Hacker News Reader

Comment by vowelless | Hacker News Reader

I used to think electronic voting was the logical next step. But now, I think voting is too important to be left to electronics. It should be done on paper.

We trust billions of dollars every day to electronic banking, so why not a vote? Electronic banking comes with many types of federal guarantees to protect against fraud. The government can step in to investigate and prosecute the fraud as well. But there is no such guarantee for the voting to select the government itself!

But it takes so long to aggregate the votes if done with paper ballots. Precisely the point. Electronic voting allows scalable attacks where the number of weak points is dramatically reduced. It is very hard to scale attacks on paper ballots. You would need a coordinated effort in many voting stations to make it work as opposed to hacking a more central electronic system.

That is why I moved from thinking that electronic voting is the logical next step to thinking that we probably need to revert back to paper ballots.

View on HN

Anyone interested in electronic voting, I would suggest reading the article: Internet Voting: A Requiem for the Dream in the last issue of Phrack. It was eye opening for me. http://phrack.org/issues/69/11.html#article

Conclusion:

    1. Internet voting is not compatible with democracy
    2. No amount of technology can change this
    3. Whom you voted for ought to be secret
    4. Who voted should not be secret -- it should be known as widely
       as possible
    5. And who counts the votes, and how, certainly ought not be secret

Here the etherum approach with transactions would solve that. All votes would be public but still anonymous.

Look, I'm not going to say you are wrong, but... not every conversation needs to descend into ham-fisting bitcoins into it. Nowadays, it's like a Godwins' Law type thing, but instead of everything devolving into Nazis, now everything devolves into 'the blockchain will fix it'. I miss Dogecoin, at least they were in on the joke.

Such elections, much votes, wow.

I get the crypto fatigue because I feel it as well, but it really does apply here. Trustless voting is one of the more interesting possible applications of blockchain tech, and if properly implemented it could very well do away with voter fraud.

> voter fraud.

Red Herring. Not counting voter registration fraud, https://www.washingtonpost.com/news/the-fix/wp/2016/12/01/0-... Washington Post only found 4 cases in the 2016 election.

Ha, yeah I was going back and forth between adding "to the extent that it exists". Nonetheless, we can't predict whether fraud/hacking is something we'll need to really worry about in the future. If a good solution exists, we should strive for it I think.

In case you haven't noticed, there are some other countries in this planet beside the United States :P. Voter fraud is a major problem in many developing countries, and electronic voting (if properly implemented) could help tremendously in making elections a great deal more transparent.

That's the point. it can't be properly implemented.

Why do you say that? Is there a proof of non satisfiability for a set of criteria? Or you just decided it can't be done?

Like I said, it isn't wrong, and I kinda agree. Democracy is awesome but slow, we know that. It's also old, and we may have better versions out there now, maybe a Git-Democracy thingy, where it's mostly automated and we have 'code comments' in the laws to help with the judges. I dunno.

That said, bit-coins and their ilk are obvious tulip bubbles now, their hope is gone under the greed. Yes, the ideas are interesting and may have applications that are unseen. But as communism was great in theory and genocides in practice (mostly), I think the relentless blockchain spam is missing the point as well: Theory ain't shit because humans are assholes. And no, the blockchain is not going to solve that too.

No, it's not going to solve people being assholes. But a shared, write-only and unalterable database of voting transactions created by pseudonymous entities could be an extremely useful tool if we really want to safeguard against this kind of thing.

Because of the rhetoric surrounding blockchain spam, it's easy to make the comparison to marxist theory. But I think it's really just a technology, not some grand scheme to alter our economic system. It's more realistic to simply say that it's a tool that could provide some very useful real world applications.

Look, I know, it's cool, and like, it has the potential to help. But trying to tech/math your way into a better democracy isn't very likely because people are assholes; you have to make incentives for the assholery to fight itself, it's not easy. Hofstader in Godel Escher Bach goes WAY into why that is from a math/physics/art/music point of view, you should read it (maybe you have already), it's like 6 bucks. https://www.amazon.com/gp/offer-listing/0465026567/ref=tmm_p...

I'm not confounding bitcoins with marxism and that mess of history. I'm just saying that there are things out there that were good in theory, but the applications of the theory are just plain terrible, marxism is a famous example of that.

