New Hampshire set to pilot voting machines that use software everyone can see

https://therecord.media/new-hampshire-set-to-pilot-voting-machines-that-use-software-everyone-can-see/

by isaacfrond • 4 years ago

200 234 4 years ago

alexb_• 4 years ago

There was a voting machine posted here a while back that was literally transparent, as in you would literally be able to see the computer marking off the paper ballot through a transparent box. Is this the same thing, or is this something different? I don't think "computer experts say it's okay" is going to help build trust when people are distrusting of authority in the first place, so I hope it's the transparent one.

eru12• 4 years ago

The article says:

“There’s a strong desire to see how ballot counting machines are actually counting the ballots,” New Hampshire’s Secretary of State, David Scanlan, told Click Here in an interview. “And open-source software really is the only way that you can do that effectively.”

In any case, I don't think voting machines are a good idea.

I know that you can use enough cryptography and enough open sourcing to make them secure, but what might convince me wouldn't convince the 'village idiot'.

Paper voting and traditional election observers work in a nice 'analog' way. It's tangible, and even a 'village idiot' can understand how it works.

Most voting systems aren't complicated enough to need a computer to evaluate them.

(And those that are should arguable be changed.)

nicoburns2• 4 years ago

IMO secure isn't enough. You also need to make it auditable. As far as I can see, it's pretty much impossible to do this satisfactorily with a digital solution. It also seems entirely unnecessary. Manual counting systems work well, and allow people to feel like they are participating in the democratic process (because they are).

fredleblanc• 4 years ago

I live in New Hampshire, and though I've never voted on a computer where I'm touching a screen, I still feed my paper ballot into a scantron machine that seems to do all the counting. I’ve voted in maybe 20 elections (between local, state, and federal) in my lifetime, and it's always been done this way around here. Maybe we all forget that that's a computer, too.

All that said, I live in a town of less than 3,000 people. I don't know that the solutions that work for us here would work everywhere.

HPsquared• 4 years ago

Ranked choice voting systems (e.g. single transferable vote) have a lot of "game theory" advantages over e.g. first-past-the-post, but are hard to implement with manual counting.

Edit: I suppose that doesn't mean voting machines are required though, just that the results on each ballot paper need to be inputted to a computer to determine the outcome. A lot of data inputting required, but still auditable.

velcrovan2• 4 years ago

I’m curious, do you distinguish between ballot counting machines (what the NH SoS is talking about) and voting machines (your term)?

I understand “voting machine” to be any mechanism that acts as a substitute for a paper ballot, or that acts as an intermediary between you and a paper ballot. And I would agree that the former are a terrible idea and the latter probably don’t provide much net benefit.

But ballot counting machines are a different matter. Here’s the thing: there’s no voting process without a ballot counting machine. It’s just a matter of whether that machine will be a carbon-based one subject to bias, fatigue, boredom and hunger, or an electronic one that excels at stupid-simple repetitive tasks and is subject to none of those things.

frob3• 4 years ago

Electronic ballot-tallying machines are necessary to running accurate and speedy elections. As we saw in the Arizona fiasco with the "Cyber Ninjas," hand-counting ballots takes weeks, if not months. Additionally, hand-counting has an error margin of 1-2%. In a era where many races are within a point or two, hand-counting ballots will lead to the wrong person winning office.

We also have tons of checks in place to make sure the machines work. There are calibration runs where known stacks of votes are sent through the machines and confirmed at the end. The vote totals on the machines are checked against the number of people who voted. Post-election, election officials randomly choose machines, open them up in front of the public at preannounced times, and confirm that the ballots that have been locked inside the machine match the tally the machine produced.

snarf213• 4 years ago

Voting machines should only ever be used to automate counting of votes. They should never mark the voting sheet. Having the physical paper lets us easily recount or reverify. If it was marked erroneously, all is lost.

kube-system6• 4 years ago

No, the paper should be marked by a machine, and displayed to the user for confirmation. If you let the user mark the paper, you get 'hanging chad' problems.

hirundo• 4 years ago

Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H. Anyone who cares to will be able to see if the new machines recorded the votes correctly

If hand counting paper ballots instills confidence, then at some low level of public confidence in elections, it makes sense to do so routinely, rather than just a demonstration. Vilifying doubters doesn't seem to be very effective. For many of those there is no level of proof that could dent their opinion, so little is lost by simply attacking them. But there are many others that are convincible by sufficient openness.

Sure, turning it back into a manual process has its own issues, particularly with efficiency. But with an election efficiency is a minor consideration compared to confidence.

bediger40002• 4 years ago

There have traditionally been ways to mess with a hand count.

One example I recall is vote counters wedging a piece of pencil lead under a fingernail. If they see a ballot they don't like, swipe the lead across it and toss the ballot in the "spoiled" pile.

Sure, this requires a little bit of blind eye from the county clerk (or whoever), but if the election goes the right way, it's worth it.

iso16313• 4 years ago

In the UK party candidates and guests are watching the count so would pick that up. It's very rare that the losing candidate plus all spoiled votes makes a difference in any case, and significant numbers of double voting would raise very interesting questions. They simply don't happen.

SketchySeaBeast8• 4 years ago

I do believe audits and observers would catch that pretty quick.

foldr2• 4 years ago

Some problems with this, besides the problems that other posters have already mentioned.

* One vote counter can't make much of a difference by themselves, so you need a conspiracy of vote counters. But conspiracies are difficult to bring about and keep secret in the real world. This is especially so if you have to pay the individuals involved – which seems likely, given that vote counting is boring, thankless volunteer work.

* Everyone involved in the conspiracy risks going to jail, but hardly anyone benefits on a personal level. Why would anyone risk it?

* The extremely large number of spoiled ballots would be suspicious. Especially as they'd probably look rather unlike ordinary spoiled ballots.

