Verified Voting | Hacker News Reader

Verified Voting

verifiedvoting.org

50 pointscolinscape45 comments

The consensus of both high-assurance security and top minds in general INFOSEC is that voting shouldn't be done with computers or shouldn't exclusively rely on them. They're black boxes connecting via black boxes with endless ways to be attacked. I've noticed all the ways that protect them from that just make the process more incomprehensible to both lay people and technical people. The paper ballots or hybrids where electronics spit out a human-verified one are best schemes. Fewer forms of fraud that are easier to detect by massive numbers of people. Better to just improve those systems.

Far as hybrids, the Scantegrity scheme was always interesting to me as the human-visible steps are straight-forward:

https://people.csail.mit.edu/rivest/pubs/CCCEx09.pdf

Prior studies showed even it had usability problems. Someone interested in secure voting might want to tackle those for it or other stuff in the related work section.

Not only that, paper ballot voting scales well, creates jobs for people, and leads to increased trust in the system, since people are directly involved. Who does electronic voting benefit?

People who live in states with strict absentee voting laws and who have to work on election day. Now perhaps the solution is to make election day a national holiday (and a real holiday where everyone but safety-critical workers are given the day off -- and no, cashiers at Walmart or car salesmen working for "our big election day sale" won't count as safety critical).

If polling stations are numerous and accessible enough, an entire day isn't necessary.

https://www.ontario.ca/laws/statute/90e06#BK18

edit: Canada also has advance voting. Polling stations open 5 days before the election day and people can voting during business hours on those days.

It's not just a technical problem. With online voting, somebody can be forced to make a certain vote, for example, at gunpoint. Or blackmailing, bribing, et cetera.

Voting offices protect against this.

What are your thoughts on vote by mail?

You can always mail in the ballot, then go to a polling place and vote there. IIRC, that overrides your mail-in vote.

How would that even work? They wouldn't be able even to start opening ballots until after election day.

In California, you definitely can't do that. Ballots are separated from the envelopes, for anonymity, before counting. The different counties even have web pages where you can check that your ballot was received and counted. (Mine was received 10/31, opened on 11/1, and counted on 11/2.)

Some states already allow people to change their votes if they voted early.

Not always -- it varies on a state-by-state level. I live in NJ, where you can do this. However, it only works because absentee/mail-in balloting is held until after election day, and in some cases are only counted if the election is within the number of absentee ballots, and an in-person vote will trigger them to manually throw out the mail-in ballot.

Yes -- in this modern world where so many things are being made more convenient by doing them electronically/over the Internet, it's tempting to think that voting should be another such thing. But it has to be held out as an exception. This is one case where the old technology of paper is better.

This all seems beside the point. So what if I can verify that my vote is correct? How does that stop somebody with access to the software/machines from tampering with the vote tallies?

I have worked as an election scrutineer for a political party. You just can't beat having several people standing there -- each representing a different political party -- watching each ballot be unfolded and counted, confirming the exact count for each candidate, contesting any spoiled or rejected ballots, recording an independent copy of the vote totals for all candidates, and signing off on the official vote total.

The fact that each ballot box has multiple eyewitnesses and that all of the counted ballots are sealed in a signed envelope makes the whole process very transparent and easy to audit. None of this is true to anywhere near this extent for electronic voting.

In California over half of ballots are sent in by regular, old fashioned, snail mail via the USPS. I have no handshake saying my ballot was received, no proof that someone at USPS or with easy access to USPS shipping infrastructure (e.g. the mail trucks that don't get locked when the mail man goes out) doesn't swap in a different ballot, or any assurances that again someone isn't correlating my name and address with the ballot I mailed in. All these problems are mostly solved just by using something like HTTPS.

Now the biggest problem is how secure people perceive the voting process to be. And since most people don't really understand how these things works there will be huge room for conspiracy theories to arise about vote hacking. This in turns undermines the democratic system. I've talked to many people who actually feel more secure sending in their credit card details over the POTS or by mail, not understanding that these systems are even less secure, even after explaining to them the vulnerabilities.

