Can Our Ballots Be Both Secret and Secure?

https://www.newyorker.com/news/the-future-of-democracy/can-our-ballots-be-both-secret-and-secure

by ryandvm • 6 years ago

51 194 6 years ago

Since 2018, as part of a program called Defending Democracy, Benaloh has been working on voting software that attempts to solve the problem of trust in secret-ballot elections.

No. Stop. Listen, it's possible to write secure voting software that a domain-expert software engineer understands, and a general software engineer can understand. That's not the problem.

But for voting, that is not enough. The entire voting system has to be easily understandable by everyone in society, in order for society to trust the system.

Where I'm from, all voting is done with papers and envelopes and urns and seals, and with people having eyes on the process at all times. And the most important thing to realize is that this process is infinitely parallellizable, so getting election-night preliminary results isn't hard, even though every single vote is manually counted. You just need enough people to count the votes.

cameldrv• 6 years ago

This, plus the inherent blessing and curse of computers -- if you can do something one time, it's usually very easy to do it 1000 times. If you want to tamper with one precinct or one county, you have to write some exploit. If you want to tamper with all of them, still, one exploit.

However, if you want to tamper with a whole state of paper ballots, you have to stuff a thousand ballot boxes. The chances of getting caught are far higher.

bl0b• 6 years ago

I'm under the impression that computerized voting systems are in no way standardized nation-wide (USA, at least). But your point still stands that it seems easier to hack a computerized voting system to commit large-scale fraud than to fraud with paper ballots.

fzeroracer2• 6 years ago

It's the same reason why voting via mail is very hard to exploit. Voting functions as a secure handshake (register to vote via mail, government sends confirmation, government sends ballot, you send ballot back, government sends confirmation of vote) and requires you to sign it with some identifying information like a signature.

There might be some individuals trying to cheat the system at the family level, but trying to cheat it at a larger scale requires you to do so at a point of collection. It also becomes very easy to find this sort of tampering by sending voters a way of confirming who they voted for.

imustbeevil4• 6 years ago

No one gets that day off, and voting closes before the line outside is gone.

It is disturbing how much voter disenfranchisement is allowed in this system.

Fjolsvith11• 6 years ago

Every workplace I've been at allowed you to leave briefly to go cast a vote.

Sounds like you worked for some really disenfranchising companies.

excalibur• 6 years ago

Personally I make it a habit to vote first thing in the morning, before going to work. Lines are negligible, and I've never had an employer complain about me showing up a few minutes late wearing an "I voted" sticker. But YMMV.

IncRnd6• 6 years ago

That's why people can vote early or can even request a mail-in ballot.

It's disturbing how people talk about voting as if there is disenfranchisement, without knowing the various times and ways they can vote.

JohnStrangeII• 6 years ago

I find it hard to believe that a democracy is unable to create a law that gives their voters a day off for voting every four years. Realistically speaking, even half a day off would suffice.

mjevans• 6 years ago

That, and have an UNOFFICIAL digital count as well, the one that's done quickly for the news and everyone making planning, with the official, double-counting verified recount reaching the same numbers as the electronic and previous hand count (within a very small % for human error).

If there's a disagreement the human counts are repeated until within 0.001% and then they're official.

ta1234567890• 6 years ago

Except we are lazy and will come to rely on the digital system, then we will never care to recount unless there's a lot of pressure, and even then it might take so long that we will probably not wait. Already a US presidential election was decided on the wrong count, when the proper count came out it was too late.

cortesoft2• 6 years ago

How does that work in the middle of a pandemic, where people shouldn't gather at a location like that?

How does it handle people who can't leave their home? Or people who are away on the voting day?

andreareina• 6 years ago

Carefully. Singapore just went through a general election, ~2.5M votes cast at 1,100 polling stations. Citizens were assigned a polling station and a 2-hour window to go vote. Masks required, distancing enforced, sanitizer and disposable gloves provided.

(Not a citizen so I can't comment on how it actually all went down)

https://en.wikipedia.org/wiki/2020_Singaporean_general_elect...

https://www.channelnewsasia.com/news/singapore/ge2020-singap...