* Observers would notice that some counters (those involved in the conspiracy) were processing many more spoiled ballots than others.

I'm reminded of Number 2 pointing out do Dr. Evil that he could quadruple his profits if he shifted his resources away from evil empire building and towards Starbucks. The money and resources spent on rigging the count could be spent more efficiently on 100% legal means of increasing vote count, such as canvasing (= knocking on supporters' doors and encouraging them to go vote).

Simulacra• 4 years ago

“Software everyone can see“ sounds like window dressing.. You would have to understand how the software works. Open source voting software is a great idea, but the vast majority of people are not gonna have any clue.

Is this really transparency?

eru12• 4 years ago

It's a small step in the right direction.

pessimizer3• 4 years ago

You would have to understand how the software works.

No you don't. You have the opportunity to trust someone who understands how the software works, which you wouldn't have if the people you trust weren't allowed to inspect the software.

With this kind of logic, you could never trust an election where you didn't physically count all of the votes yourself. Since that doesn't make sense (not scalable when elections get beyond about 20-30 people), we allow voters to send people they trust to observe and participate in the vote count. This is like that.

iso16313• 4 years ago

In the UK we go to a voting place. We get given a piece of paper. We walk to a little booth, we mark an X next to who we want, we put that piece of paper in a black box. Your name is crossed off on a piece of paper to say you've voted.

That black box gathers a few hundred votes over the course of the day. There are multiple people in the room with that black box throughout the day.

At the end of the day the number of people who have voted and the number of pieces of paper that have been used, are both counted to ensure they are the same.

The box is then sealed (with tamper tape) and transported to a central hall, usually in a car, but sometimes by ferry or helicopter depending on weather and location. Obviously this takes longer for rural areas than for urban areas.

When it arrives, it is unsealed in front of many witnesses, and the ballots emptied. They are counted (how many pieces of paper), and this number matches the above paperwork.

The ballots are then put into a pile in the middle of the room where all the candidates and their teams can see, and are counted by a team of however many (say a team of 20 for a district of 60k votes - tend to be local council workers being paid overtime). From the counts I've seen, 300-600 an hour is a reasonable speed. Those are bundled into bundles of 100 and put into piles on display.

Any ambiguous marking that the person counting or the people watching think is amigious is set aside (the famous "WANK/WANK/NOT WANK" case [0]), and the candidates and their agents get to see and agree on the paper.

Urban counts of districts with c. 70,000 voters tend to get the first ballot boxes about 10-15 minutes after polling closes and start counting. Some have large numbers counting in an aim to get the count done first (in an hour or so), others take longer, but the majority of districts are verified, counted, and recounted after about 6 hours. Some places have to wait for the aforementioned ferry etc so don't report to maybe 12 hours after.

I don't understand why you need machines to vote or machines to count. Breaking the system above by a few votes is probably possible with a small team of conspirators, but breaking it beyond that doesn't scale.

[0] https://www.joe.co.uk/politics/voter-writes-wnk-all-over-bal...

eru12• 4 years ago

My thoughts exactly. When I was still living in Germany, the system worked pretty much the same. (No clue whether they changed anything since then?)

However this sane and simple system would probably not work in eg Australia? Their voting system is too complicated.

fabian2k• 4 years ago

Germany hasn't changed anything. And there are also seriously complex ballots on the local level, so that isn't a limit.

SketchySeaBeast8• 4 years ago

Yes, exactly. Canada still does manually counting federally. It works. Ironically, it doesn't stop the complaint about bad voting machines, but that's because people get their news from the states. There are no voting machines, no way for software to fudge the numbers just enough for someone's decided candidate to win.

Is it more of an effort than trusting a machine is working correctly? Yes, absolutely, but this is the literal fundamental foundation of democracy we are talking about - let's put in a bit of effort.

capableweb4• 4 years ago

On the other hand, Brazil have been electronic voting exclusively since ~2000 with no evidence of fraud/mistakes since then, AFAIK.

If it seems to be possible in a country like Brazil, why not in Canada/UK/USA?

bmacho2• 4 years ago

I don't understand why you need machines to vote or machines to count. Breaking the system above by a few votes is probably possible with a small team of conspirators, but breaking it beyond that doesn't scale.

Exactly. Replacing a system that is guaranteed to work with an another system that is guaranteed to not work is foolish.

capableweb4• 4 years ago

Why is one guaranteed to work VS the other one not? Seems a bit simplistic.

There are electronic voting systems that have been running without issues for decades, why couldn't the US accomplish the same?

mrweasel2• 4 years ago

I don't understand why you need machines to vote or machines to count.

The voting machines isn't for you, it for the politicians. Denmark have system pretty much identical to what you described. We normal have a result for parliamentary voting within five to six hours of the polling station closing. After three or four hours we normally have enough votes counted to call the election, on a party basis.

The issue is the individual candidates, the well known politicians are interviewed a few hours into an election night, when their seats are secured. The lesser known politicians may have to wait for a day, or two, in order to have their seat confirmed. So they get no airtime, no interviews, because the media don't care when the personal votes are finally counted and confirmed. The voting machine are for those low ranking politicians ego.

As for the US, who don't have a parliament and only two, or three, candidates in each election... I have no idea. Because they f-ed up their election system and closed to many polling stations, resulting in ballot counting taking to long?

iso16313• 4 years ago

I'm not sure how closing the stations makes any difference. The number of votes to count id directly proportional to the population, and if a democracy can't afford 5 cents per vote once every few years then maybe it shouldn't be a democracy

puffoflogic2• 4 years ago

Your name is crossed off on a piece of paper to say you've voted.

In the US, this is racist.

where all the candidates and their teams can see

In the US, this is insurrectionist.

falafelite4• 4 years ago

A lot of skepticism and negativity here, with a focus on "open source means something to me, not the layman" as well as mentions of is that really helpful, is it auditable, etc. Valid concerns, but I guess my reaction is hopeful because hey there's at least one group of people who are trying to build something that is more transparent.

