How can EVS insure that no party can connect the voter to the vote they cast?
Regardless of the method used to confirm voter intent, the “reconstruction” problem can be overcome by simply decreasing the resolution of the timestamp. If, for example, the tamperproof module incremented its timestamp clock once per hour, there might be 22 votes recorded during that period. It would therefore be highly unlikely that one could gain knowledge about how any specific individual voted unless, of course, only one voter voted per time increment, or all voters voted the same way (in either of these exceptional cases no system has an advantage). Longer clock increments might be more appropriate depending on local voting patterns. The point is, it’s possible to have the best of both worlds – preserving the anonymity of the voter, and establishing securely the knowledge of when and where an authentic and tamperproof record was produced. While it might not be as practical to implement, another approach would be for pairs of (or possibly multiple) machines to be hardwired at the