AdamJacobMuller3• 6 years ago

I'm a pretty technical guy. Given enough time I'm confident that regardless of what technology stack/language you wrote the voting system in I could have reasonable confidence it was error-free enough and probably not deliberately backdoored.

Do I have that kind of time? No.

Am I going to give more than a cursory glance at open source voting software? No.

Am I going to catch 100% of accidental bugs? No way!

Even if I do, am I going to catch 100% of deliberate and obfuscated bugs? Hell no.

Even for me, a very technical person, purely electronic voting is fatally flawed in terms of trust.

NegativeLatency• 6 years ago

Or even side channel stuff not related to the voting code itself, or bugs in whatever ui people look at aggregated results in.

pbhjpbhj8• 6 years ago

You don't know that the ballot box wasn't switched in transit, nor presumably that the postman in your area didn't switch all the voting papers.

Any system that's anonymised seems to require trust.

techntoke9• 6 years ago

The entire voting system has to be easily understandable by everyone in society, in order for society to trust the system.

Can you tell me how current voting systems work, because it is a black box to me and I can't even verify that my vote counted for the person I picked. From what I can tell, the local election officials can tally the votes however they want.

Ericson2314• 6 years ago

GP's critique is not a defense of the status quo. Please do not construe it as such.

See https://freeandfair.us/# for voting technology that still wisely involves much paper.

henrikschroder6• 6 years ago

I'm not an US citizen, I've never voted in the US, I have no idea how your shit works or not.

But I know how my country's system works, and it's super fucking easy. On election day, I got to my voting place for my voting district. Each district contains a couple of thousand voters. For each election I'm participating in - national, regional, local - I place one piece of paper with the name of the party I'm voting for in an envelope, secretly.

I then go to the election officials, identify myself, and they look me up in their voter roll, which is simply a printout of the couple of thousand voters who should be voting in this place. We all check that I'm in there, and that I'm not already marked as having voted. Then they strikethrough my name in the roll, and put my envelopes in the corresponding urn. I am now certain that my secret vote went into the right urn, and everyone else can be certain that I've only voted once.

Once the voting ends in the evening, election officials in each voting place opens their urns, and opens each envelope, removing the vote inside. Then they simply sort and count the individual pieces of paper that are the votes. You count the total number of votes, you count the total number of voters crossed out in the voter roll, and make sure it all matches up. And this gives you a preliminary vote count for each political party in each district, so you only need to report a couple of numbers to the election authority.

Anyone can watch this process! I can go and watch it. You can come and watch! And it's so simple to count pieces of paper that anyone can do it. And with observers from the various political parties, you can't cheat.

After the preliminary counting, you take all the votes and your voter roll and put it in a sealed box and send it to the regional voting authority where they do a final control count, and archive the votes for history.

As for me and my vote, I can check my district on the website of the election authority: https://data.val.se/val/val2018/slutresultat/R/valdistrikt/0...

I am one of the 1160 voters out of the 1363 eligible, I can see that the party I voted for got at least one vote, so I can be fairly certain that my vote was counted, while what I voted for is still a secret.

Compromising this system is incredibly hard, because it is parallellized and distributed. And the paper trail will always be there. Somewhere in a vault, there are 6,535,271 pieces of paper representing the 2018 vote for the national parliament. You can't accidentally erase that or lose that.

dilap2• 6 years ago

is there some reason you can't get a random id associated w/ your ballot?

then just list all results (by that id) on a website somewhere.

you hang onto your id stub, and can tell if your vote was mistallied or left out.

this can work w/ a digital or traditional analog system.

(maybe need some more work to figure out how to ensure there aren't just extra "ghost" votes padding the results.)

henrikschroder6• 6 years ago

That allows vote buying/coercion.

You show me your receipt, I verify that you voted the way I wanted, and you get money. Or, if the receipt shows you didn't vote like I told you to, I punch you in the face.

YokoZar• 6 years ago

There are cryptographic schemes where you can verify that a vote was counted but not how it was actually cast. Physical ballots going through an optical scan machine sometimes have an id stub that gets detached before they go into the counting pile -- imagine that it wasn't possible to add a stub to the "counted" list without also adding a ballot.

luckylion3• 6 years ago

Where I'm from, all voting is done with papers and envelopes and urns and seals, and with people having eyes on the process at all times.