I know very little about security but couldn't a system be created like git, where for every vote the voter gets a sha of his vote?

That way she can later verify that in his section repository his vote is still there and has been counted. Of course the mapping sha1 <-> voter will be anonymous, but this way everyone can see all the votes.

This doesn't solve the problem of some hacker adding votes on top of the legitimate ones though.

There is a practical advantage to being unable to confirm your own vote: if someone tries to buy votes people could just take the money and still vote anyway they choose since there is no way to prove afterwards that you didn't vote that way.

But pgz specifically said that the votes could be kept anonymous.

Yeah but the people corrupting you, would ask you for your sha as confirmation.

Here in Italy for example it's forbidden to bring your smartphone into the voting cabin, because the Mafia was asking for photo proofs.

So esrauch found a great counter to my idea.

If parties are corrupt enough to require a picture, and voters willing to engage in this corruption, how do you, realistically, prevent this from happening?

Body cavity searches?

That the Mafia can buy people to vote for their preferred candidates I think shows a failure of the political class. Why haven't politicians been able to deliver a government where what they're proposing is more valuable than a few dozen to hundreds of euros?

Fill out a Mafia-friendly ballot, take your picture, then spoil it and request a new ballot.

My general opinion is that mafiosos are clever and would already have figured out a way to get around such tactics.

As you present this argument here is exactly as it is typically presented elsewhere, which is in a vacuum.

The question to consider is: how do the potential issues presented by a tool allowing individuals to confirm their own vote compare with the issues potentially resolved?

In this consideration, it must be included that tools already exist for individual vote confirmation. Snapchat and even just plain-old MMS are two easy examples. Additionally, a widespread campaign to manipulate a vote through bribing voters is likely to be uncovered through other means such as whistleblowers, else the necessary number to effect the outcome of the election is unlikely to be met.

What is the potential benefit? Individuals can verify their vote was included in the final count as they intended. This would even make allowances for human counters who have trouble interpreting a voter's ballot (e.g. hanging chads) can be corrected, plus increases in efficiency, such as adding some sort of automated counting system, can be employed while black box concerns substantially mitigated.

Allowing voters to confirm votes would substantially reduce nearly all vote rigging concerns that relate to the counting of their votes, largely leaving only the issues beyond this, such as voters voting more than once, voters voting in place of other voters, etc.

What if when you vote you were given one real sha, which shows who you actually voted for, and then one fake sha, which would show the opposite? As long as only you (and the vote aggregator) knew which one was which, you could produce "proof" to any vote buyer.

But the fake SHA would have to not be counted, yet the purpose of the SHA is to prove that your vote was counted. There are variations on the scheme, but fundamentally, in a system where the voting machine gives you a real and fake token, which have to be indistinguishable after the fact, what's preventing it from swapping them?

That minor advantage is outweighed by the disadvantage of not knowing if any of the votes were counted correctly.

Anonymity is important, but the hashing is an issue because somehow the hash is created, and that is just as much a black box issue as the rest of the chain.

yes they can. there are a few proposals around end-to-end verifiable voting.. with a "privacy preserving" verification.

This means that you can verify that you voted from whom you thought... but nobody can force that knowledge from you at gunpoint.. even if they had the verification token.

Some of the famous ones are Scantegrity (proposed by Ron Rivest) and Punchscan.

https://en.m.wikipedia.org/wiki/End-to-end_auditable_voting_...

Indeed. Really interesting stuff, the intersection of security, privacy, democracy, technology, social systems.

