Pvote: prerendered user interfaces

In Pvote, the ballot definition file contains:

• prerendered full-screen images of each ballot page
• prerendered smaller images of highlighted options
• prerendered images of characters for entering a write-in candidate
• prerecorded audio of instructions
• prerecorded audio of contest names
• prerecorded audio of candidate and option names
• coordinates of touchable regions of the screen
• specification of actions triggered by touching the screen or pressing keys (such as selection and deselection, entry of characters in a write-in field, or navigation to other pages)

Pvote is not the first voting software to use prerendering, although I believe it takes the concept further than before. Pvote's ballot format is highly generalized so that the user interface (both visual and audio) can be completely redesigned in the ballot definition without changing the Pvote software.

The prerendering strategy can work for other contexts as well (not just for voting machines). Prerendering is effective when user interfaces change often but high assurance is needed. Its main advantages are:

• Less security-critical code. Much of the software complexity is offloaded to ballot design tools that prepare the ballot before the election, so the voting machine software is simpler and easier to verify.
• Less frequent changes to security-critical code. The user interface can be completely redesigned without changing the voting machine software, which means the software can be more thoroughly reviewed.
• Design by designers, not programmers. Ballot design can be done by designers with professional experience in usability and accessibility. Programmers can focus on security without being affected by user interface design changes.
• Testing by anyone. With a platform-independent ballot format, anyone can download the ballot and try out the user interface to confirm that it is correct and fair.

Below I list the prior work in prerendered voting interfaces of which I am aware; if you know of others please contact me and let me know.

OVC/EVM2003

EVM2003 is an open-source project to develop a reference implementation of the Open Voting Consortium design standards. It is also written in Python and I am told that it involves the display of ballots as prerendered images.

ES&S

According to Doug Jones, the ES&S iVotronic, a commercial DRE voting machine, has a "bitmap ballot" feature.