No paper ballot in box scheme can do that: anything that is run by officials means that the correctness of the system depends on the officials' word only.
Please sign up and observe your local elections. The Australian Ballot system (private voting, public counting) is time proven, battle hardened.
Paper ballots cast at precincts counted when the polls close is the gold standard. It works because opposing belligerents agree on the outcome. Trust forged from mutual distrust.
Paper ballots permit guaranteeing the physical chain of custody. You should show up and help keep that guarantee.
The security of a digital systems is "good enough" IMO, especially if there's a public cryptographically verifiable ledger. We bank online where the banks essentially only hold cash in the form of a database entry. The benefits of digital voting means we can have more granular input in our government's operations. I don't see paper ever scaling to meet that demand.
Remember that your IMO is not what the consensus among security experts is. There are many things that you and me missed.
The worst problem with electronic internet voting is that depending on country, something like 5-40 percent of voters loses the secret ballot and the opportunity to vote independently without coercion. Husband, brother or other family member will be behind their back to watch how they vote.
Here in Finland I have a friend who has been election official and he says that it's not uncommon common for family member trying to squeeze into ballot box or try get behind. Especially if the ballot has been cast in post office with small space.
Your jurisdiction's voter registration database is (hopefully) up to date. YMMV. Note that verified reports of registration fraud are very, very few. Whereas caging, purging are fairly common.
Briefly, On election day: voter shows up to correct poll site, shows some kind of ID (YMMV), name found in that location's poll book, voter signs in, ballot is issued, voter marks ballot, voter casts ballot. If there's any error (question) during this process, voter is issued a provisional ballot, to be adjudicated out of band.
Ballots are counted before the polls open and again when the polls close. The bookkeeping is simple and easily verified.
Everything is bundled in tamper evident seals, observed and signed by members of opposing parties, physically escorted by opposing members, etc.
I don't see why this level of security couldn't be used to randomly and deterministically assign crypto keys that are used for some kind of blockchain voting scheme. Put a thousand pre-known keys in a hat, one thousand people draw keys from a hat, the key is activated on the blockchain and points to a user-defined voting wallet. Now you have anonymous cryptographically verifiable voting with double spend protection. Am I missing something?
Might as well just vote then and there
Voting wallets? Assign crypto keys? You mean just like issuing a ballot? How would someone do a recount? An end-to-end audit? Keep track of who was assigned which key (thereby destroying the secret ballot)? Who voted and who didn't? How do you handle provisional ballots? Etc.
PM me once your proposal satisfies the requirements (works as a replacement) for current election administration systems.
Okay, maybe I'm being too dismissive, which I normally hate. But blockchains, crypto, signatures are not magical. Design the whole system, make it auditable while accounting for information leakage, simulate a few real world elections. Do the leg work, unlike Chaum, Rivet, others. THEN we can talk.
"Scantegrity II Municipal Election at Takoma Park: The First E2E Binding Governmental Election with Ballot Privacy"
http://static.usenix.org/event/sec10/tech/full_papers/Carbac...
With the prior Punchscan system, voter privacy is accomplished thru hash collisions. Hiding your ballot in a herd of ballots cast. A trick that works only if your herd (precinct) is large enough and your ballots are simple enough. Definitely would not work (protect voter privacy) in my jurisdiction.
Side note about IRV, as used in Maryland Park: It's now a non-starter. After the handful of well-studied experiments, election administrators are dead set against it. Ballots are complicated, voter education is tough, and IRV necessitates electronic tabulation, which rules out legally required manual recounts. (My jurisdiction often gets over 500k ballots. IRV is not feasible here.)
People lose wads of cash that are valuable to them; they're going to care even less about their electronic verification file.
This is a thing you actively don't want. You don't want to be able to prove to anyone else how you voted. Otherwise it would be absolutely trivial for your boss to say, "So, you voted for that anti-union candidate, right?" (Or your boss to not say that, but just happen to give promotions to people who show proof of voting the way the boss wants.)