This slide deck from Ron Rivest gives a good overview of the landscape:

Ronald L. Rivest MIT

Auditability and Verifiability of Elections

ACM-IEEE talk March 16, 2016

https://people.csail.mit.edu/rivest/pubs/Riv16x.pdf

why can't the voting machine print a receipt with a unique random number for each instance? why can't every voter get an alphanumeric-ID that has nothing to do with his last/first names? This way the whole voting record can be listed publicly, searched and verified by all those who voted just like a lottery ticket to some extent. Technically there are so many ways to double-check the election correctness but none is implemented, why? just a dumb machine that my input is going to /dev/null without any way to check the return/error code?

Right to vote should be restricted to those with knowledge qz.com/796962

You're being downvoted heavily for this and it's easy to see why. The arguments against an epistocracy are numerous and in my opinion unrefuted, the core point being, who determines the epistocrats [0]?

[0] https://link.springer.com/article/10.1007/s11158-012-9179-1

The US used to be an epistocracy [0], and the result was disenfranchising racial minorities for decades. The testing system was deeply racist, and basically prevented black people from voting. The battle to eliminate the tests was long and hard and continued until a deeply divided Supreme Court upheld the Congressional nationwide ban on literacy tests in 1970, in Oregon v. Mitchell [1]. Although I dislike it when people cast uninformed votes, I would fight for their right to do so if it ever again came into question.

Let me guess, although you say "[the] right to vote should be restricted to those with knowledge" you did not have sufficient knowledge of the US's past as an epistocracy. Which makes me smile; you definitely wouldn't pass _my_ knowledge test :)

[0] https://en.wikipedia.org/wiki/Literacy_test

[1] https://en.wikipedia.org/wiki/Oregon_v._Mitchell

Suppose everything you say is true, and every single supporter of epistocracy is racist. It does not follow that epistocracy is bad. Consider the possibility that epistocracy is racist but it also produces better governance - e.g., perhaps the racial groups being discriminated against vote for bad governance.

(Define "bad" however you like, but strictly in terms of actions taken by the government rather than how those actions were decided on.)

If that were true then the racist epistocracy you discuss would be a good thing, in the sense that governments would provide better services to citizens.

The main argument against this is that voting rights are a way to express respect, membership and status to humans. But the solution to this conundrum is to stop using voting rights as a status symbol.

Here's a nice article that discusses this idea in much greater detail: http://bleedingheartlibertarians.com/2016/09/expressive-mean...

I think what you're saying boils down to "even if it's racist, it is preferable if it produces better outcomes".

The weakness of that argument is in the definition of "better outcomes". You say "Define 'bad' however you like, but strictly in terms of actions taken by the government...". Do you really mean this? To pick a topic that is far enough back in history that most agree today - would you be willing to agree that "Brown vs. Board of Education" was a failure of the system because it eliminated the policy of "separate but equal"? After all, segregated schools, buses, bathrooms, and other accommodations clearly did reduce the interactions between the races and thus the opportunities for interracial conflict, while (by definition) offering "equal" facilities to each race. I would not accept that argument and I suspect you would not either.

So if it all comes down to the value function we use to assess what outcomes are desired, how should we decide on the this value function? Perhaps we could conduct a sort of a poll of the members of society... we could call it "voting". Actually, with the exception of a few cases of direct democracy in the form of ballot initiatives, that is the system we have today: at least in the US, voters rarely decide policy, they decide WHO will decide policy. Perhaps you can make a case that only those who are "smart enough" or meet some other criteria should be allowed to influence the decision of who decides policy. I would disagree. Simplicity is an important virtue in a system intended to be robust, and "everyone gets one vote" is far simpler than some sort of assessment for voters. ("Everyone older than a certain age gets one vote except if they've been convicted of a felony" isn't quite as clean and simple, but it's what we've got at the moment.)

So if it all comes down to the value function we use to assess what outcomes are desired, how should we decide on the this value function?

As per my hypothetical, you personally (mcherm) get to define it.

Suppose you define it as "segregation is bad" - I gather from your post that you believe this. Suppose further that democracy produces segregation, but epistocracy or dictatorship does not. (On all other policies suppose they produce the same result.)