And it doesn't always work. I assume you're German, so I'm inclined to remind you of Bremen's election 2015 where a group of students change votes to advance one party. When you have a very politicized election, you're going to need more than trust in procedures.

I don't know that some software will help there, but "we're doing it on paper" doesn't solve the problem.

hef1989812• 6 years ago

Ah, one case out of how many elections? It would also be nice to explain what happened and how. The AfD insisted, together with more right leaning media, on a recount. The happened and gave, initially, one additional seat. The SPD, who lost one seat, challenged that. It went to court, all 33k vote were recounted, roughly 500 corrections were necessary. 13 votes were lost. The AfD lost one seat (they failed to gain more than 5% of the vote). The election was deemed legit, not reelection was necessary.

So yeah, we are doing it on paper pretty much solved that problem.

joveian• 6 years ago

The Oregon vote by mail system lets you get a notification when your ballot is received by the counting center. I'm not sure exactly how it works but the counting might be observable from that point.

Fjolsvith11• 6 years ago

I bet it also tells you when the mail ballot someone swapped for yours was received.

Kednicma4• 6 years ago

Oregonian here! My signature is on file with the state, and both an OCR system and a human look at my signature on the ballot to make sure it matches. Additionally, my ballot has a barcode on it and a security weave, so that a "counterfeit" ballot and envelope would have to have come from inside the ballot-production system; loss-prevention techniques can be used to track down any stolen envelopes. Finally, the attack would have to come from inside the postal system as well, because only post officers and voting officials touch my ballot. In my specific case, I can even drop my ballot directly at a ballot box and not have to post it.

If you have any evidence of widespread voting fraud in Oregon, please show it. Otherwise, no, we're not interested in your attempts to denigrate a convenient and reliable voting system; it reeks of antidemocratic sentiment and I don't see why we should tolerate it.

sxcurry• 6 years ago

That doesn't happen. There are a number of security measures including signature verification. There is little to no ballot fraud in Oregon.

advisedwang• 6 years ago

I haven't voted in Oregon, but the vote-by-mail I have done has a two envelope system. The outer envelope has identifying information, and that can be used to give you a notification. It is then separated from the inner envelope, which goes to the counting.

Observers are present to ensure nobody correlates the the information with the ballot or tampers with the post-opening process.

Mindless21126• 6 years ago

Ballots don't need to be secret, they just need to be anonymous. If you get rid of the secret constraint, it becomes fairly easy to produce a trustworthy voting system:

1. Immediately before identifying at the polling location, each voter takes a nondescript strip of paper out of a large container of numerous strips of paper, each with a unique identifier printed on it. (No one but the voter knows which identifier they took. No one can force a specific identifier.)

2. The voter fills in the identifier on a Scantron-style paper ballot. (Easily digitized, with a paper trail.) The ballot box scans the unique identifier and spits back out out any ballot with an identifier that wasn't generated for that polling location. (Ensuring no one can force a specific identifier.)

3. A list containing the entirety of every ballot is published publicly, including the unique identifier. (The voter can look up their ballot later. It becomes difficult to coerce a voter because they can say any one of the published ballots is theirs.)

4. A list of names of people who voted is published publicly. (Registered voters who didn't vote can check if a ballot was cast in their name. This is already done in many places.)

You can also have mail-in ballots with user-generated statistically-unique identifiers (requiring only several rolls of a die, so anyone can do it at home), but you can't prevent voter coercion that way.

amalcon• 6 years ago

The voter fills in the identifier on a Scantron-style paper ballot.

The voter will mess this up a disturbing fraction of the time. It will be rejected. The voter will try again, possibly have it rejected again, give up, and go on Twitter to complain about the new system.

Also, I can go to vote, surreptitiously take two strips of paper, use one, pocket the other. I coerce my spouse into using that one, and pocket the one they took.

It becomes difficult to coerce a voter because they can say any one of the published ballots is theirs.