Maybe it's not perfect, but (at least to me) seems like a step in a good direction. Also for what it's worth the company making the tech has a product for auditing as well. Idk guess I'm feeling more optimistic this morning.

eru12• 4 years ago

I wrote some skeptical remarks.

But yes: this is definitely progress compared to closed source machines.

DoingIsLearning• 4 years ago

Maybe it's not perfect, but (at least to me) seems like a step in a good direction.

Is it? Provided you have a working democratic state with checks and auditing, what is the problem that voting machines solve?

The level of guarantees that you have with a paper vote is hard to surpass and the inconvenience of paper vote is not that big considering how often voting occurs (even in the extreme case of Swiss style referendums).

falafelite4• 4 years ago

Is a paper-vote a reference to literally marking a piece of paper, or a human counting said piece of paper? Sorry if that's a dumb question, just want to make sure I follow. It seems like this tech works with marking a piece of paper that is then read by a machine. I suppose if the paper is kept, perhaps it's nice from the point of view of the election-handling-folks to automate the counting process, but be able to audit the paper ballots?

davoneus• 4 years ago

Provided you have a working democratic state with checks and auditing, what is the problem that voting machines solve?

It solves the problem of waiting days or weeks for a result. It solves the problem of multiple languages on a ballot. It solves the problem of visually-impaired voters accessing the voting machine, it solves the problem of incorrectly filled out voting sheets (hanging-chat).

Hell, that's just off the top of my head, and I'm sure others can contribute more.

tokai• 4 years ago

Voting machines are always a bad idea. There are issues of trust and security that can never be solved. So trying to open-wash this dangerous way of voting is at best just as bad as closed machines and at worst an angle to make people think its a safe and good idea.

Loughla3• 4 years ago

Yes and no. There is never a situation where electronic voting with no paper back up that must be stored and catalogued for a prescribed time via law is a good idea.

But a system that uses electronics to tabulate votes that can be verified via paper ballots that are stored long-term, securely? Why not?

Edit: Maybe I didn't describe this well. The person makes the vote on paper. The paper is counted by a machine (like the article is saying). The paper is stored securely and catalogued for later reference and audit. What is the problem there?

falafelite4• 4 years ago

Why are they always a bad idea in your view? I'd imagine that they're quite nice from the point of view of those who run elections and actually have to count them. I'd love to hear your thoughts!

kube-system6• 4 years ago

But it is a solved problem. You can use machines to mark paper ballots, and to quickly tabulate them. This is the best of all worlds: the results are auditable, the user can confirm their ballot was recorded properly, and the election officials can quickly count the ballots.

lm28469• 4 years ago

Maybe it's not perfect, but (at least to me) seems like a step in a good direction.

It just add bigger SPOF. Compromise a single voting machine and you control hundred thousands of votes. Compromise one vote counter and you control thousands at most

There are literally no problems to solve in modern functioning democracies when it comes to votes, it's just some technocrat mentality that requires everything to be automated so it's faster/more efficient, etc.

So yeah you can make these things faster at the expense of basically everything else, including trust

falafelite4• 4 years ago

Interesting okay. Is a combo of paper and automated counting not ideal then? To my mind automatic counting is probably great for the speed you mentioned, and I'm sure those who have to perform the counting/run the election like it, but then keeping paper to hand-count as a backup or to verify seems sensible too. Or is the very possibility of a compromise too bad to entertain?

carapace• 4 years ago

If there is a CPU between you and your recorded vote you live in a "hackerocracy": you are ruled by the best hackers.

The only reason to have electronic voting machines is to subvert the voting process.

simiones2• 4 years ago

"Open source" voting machines is essentially like baby-proofing a machine-gun. All of the problems that electronic voting poses to true democracy are 100% still there, but it looks safer - which may, unfortunately, make it more attractive.

I'm putting open source in quotes, since only software can be open source, a voting machine is a piece of hardware that you do not own, so you have no idea what it software it is running.

ianai• 4 years ago

Yes the negativity is stark and dangerous given the other conditions this year.

SketchySeaBeast8• 4 years ago

Sorry - so how do I ensure that the code running is the code I expect it to at the moment I vote? I "can simply hire a computer expert to examine it and see, in real time"? That doesn't seem feasible while I'm sitting in the voting booth.

I see they are using manual vote counting this time around to check, but how is that any guarantee the software will be the same in 2 years time when it happens all over again? Knowing there is software in some git repo somewhere that I can audit doesn't make me trust the machine in front of me any more.

starkd3• 4 years ago

True, the average voter is not inclined to hire a computer expert to do an analysis, but if there is widespread suspicion, they will at least have the ability to vent their collective outrage into an actual audit of the code. This transparency can provide some assurance.

mFixman• 4 years ago

Volkswagen cheated on emissions tests by creating software that did the expected results only during an audit. Doing the same for voting software would be much easier.

There's no way for a computer to completely prove it has the right software for a job.

SketchySeaBeast8• 4 years ago

Can it though? If the audit is called for after the election how do we determine the code that the auditor is inspecting is what was run on election day?

It's still a black box on election day - it's just got detailed instructions written on it claiming that's what is inside.

nyokodo4• 4 years ago

audit of the code

The OP is talking about the inability to audit the code actually running at the time of voting. You can audit the code in the repo all you like but if the hardware of the voting machine is compromised, or the code you audit is modified or replaced sometime before execution, or there is other malicious code running on the machine interfering with the voting then your audit is useless.

mavhc3• 4 years ago

1. Send the results to multiple independent organisations 2. Print out for each voter a list of codes they can use to show that they voted for each candidate, show on screen the code they need to memorise/highlight for their actual vote 3. Later they voters can put that code into any of the organisations' websites to check their result was recorded correctly, which also means each org can check that they have the same results the voters think they made

SketchySeaBeast8• 4 years ago

Isn't this de-anonymizing the process a bit - I know your name won't be printed directly on it, but now the organization you went to can determine who you are and who you voted for.

luxuryballs• 4 years ago

yeah open source software isn’t a fix for this it’s a ruse, the last built and deployed binary can in theory contain anything, why are we using computers for this??

jcrawfordor5• 4 years ago

The audit strategy for precinct tabulators such as these is not to audit the machines but the actual ballots, which are retained. Upon suspicion (usually this requires a court order, details vary a lot by state) the original ballots, which are retained after the machines tabulate them, can be hand-counted or more practically recounted by independent machines.

