Hacker News Reader

Comment by spacehome | Hacker News Reader

I hope this includes voting software.

There is an effort happening in San Francisco right now to do just this. See here, for example, for a recent March 24, 2016 hearing on the topic:

https://sfgov.legistar.com/LegislationDetail.aspx?ID=2567089...

"Hearing on San Francisco's efforts to fund, design, and implement an open source voting system, including budget costs and projected roll-out schedule; and requesting the Department of Elections and the Elections Commission to report."

It's currently up for consideration in the budget.

SF resident Brian Behlendorf recently endorsed (along with EFF, Code for San Francisco, California Common Cause, local GitHub CEO Chris Wanstrath, etc), and we're looking for more high-profile supporters to help influence the Mayor's budget decision:

https://twitter.com/cjerdonek/status/716448812181512192

I could be wrong, but in most cases the US government buys appliances from companies like Diebold and they don't develop or contract software for voting. The best that can be done is regulation to force audits of the appliances like what Nevada does with casino slots. Even that would be a huge step up.

Might be a reason to long-term require all software used be open source and for that matter make it easy for a user to confirm that the system in use real-time is the system that's open-sourced too.

How do you allow a user to confirm this in real time? Hash displayed on th screen?

Users wouldn't confirm this in in real time just like users have no way of verifying in real time that their paper ballot was actually counted.

A better outcome for this type of system would be a pre-election and post-election verification of each machine (which isn't unreasonable since the number of machines is far less than the number of ballots) in which interested agents from each party/group could be present during the verification process (and use their own machine if they desire) to ensure that all the digital signatures match and there's no foul play.

Yes, that's correct, being able to download the code, hash it, and then compare it to the hash displayed real-time would be a first step towards enabling this.

the software can easily be modified to display the hash you are expecting

To start, something is better than nothing. Long-term remote inbound two part authitacation combine with like measures for hardware via meta-programming would make bypassing this very, very hard for the average hacker.

perhaps use a Merkle hash to verify your vote was counted?

There are actually foundations out there that do exactly that. If you're interested, OSET Foundation (http://www.osetfoundation.org/#welcome) has developed everything from ballot scanners to entry systems. It's all open source and they've been at it for about 10 years. They patented some of their systems and made the Secretary of commerce the owner of these patents, as far as I'm aware. Legislation is slowly moving towards adoption, given the potential reduction in cost.

In general the US Federal government does not operate polls. The various local governments operate elections while abiding Federal and State laws and regulations. In practice, the highest level where software standards are promulgated is state governments and there only some states and with variation among them.

Unless you have a way to ensure the code actually running on voting machines is the code that was published, there is no point.

Yes there is, it significantly raises the bar for maintaining plausible deniability while enabling voting fraud.

Right now if there is a bug that creates incorrect vote totals it would be very hard to prove it was done intentionally. If the software was required to be open source, then just the fact that they were running different software than was published would be strong evidence that it was intentional.

The low tech solution tried in India is to have a paper trail on the electronic voting machines itself.

>> ... will be fitted with a printer that will have a drop box to store the paper trail of the votes cast. This is expected to alleviate concerns — expressed earlier by the opposition led by BJP — over possible tampering of EVMs to favour a certain candidate.<<

http://www.business-standard.com/article/pti-stories/2019-ge...

http://timesofindia.indiatimes.com/india/EC-ready-with-new-a...

Reply on news.ycombinator.com