• des moyens de paramétrage d'au moins deux options de vote,
• des moyens de réception d'un bulletin de vote électronique indifférencié,
• des moyens de présentation desdites options de vote à un électeur,
• des moyens de sélection ou de saisie d'une desdites options par ledit électeur,
• des moyens d'enregistrement d'au moins une information de vote sur ledit bulletin de vote,
• des moyens de contrôle par ledit électeur de ladite ou desdites informations de vote enregistrées,

The invention also relates to means for registering at least one voting information on an electronic voting ballot comprising:

• means for setting at least two voting options,
• means for receiving an undifferentiated electronic ballot,
• means for presenting said voting options to an elector,
• means for selecting or entering one of said options by said elector,
• means for recording at least one voting information on said ballot,
• means of control by said elector of said recorded voting information or information,

• des candidats ;
• des listes de candidats ;
• une réponse à un référendum ;
• la sélection ou l'indication d'un vote blanc.

Said voting options set in said bulletin may include one at least elements belonging to the group comprising:

• candidates;
• lists of candidates;
• a response to a referendum;
• the selection or indication of a blank vote.

In some embodiments, the control means made available to said elector by said registration means also allow him to verify and validate irreversibly his vote. In other embodiments, the reader can modify by itself a characteristic (physical, electrical, ...) of the bulletin by way of validation. For example, in one embodiment in which said ballot is not reusable, it may be provided that said voter validates his choice by detaching a specific part of said ballot.

The figure 2 illustrates an example of dynamic operation of the invention.

A first step 21 consists in providing an elector with an undifferentiated ballot. In this embodiment, this step is carried out publicly, that is to say in the presence of one or more people.

This step firstly comprises a sub-step 211 for reading the voter identification medium. According to the embodiments, this support may consist of a paper electoral card or in electronic form. The electoral map can be a card card with a bar code that allows reading through an electronic reader. Coupled with an electronic electoral register (the electoral register 11 in figure 1 This embodiment has the advantage of allowing a voter to be found quickly in the electoral register. These operations can also be performed electronically, especially in a manner coupled with the voting device.

In this embodiment, the method then provides a sub-step 212 for verifying the identity of the voter. On the one hand, the information read on the electoral map is brought closer to the electoral register in order to verify the inscription of the elector on the electoral register of the polling station and to obtain the identity expected of the elector. On the other hand, a control of the identity of the owner of the card is performed. According to the embodiments, this control can be done by providing a piece of identity or by a comparison with an anthropometric or biometric fingerprint recorded for example at the level of the electoral register.

This substep ends with the provision of an electronic ballot to the elector. In the embodiment described, it is an electronic card comprising a microprocessor and / or a memory.

According to the invention, the method then implements a second step 22 of recording a voting information on said bulletin.

This step, which is usually done in the voting booth, is divided into several sub-steps. In this particular mode of implementation, the first substep consists of an initialization 221 of the ballot. Since the ballots are reusable for another election and in order to limit the risk of fraud, it is planned to erase any data potentially present on the ballot paper, or at least to allow checking the contents of the newsletter.

In addition, as illustrated in figure 3 , information 302 characterizing the election, for example the nature of the election, the municipality and the polling station of the elector, a reference of the device 13, are added on the bulletin 12. This information may also include a timestamp of the vote 304 (date and / or time of the vote). These data may be used for statistical purposes or allow for future checks. According to another embodiment, they may have been previously registered on all newsletters.

The method then provides a substep 222 for entering or selecting voting information by the voter from the voting options presented to him.

The choice of a voting option by the elector is followed by a substep 223 for storing the voting information input or selected at the level of the voter. electronic ballot. The figure 3 also illustrates the storage 306 of the voting information validated by the voter at the level of the ballot memory 12.

A sub-step 224 of returning the recorded vote, for example on a screen, then allows the voter to verify that the vote on the ballot is the one he has chosen.

A last sub-step 225 of validation of the vote closes the registration phase on the ballot and causes the return of said ballot to the voter. In this embodiment, this validation is done by pressing a validation key of the device 13. In other embodiments, it may be for example a voice recognition of a keyword through the device. 13. Different modes of validation can be implemented outside the device 13, for example by means of an action of said voter on said bulletin.

In the case where several votes are to be carried out simultaneously (elections relating to distinct communities, choice concerning several distinct aspects, ...), it is possible to register on the same ballot several voting information in succession.