Every conceivable election method is vulnerable to some type of fraud, and hand-counting leads to relatively very high unintentional error rates. Post-election audit sampling is a typical practice in many states and should be in all.

sidewndr464• 4 years ago

Unless I can take home the voting machine & verify that the software running on the machine is in fact the claimed software this doesn't mean anything. You could just as easily publish one set of software and have the machine run something completely different.

SketchySeaBeast8• 4 years ago

That's my struggle with this as well - what are you going to do, show me a checksum on the monitor to somehow "prove" that the software is the same?

sidewndr464• 4 years ago

Given that they could just as easily fake the checksum, they might as well use a 1-bit checksum. The security of a 1-bit checksum is just as good as a 256-bit checksum in that scenario.

starkd3• 4 years ago

They can automate the installation of the current code onto the machine, which is in turn also open source.

_-david-_4• 4 years ago

They are going to have 24 hour cameras pointed to the machines after the installation, including during shipment right? If not somebody could change the software. Even with cameras somebody could manipulate it probably.

ratg132• 4 years ago

Personally I think the software is largely irrelevant.

As long as the machine prints a paper receipt that I can verify is correct before it is stored, the code that creates the receipt doesn't really matter.

pessimizer3• 4 years ago

Will you be satisfied with that slip of paper if your vote was never included in the official count because the software was bad?

jmyeet• 4 years ago

I'm glad to see New Hampshire still has paper ballots doing this. Pure electronic voting (IMHO) should be banned. Either you should fill out a ballot that a computer can verify or use a touchscreen that produces a paper (filled-in) ballot.

As for open source, I don't think it matters. I mean, even if the software is open soruce, how do you know what the machine is running? Are you going to build it yourself and verify hashes? Can you?

Don't get me wrong: open source for something like this is a good idea. Experts should be able to verify this. It just won't stop claims of election fraud because those largely aren't based on a lack of transparency but rather political expeidency.

jmclnx• 4 years ago

there’s a paper record to prove it.

Well at least NH seems to be doing it right. But if I use that machine, do I get to see the paper record. What I mean, is it printed for me to look at and placed into a sealed ballot box ? If not, then I am glad I do not live in NH.

tomatotomato373• 4 years ago

Can someone enlighten me why we need a full multipurpose computer that can run custom software just to increment one of two numbers? What's the secret sauce that means we can't run the whole election off of a cluster of 4000-series CMOS's on a breadboard mounted in a plexiglass case in the public somewhere?

willcipriano3• 4 years ago

You probably want a record of votes with times and not just a simple counter.

yifanl6• 4 years ago

I'll come off as glib. but... why? So third parties can make a funny youtube infographic timeseries?

tomatotomato373• 4 years ago

That's not impossible for a simple electromechanical calculator either. An attachment similar to those paper drums seismographs use would suffice while still being simple enough to be trustworthy; a video recording of the counter along with maybe an array of debug LEDs would suffice too now that I think about it.

TT-392• 4 years ago

I remember hearing about a study on very simple electronic voting machines. These machines had a bunch of buttons representing the candidates. And in the study, they were able to make a decent guess of who voted what by looking at the rf emissions from the machine from a distance.

I could imagine a whole computer being there could make the rf emissions less predictable. I can definitely think of some ways of making a simple machine like that more resistant against an attack like that. Idk if the study looked into that, I can't find the study anywhere.

orangepurple• 4 years ago

Run a low power spark gap transmitter nearby to prevent snooping lol

tomatotomato373• 4 years ago

Timing attacks and similar methods of vote snooping is definitely a big issue I've been thinking about for a very simple calculator like this. At first you'd think you could mitigate that with some sort of analog capacitor timer buffer thing somewhere in the chain but then you screw up a lot of predictablity needed to trust such a device...

klyrs2• 4 years ago

Not just one of two numbers. Ballots contain multiple referenda, and races for multiple positions, each of which can have anywhere between 1 and tens of candidates.

You need to display all of that information, take a user's input, store it in an auditable format. Oh, and people like "small government" so making custom hardware is completely out of the question. Using a "multipurpose" computer is the economical choice.

But there's another aspect to this: if you can swap out the hardware and keep the software the same, it makes the whole thing more transparent. A jumble of 4000-series CMOS on a breadboard could hide any number of bugs/backdoors. And, perception of trust is important, nobody wants to vote on your science fair project. Also, you'd need to produce thousands of these machines to run an election. Really easy to procure thousands of commodity multipurpose machines... but you're talking about mass-manufacturing your science fair project. Hell no.

bastawhiz2• 4 years ago

There's a lot to be said for the value of commodity hardware: you almost certainly can't prove that purpose-built hardware has or hasn't been tampered with by the manufacturer. With commodity hardware, the risk that the manufacturer anticipated your use case (voting machines) and implanted a backdoor that can affect their functions is extremely small.

rgacote• 4 years ago

And some positions allow you to vote for "up to" some number of candidates. Town selectman is a typical example.

jefftk• 4 years ago

You need to display all of that information, take a user's input, store it in an auditable format.

