In the above titled paper (ibid., vol. 4, no. 4, pp. 611-627, Dec. 09), due to a production error, the affiliations of two of the authors were listed incorrectly. The correct affiliations are presented here. Also, the name of the last author in the affiliations footnote was printed incorrectly. The correct name is P. Y. A. Ryan.

In the above titled paper (ibid., vol. 4, no. 4, pp. 628-637, Dec. 09), the fourth sentence of the Abstract contains an error. The correct sentence is presented here.

Scantegrity II is an enhancement for existing paper ballot systems. It allows voters to verify election integrity - from their selections on the ballot all the way to the final tally - by noting codes and checking for them online. Voters mark Scantegrity II ballots just as with conventional optical scan, but using a special ballot marking pen. Marking a selection with this pen makes legible an otherwise invisible preprinted confirmation code. Confirmation codes are independent and random for each potential selection on each ballot. To verify that their individual votes are recorded correctly, voters can look up their ballot serial numbers online and verify that their confirmation codes are posted correctly. The confirmation codes do not allow voters to prove how they voted. However, the confirmation codes constitute convincing evidence of error or malfeasance in the event that incorrect codes are posted online. Correctness of the final tally with respect to the published codes is proven by election officials in a manner that can be verified by any interested party. Thus, compromise of either ballot chain of custody or the software systems cannot undetectably affect election integrity. Scantegrity II has been implemented and tested in small elections in which ballots were scanned either at the polling place or centrally. Preparations for its use in a public sector election have commenced.

We reduce the required trusted computing base for direct recording electronic (DRE) voting machines with a design based on trusted platform modules (TPMs). Our approach ensures election data integrity by binding the voter's choices with the presented ballot using a platform vote ballot (PVB) signature key managed by the TPM. The TPM can use the PVB key only when static measurements of the software reflect an uncompromised state and when a precinct judge enters a special password revealed on election day. Using the PVB with the TPM can expose authorized software, ballot modifications, vote tampering, and creation of fake election records early in the election process. Our protocol places trust in tamper resistant hardware, not in mutable system software. Although we are not the first to suggest using TPMs in voting, we are the first to provide a detailed engineering protocol that binds the voter choices with the presented ballot and uses the TPM to enforce election policy. We present the protocol, architecture, assumptions, and security arguments in enough detail to support further analysis or implementation.