Maybe for simple ballots. A question including e.g. a ranking of ten candidates has about 3.6 million possible configurations -- more if undervotes or other ties are permitted. The voter can be coerced to fill this out in a specific way to self-identify, and then vote in a prescribed way on another question.

edit: Of course, this vulnerability already exists: the voter could be given that same instruction. An observer of the ballot counting process can tell if the correct ballot was cast.

Mindless21126• 6 years ago

Good points, though they're rather at odds. If you assume voters will mess up their ballots that frequently then the voter being coerced can just find a ballot that's close to what they were coerced to do and say they messed up the rest.

No way to prevent surreptitiously taking more than one strip of paper comes to mind. Someone should be observing the voters take the strips of paper to ensure only one is taken, but that doesn't prevent sleight of hand. But if there are mail-in ballots, you've already basically given up on voter coercion anyway.

jcrawfordor2• 6 years ago

What you describe is the ballot-permit system currently in use in many jurisdictions (terminology varies, and the permit may be called an application to vote, voter authorization, or similar). The difference is that the ballot information is not published. There are two reasons for this:

1) Current election systems, with few exceptions, do not retain per-ballot voting information, only tallies. This is in large part a practical matter, ballots go through various channels of handling including exceptional cases (e.g. hand entry of damaged ballots) and many of these paths become much more complicated if you need to electronically record the individual selections on each ballot.

2) The risk of re-identification of voters to ballots is high and extremely difficult or impossible to satisfactorily resolve. There are many, many potential ways to establish which specific ballot was cast by a given voter. This is especially important considering that in many elections the number of voters per ballot style (which may be equivalent to a precinct in your area, the exact combination of questions which appears on the ballot based on voter location and potentially party affiliation) will often not be very large, even in densely populated areas, because of course as the area becomes more densely populated the electoral precincts become smaller.

Finally, your step 2 is quite unnecessary for current purposes, the physical possession of both the ballot and permit are sufficient to prevent overvoting. One permit entitles an individual to cast one ballot. In the case of mail-in voting the ballot is sealed inside of the permit in a tamper-evident fashion (the outer envelope serves as permit). It also presents a more complicated and worse privacy proposition than the existing system, as the ballots can be post facto linked to the permits and someone could have (likely did) observe the voter take the permit. In current practice ballots cannot be linked to permits after they are physically separated when the voter casts their ballot. This protects the voter by reducing the time period during which their ballot can be identified.

Mindless21126• 6 years ago

For point 2, you could put the very local questions on a separate ballot with a separate unique identifier per voter. It would be mildly inconvenient though.

Someone should be observing the voter taking the strip of paper, but it would be done in a way to prevent them from observing which one was taken by the voter.

jhanschoo• 6 years ago

Regarding (3). In addition to other comments, a vote buyer can demand that a voter affirm their ballot number before the results are published.

tzs• 6 years ago

If you want a system based on Scantron-style paper ballots that allows cast ballots to be published, allows anyone to verify that the count was correct, and allows voters to verify that their vote was counted correctly without being able to prove they voted for a particular candidate, see this [1]. It's been around for several years, and has been used successfully in a few elections.

[1] https://en.wikipedia.org/wiki/Scantegrity

Mindless21126• 6 years ago

Excellent! (And presumably more robust than the scheme I described.)

akvadrako5• 6 years ago

Why do you think ballots don’t need to be secret? That’s often been feature of democracy since the beginning.

mFixman• 6 years ago

"Prove that you voted for Putin or you are fired".

alex_young2• 6 years ago

Why can't PKI be used?

If I sign a vote with my private key, and my public key is used exactly once, and is registered with the electoral body, and a list is printed of signed votes by candidate, I can validate that my key was used to sign a vote for the person / issue I voted for, and we can also know that everyone only voted once.

Key distribution could be based on the current registration system we have in place now, and you could use the key they send you to change your key pair so the state can't forge your vote. One could even automate this, even with an open source app we could all inspect.

It seems conceptually simple.