In the illustrated embodiment, the next step is a public identification step of the voter. This step is similar to step 21 (but may be based on different means) and comprises a sub-step 231 of reading the voter identification medium, similar to the step 211 described above and allowing to search for the elector on the electoral register, and in a sub-step 232 verification of his identity. On the other hand, this results in validating the elector's right to vote, that is to say, to validate the passage to the next step of reading and counting the vote.

According to the embodiments of the invention, step 23 may take place before or after the introduction of the ballot in the voting device 14. In the latter case, as illustrated in FIG. figure 6 , the device 14 may be provided with the necessary control means and in particular, if the voting right is verified from manual way, a means of validation 630 by an assessor, which can be either a means identifying the assessor, or a simple command (button, lever, ...).

In the embodiment described here, step 24 of reading and counting takes place publicly. The voter inserts his ballot 12 into the device 14. In this embodiment, the support on a biometric sensor 630 for validation by the assessor causes the reading of the vote and its immediate recognition. A message indicates to the elector the effective taking into account of his vote.

According to the embodiments, the reading of the bulletin may comprise the reading of at least one information present on said bulletin other than the voting information. This information, as illustrated in figure 3 , may in particular make it possible to carry out an additional check of the validity of the ballots. In case of misreading of the ballot or doubt about its validity or multiple insertion, the vote is not counted.

The step 25 of transfer of the ballot in the ballot box follows the taking into account of the vote.

The last step is a 26 signature step of the elector. The manner in which the voter's signature is affixed depends on the embodiments. In a particular embodiment, close to the traditional votes, the voter can for example sign an electronic electoral register with a special pencil and a touch screen. In another embodiment, it can also affix its fingerprint on a touch screen. Another possibility of realization would be the use of another biometric means.

In a particular embodiment, the means for voter registration can be implemented by the voting device 14, for example by means of the biometric sensor 620 illustrated in FIG. figure 6 . This operation can then be carried out simultaneously with the vote (likewise, if necessary, that the step of registration).

The method has the advantage of allowing a very fast, even instantaneous, counting of the votes at the end of the poll. If transfers were made to a server, it also has, almost instantaneously, the result of the vote of all the polling stations equipped.

The figure 4 describes an embodiment of the vote counting according to the invention.

Depending on the modes of implementation of the method, the communication 400 of the results of the electronic vote can be carried out in different ways by the vote counting device. It can be for example at least one of the following means: an impression, a voice synthesis, a display on a screen, communication to a remote site, making available on a website ...

The ballots remain in the ballot box, for example pending the end of the appeal period 402.

In case of dispute 404, it is necessary to proceed to the opening 406 of the urn. In the particular embodiment described here, this is possible only after the end time of the poll and further requires the entry of a secret code.

In this case, the method according to the invention provides for manual counting of the ballots 408 by reading the stored voting information.

Once the dispute has been resolved 410 and the appeal period has expired, the ballots are considered reusable 412.

The figure 5 illustrates another method, for the taking into account of the vote, based on the voting device of the invention.

In this particular mode, the method provides a first step 500 of insertion of the ballot in the voting device, followed by a step 510 of verification of the right to vote of the voter. In the embodiment illustrated here, it is a verification of the elector's identity (as in step 23, figure 2 ), followed by a verification that the vote of that elector has not already been counted for that ballot.

In the case where the voter is actually entitled to vote, this step is followed by a step 520 of reading the electronic voting ballot and in particular the voting information it contains.

Then comes a step 530 of verifying the validity of the ballot. For example, a ballot is considered valid if it is legible and contains the expected polling date.

• une sous-étape 542 de mémorisation des informations de vote ;
• une sous-étape 544 de communication à un serveur distant des informations de vote, permettant ainsi, par exemple, au serveur de comptabiliser à son tour les informations de vote ;
• une sous-étape 546 de mise à jour des droits de vote de l'électeur, afin que celui-ci ne puisse plus présenter de bulletin de vote. Cette mise à jour du droit de vote est ici réalisée localement par le dispositif. Dans une autre mise en oeuvre de l'invention, elle peut être réalisée par un serveur distant, auquel le dispositif communique par exemple l'identité de l'électeur.

In the case where the ballot is considered valid, this step is followed by a step 540 of counting the vote. This step includes several sub-steps:

• a substep 542 for storing the voting information;
• a substep 544 for communicating to a remote server the voting information, thereby allowing, for example, the server to post in turn the voting information;
• a sub-step 546 for updating the voting rights of the elector, so that he can no longer submit a ballot. This updating of the voting right is here carried out locally by the device. In another implementation of the invention, it may be performed by a remote server, to which the device communicates for example the identity of the voter.

