@Article{Riv08b,
  author = 	 { Ronald L. Rivest },
  title = 	 { On the notion of `software independence' in voting systems },
  doi =          { 10.1098/rsta.2008.0149 },                  
  journal = 	 { Philosophical Transactions of The Royal Society A },
  date =         { 2008-08-06 },                  
  OPTyear = 	 { 2008},
  OPTmonth = 	 { August 6, },
  volume = 	 { 366 },
  number = 	 { 1881 },
  pages = 	 { 3759--3767 },
  annote = 	 { An earlier (2006) version of this paper was co-authored with John Wack,
                   who was unfortunately unable to join me as a co-author on this final
                   journal version.
                 },
  keywords =     { security, voting, software independence },                  
  abstract =     { 
        This paper defines and explores the notion of `software independence' in 
        voting systems: `A voting system is software independent if an (undetected)
        change or error in its software cannot cause an undetectable change or error 
        in an election outcome'. For example, optical scan and some cryptographically
        based voting systems are software independent.  Variations and implications of this
        definition are explored. It is proposed that software-independent voting systems 
        should be preferred, and software-dependent voting systems should be avoided.  
        \par                  
        An initial version of this paper was prepared for use by the Technical Guidelines
        Development Committee in their development of the Voluntary Voting System Guidelines, 
        which will specify the requirements that the USA voting systems must meet to 
        receive certification.  
                 },
}