Mindless21126• 6 years ago

1. Whoever issued you the key pair can know which vote is yours.

2. Someone can coerce you to vote a specific way by forcing you to provide them with your private key.

alex_young2• 6 years ago

1. Can’t the state already know who voted for what right now? That seems like a nonissue.

2. Someone can also force you to give them your mail in ballot. How is this different?

lordnacho• 6 years ago

How many people who aren't programmers or mathematicians will trust this?

codingdave• 6 years ago

So how does my grandmother, who has zero technology in her life, sign with her private key?

Voting needs to be available to all voters - we need to avoid putting in a barrier the would turn elections into "all voters who have smartphones".

jeffdavis• 6 years ago

How are mail-in ballots protected from fraud? I keep hearing that fraud is not a problem, but I'm wondering (a) how do we know there is little fraud; and (b) what mechanisms make it safe from fraud?

edoceo4• 6 years ago

Maybe the aren't: https://fox8.com/news/mail-carrier-pleads-guilty-to-altering...

boomboomsubban3• 6 years ago

"Bored mailman convicted for altering 8 ballot request forms" suggests that they are secure. Even if he wasn't caught, there should have been time for the ballots to be replaced.

js2• 6 years ago

Fraud isn't impossible, just difficult to do on a scale that would matter in most elections. In NC, an election had to be redone because someone working for the GOP candidate had fraudulently collected absentee ballots (from registered Democrats I think), preventing those ballots from being counted or possibly tampered with them, and it was a close race.

https://www.reuters.com/article/us-usa-election-north-caroli...

https://www.npr.org/2019/07/30/746800630/north-carolina-gop-...

So obviously the voter needs to be careful to place the mail-in ballot correctly into the USPS and then the USPS has to be trusted to deliver the ballots correctly.

Beyond that, the mail-in ballots are checked against the registered voter rolls. So the state has to maintain clean voter rolls.

But this is not much different really from in-person voting. In theory, I could go to my local polling location and claim to be one of my neighbors, sign their name, and take their vote. They'd only notice if they showed up to vote later. But I'd likely get caught if they'd already voted. Or maybe the poll worker would recognize me. There are lots of scenarios you could imaging getting away with a handful of fraudulent votes. But it would hard to be able to do anything significant enough to affect the outcome of most elections.

https://www.snopes.com/fact-check/mail-in-ballot-voter-fraud...

hef1989812• 6 years ago

One thing I really don't get is the voter registration thing in the US. All European countries I know of simply require residents to register their primary and secondary residencies. You get voting papers to your primary residency. That's it. No registration as a voter, no party affiliation. You can be a party memebyer, but that information isn't public.

That system works just fine.

jcrawfordor2• 6 years ago

Mail-in ballots are linked to a voter permit (outer envelope) which serves the purpose of maintaining the pollbook, that is, ensuring that each voter casts only one vote. This prevents ballot stuffing.

Mail-in ballots are sealed in a tamper evident fashion inside of the permit, to prevent modification. Because opening the envelope would probably damage it, a duplicate enveloped (forged permit) would need to be produced to modify the ballot. In most cases a duplicate ballot would also be needed, which presents its own obstacle, although ballots are not generally intended to be protected against forgery.

The postal service is backed by a particularly strong set of criminal laws which generally make a felony to interfere with the mail. This is of course on top of laws protecting the voting system from tampering.

The outer envelope (permit) is a sworn statement and signing for someone else's ballot would be perjury, a felony, in addition to other laws around voting that likely exist in the state.

None of these measure are perfect, but combined they make vote-by-mail fraud difficult to achieve on a meaningful scale. Remember that, to be effective, voter fraud needs to be successfully committed not once, but many times. The difficulty of each case and general history of harsh prosecution of small-time fraud creates a significant disincentive to try.

coldcode• 6 years ago

Sadly this only works if you have a Post Office, which we in the US may not have in November.

Shared404• 6 years ago

I would write a comment, but this sums it up.

https://xkcd.com/2030/

pbasista3• 6 years ago

I agree that designing an objectively reliable online voting system is very difficult. But at the same time I think that in principle it can be done. However, in my opinion the current unavailability of such a reliable system is not the largest issue with online voting.

Instead, it is its potential for giving the people with power more ability to control and enforce the voting behavior of the people over which they have some kind of influence.