Finally, the ballot (25) is automatically transferred to the associated ballot box.

When it is detected (step 510) that a ballot does not correspond to a voter having a right to vote or when, in step 530, a ballot is considered invalid, an alert 560 is provided in order to report the refusal of the ballot.

According to the embodiments, it may be a local indication (visual or audible for example) and / or an indication to a remote server, for example to warn an authorized person of any anomaly during the course of unfolding of the poll.

This step is followed by an elimination step 570 of the ballot. Depending on the embodiments, it may be a destruction, deletion or marking of the ballot, a retention in an annex urn or a rejection.

Claims (14)

Secure electronic voting device, comprising means for reading electronic ballots containing at least one voting information previously entered by an elector using appropriate registration means,
characterized in that it comprises: means for inserting in said reading means a ballot, cooperating with means preventing the withdrawal of said ballot; means for checking the validity of a vote, issuing an order for transfer of said ballot paper to said ballot box, after taking into account the voting information or information it contains, when said ballot and / or the voting conditions are considered valid; means for processing the voting information or information read by said reading means; means for automatically transferring said ballot, after receiving a confirmation signal for taking into account and without human intervention, to a secure ballot box, so as to allow double counting of said voting information, firstly with the aid of data read by said reading means, and secondly in a deferred manner, by reprocessing the ballots kept in said ballot box. Voting device according to claim 1, characterized in that said control means take account of at least one identification and / or authentication information of an elector and / or at least one assessor responsible for said vote. Voting device according to claim 2, characterized in that said control means comprise at least one of the elements belonging to the group comprising: means for obtaining at least one biometric information; means for reading at least one identification and / or authentication data medium; a keyboard for introducing an identification and / or authentication code; means for recording and / or voice recognition of at least one keyword; means for recording and / or recognizing a handwritten signature. Device according to any one of claims 1 to 3, characterized in that said control means verify the validity of the voting information or information present on said ballot, with respect to at least one predefined validity criterion. Device according to any one of claims 1 to 4, characterized in that it comprises at least one of the means belonging to the group comprising: means for erasing the voting information of a ballot; - means of returning a ballot; means for securely storing a ballot in a zone separate from said secure ballot box; - means of accounting for a failure, or a ballot not taken into account; - means of marking a ballot; - means of destroying a ballot, implemented when said ballot and / or the conditions of the vote are considered invalid by said means of control. Device according to any one of Claims 1 to 5, characterized in that the said control means deliver at least one visible and / or audible signal indicative of the validity or invalidity of the vote. Device according to any one of claims 1 to 6, characterized in that said processing means comprise means for storing and / or accounting for said voting information or information. Device according to any one of claims 1 to 7, characterized in that said processing means comprise statistics determination means, taking into account time stamp data associated with said voting information. Device according to any one of claims 1 to 8, characterized in that said processing means comprise means for transferring voting information and / or statistics to at least one remote server. Device according to any one of claims 1 to 9, characterized in that said reading means, said transfer means and said ballot box are at least partially transparent, so that an elector can see his ballot all the time. to be in the urn. Device according to any one of claims 1 to 10, characterized in that said urn is equipped with locking means whose opening is only possible according to at least one of the predetermined criteria belonging to the group comprising: - a date and time of the end of the poll; - a date and time of end of the appeal period; - Authentication and / or identification information of at least one authorized person. Device according to any one of claims 1 to 11, characterized in that said urn carries shielding means for protecting the ballots against an attempt to erase, read and / or write data by emitting electromagnetic waves . Secure electronic voting method, using a device according to any one of claims 1 to 12, characterized in that it comprises the following steps: - insertion in the reading means of a ballot, cooperating with means preventing the withdrawal of said ballot; - checking the validity of a vote, issuing an order for the transfer of the said ballot paper to the said ballot box, after taking into account the voting information or information it contains, when the said ballot paper and / or the conditions of voting vote are considered valid; processing of the voting information or information read by said reading means; - automatic transfer of said ballot, after receiving a confirmation signal for taking into account and without human intervention, to a secure ballot box, so as to allow double counting of said voting information, firstly with the aid of data read by said reading means, and secondly in a deferred manner, by reprocessing the ballots kept in said ballot box. Computer program product downloadable from a communication network and / or recorded on a computer-readable and / or executable medium by a processor, characterized in that it includes program code instructions for implementing the method of Electronic voting according to claim 13.

Images