>But trying to tech/math your way into a better democracy isn't very likely because people are assholes

That's ridiculous. So we can't do anything, whatsoever, to improve our society and our systems, because eh people are assholes or whatever? That's nonsense. Of course we can improve our systems, our laws, our government, and of course mathematics and technology can help. For example, our voting systems are woeful because they are holdovers from a time when nobody thought about these things from a mathematical point of view (and nobody still does: "let's just vote for people and let the person with the most votes win" sounds perfectly simple and correct for 99% of the population). But we can do much better, and it can objectively improve our democracy a whole lot.

Will applying mathematics and technology to democracy fundamentally change and transcend human nature? Duh, of course not, but nobody claimed it will. There's plenty between implementing an utopia and going nothing at all.

> So we can't do anything, whatsoever, to improve our society and our systems, because eh people are assholes or whatever?

Yes, that is correct. Also, me and Mr. Strawman could use some more hay, do you have any?

> ...and nobody still does...

This is what I'm talking about. Trying to force math/tech onto a democracy/republic where the voting population doesn't understand it cannot end well. The voter will be suspicious, and rightfully so, of the process if they do not understand it. This is especially true if there is any corruption in the system at all. Since we know men are not angels, then the vast majority of voters must have belief in the processes as we all know men do become devils. Democracy demands this faith to work. Yes, we can make the system mathematically better, but if that comes at the cost of the faith in democracy, then it's mute. Even with the system we have now, simple as it is, there is already a large lack of faith in it by a lot of the US, and this is already a threat to idea of self-determination.

Only by introducing hundreds of extra failure modes. If you implement this I can now destroy your democracy by:

- Bribing voters because you've implemented voting over the network

- Once you figure out you need to switch to voting booths I'll do timing attacks to deanonymize the vote

- As soon as you have a count I'll seed distrust in the count as only a very small percentage of the population actually understands the blockchain and cause a riot or two

Electronic voting is the reverse FizzBuzz. FizzBuzz tests if you know the absolute basics about technology to implement something extremely simple. Electronic voting tests if you are able to reject the use of technology when it doesn't add any advantage and instead creates very hard to solve failure modes. Voting benefits from the use of the extremely simple ballot and box. It benefits from it not being programmable and from the counting method being something that almost all the population is able to carry out let alone understand.

Big barrier: Convince voters that the system is reliable in theory and perfectly implemented.

Paper works fine.

But... if he's not wrong and it is actually relevant to the discussion why are you upset about it? Is he supposed to refrain from mentioning it because... it's been popular for the past few weeks and so you're tired of hearing about it?

I dunno. The constant barrage of: "BlockChains, but for Cancer!" just seems ... derivative now. Like the 'Uber, but for dogs' was this time last year. Everyone knows these hacker-coins are a scam, the last one with them looses their shirt. Yeah, the ideas are kinda cool, but, nah man. Like, from Mean Girls: "Gretchen, stop trying to make 'Fetch' happen, it's not gonna happen"

https://www.youtube.com/watch?v=Pubd-spHN-0

Wouldn't most current block-chains tie a rather fine (say 5-minute, accounting for drift) timestamp to each vote? So in small voting districts, if you had a way to know approximately when people voted, you could go a long way towards de-anonymizing votes (say, you managed to track someone's device, that they used for voting, or track their location, if using dedicated voting machines)?

I don't know if it would be inherit to making a secure voting system on a block-chain that you had such (unnecessary for voting) fine-grained timestamps, but just a thought.

Electronic voting != internet voting. Remote voting has irresolvable problems in regards to voter secrecy: you can't preserve that with remote voting, and it's indispensable to ensure you don't sell your vote.

But that is not synonym with electronic voting. You can go into a polling station and vote on machines; a well designed system shares all vital properties of paper systems while adding many useful features, including ways to reliably count votes algorithmically in an independently verifiable way (any citizen can do the math and check the results, and check that each person only voted once, even though they can't tell who voted for whom).

Don't say it's impossible, with a bit of ingenuity and a bit of mathematics it can be done. :P

EDIT: For more info read https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy.... It's fascinating.

It's impossible to have an electronically mediated voting system that both protects the secret ballot and ensures the public count. Because there is no digital equivalent to the one-way hash of dropping a ballot into a ballot box.

Chaum, Rivest, Pret a Whatever... Fine. Prove it. With a real world election (simulated). Burden of proof lies with the technophiles, not with the proud defenders of Democracy.