These are machines that read paper ballots and compute totals. See https://news.ycombinator.com/item?id=33469882

kunwon1• 4 years ago

I've always wondered why there isn't overlap between voting machines and slot machines. Surely most of these problems have already been solved by the Nevada Gaming Commission

bastawhiz2• 4 years ago

The problems do look the same. Why don't they share a common enforcement agency? Because they deal with two types of entities (government vs corporation) that operate machines with vastly different use cases with vastly different threat models. A casino's threat model for its slot machine supply chain is completely different than the threat model for voting machine integrity.

Boiling the problem down to the integrity of the hardware and software throws out the nuance of how and why exploitation might occur (and who is doing the exploiting), which has huge implications for how you make regulations and do enforcement.

jcrawfordor5• 4 years ago

There are multiple reasons. First, the tabulator typically needs to determine the "style" (layout) of the ballot from one of possibly hundreds of options (due to multiple government and taxation jurisdictions). Second, a typical ballot in most US jurisdictions has a dozen or more questions on it, and cumulatively across all ballot styles there are often over a hundred questions.

Third, though, and perhaps most significantly, "traditional" optical mark reading (OMR) systems using LED or laser sources and diodes were inflexible as to ballot layout and more problematically not very reliable across varying marks (remember the grade-school requirement for #2 pencils due to OMR scoring of exams), a particularly big issue since voters are often not experienced with OMR systems and so do not mark their ballot "correctly." To address this, almost all modern ballot tabulators use a CCD mechanism to take an image of the full ballot and then interpret it via machine vision (this is not a case of machine learning, the algorithms used are actually very simple). This yields much more reliable interpretation of ballots with fewer ballots rejected to hand-counting, but requires more complex software.

It's important to understand that most US election administrators avoid hand-counting in large part because of its inaccuracy. In many US jurisdictions hand-count ballots are counted by two individuals to improve reliability, but the error rate remains higher than machine tabulation. When it is 1AM after a day that started at 5AM and you are on the hundredth ballot you've hand-tabulated since you got off the precinct floor it becomes extremely difficult to tabulate with the virtually zero error rate that US voters expect. This is not a hypothetical scenario but one that's pretty typical of US election working conditions due to the slim budget and expectation of rapid posting of returns.

anigbrowl2• 4 years ago

just to increment one of two numbers

Oversimplification isn't helpful.

ecshafer• 4 years ago

Open Source is not sufficient for voting machines, and frankly I don't think software should be involved at all. How do we know the source code was compiled without a tool chain attack? How can we verify that the software running even is the source code involved? How can we verify there isn't some kind of IME like kernel running somewhere that does something nefarious? How we do know it wasn't tampered with?

Even if you remove networking from a machine the whole system is so fragile and there are very high stakes at play.

lbriner• 4 years ago

The same way you verify that manually counted votes haven't been miscounted, discarded or altered. You allow witnesses.

Independent examiners will be permitted to verify the source code is actually used as-built, that it has a signature attached and that every machine that is built has the signature checked.

Sure, it's not perfect but neither is manual counting (plenty of countries are proving that right now). The question is, I guess, does a software-based system provide notable advantages over manual counting other than cost and speed of a result?

sb057• 4 years ago

Are you going to have experts examine the hardware of 1 million+ voting machines in the United States? And are all of those witnesses going to be infallible and trusted by the public?

bmacho2• 4 years ago

A witness can ensure that envelops go in a box, and then they get them out from it. Box are verifiable.

But how could a witness verify a software and a voting machine?

Vvector2• 4 years ago

We need a voter verified paper trail, based on an open standard, that can be read by different tabulator machines running different software, and still be hand counted just in case.

contravariant• 4 years ago

That's basically just pen and paper but with automated counting machines.

Vvector2• 4 years ago

Computer assistance can prevent over-votes and warn of under-votes. It also resolves any "voter intent" questions (i.e. hanging chads). It can also format the printed ballot to increase the speed at which a machine can read them.

jcrawfordor5• 4 years ago

That's exactly what this system, and the majority of electronic voting systems used in the US for the last decade, provides.

up2isomorphism• 4 years ago

Voter id voter id voter id, that’s it.

It is ridiculous that we are still debating on that , which shows how messed up we are now.

mrweasel2• 4 years ago

What do you mean? As someone not in the US, I don't know what you mean if you just write "voter id" three time.

Vecr3• 4 years ago

In some places in the US they don't check your ID before you vote. When I voted this year and last they did not check for any ID whatsoever, and the only information they wanted could be looked up in a phone book or previous voter record (but I did flash a US passport last year just in case, so they know I'm probably not an illegal, this year they probably know who I am, new clerk last year). Without checking IDs it's easier to vote twice (under a false name all but one time, or some bluffing/sneakiness to avoid giving a name, otherwise you would probably get caught). The main thing people appear to be concerned about is people voting where they are not supposed to be, such as US non-citizens on visas/green cards, tourists, and illegals. Another problem would be voting in the wrong state's elections, or the wrong county/schoolboard's.

duxup• 4 years ago

I always like the mix of the scanning ballots in Minnesota that are paper / filled out by hand, scanned and go into a box tied to a machine for easy auditing.

ilc2• 4 years ago

This is one of the few areas where paper is still king, IMHO.

Been filling out paper ballots for years. I don't want to vote on a machine. A machine can count my vote. But there should be a paper that goes in the ballot box, so it can be recounted using multiple methods. Different machines, humans, dogs, cats... whatever. There are real physical artifacts.

anonym29• 4 years ago

+1! But this is still a net positive. Multiple forms of validation and open sourcing the software running on these machines are both components of a "defense in depth" strategy.

capableweb4• 4 years ago

So you're for this voting system then? Your messages reads like you're against the system mentioned in the submission, but it seems like the system is actually doing it via paper, just like how you want it?

The trial described in the article:

On November 8, VotingWorks machines will be used in a real election in real time. New Hampshire is the second state to use the open-source machines after Mississippi first did so in 2019. Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H.