Do you still oppose epistocracy/dictatorship? If so, why?

> you personally (mcherm) get to define it

Oh, if I get to be absolute dictator (and yes, getting to define the value function IS equivalent to being an absolute dictator) and all voting is merely advisory, then I'm perfectly happy with epistocracy or whatever else you want that puts that in place.

> Suppose further that democracy produces segregation, but epistocracy or dictatorship does not. (On all other policies suppose they produce the same result.)

I do agree to assess electoral policies based on their outcomes, not some other approach (like a fundamental "principle" about how elections should be conducted). So if I assume that method "A" produces an outcome that I like better than that produced by method "B" then under that assumption I do prefer method "A", regardless of what "A" and "B" are. But this does not persuade me in favor of epistocracy.

There are lots of theoretical arguments why having only knowledgeable people make decisions would result in better outcomes. But it would be foolish to evaluate a policy only on the basis of theoretical arguments without considering the outcomes measured through practical experience. And practical experience has shown that attempts to introduce a filter to allow only "properly educated" people to participate frequently seem to devolve into a mechanism for excluding certain groups from participating. If epistocracy is marginally better than universal suffrage, BUT is fragile, in that it comes with a much greater chance of devolving into excluding of certain outgroups (like racial minorities), then on the whole, universal suffrage would be superior. And my view of history suggests that this is the case.

> Suppose everything you say is true, and every single supporter of epistocracy is racist. It does not follow that epistocracy is bad. Consider the possibility that epistocracy is racist but it also produces better governance - e.g., perhaps the racial groups being discriminated against vote for bad governance.

Fundamentally, this is possible. We are ageist when it comes to voting, for example, because we restrict votes from the very young on the basis that they are much less likely to vote sensibly. A five year old is not expected to be able to weight the complexities of immigration policies or tax issues.

But I would argue we start from the idea that anyone is equally capable of voting, then use evidence to restrict people.

So, it might be beneficial to stop everyone born on an odd year from voting, or people whose great-grandparents lived in a different country, or who have red hair, or are under 5"4', but without any evidence that this is the case and with history suggesting that restricting voting often results in revolts then why would we start in that situation?

> The main argument against this is that voting rights are a way to express respect, membership and status to humans.

No, the main argument is that voting rights result in representation. It's not for a feel-good factor, but for the same reason having wolves and sheep vote on dinner when only the wolves can vote might not result in an outcome that really represents the will of the population.

So, in my comment I never once said supporters of epistocracy are racist (or that every supporter of epistocracy is racist.) [0] I said that epistocracy itself was racist in the most literal sense: discriminating by race.

I said that it disenfranchised racial minorities for decades, which is something that is factually true; some Southern states did not have laws preventing black people from voting because epistocracy was the system by which black people were stripped of their right to vote, i.e. literally disenfranchising them by the dictionary definition - the first definition, according to both the Merriam-Webster and Oxford English dictionaries.

At this point let's ignore the race issues and just assume two things to be true: 1) epistocracy is the most effective form of government and 2) epistocracy deprives every citizen (who is ignorant of X, whatever X may be) of their right to vote.

Personally, even given these assumptions I would not be in favor of epistocracy. In my opinion, a dictatorship would be the most effective form of government. But do I want a dictatorship running the country? No.

Because I, personally, hold these truths to be self-evident: that all men are created equal, that they are endowed with certain unalienable rights, that among these are life, liberty, and the pursuit of happiness. And regardless of the enticing Siren call of an effective system of governance - which sounds all the more sweet with the modern political world of Trump, Clinton, Duterte, Geun-hye to name a few - I would not deprive any citizen of this planet of their rights, however dire the consequences.

[0] I do think that many or indeed most modern supporters of epistocracy are racist and ignorant, but that's not relevant; I don't dislike something solely on the basis that its supporters are racist or ignorant. I assume both Donald Trump and I like pictures of cute kittens, for example. As an aside, it's very obvious that almost every supporter of epistocracy was racist when it was in place in America.