People used to say the same thing about digital currencies (think: Beenz.com https://en.wikipedia.org/wiki/Beenz.com ) - because digital information can be copied freely, therefore a digital currency would need a central arbiter and a distributed digital currency would be impossible. And then BitCoin and the blockchain happened.

To say Internet voting is impossible is to admit a failure of imagination and ingenuity - I'm confident that some novel application of cryptographic and distributed-computing techniques could come up with a secure system.

But I'm wary of how complicated it would necessarily be to the average voter, or even someone with an advanced knowledge of computing - concepts like hashing and the blockchain are almost impossible to correctly explain to a layperson, let alone do they have the way to be confident of the results themselves - it would immediately cast doubt on the system because you cannot trust something that you cannot understand.

Ah, thank you for the reminder.

Moratorium on blockchain-based voting system proposals.

There's a big difference between claiming there is no current technology to do this (which I agree with), and claiming it is impossible for there to ever be any in the future.

> Because there is no digital equivalent to the one-way hash of dropping a ballot into a ballot box.

This is equivalent to preventing double-spending in the blockchain analogy - a solved problem. There are already companies trying to exploit this to develop electronic-voting systems: https://followmyvote.com/.

I imagine it working like this:

1. Government announces an election. Registered voters are asked to submit the public addresses of their 'vote wallets'. The public addresses of the wallets are derived from the registered voter's public information (e.g. their name). This information need not be secret. The public blockchain would ensure that everyone who is registered received their votes to cast: the equivalent of receiving an empty ballot paper.

2. A Monero-like system (confession: I don't fully understand it yet) acting as a blackbox or Bitcoin-tumbler system then distributes empty-ballots from the public wallets into new private wallets that each registered-voter will have created in an anonymous fashion.

3. Registered voters then cast their votes by 'spending' their ballots (coins) by sending them to the public wallets of electoral candidates. These transactions may be cryptographically signed by a private key derived from the registered-voter's public wallet. This allows a voter to verify that their vote was correctly cast, without allowing others to see whom they actually voted for.

4. There is a problem in that the results of the election cannot be kept secret until the election is over, as the blockchain must be distributed publicly, so observers will see the votes going towards a particular candidate as-they-happen, which will necessarily change voters' votes in cases of tactical-voting; though possible solutions exist, such as having blockchain network nodes agree to only allow final vote transactions during a tiny time window of only a few seconds - or a Proof-of-Work system that will necessarily take more computation time to verify a vote was for a particular candidate the more in-advance of the polls-closing deadline the vote was made.

Because votes cannot be 'mined', and all originate from a single 'government wallet' it means that votes cannot be manufactured - as far as I can tell the only weakness is that false voter-registrations could exist and be used to cast votes, but then we have that situation with postal-voting now any way. If a tumbler approach is used to distribute ballots from public wallets to private wallets it's possible for participants to create more than one private wallet, and claim more ballots for themselves - but this can be detected by:

1. As part of step 1 above, voters create a private secret K.

2. Each voter then creates a hash of K, known as K'.

3. The blockchain would also contain a Bloom-filter, or equivalent implementation of a "Set contains a member" test that does not reveal the actual set contents. Then a strictly sequential process begins, where the Bloom-filter is publicly modified by each registered voter to add their own K' values - this necessarily means that the K' values of the first voters will be publicly known entirely, but as the table becomes more populated it will be impossible to fully know what the entire values of each K' value is. This can be mitigated by having the system create known 'sacrificial' / dummy voters to provide some initial protection for the first actual voters.

4. When the private wallets are created by each voter (in step 2 above) they must be tagged with the K values each voter created as Kp. A private wallet will only be able to participate in the ballot distribution process if the hash of its Kp value (Kp') appears in the Bloom filter populated in the previous step) - thus restricting each voter to only 1 private ballot wallet.

re #4,

Right to voter privacy (secret ballot) is in my state's constitution.

I'm open to relaxing absolute privacy with something like temporary time boxed privacy. Like until an election is certified.

This has been solved, and it's really simple actually.

I wrote about it in another comment, but I'll quickly go over the technology here as well.

When a citizen votes, the vote is encrypted with the government public key. The vote is then put into a container and is signed with the citizens private key.

The vote gets sent to the voting-system servers and is then stored until counting day.

Once the voting period has ended the encrypted votes are pulled out of the signed containers and the signed containers themselves are destroyed, this anonymizes the votes. Only then are the encrypted votes decrypted with the government private key.

We keep the signed containers around the encrypted vote to make sure no-one can be forced to e-vote. Every citizen can vote as many times as they want during the e-voting period and only the last vote counts.