It seems to involve paper ballots, as far as I can understand it.

And this is how the authors of the voting system describes it themselves: https://www.voting.works/voting-system

ilc2• 4 years ago

I'm not sure I like VMDs. They can lead to slippery slopes.

IE: Only Fred used the VMD... Or how does the counter interpret the VMD? Are people vigilant about checking their ballots?

Pen, paper -> Into Box -> Counting, KISS. I can deal with a scantron. Not much more is needed here. I'd rather we work on chain of custody and figuring out who has voted etc, that are harder to solve. Though honestly, the fraud rates are so low, on double voting, I suspect made up voters, and ballot box stuffing are bigger concerns.

onionisafruit• 4 years ago

This is what I like about the machine I vote on in Texas. You vote on the machine then it prints the ballot for you. You walk your ballot to a scanner and feed it in where it tells you it successfully read your ballot.

snazz• 4 years ago

I just voted on the same type of system in Wisconsin. It’s nice to have the paper trail. When I voted in Minnesota, I made my selections by filling in bubbles and then feeding the paper into a machine. Either way there’s a physical piece of paper with my selection on it.

alistairSH2• 4 years ago

Something like this sounds like the best solution. I want a paper ballot I can inspect before it gets fed into the counting machine (and which is kept after scanning for recounts, should the need arise). If that ballot is marked by machine to avoid "hanging chads", all the better.

coldpie• 4 years ago

I don't understand why that's better than just doing a scantron style bubble form with a pen. That's what we do in Minnesota. Introducing computers to the actual voting (not counting) process seems like needless complexity. Software quality and UI design in 2022 is absolutely abysmal. Keep It Simple, <polite S-word>.

antihero2• 4 years ago

How do you verify the scanner software is telling you the truth though? Also what exactly is the point of doing this?

snarf213• 4 years ago

The challenge here is that too many people will assume it did it right and not verify. That creates an attack vector. That creates another thing for people to yell fraud about. With paper, there can be no bait and switch, you physically have to press pencil to paper.

As far as the "people don't color the circles correctly", the counter machine can kick that back and say "unclear scan, please verify all circles are colored correctly" and not count that ballot.

cjpearson• 4 years ago

The title is misleading. New Hampshire uses paper ballots and ballot counting machines. Hand-counting is used in some cases such as recounts. They are trialing new ballot counting machines, not electronic voting machines.

jjeaff• 4 years ago

The vast majority of voting machines in the US creates a paper trail. Usually, you vote and the system prints out a receipt showing your vote which is then kept in the case of later hand audits.

Dracophoenix• 4 years ago

Even of that leads to hanging chads potentially costing a presidency again?

alexvoda3• 4 years ago

While I agree with you that the ballot should be physical, electronic counting defeats the purpose of transparency. Counting should also be manual in the presence of representatives of each candidate. Marking of ballots and voter eligibility checking do not present any issues if done electronically.

Maybe one way to address the issues of electronic counting would be to have parallel counts by each candidate (and their reps) using their own hardware and software with a manual count in case the electronic counts of every candidate do not match. But this means each candidate has to bring their own counting infrastructure which is prohibitive.

a9h74j• 4 years ago

parallel counts by each candidate

I have often imagined having say two scanners in physical sequence (so passing through a ballet is a single operation), and having more than one (competing) recorder for the output of each scanner head.

This would require some standardization of form factors and interfaces, but with small enough electronics units and scanners, in principle parallel data paths could be included in a single intentional "infrastructure".

d_christiansen• 4 years ago

Another nice method to reduce risk from electronic counting is called the "Benaloh Challenge" (after Josh Benaloh, the inventor). The idea is that there are two steps to putting the paper ballot into the machine: first, the machine precommits to an encryption of its count (e.g. by printing some paper with evidence on it), and then the voter decides whether to spoil the ballot or actually cast it. If the voter spoils the ballot, then they get a new paper ballot to vote on, but they can retain the commitment. Voters may spoil any number of ballots. Decryptions of spoiled ballots along with enough information to check the machine's work are provided to the voter, either immediately or at the end of the day. This means that a cheating machine cannot cheat very much, though the whole thing also really relies on a verifiable privacy-preserving audit trail for the actual count (e.g. with homomorphic encryption). It at least means that nobody need trust the actual computers.

jcrawfordor5• 4 years ago

The machines in use, from VotingWorks, are precinct tabulators. This means that the voter fills out a paper ballot and the machine scans and retains it, allowing for recount either manually or by alternate machines later on---exactly as you describe. Precinct tabulation was developed to reduce election costs and speed up counting by avoiding the need to transport ballots to a central location and stack and feed them to begin tabulation---they are fed by the voter and tabulated on-site. Almost all precinct tabulators, including those from VotingWorks, are offline and tabulate results to multiple storage media that are physically transported to a totalizing system (typically with paper tape printout as an audit and backup measure, in addition to the availability of the original ballots). This allows election administrators to begin posting a substantial portion of returns within an hour or so of polls closing, rather than the many hours historically required to feed ballots to central tabulators. This is particularly important since polling has found that many voters now distrust results that are delayed in posting and tend to view multiple-day vote tabulation as an indication of fraud, which has added to the motivation of election administrators to have most returns available the night after the election rather than in the following days... a logistical challenge that is difficult to meet without precinct tabulation, given the very limited budget most election administrators have to hire temporary staff.

Unfortunately many people now conflate "voting machine" with direct-recording electronic or DRE machines. While DRE machines became common for a short period after the Helping America Vote Act imposed accessibility requirements that were difficult to meet with paper ballots, most voting machine vendors now offer "ballot marking machines" (sometimes integrated into the precinct tabulator) that allow individuals with special needs to mark a paper ballot using methods like voice feedback. The marked paper ballot can be verified by the voter or another individual before tabulation. Ballot marking machines have mostly eliminated the original motivation for DRE voting and the popularity of DRE voting across the United States has decreased since the shortly-post-HAVA period (2004 election cycle, basically), with many states prohibiting DRE entirely or DRE without voter verified paper audit trail (VVPAT), an arrangement in which all machines essentially function as ballot markers and produce a paper ballot with the voter's selections for the voter to inspect.

