• Preventing the addition of bogus ballots but without running the risk of invalidating valid votes as a result of the generation of incorrect digital signatures on the printed paper ballots.
  
  
• Preventing the elimination of valid votes by providing an accurate recovery mechanism.
  
  
• Providing election authorities with accurate mechanisms to determine the correct results in case of discrepancies between the results from the DRE and the count of paper votes.
  
  
• Providing accessibility to the VVPAT solution for the blind and visually impaired voters.
  
  
• Enhancing the redundancy of the voting system by recording the votes also in the Audit Module.

Pnyx.VVPAT provides security and accessibility to VVPAT solutions

• Pnyx.VVPAT derives from Scytl's 10 years of research and development experience in security solutions for the electronic voting industry and is protected by international patents.
  
  
• Pnyx.VVPAT is based on an independent module (called Audit Module) connected to both the DRE and the printer. The Audit Module has two components:
  • A simple hardware device with minimum computing capabilities.
  • Cryptographic software that runs in the hardware device to protect the votes.
    
    
• The Audit Module represents a secure and reliable environment because:
  • It is independent from the manufacturer of the DRE.
  • It is based on open-source software and on software that is open to audits.
  • It is very simple since it only performs a limited number of functions.
  • It is very easy to audit and certify by election authorities.
    
    
• The main function of the Audit Module is to provide cryptographic protection to both printed paper ballots and digital votes. This cryptographic protection is based exclusively on the voter's verification decision and does not rely on any instruction given by the DRE or the printer.
  
  
• Pnyx.VVPAT can be easily integrated with any DRE manufacturer and with any VVPAT solution.
  
  
  
  

1. The voter makes the selection of the desired voting options in the DRE
2. The selected voting options are transferred from the DRE to the printer through the Audit Module. A paper record containing the selected options is printed (and/or reproduced through headphones).
3. The voter verifies (via the paper record and/or audio) the selected options and accepts them.
4. The verified voting options are digitally signed in the DRE and are sent to the Audit Module. The Audit Module checks the validity of this digital signature. Any problems that could invalidate the signature of the verified options would be detected at this point.
5. The Audit Module digitally signs the (digitally signed) voting options received from the DRE. The resulting digital signature is stored in the Audit Module and it is also sent from the Audit Module to the printer (e.g., the digital signature is printed on the paper record as a bar code) and to the DRE. The DRE verifies the validity of this signature and may store it with the electronic vote. The Audit Module can also store the digitally signed vote to enhance the redundancy of the voting system.

1. The election authorities retrieve the electronic votes from the DRE and check their validity by verifying their digital signatures (generated by the DRE and the Audit Module) before counting them.
2. The election authorities also check the validity of the printed votes by verifying their digital signatures (generated by the DRE and the Audit Module) before counting them.
3. Printed votes and electronic votes can be cross-checked using the ballots identifiers and digital signatures. This allows recovering lost electronic or paper votes and valid votes that have been invalidated due to printing or electronic errors.
4. The Audit Module contents can also be used to check the election accuracy and solves disputes.