Online voting system: control panel
How it works
We hope to answer all your questions here about how to set up votes, and what is and is not possible.
If you have any questions, please do not hesitate to contact the System Administrator.
Jump below to:
- Setting up a ballot
- How the voting works
- Paper voting ('split' voting)
- Security architecture
- Can voters who have been missed off be added mid-ballot?
- Can the list of votes cast (and, where relevant, count) be kept private until the result is officially declared?
- Why is the maximum ballot period 3 days?
- Can JCRs and MCRs disaffiliated from CUSU use the online voting platform to create ballots for college elections?
The CUSU Managed Online Voting System is a system which lets organisations around the University set up online votes in a secure manner.
We encourage groups to use this managed system rather than set up their own votes using content management systems etc. Online voting is a non-trivial matter to set up and run securely, and there are many pitfalls. A large amount of work has been undertaken to bring you the current system, and the voting system has been subject to code audits as well as advice from experts. The voting system also enforces best democratic practices.
This system is run across two separate webservers:
- A setup server, where you are currently are. This is the part of the system where JCRs/MCRs, Societies, and other groups can set up new ballots.
- The high-security voting server, where the voting actually takes place, and where upcoming/current/previous ballots are listed and where their results are shown.
Setting up a ballot
To set up a ballot, use the Add a new ballot link. This will guide you through the process of specifying the settings you need, and the list of voters.
Ballots must be set up and the settings finalised at least 2 hours from before it opens. After this time, there is no way to delete or amend any settings or the list of voters. This is because, by this time, the secure voting server will have pulled across the setup information and fixed it in place.
How the voting works
The voting will open automatically at a time specified when the vote was set up. It will be listed on the front page of the voting server under the list of current ballots, and voters can follow the link to the relevant vote.
If the voter (as authenticated via Raven) is on the electoral roll for that vote, they will be able to submit their vote by entering their choices on a form. The form prevents users submitting invalid votes (as recommended by our contact at the Electoral Reform Society).
Submission of a ballot paper results in three things:
- The fact that they have vote is marked against their username in the list of voters, thus preventing them voting again.
- Their choices are stored in a separate list, against a unique voting 'token' (which is a short list of words.
- The choices and token are also e-mailed to the master mailbox for the system. This e-mail is also blind-carbon-copied to the voter. (The identity of the voter is therefore not revealed.) This e-mail creates an additional audit trail whilst still preventing matching of the choices to the voter.
Note that at no point is there any linkage between the votes cast and which voter, except in the e-mail which the voter receives. The only scenario in which it is possible for others to tell who has voted is if only a single vote has been cast. (Additionally, of course, the System Administrators have access to the server logs, but that mirrors the role of the Returning Officer in a paper-only voting system. However, the publishing of the vote<>token list provides a means to detect fraud.)
At the time the vote closes, the list of votes associated with each token is published at the end of the vote, enabling people to perform a count themselves. The BOB system includes a counting implementation using the program OpenSTV. However, it is the Returning Officer's responsibility to perform an additional count if they do not trust this count implementation.
The list of votes<>tokens cast is published immediately the whole ballot is closed. This cannot be disabled.
Paper voting ('split' voting)
Sometimes, an organisation may wish to have an online vote followed by paper voting of those who have not voted.
The downside of having paper voting additional to online voting is that the system will not provide any automatic counting. It is the Returning Officer's responsibility to arrange this, possibly using a counting program such as OpenSTV. If this is a problem, one possibility is to have a laptop to be placed in college, replacing paper sheets entirely. Under such a setup, voting in college is effectively the same as voting from any other computer, just made conveniently available at lunchtime, etc.
If paper voting really is required, this can still be achieved via the online system. The person setting up the vote can specify a third date/time (in addition to the opening and closing of electronic voting). Once the online voting has closed, the Returning Officer can log into the administrative menu to print off the electoral roll but with the names of those who have voted crossed out. Once paper voting is completed, the Returning Officer can perform the manual count, using both the list of vote<>tokens and the manual ballots. However, please note that we are unable to assist with such counts.
This is described on the Security page.
Can voters who have been missed off be added mid-ballot?
No, unfortunately not. There is no way to make changes to the configuration of the ballot on security grounds.
Returning Officers should check the list of voters, and circulate the link to the ballot so that people can check they are on the electoral roll before the opening of the ballot.
The only workaround is to ask the missing voter(s) to cast a paper ballot, then not declare the automatic online count as valid, to combine the paper ballot with the electronic vote list that will appear after the ballot has closed, and run a manual STV count using a spreadsheet. However, this may not be acceptable given that it could identify the voter's vote to the Returning Officer if only one such ballot is submitted on paper.
Can the list of votes cast (and, where relevant, count) be kept private until the result is officially declared?
The list of votes cast becomes visible to everyone immediately after the ballot is closed. Also, the result is also shown automatically, unless paper voting is also in use. A few people have asked us whether there is any way of overriding this and keeping the list of votes confidential until they are officially revealed.
This is not possible, as a direct result of the security design of the voting system. Such functionality was actively considered during the design phase of the system but it was explicitly rejected at that point.
Part of the security model of the system is that the list of votes cast (but obviously not the connection with who cast them) is revealed after the closure of the election. This is so that people can verify that their vote was saved correctly, alongside other checks and balances that seek to ensure this.
As a result, anyone who wants to put that same list of votes into OpenSTV (which is a free counting program) and do a calculation is fairly trivially able to do so themselves anyway. So it makes more sense to have an open result count which avoids any suspicion (however unwarranted) that the Returning Officer is doing any fiddling or trying to console a losing candidate.
Effectively this almost mirrors the same situation with a paper vote where voters should, under a democratically-run system, be able to watch a manual count themselves, and often can determine by watching the votes go past who the winner is (admittedly without the same level of accuracy), prior to the official announcement of the result.
The ability to check the vote is therefore a fundamental part of the security design of the voting algorithm, so this cannot be changed.
Why is the maximum ballot period 3 days?
The normal limit is currently set to 3 days, for these reasons:
- Security patches and upgrades to the system can be applied more easily - long ballots make it hard for us to schedule these without having to interrupt voting.
- Shorter voting periods (e.g. 2 days) tend to incentivise better those in charge of issuing publicity and ensuring a good turnout.
- A longer period can sometimes give appearance of a lack of confidence (on the part of those running the ballot) that people will make the effort to vote.
- Candidates are spared from a long wait to find out if they've been elected, which could distract study.
Three days seems to have been received as about the right limit (hundreds of ballots have taken place successfully within it), and seems to be within the scope of what most JCRs/MCRs have historically done with paper votes.
If you think you have a case for extending this limit, do get in touch.
Can JCRs and MCRs disaffiliated from CUSU use the online voting platform to create ballots for college elections?
The CUSU online voting platform is only accessible for JCRs and MCRs affiliated with the Union. Voting rights of individual students are not affected.
We welcome any feedback on this system or this documentation, including any suggestions for improvement.