and what would happen if you forced a random sampling of individuals to destroy their slips? so random group can verify but you have no idea who is in that random group?
edit: or perhaps better, a random sampling were permitted to print out a proof of vote slip, but didn't have to. But if not chosen, you didn't get a proof of vote slip.
Now, in thinking it through, it might not help much. if someone can manipulate the voting machines, they can know who printed out their slips and manipulate the other votes. With that said, if done correctly, with a paper trail, I think it be difficult.
i.e. users are giving 1 or 2 outputs. piece 1 is a paper print out with a uuid and their votes that gets deposited in big box and counted as deposited. piece 2 that not everyone even has an option to get, can be kept. there has to be no way to distinguish the different piece 1s of those who get a piece 2 or not. If so, if everyone who got a piece 2 sees that their vote was recorded per the record they have, they can be confident that their vote was recorded correctly.
if their vote is not recorded correctly, they should have an anonymous mechanism to deposit their slips to make known that their vote was not recorded correctly. (hand waving at that, as unsure how to do that).
edit: or perhaps better, a random sampling were permitted to print out a proof of vote slip, but didn't have to. But if not chosen, you didn't get a proof of vote slip.
Now, in thinking it through, it might not help much. if someone can manipulate the voting machines, they can know who printed out their slips and manipulate the other votes. With that said, if done correctly, with a paper trail, I think it be difficult.
i.e. users are giving 1 or 2 outputs. piece 1 is a paper print out with a uuid and their votes that gets deposited in big box and counted as deposited. piece 2 that not everyone even has an option to get, can be kept. there has to be no way to distinguish the different piece 1s of those who get a piece 2 or not. If so, if everyone who got a piece 2 sees that their vote was recorded per the record they have, they can be confident that their vote was recorded correctly.
if their vote is not recorded correctly, they should have an anonymous mechanism to deposit their slips to make known that their vote was not recorded correctly. (hand waving at that, as unsure how to do that).