So if someone is standing behind you and telling you to vote somehow, you can do as they say and just vote again afterwards.

As an extra backup, if you do cast your vote on paper as well, then the paper vote is counted and the e-vote is discarded.

The system has a prerequisite though, each citizen must have a private key. We do, as it's stored on our id-cards(equivalent to passports within the EU).

Procedures are in place to protect the Government private key during the voting period and just like with paper-voting observers are involved in every step of the process.

The English documentation is scarce, but the software itself is open source: https://github.com/vvk-ehk/evalimine

Ah. Opened that link. Stopped once I saw "Estonia internet voting"

https://en.wikipedia.org/wiki/Electronic_voting_in_Estonia#C...

That one, yes :)

Their whole analysis is based on this claim: "claiming they could be able to breach the system, change votes and vote totals, and erase any evidence of their actions if they could install malware on the election servers."

That is true for all server based software.

Procedures have been set up to mitigate this risk. All software, servers and anything else running in the network is audited before, during and after the election. The whole process is public and anyone can become an observer, just like with paper ballots. There really are many eyeballs making sure the election servers are running the software they are supposed to.

AFAIK everything else they pointed out was purely procedural and the guidelines there have been updated. There really weren't any reproducible technical issues and some of the procedural ones are outright misrepresentations.

The full sources for these two are sadly in Estonian, but the main response to that research can be seen here in English: http://www.vvk.ee/uudised/vabariigi-valimiskomisjoni-vastula...

""" Posted Wi-Fi credentials — The official video of the pre-election process reveals credentials for the election officials’ Wi-Fi network, which are posted on the wall. """

The credentials were actually just for a separate public guest network, that has nothing to do with the "election officials network" or the network where the voting servers are.

or: """ Keystrokes reveal root passwords — Videos posted by officials during the election show operators typing, inadvertently revealing root passwords for election servers. """

Although this was recognized as a possible attack vector and the procedures for filming have been updated, the "operator" typing a password was actually one of the observers typing a password in their own computer.

Obviously any hints to compromised processes are taken with 100% seriousness and if needed processes and guidelines are changed to protect the integrity of the system.

Any technical reports are also (publicly) analyzed and if an issue is indeed found, they're fixed. The thing is, "https://estoniaevoting.org" said everything is bad, and the system should not be used, but never published/provided any re-producible test-cases that could be verified.

OSCE has audited all of our elections, they've given some procedural pointers that have been implemented, but OSCE observers have not deemed our elections compromised.

This is their 2011 audit: http://www.osce.org/odihr/77557?download=true, the pointers given to improve our system have been implemented by now.

And here is their 2015 audit: http://www.osce.org/odihr/elections/estonia/160131?download=..., which has some new pointers, but again has not deemed the system to be insecure.

We're having another parlamentary election in 2019 and again, the system will be improved for that(more verification methods are being implemented), but so far, all of our elections have been deemed acceptable and work is being done to keep the track record.

The Estonian method is too complex to be easily proved to be secure. You have to play a cat-and-mouse game ad infinitum to keep up its integrity. Simpler systems are less costly over the short and long term, and more secure by default.

Could you give me an example of what makes it too complex and maybe an example of a system that is simpler?

https://www.quaxio.com/simple_auditable_anonymous_voting_sch... explains how to create a toy voting system which both preserves privacy and where everyone can tally the votes.

If you were to actually build something like this, you would use blind signature. But having this toy example shows that the two concepts aren't exclusif.

All crypto schemes I studied rely on hash collisions. Meaning your ballot is hidden within a herd of ballots. This works for hypothetical elections where there are lots of voters and simple ballots.

Alas. Our actual elections are administered per precinct (say 0 - 1000 voters) and have complicated ballots (dozens of issues, races). Meaning your utterly unique ballot is unlikely to collide with any other cast ballot.

The blockchain-based schemes I briefly studied rely on fuzzing timestamps. A different kind of collision.

Here's the takeaway: Our elections administration is finely tuned to the Australian Ballot. Any new voting system has to specify the style of ballot, which circumstances are applicable, and how the laws, rules, and procedures will have to be modified to adopt it.

Did you even read the link I posted? It's a voting scheme which is anonymous and auditable. It can be turned into a usable system using blind signatures. Nowhere does it mention hash collisions.

You're right. I didn't bother. I just now went back and parsed it.

