How to vote, post 2000 presidential election

I've been pondering the problem of how one should vote, mostly because my local government has decided to deploy "Winvote" voting machines. They suck horribly, and make me fear for my enfranchisement, but thats a different rant. This rant is just to write down some simple specs.

Here's what I feel a voting mechanism should be like:

• A vote must be secret. There must be no physical way to eavesdrop on a vote, voter, or polling site.
• A vote, as in the official record, must be human readable. If we are going to do a recount, it must be possible to be done without the original machine, or any machine for that matter.
• A vote must be indelible. There must be no physical way to modify a vote. If a voter makes a mistake, that ballot is spoiled, and recorded as such.
• A vote must have a physical audit trail, that trail must be complete from the voter all the way to the final number, and that trail must be human readable.
• A vote may be machine readable. This one is a convenience, and only a convenience.

Then there are some hairier requirements. Should a voter be able to look up their vote later? The pro is that they can verify that the record actually reflects what they told the voting machine. The con is that someone who is being impressed to vote can not lie to their impressor.

Then there are the voting machines. They must be completely open to inspection, no component may be invisible, proprietary, or secret. They must be physicly impossible to tamper with. In short, they must be too stupid to manipulate, the only possible activity should be to accept input from a voter, and put it onto a ballot. A machine must also show the true record of the vote (which is human readable) to the voter.

The counting machines must behave similar to the voting machines, completely open, and too stupid to manipulate. The only possible action is to accept ballots, and return a total count for each question on the ballot.

Then, all the equipment and consumables must be second sourceable. This system needs to be a commodity. Thus, no single manufacturer is in a position to manipulate the system. If a manufacturer is found to have exploited an error in the system, it must be trivial to avoid that manufacturer.

My final point is that Canada has no problems voting with paper and sharpie markers. The time it takes to count the ballots is irrelevant compared to the accuracy of the count, if we have to wait two weeks, so be it. There is no more important spec to a voting system than accuracy. An error rate greater than 0 by even the smallest fraction of a percent is unacceptable.