DRE with VVPAT can be attractive because it integrates the "ballot on demand" system into the voting machine, simplifying the three-step process typical of precinct tabulation where the voter obtains a ballot from a ballot-on-demand workstation, marks it, and then inserts it into a tabulator. Ballot-on-demand is functionally required by most modern election administrators because it facilitates "voter convenience" models where voters can appear at any precinct (usually within their county), not just at the single precinct in which they reside. The reason for this is simply that, considering the multiple taxing jurisdictions in most parts of the US, a single county election can have hundreds of distinct "ballot styles." Preprinting every ballot style for every precinct is impractical and encourages fraud due to the number of valid ballots "lying around." Ballot-on-demand tends to have a very positive impact on election integrity in this way: the ballot does not physically exist until it is issued by the BOD system which is typically integrated into the pollbook system such that a ballot cannot be issued without marking a voter as voted in the pollbook. DRE with VVPAT is mostly equivalent to precinct tabulation with BOD, but many prefer precinct tabulation with BOD because the majority of voters (those not using assistive technology) mark their ballots manually which decreases the risk of mismarking by a ballot marker.

It's important that American voters understand that non-auditable voting machines are no longer common in the US and are found only in some states, and the portion of votes counted by methods without paper audit trail is decreasing year over year as states replace aging DRE equipment.

Unfortunately, the larger problem with US election administration is not DRE machines but funding. State election administrators usually operate on extremely restrictive budgets. States originally purchased DRE machines mostly because they were the cheapest option that met HAVA requirements, which essentially required many states to wholesale replace their voting equipment on short notice. Most states that use DRE equipment today use it because they cannot afford to replace it. There is very little, even zero, real support for DRE machines other than for the simple reason that states cannot afford to purchase anything else... and this is no longer as true today due to more affordable ballot marking machines, and vanishingly few election administrators are choosing DRE when they have funding available to replace voting systems.

A larger concern in voting security is likely registration and pollbook systems, which are often poorly audited and from small software vendors, once again largely due to the small budgets available to pay for them. In the cases that voting irregularities have been found in the US, they are virtually all a result of defects or limitations of the pollbook system and unrelated to the actual vote tabulation. This encompasses situations like individuals voting multiple times---one voter, one vote is a responsibility of the pollbook system and not the tabulator, which is unaware of the voter's identity as a precaution to protect secrecy of the ballot, constitutionally required for federal and many state and local elections.

dpkirchner• 4 years ago

I want to see examples of ballots that changed votes during recounts. I'm curious about what went wrong with the initial scan (I have ideas, of course) but seeing the actual problems would be nice.

tylersmith• 4 years ago

How does giving the vote aggregators a piece of paper assure to you that the outcome reflects that paper?

Buttons840• 4 years ago

Yes. Paper ballots in please.

Everyone thinks about counting. "We need fast counting, we need accurate counting" they say.

We also need to think about understanding and trust. Think of your neighbor, think of 'Florida man', do you expect them to understand a voting machine? Do you expect them to trust a voting machine? I'm a computer programmer and am hesitant to claim I understand voting machines. I do understand paper though, and I do trust the nice people I went to church with when I see them running the polls.

elil17• 4 years ago

When I voted in this year's election in the US, I used a computer which printed my ballot after I filled it out digitally. That ballot was then scanned by another computer and put in a ballot box for any potential future recounts. That seems like the ideal way to do it to me - I eliminate the risk that my ballot isn't counted due to my admittedly poor scantron filling skills but I still get a paper ballot in a box that a human can count if need be.

schimmy_changa• 4 years ago

Man, people are really negative about this, but it's a great idea.

In the old days, paper ballots would also 'go missing' from districts known to be favorable to the other side (aka be chucked out of trucks on a bridge over a river). The best option seems to be open source voting machines + paper audit. This way you get immediate counts and then an audit trail, so would-be manipulators have to mess with BOTH at the same time which is significantly harder.

Think you know a better way HN? Let's hear it.

calvinmorrison• 4 years ago

Yes, that's why we have poll watches / volunteers from both sides.

matheusmoreira3• 4 years ago

Brazilian here, we've been using voting machines for quite some time now. We are currently facing nation wide protests at least partly due to suspicion of election fraud. People aren't accepting the election's results.

Questioning the legitimacy of the voting machines has also become illegal ("fake news").

ufo3• 4 years ago

(Because of unfounded claims of fraud, according to the losing candidate). It's a shame. There are many ways that the voting machines could be improved but that will be much harder now that the far right has monopolized the discourse on auditable paper trails in their self-serving attempts to overturn valid election results.

rozab• 4 years ago

There are other ways to achieve an audit trail with paper ballots. Like cameras. Electronic voting is opaque by nature compared to a bunch of people in a room actually counting paper ballots.

kaapipo• 4 years ago

In the old days, paper ballots would also 'go missing' from districts known to be favorable to the other side (aka be chucked out of trucks on a bridge over a river).

The problem with electronic voting, however, is that it takes roughly the same effort to change one vote than it takes to change millions

TrevorJ• 4 years ago

The fact that at some point over the last 6 years, a huge bipartisan majority of people expressed doubts about the security of our elections (One party in 2016, another in 2020) and yet very little real change has been accomplished is pretty telling. Fact is, if you are in power, there's very little motivation to mess with or risk a change to the system that got you into power.

ensignavenger3• 4 years ago

It is worth noting that Windham New Hampshire had a case of actual vote miscounting in the 2020 election- though not the presidential election- and the miscounts did not change the results. The Democrat who lost the race is the one who requested the recount (and the recount favored the Republican candidates who won).