If a dictator (or epistocracy) protects these unalienable rights better than 50%+1 of the population does, your premises argue in favor of that dictator/epistocracy/non-democratic government.

Voting rights are neither life, liberty nor pursuit of happiness. Voting rights are something else: the right to have a nonzero probability of directly influencing the use of (legal) violence against others. It's easily possible for a person to have your three inalienable rights without this.

However bad our system is it is always at least in theory possible to change it to reverse course undo wrongs and start anew with new shmucks and new laws. However good you think such a system might be it would undoubtedly serve to disenfranchise a progressively larger group of people all the while supported by those remaining in the in group.

Once you open the door to disenfranchisement being legal and permissible this is inevitable both because there is a giant teaming mass of ignorance to justify kicking some of the idiots out and those in the remaining group would always benefit from removing some of those in various out groups so long as the group and its supporters is a small enough portion not of the population but of the remaining voting group. For example maybe its impossible to disenfranchise the blacks until you have first went after the hispanics, maybe its impossible to go after the hispanics until you first get rid of all the ones that came here within the last few generations.

Whatever ideals you start with you end up with a decreasing minority of the population making all the decisions and a growing majority not only dissatisfied but unable by definition to do anything about it short of violence.

When tensions increase sufficiently you end up with riots at minimum and civil war at maximum.

The USA is still slightly an epistocracy because there's a civics test before long-term residents gain the right to vote[1]. I think this element of epistocracy is fine; it's not deliberately racist like the other tests were. There are many possible epistocracies.

Some epistocratic measures could decrease oppression of specific demographics, rather than increase it. We currently ban children from voting, presumably because they'd cast bad votes. But if there was a way to measure ability to vote well, then we could let children vote if they have that capability. If there is legal oppression of children (which seems likely, since there's been oppression every other time a non-voting demographic had laws that specifically target them), then the voting children should be able to decrease that. An example of a bad law oppressing children was the Canadian ban against them carrying asthma inhalers in school. Thankfully, this law has changed, but not before it killed someone[2].

Specifically, my proposal is that we adjust the disenfranchisement of citizens that we currently do (of children, felons in some states, and the mentally incapacitated) with a civics test where they can vote if they pass. The civics test for long-term residents might be fine as it is. It seems really easy to me, but maybe that's desirable.

[1] https://my.uscis.gov/prep/test/civics

[2] http://www.cbc.ca/news/canada/ottawa/ontario-mom-urges-schoo...

A simple test to use is ability to complete a valid ballot.

And then you commit to making it as simple as possible to complete a valid ballot.

The US was never an epistocracy. While some states did technically have a "literacy" test, it was a literacy test in name only; and designed specifically to disenfranchise black voters. Using that as evidence that epistocracy is bad is like using the present day voter verification attempts as evidence that the concept of secure voting is bad.

When I was taking security classes one of the things they kept mentioning is that it's possible to increase security so much your users grow frustrated and wind up installing backdoors for themselves. For example there's a long security review before installing new software, so someone brings in their own device with this software. They're not a hostile attacker, yet have opened your infrastructure up to new attack vectors.

The same is true for voting. The more secure you make it the less people will vote. The less people vote the less they trust the system. This then winds up undermining the very thing you were trying to protect.

Edit: I'm not arguing for zero security. I'm arguing that some thought goes into what security procedures you implement on voting, and how that enfranchises or disenfranchises people.

And yet you yourself have in your own profile this quote:

"If you don't read a newspaper you are uninformed. If you do read a newspaper, you are misinformed."

Also, the article you linked to ends by saying Of course, any epistocratic system would face abuse. and but epistocracy tries to make sure the informed many are not drowned out by the ignorant or misinformed many.

But this is why we have multiple levels of government, checks and balances, and civil society.

Reply on news.ycombinator.com