You're right. No hash collision (shuffle) in that arm waving proposal. So there's no attempt to anonymize the voter's identity.

Votes cast and recorded in order deanonymize the ballots. If the order is not recorded then the election cannot be audited.

As I hinted (elsewhere), the blockchain proposals fudge the timestamp (when the ballot is cast) in an attempt to anonymize the voter.

Estonian reporting in.

Our internet voting system has solved this problem. The votes secrecy is guaranteed by allowing citizens to vote multiple times and only the last vote is counted. No-one is obligated to vote on the internet and a paper system works in parallel. If you cast your vote on the internet AND with a paper ballot as well, the paper ballot is counted.

This guarantees no-one can be forced to vote, as they can simply vote again in the 7 day e-voting period.

Each vote is encrypted and signed, but in two different containers. The goverment public key is used to encrypt the vote. That container is then wrapped into another that is signed with the citizens private key. Before counting, the double-casts are filtered out and the votes are anonymized by removing the signed wrapper.

And, it's open source: https://github.com/vvk-ehk/evalimine

If you can vote online, and on paper, and the paper one always trumps the electronic one, then a fraudulent party would just fake the paper ballots and send them in for everyone in the country. Everyone who depended on the electronic vote would then no longer control their vote.

the same can be said for the paper ballots that are never used. Voter turnout is never 100%.

As an example faking even 10% of the abstained votes would have swayed the brexit results.

I don't see how this makes online voting insecure, fake paper ballot risk has always been there and has been deemed to be a mitigated risk.

Tom Scott has a very educational video[0] on why electronic voting is a really bad idea.

[0]: https://www.youtube.com/watch?v=w3_0x6oaDmI

>But it takes so long to aggregate the votes if done with paper ballots.

This one was alway wierd to me. Other countries always manage to count the votes in one night, and while the USA is very big, you'd think there would be that many more people counting the ballots available to make up for it. I guess it doesn't scale that easily.

Maybe the (low) number of voting locations is a problem?

Around here, it's recommended to have a polling location for every 800~1000 voter and a booth per ~300 voters.

When the polling location closes, staff (volunteers) start counting very publicly: anyone can watch and the procedure is legally specified such that overseers can trivially keep track and count of everything, the results are certified, displayed at the polling location and (if necessary e.g. for non-local elections) sent up to the next administrative division.

Unless there are improprieties, it doesn't take very long to count a thousand votes.

Bingo.

Too few voting places, and voting days are not holidays (or on sundays) like in other countries. There are very obvious steps that could be taken to solve both counting time and voter turnout as well as suppression.

> There are very obvious steps that could be taken to solve both counting time and voter turnout as well as suppression.

But when the party in power counts on that low turnout due to suppression in order to remain in power, do you really think they will do anything about it during their time in power?

As a UK citizen, some of the voting practices I see in the US seem really mind-boggling:

- Not enough polling stations

- Long lines as the norm in many places

- Polling stations closing early -- I've seen 8pm

- Exit polls released before voting closes

I guess these are generally due to the US being a large country spanning several time zones, with low population density. But they seem fixable, especially if you care enough about the integrity of the vote to commit enough staff and money to the process.

Given the ridiculous amount of money that gets ploughed into campaigning in the US, it seems bizarre that you can't spare a fraction of that to improve the process. But it seems like what little money is available is captured by hucksters selling electronic voting machines.

(Not that the UK system is perfect! Our voting system is pretty bad. Both countries could really use PR.)

The simple explanation is that those things are often done with purpose.

Lack of resources can also be an issue, voting is generally administered at the county level and state/federal funding is pretty limited.

Yeah, the targeted voter suppression is terrifying (and apparently legal! But hopefully that can be remedied in the courts. The recent progress on gerrymandering seems promising.)

Anecdote: the small city I used to live in once scheduled polls on the same weekend night as three popular local sports events. Can any system work with arbitrarily rotten politicians?

That voting is a regular workday seems unworthy of a democracy.

The UK votes on a weekday too! Though I think it's the combination of weekday voting and short polling station hours that's bad.

Weekend voting would feel weird to me, but you're probably right that it's better.

I feel like weekend voting would help for those who work "regular 9-5 jobs" but those who are young, and say still in college/university and working weekends, would now have a more difficult time voting. The weekend type jobs usually won't let you have time off to vote, they schedule you that time because they're busy, so it might be much more difficult for those people.