The right to a secret ballot is demanded by the Universal Declaration of Human Rights.
Yes, this renders the electronic voting problem - and honestly the voting problem in general - very close to impossible. That's why it's hard.
I just invented a scheme to anonymize votes in 5 minutes. I'm sure if smarter people tried we could definitively solve this. I'm not convinced this is hard as much as people are saying it's hard.
(The other thing is that photos of ballots have only become a serious threat in the last few years, and at the moment there's not really voter coercion through those photos, as far as we know. If it becomes a problem, I expect a bigger crackdown on it.)
Tada!
You need to have deniability; I need to be able to revoke my ability to prove how I voted, and moreover I need to be required to revoke it (otherwise I can be compelled not to revoke it). Right now, I am unable to leave the voting booth with any receipt of how I voted, even if I wanted to (i.e, even if someone else wanted me to). I can see my vote, and election monitors prevent anyone else from seeing it until it leaves my hands. In most places in the US, I can't even take a cell phone photo of my votes, and that's a good thing because nobody can ask me to take a cell phone photo of my votes.
2. If they're pre-known, anonymous, single-use keys, nothing prevents a corrupt election official from keeping a copy of the key and voting before the voter gets home. The voter has no way to prove that they didn't vote and that someone stole their key.
We use this in Mexico, in addition to (non-digital) fingerprint-carrying voter ids. Historically, it has not prevented fraud in general (most of which happened due to insufficient audit procedures and rural polls not having observers from all parties, allowing for stuffed ballots and the like). It did however close that particular attack vector. My trust on the results of an individual polling station in an urban area with observers from all major and most minor parties is actually quite high, even as I know any or all of the observers involved are likely to be corrupt and have low regard for the law. The reason for this is that they are all incentivized to prevent each other from cheating and have the means to detect tampering in such setting (without needing uncommon expertise beyond observation and basic arithmetic).
Here in Romania there were cases when two or more parties agree to cancel the votes for the opposition or even count them as theirs.
We call those "allies".
In most countries parties or volunteer groups nominate their own observers. UN can send their own observers.
Electronic voting is by far most vulnerable. It's not the algorithms, it's all other tings around them and verifying them.
To change the outcome of an paper ballot election you need to have thousands of thousands of people on your side and have everybody keep quite.
Do most people trust the officials? Sure. But any campaign with enough volunteers is able to verify everything.
It's to an extent possible to mount a local attack with paper ballots but its cost is an effort too great that it doesn't scale. You would basically have to get your own people, or paid people, to swap the ballots while nobody else is watching to get the results you want in one election district.
Because ballots need to be saved for recounting the marks on the ballots also need to be sufficiently distinct so that they don't look like they all come from a photocopier. Again, if there seems to be anything fishy, people can and will organise to redo the election locally, this time with different representatives from the parties.
With digital voting, vulnerabilities and malware and automated attacks scale to all systems involved and theoretically a single entity can rewrite the election results of the whole nation. Worse yet, it may not be evident whether the results are skewed or not as it's just digits in a computer and those can be changed without a trace.
Then again, it appears in some countries you can just claim millions of fraudulent votes without any proof without being called out for it.
> No paper ballot in box scheme can do that: anything that is run by officials means that the correctness of the system depends on the officials' word only.
This comparison is flawed, the entire correctness of a electronic scheme could only be verified by a few experts, whereas in every polling place with a paper ballot, there is a committee, and witnesses of the vote count. Proving the correctness of a paper ballot system such as the one described in [1] is trivial.
Ultimately, the correctness doesn't even depends solely on officials: In the course of the day, the polling station officials ask voters whether they want to participate in ballot counting as tellers. Voters can also volunteer to do so ; candidates can nominate tellers as well.
[1] http://www.elections-legislatives.fr/en/system.asp (search for "How are the ballots counted"). The presidential elections protocol is the same as the one described here.