See https://apnews.com/article/donald-trump-new-hampshire-voting...

https://www.concordmonitor.com/voting-machines-nh-new-hampsh...

The news of this has of course been buried under all of the false claims of voter fraud from the 2020 presidential election.

So it is not surprising that New Hampshire would be looking at a new approach to voting machine technology.

Rebelgecko• 4 years ago

Wow, those error rates are actually much higher than I'd have expected. I wonder if the cause is something like a difference in how humans vs machines deem ballots invalid?

jandrese• 4 years ago

You can change a lot of votes by altering the rules as to what is considered a valid vote. Read into the details of the 2000 election and you'll see just how much of a leg up George W Bush got from party control of the vote counting. There are plenty of scenarios where he would have lost if the rules were decided differently during the counting process. Had the decisions been made neutrally Bush would have lost in Florida.

ensignavenger3• 4 years ago

The audit found that the ballots had been folded "incorrectly" (Is there a right way to fold the ballots?) and if the crease went through the mark for a candidate, it would count the crease as a mark. This meant if the voter had marked another candidate, it would think it was double voted and not count it, and if they had not marked a candidate, it would count it as a vote.

I am not sure having the source code of the machines be open source would help, but maybe make it easier to audit and detect that the crease would lead to a miscounted ballot.

aksss2• 4 years ago

Right, the interest in having auditable and secure elections is not simply a right/left issue and does not mean one's an "election denier" or an "insurrectionist". It just stands to reason that basic controls for governance should be a key attribute of how elections are run, and no, the feds shouldn't be paying for this, imo.

In my home state, a Republican candidate (albeit disowned) was indicted for ballot harvesting, particularly for hiring a consultant from CA to run around through a particular east Asian community collecting ballots. If a system works, every politician will exploit it.

* ID's should be required (like they are for everything else, including travel, bank accounts, bars, etc);

* voter rolls should be scrubbed;

* election results should be auditable;

upofadown• 4 years ago

Wait, you mean that there is currently non-inspectable software in a path that could allow that software to switch around votes? How could that possibly work?

pessimizer3• 4 years ago

That's been the case since the dawn of voting machines.

cakeface• 4 years ago

You can see the source code on github https://github.com/votingworks/vxsuite

Looks to be TypeScript running on node. They have an embedded kiosk browser.

ElijahLynn2• 4 years ago

Thank you, I was skimming the article for a link to the source code but was having trouble finding it.

Stevvo• 4 years ago

"the Python and Linux programming languages are all open-source"

ElijahLynn2• 4 years ago

I'm having a tough time finding the link to the source code in the article. Am I missing it?

ccbccccbbcccbb• 4 years ago

No matter how transparent the voting software and machines are, nothing can fix election between candidates who all hatch from the same incubator.

sgc• 4 years ago

"that everyone can see" makes me want to see completely analogue tabulators that tally the vote using only mechanical means, inside glass cases that are being recorded and streamed.

Less seriously, add random dry ice steam, fire, and whirling gears for best effect.

constantcrying2• 4 years ago

Voting machines should not exist. Even if they are just printers.

Computerized vote counting is a ridicolously bad idea on every imaginable level. Especially if there is any amount of centralization. Computerized ballot printing "just" makes it very easy to deanonymize people.

Here where I live your name is crossed of a list after you have shown your ID card. Then you get a piece of paper which is thrown into a box. Given the incentives, anything less rigorous seems quite ridicolous.

wewtyflakes• 4 years ago

Given the incentives, why does that make you trust humans more?

constantcrying2• 4 years ago

Because corrupting one hunan likely has negible effects. Corrupting one machine is equivalent to being able to corrupt all similar machines.

Voting machines have attack vectors which can not work on humans.

cosmojg• 4 years ago

I don't get why we don't just print receipts with anonymous hashes at polling stations, publish all counted votes with those hashes, and allow people to independently verify that their vote was counted. This would be so easy to implement. It's truly depressing that it hasn't.

yamtaddle• 4 years ago

You'll still have people saying there were extra votes or that the votes weren't counted correctly. It'd have almost no effect on complaints about election integrity, just like... every other indication they're barking up the wrong tree hasn't had an effect.

aksss2• 4 years ago

Twenty years ago, we could count on results the same night of the election, and in our town/city election night was always a party night - everybody involved in the campaigns would gather in a convention center where the local news orgs would live broadcast, the surrounding bars would be packed, and usually by 10-11pm, winners would be known.

Somehow, twenty years in the future, we don't know results until weeks after the election, and auditability/transparency sucks.

halffaday• 4 years ago

the Python and Linux programming languages are all open-source.

Yikes

bkmeneguello• 4 years ago

Voting doesn't need to be fixed. It must be banned! Voting is an act of faith. Faith in who manages the electoral process. We need a private laws system, where you hire the governance you want, no more majority oppression or state subordination.

tomohawk• 4 years ago

None of this matters unless only secret balloting is allowed. Mail in balloting is not secret. Only in-person balloting is secret.

When a person has a mail in ballot, they could be coerced or paid for their vote in an undetectable way. It might not even be the person who is authorized to vote, but someone else entirely - again completely undetectable.

History has shown time and again that people are motivated to cheat at elections, so all ballots need to be cast in a controlled space that prevents these shenanigans.

This is why the vast majority of OECD countries disallow or tightly limit mail in balloting.

ensignavenger3• 4 years ago

This appears to be the code repo- https://github.com/votingworks/vxsuite-complete-system

But it does not have a license file or any license headers... meaning it may not be under an Open Source license at all?

Some of their code- the audit program, looks like it is AGPLv3... which seems like an odd choice of license for this sort of system. Still happy to see more work on Open Source voting systems.

New Hampshire set to pilot voting machines that use software everyone can see

Related Stories