For example, a boss can offer a bonus to employees who would verifiably (e.g. under supervision) cast an online vote according to the "company's recommendation". Or a landlord can say that the rent will be raised next month unless the tenant votes under the landlord's supervision and according to the landlord's preferences.

Such practices probably exist today as well. But the difference is that in the physical voting system, even the people who are being pressured to vote in a certain way are in the end required to be alone and behind a privacy screen while casting their vote. So, even if they have been forced to promise to vote in a certain way, they eventually have the freedom to vote as they like without having to fear that their actual voting behavior will be revealed.

That freedom originates from the requirement to cast a vote in private. Availability of online voting removes such a requirement.

orthoxerox2• 6 years ago

Then the system should be designed to let you avoid such demands:

- you vote once under supervision and another time later in private. Only your last vote counts

- you are given multiple private keys and only one of them is real. If you vote using any other one, the system behaves as if your vote was recorded, but actually doesn't count it

heavenlyblue2• 6 years ago

How are all of your points different from mail voting?

blhack• 6 years ago

The inefficiency of in person paper voting is a feature.

It means that large scale fraud is extremely difficult due to the labor required. This is a good thing. Hundreds of thousands of dispersed voting locations means that to pull off a “hack” you’d need to hack thousands or perhaps 10s of thousands of locations all with their own details.

In a digital voting system, you’d need perhaps to find a flaw in 1 system. The centralized one.

I don’t want digital voting. I want anonymous, and inefficient in person voting where the issues are small and localized.

techntoke9• 6 years ago

They are still counted through a central authority and your vote can't even be tracked. You basically just have to "trust the system" today even though there has been a lot of strange things happening for decades with votes.

akvadrako5• 6 years ago

They can certainly be counted locally first, requiring a wide conspiracy of all parties to make a big difference.

Ma8ee2• 6 years ago

That is not really a problem. The count from all voting stations are public, and they are checked by the people that counted the votes. And it is of course trivial to check that the totals are correct.

kungato• 6 years ago

The trick is that by using the Dhondt method and gerrymandering you have to manipulate way less votes than one would actually expect. In my country of 5 million people last week 11 votes decided whether someone went into parliament and there were 11 excesss votes at one station which were then deleted and guess whose those were

jakehop• 6 years ago

While an interesting problem to try and solve (in theory, not in practice!), one has to be very much aware of where those 11 votes had to be injected for the “hack” to work.

You basically need to have a somewhat precise picture of the proportionality before you could do it I a non-obvious way (= small margin victory).

While polling gives you something close to that, I don’t believe that it’s precise enough.

jzwinck2• 6 years ago

If the difference is only 11 people, it doesn't seem too much of a stretch to say the result doesn't matter, both candidates got the same number of votes within a very small margin of error (which will never be zero).

Either you decide the two candidates were both good and there was no clear decision to elect one over the other, or you set up a voting system where such close races result in some totally different outcome, such as both people enter parliament for a shorter time, having a tie breaker of some kind, etc.

forty2• 6 years ago

This 100%. I'm French, and I always volunteer to count votes after the ballots. Honestly the system is really robust, it's probably very very hard to cheat without being noticed, everything is done twice, with everyone being able to watch the whole process. No way we can have something even close in term of confidence with something digital.

If we really want to use new technologies to make things even safer, we could film and broadcast everything so anyone could check that there was no cheating (and I assume some people would record it so we could check also after the fact)

williamdclt• 6 years ago

You could even still have a counting machine: stick the papers in it, it scans the vote, it spits out the paper and humans do their own manual count. Compare the numbers of the unbiased but hackable machine and the biased but unhackable humans.

Not sure it's a step in the good direction, too easy to remove the humans some time later, but if we want to use technology to make counting more secure there's definitely easy ways

badrabbit• 6 years ago

At the same time you have parts of a country that actively suppress votes. For example, in many deep south counties that are turning blue, the long standing majority would make up the election commission staff and other election related positions. Organized fraud is hard, but if enough people agree that fraud is neccessary, fraud will happen at a large scale.