At least the weekday election day somewhat levels the playing field, at least as I see it.

Why not leave the polls open for multiple days then?

Texas has early voting for about two weeks prior to poll day, which makes voting convenient. That said, the recent attempts at voter suppression and gerrymandering abuse are saddening.

Why not just make it a public holiday? Maybe even offer some cheap food at each venue.

I'd go beyond that even. The US loves pageantry and celebrating freedom. But what event could be more appropriate for a celebration of freedom than voting day itself?

You could have small festivals at every voting booth to encourage people to come out to vote, and you could even move the ballot boxes as part of a big parade so there's absolutely no doubt in the process.

Indeed. Not very long ago, the BBC ran a story entitled "Why are elections in the UK held on Thursdays?":

http://www.bbc.co.uk/news/av/uk-england-hampshire-39795769/w...

In Australia we vote on Saturdays. That seems to work ok.

It works very well. We also have a basically-no-questions-asked early voting for a couple of weeks. Nominally it's intended for if you're preoccupied (overseas, working, etc.) on voting day but in practice people use it to dodge the lines.

That said, we also have so many voting booths (I have never not been able to walk to my closest - usually only about 1km away) that the worst line I've ever waited in was probably 10 minutes.

Arguably, this is just another form of "legal" voter suppression.

An employer cannot legally fire a person for taking time off to vote, or to attend jury duty. That doesn't mean they don't, it just means they can't do so legally.

But if you are someone who depends on that job (such that you can't just go out and find another), losing that job because you voted is something you're going to weigh, and regardless of how you vote (though typically - at least historically, notwithstanding our last election - those on the lower-end of the economic scale vote for Democrats), you are more likely to want to keep your job to pay for rent and food, than to vote.

Furthermore, even if your principles matter more to you than your job, if you do get fired, you aren't likely to then go thru the process of taking your former employer to court for firing you (because that would mean more time and expense away from finding another job).

Heck - the employer may not even need to break any laws, just make implicit threats as to what will happen should an employee take time off without consent of the employer, while neglecting to tell the employee about their voting rights (and nobody reads those employee rights posters in the breakroom either). Even though such threats aren't arguably legal either, nobody is going to fight against them because again - that means loss of job and money to pay rent.

I've volunteered to count votes before. It's finished within an hour of the polls closing.

Vote count could also be optimised with machines. Each party can bring it's own OCR machine to count the votes. If there is a disagreement, fallback on humans.

The issue is with having a single machine that we have to trust end-to-end.

> Each party can bring it's own OCR machine to count the votes.

There are 5 digits voting precincts in the US, give or take.

It would not need to be done for each poll place or precinct. Each party could pick high population or high risk precincts.

I think a larger issue is proving that the machine's the parties brought are not tampering with the ballots.

Would you be okay with Republicans targeting largely black polling places ?

Why wouldn't I be? They are just performing another count.

If one party brought machines to a poll place and managed to make trouble it is likely that the other party will show up too. Eventually it would just be part of the political landscape and the results would be better vetting all around.

Do Diebold machines still cost 3k a pop[1]? You can get 3 high-end scanners at that price. And generally more than one Diebold would be deployed per location right?

Let's say the scanner costs $500 and there are 9999 locations. That's 50M of investment per party that can be re-used. It's a lot of money but it's an order of magnitude less than their campaign cost[2]

[1]: https://www.wired.com/2008/04/the-cost-of-e-v/

[2]: https://www.opensecrets.org/overview/

Will this be mandatory for parties? Should the green party be forced to bring their own scanners?

Why would it be mandatory? It's a way to let parties assure themselves that the votes were counted by a trustworthy method. If they're already satisfied that that's true, then nobody can conceivably benefit by having them bring their own machines.

Even in this case you still have vulnerabilities in the two party's machines. Just because they have different interests doesn't mean that they'll apply strength to their machine's defenses, or even have the ability to stop the attacks on their machines assuming they were 100% committed to following correct procedure.

> But it takes so long to aggregate the votes if done with paper ballots.

This is also why the complaints of government being slow to respond to things are hollow: It's meant to act that way.

Which is why Trump and his "Executive Orders" are problematic; that isn't to say they are problematic for previous administrations as well. At any rate, they exist for a certain purpose, but that freedom to use them has been abused pretty much from day one of their existence.

