@Article{CCCEx09,
  title = 	 { Scantegrity II: End-to-End Verifiability by Voters of Optical Scan
                   Elections Through Confirmation Codes },
  author = 	 { David Chaum and Richard T. Carback and Jeremy Clark and Aleksander Essex
                   and Stefan Popoveniuc and Ronald L. Rivest and Peter Y. A. Ryan and Emily
                   Shen and Alan T. Sherman and Poorvi L. Vora 
                 },
  pages =        { 611--627 },                  
  doi =          { 10.1109/TIFS.2009.2034919 },                  
  journal = 	 { IEEE Transactions on Information Forensics and Security },
  publisher =    { IEEE },                  
  issn =         { 1556-6013 },                  
  OPTyear = 	 { 2009 },
  OPTmonth = 	 { December },
  date =         { 2009-12 },
  volume = 	 { 4 },
  number = 	 { 4 },
  keywords =     { cryptography, electronic voting, end-to-end verifiability, privacy },                  
  abstract =     {
        Scantegrity II is an enhancement for existing paper
        ballot systems. It allows voters to verify election integrity---from
        their selections on the ballot all the way to the final tally---by
        noting codes and checking for them online. Voters mark Scantegrity
        II ballots just as with conventional optical scan, but using
        a special ballot marking pen. Marking a selection with this pen
        makes legible an otherwise invisible preprinted confirmation
        code. Confirmation codes are independent and random for each
        potential selection on each ballot. To verify that their individual
        votes are recorded correctly, voters can look up their ballot serial
        numbers online and verify that their confirmation codes are posted
        correctly. The confirmation codes do not allow voters to prove how
        they voted. However, the confirmation codes constitute convincing
        evidence of error or malfeasance in the event that incorrect codes
        are posted online. Correctness of the final tally with respect to
        the published codes is proven by election officials in a manner
        that can be verified by any interested party. Thus, compromise
        of either ballot chain of custody or the software systems cannot
        undetectably affect election integrity. Scantegrity II has been
        implemented and tested in small elections in which ballots were
        scanned either at the polling place or centrally. Preparations for
        its use in a public sector election have commenced                  
                 },
}