I am not saying digital election is better, but I would like to see a formal securirty/risk assesment of both options against known voter hostile counties.

With mail-in ballots for example, what if small groups of mail persons(1-5) manipulate absentee ballott mail when sent to and collected from voters, how does that risk compare to say insecure network connections and poor authentication with digital voting systems. A formal threar model for both approaches and risk assesment that is. Both methods are not secure, as a techie, the vulnerabilities of digital systems is glaring and obvious but they mean little in terms of risk wihout applying a threat model.

You said paper ballots make mass fraud hard, that is because of the threat model you had in mind. The chaos of the 2000 presidential election shows a slightly diffrent threat model where organizing large number of people was not needed. Bad guys will always find a way, what I like to do is to take an empirical approach at making thier mischief harder to pull off.

hef1989812• 6 years ago

People joked after the Florida disaster, when George W. Bush was elected, that maybe the US needs international election observers. You know, like developing countries.

Not sure if that's still a joke now.

pessimizer• 6 years ago

the long standing majority would make up the election commission staff and other election related positions.

This is the problem. Part of the voting system is dictating who has the right to manipulate the votes at every point in the process, and ideally, after the ballots are sealed, that group should consist of everyone who has an interest; membership in that group should be self-defined. Practically, most people will be happy with a representative rather than showing up personally, but if everybody wants to watch, everyone should be allowed to.

If you abandon this principle, no technical solution is possible. It's like trying to make a computer perfectly safe against physical compromise; the only way to do it is to destroy the computer.

Honestly, the main problem with digital voting for me is only obliquely related to that objection - there are not enough qualified code auditors for everyone to have an auditor they trust, and massive, system-breaking changes can happen with the change of a semicolon. So the provenance of an individual vote from the voter to the commingled pile of votes is impractical to depend on. It may be possible to get it to the standard of a paper system, but it would be extremely expensive.

pbhjpbhj8• 6 years ago

Unless the vote is verifiable?

mikepurvis• 6 years ago

But then it can be proven, and therefore directly purchased.

rkhassen9• 6 years ago

This. Agreed 100%

Really, really smart people, even in technology, who should know often cannot see this. It seems like one of those magic eye pictures https://www.magiceye.com/stwkdisp.htm

If you don’t see it, you don’t see it.

Also - not sure about the implications of Corona virus and social distancing. The in person requirement becomes a potential to die or potentially spread a deadly disease.

mmm_grayons2• 6 years ago

Just voted yesterday: distancing rules in place, the gentleman runnung it didn't touch my driver's license, gloves available, masks required, and one older gentleman wore a face shield. Fairly safe and quick, though I imagine it might be more difficult and crowded on election day.

mabbo• 6 years ago

But this same lack of efficiency allows governments to make it harder to vote. Eliminate voting locations in regions where those who vote against your party are more likely. Move voting to days that the less-powerful can't take off from their jobs. Paper votes "go missing" because there's reason to believe the box of them contained too many that those in power didn't like.

Making voting hard makes the system ripe for abuse, and that's exactly what we see happen all the time.

What we need is a system that is efficient and safe. There are cryptographic voting systems in which the government publishes the entire result; everyone can see that their own vote (only) was counted appropriately; anyone can see that the overall vote was fairly counted; empowered auditors can randomly audit to ensure all votes are real. That is far superior to the existing, corruptible system.

Edit: adding some conditions on the crypto voting systems.

hef1989812• 6 years ago

Eliminating voting locations has nothing whatsoever to do with paper ballots.

bpfrh2• 6 years ago

Why is voting with paper hard?

Voting happens on a day where nearly nobody has to work.

People who can't leave their home, or are not home on the day you can vote, can still vote, they just request a mail-in vote card.

mseidl• 6 years ago

I'm a German that used to live in the US. In the US , voting sucks.

There is no "registering for voting" here. Ever citizen gets a piece of paper they bring to them to their assigned voting location(the room is assigned also, if you vote in person you have to go here). The voting places are always reasonably close. Like minutes by walking. You can opt to get a mail in ballot, if you want. Voting is always on Sunday when most things are closed. The vote turn out is over twice as in in Germany. The US has one of the lowest voter turn outs.