Arguably, they are there mainly for emergency purposes, when something needs to be done fairly quickly, but is something that would take too long to have done thru ordinary channels (Congress, etc). It was probably (wrongly) assumed that Presidents would be wise and restrictive about their use (completely ignoring how human nature works of course).

I only mention Trump because he jumped into using them almost before he was sworn in; but so far (from what I understand) he has yet to break any records for usage of them during a term (except for maybe speed). In fact, the record actually belongs to FDR (who had 4 terms, also WW2, so that might be a part of everything).

In an emergency, I can understand their use, but outside of that, we (everyone, including the President) should trust in the slow plodding of our system. It may not be perfect or work out perfectly every time, but its lack of speed gives us time to reflect and make better decisions, IMHO.

Electronic voting is fine (WITH a paper trail)

You just need regulation to prevent the abysmal idiocy of manufacturers

Also standardize the interface (ADA compliant, etc)

Hire the Nevada Gaming Commission to regulate it and so be it. Make the machine print a paper backup that is put on a ballot box as well

But is there any advantage to e-voting?

Assuming that we can achieve exactly equal security to paper voting for a moment, what have we achieved other than adding another few layers of middlemen and cost?

Arguably you could only count the paper ballots in case of litigation, otherwise you'd just use the result of the machine. Sounds like a decent compromise.

That being said here in France polling stations manage to count the ballots in a couple of hours at most after closing, so I'm not sure if it's really worth it.

> what have we achieved other than adding another few layers of middlemen and cost?

and uncertainty. In principle the idea of hitting a button and having the non-networked machine spit out a paper trail that can be electronically counted sounds like a good compromise. But this leaves 1 or potentially 2 sources of uncertainty that are not necessary: (1) that what the machine prints actually corresponds to what you wanted and (2) that the counting machine actually counts what it says on the paper.

(1) is not such a risk if you can verify it visually before submitting. There do exist I believe some ideas in cryptography to allow you carry a record of your vote that allows you to verify it without revealing the choice, these could have interesting application here, but I don't know the pros and cons.

(2) is even a risk in the non-machine case, although it can be mitigated by having multiple independent parties do the count. But it can't easily be done by machine and have the same level of certainty.

e-voting enables more sophisticated voting methods, such as [Range Voting](https://en.wikipedia.org/wiki/Range_voting).

Range voting is arguably more democratic than some other voting methods. But much more complicated to put in place with paper ballots :/.

There's a fundamental issue in voting, which is that ballot markings may not have a consistent meaning from voter to voter. Most analysis of voting methods ignore this and it's impacts, which are difficult to quantify, but it's pretty clear the effect is maximized in two cases:

(1) systems which limit rankings to a fixed number (the most extreme case for real ballot methods being two) of ranks (approval and FPTP both are two-ranks methods), and

(2) system which use numerical ranking systems that draw fiber distinctions than mere ordinal ranking (range/score voting being the main example.)

The problem is minimized in ranked-ballots methods, though there is room for debate over whether forced or unforced rankings are better in this regard.

For this reason, I would reject range voting for most public elections independent of practical difficulty (there might be exceptional cases where a consistent meaning can be attached to range ballots, but it's not the case in normal public elections.)

OTOH, ranked ballots Condorcet methods which need to compare pairwise results are probably more tractable with e-voting (or, rather, e-tallying.)

Basyesian Regret calculations show Range Voting to be superior, even when accounting for your objections.

http://scorevoting.net/BayRegsFig.html

There's even a theorem that it tends to elect Condorcet winners under plausible models of voter strategy.

http://scorevoting.net/AppCW

Believe me, its advocates have heard every criticism you can imagine, and the counter-argument is robust. I recommend you check out the book "Gaming the Vote".

The US moved to electronic voting in part due to the Florida vote counting fiascos in 2000. Electronic voting machines prevent users from making undervotes and overvotes (picking no candidates, picking more than one candidate). The machines also prevent the hanging chad issue in 2000 where the voters intention was unclear. Electronic voting machines also enable blind voters to cast votes without assistance giving them privacy and assurance that their vote wasn't tampered with. Paper voting can also have it's own security weaknesses like ballot stuffing.

So you're saying add a paper trail which would need to be counted to be verified?

Doesn't that just make it more expensive than paper ballots?

The paper trail would be used for post-election verification. A nonpartisan body randomly selects several districts in the state every election and audits the paper record versus the electronic record. If there is a discrepancy, then an investigation is started and all of the records are verified.

This gets you the speed and ADA compliance of the machines, but the reliability of paper.