But our ballots are big and easy to read/mark. No stupid "dangling chad" crap like in FL in 2000.

I'm 100% against electronic voting.

ByteJockey2• 6 years ago

There are a couple points I don't think you've considered.

1. From my experience working in the lower class service industry (restaurant worker), Tuesday (federal elections) is usually a pretty easy day to get off. Weekends or government holidays that the middle class gets off, are the days where everyone has to work. My understanding is that this applies to retail as well.

2. You need non-technical people to trust the system. This isn't a technical problem, it's a political problem. Having one person from each party in the room while paper ballots are counted is actually a pretty good solution for this. Showing people who haven't done any advanced math pages and pages of whitepapers and equations that mathematically prove that the system can't be hacked doesn't really give you this. The system will be completely accurate, but rumors will fly and the government is quite likely to lose legitimacy anyway.

newacct5832• 6 years ago

Hundreds of thousands of dispersed voting locations means that to pull off a “hack” you’d need to hack thousands or perhaps 10s of thousands of locations all with their own details.

No, all you need to do is play with the distribution of those hundreds of thousands of locations such that "your" voters have an easier time getting to them, on average, than your opponents' voters.

Your threat model isn't quite right. A deliberate third party attempt to fabricate votes isn't the only attack vector. You need a system that is robust against untrustworthy insiders too.

gurleen_s• 6 years ago

The other useful feature is that it keeps the election day from becoming a horse race/fodder for the 24-hour news cycle.

noja• 6 years ago

Aren't they already? Or are we having this efficiency debate again?

Animats• 6 years ago

That's awfully complicated, compared to systems with backup printers.

s_T_e_v_o• 6 years ago

German physicist Werner Heisenberg's uncertainty principle states that the more precisely the position of some particle is determined, the less precisely its momentum can be predicted from initial conditions, and vice versa. (Edited Definition from wiki)

I want to posit that secrecy and security have the same relationship as the uncertainty principle ascribes to electrons.

spaetzleesser• 6 years ago

Like with a lot of political things in the US I strongly believe that none of the decisions makers really want to have a system that works impartially. They just want to have an advantage for their side because it’s about “winning” at any cost no matter how destructive it is for the country.

Otherwise I can’t explain the problems this supposedly developed country has. I am from Germany and have never heard anybody having doubts about the integrity of the system there. If the US wanted to have a system that works they could look around and see how it get countries do to. But it seems they don’t want to have such a system.

spenrose• 6 years ago

"VotingWorks is a non-partisan non-profit building a secure, affordable, and simple voting system. Our vote-by-mail solution lets you scale vote-by-mail quickly and affordably. Our risk-limiting audit software ensures votes cast on any paper-based system are correctly tabulated. Our voting machine creates paper ballots that voters can directly verify. Our source code is available on GitHub. You can help by making a tax-deductible donation, joining our team, or reaching out."

https://voting.works

neverartful• 6 years ago

As others have pointed out, digital voting systems can be hacked, exploited, or otherwise derailed from centralized location. They also can contain subtle software errors.

Paper ballots can have problems like we saw in Florida (hanging chads).

When I was growing up, we had big mechanical voting machines. I have no idea how common (or uncommon) these were in different parts of the country. The machine opens up and has a set of retractable curtains. You walk through the open curtains and then pull a big lever that closes the curtains behind you. Then you vote by flipping mechanical switches for the candidate (or yes/no for policy ballot). When you're done voting, you reverse the big lever. This action increments the machine counters based on your votes and opens the curtains for you to exit. Once the polls close, the polling folks simply sum up the counters across all the machines in the polling station.

The downside is that the machines are big and heavy to store and move. I'm sure they're not cheap for the initial purchase. However, they're efficient for tallying yet very difficult to hack. In my opinion, they're the best overall voting mechanism.

specialist2• 6 years ago

Agree with all.

"digital voting systems can be hacked, exploited, or otherwise..."

Paper mediated systems have visible failure modes. Missing ballots. Spoiled ballots. Etc.

Black box voting systems fail silently.

Can Our Ballots Be Both Secret and Secure?

Related Stories