This commission also helps to insure that there was no funny business at the aggregation center.

I think "non-partisan" is just code for "not partisan yet". The parties get huge sway in shaping the voting district, why would this body be different? Could it stay different going forward and different parties attack it for different reasons?

There needs to be more than this.

Preventing idiocy. I wish such a thing were possible. I am sure that you have heard: If you make something foolproof, they will make a better fool.

Voting in Canada, the ballots are paper, then you carry it over to a person who puts it face down into what looks like a flatbed scanner and hands it back to you, and you put it into a box.

I am assuming they count electronically, still maintain secrecy, and have a paper trail that can be manually counted if needed.

>Hire the NGC

Actually this could work. Defcon this year was at Caesar's palace and despite a voting machine, a couple cars, multiple IoT devices, an electric scooter, and the Beijing Noodle's menu being pwned, nobody managed (dared?) to fuck with any one of the thousands of electronic slot machines.

People do do that; this is pretty well known. But they tend to view it more in the vein of "trade secrets" than "I'm going to demo this to everyone for free".

Totally agree with you, I do not understand this need to go digital. Voting has worked and works really well with paper, it's a process anyone can audit, even non-technical people. Sure it might take a day, and a bunch of money, but so what? Our democracy heavily relies on this process.

In theory, I don't mind digital voting. I do mind network connectivity and closed source machines.

Even if the machines were open source you'd have to personally inspect it to make sure it's actually running what it's supposed to be running. Unless you're reading to bring an electron microscope to the polling booth it doesn't seem particularly practical.

It would make more sense to check whether your vote was counted post-facto but it's hard to especially if you still want to make it difficult to figure out who voted for whom. There are a few mathematical possibilities but they don't seem particularly practical to me: https://www.youtube.com/watch?v=BYRTvoZ3Rho

So for the time being paper ballots are probably the way to go.

Gives you a paper result that you can verify, and leave there for manual recounts as needed. Checksums and verified hardware. This is not insurmountable.

You vote, confirm the receipt says the right thing, and stuff it in a box. Verified hardware is a solved problem. Given that it'd have no idea of the candidates, there's no way to program it ahead of time to favor a candidate without being caught.

We already have election officials watching each other. This needn't be more complicated than a late 70s calculator. It can even be so simple it doesn't know the candidates names or party affiliations.

Well, in theory... In reality, it will be a black box, connected to any open wireless, and made by the company who donated the most. But, in theory, it'd not be too hard to make a fairly dumb device that provides verification. It only has to count and print.

You haven't solved the problem that being able to prove to anyone else who you voted for should not be possible.

If there's a discrepancy, you count the paper receipts. You can order a million simple chips for like $0.03. They chip vendor isn't going to know who is running for dog catcher in 2018. You test a random sample to ensure they can count. You use simple code that is open source and write it to the memory exactly once and blow the fuse to prevent tampering.

We can put people in space. Verified hardware and software is a solved problem. Well, assuming you don't make it absurdly complicated. All it needs to do is eliminate manual counting - while providing a paper printout should someone need a recount.

You don't even need special tokens to make sure the person in the booth is only voting once. You can be as simple as making it flash an LED to be monitored by the election officials. They have volunteers from the various parties already there watching. Watching a light may even be easier.

It doesn't need to be complicated. It need only be a glorified abacus.

Did you reply to the wrong person? My comment was about one simple thing: It should NOT be possible to prove to anyone else who you voted for. Your reply doesn't seem to address that.

Separate from that, what does using millions of one-use physically collected chips buy you that just writing to a paper ballot doesn't?

You put your printout in the box, as I said above. It prints it out, you put it into the box after confirming it says you voted for who you said you voted for.

You buy millions of chips so that we never have to go through this again. This way, the validated code and hardware don't have to be worried about, for a long time. The chips go in the machine, they run it. You'll have spares for a very long time.

What does this do? When the polls close, they don't have to count them. They need only count if there's a demand to do so, like a recount today. That's it. Problem solved.

Oh, so you're in favor of electronic voting for instant results plus a write-only auditable paper trail. That's what I favor too. I didn't quite understand what you were getting at the first time; sorry about that.

>Gives you a paper result that you can verify, and leave there for manual recounts as needed.

That's fair. I guess you could also force a recount for a random portion of the polling stations to detect anything fishy. I'm not sure if it'd be really worth it though, would it be such a massive improvement over simply counting paper ballots directly?

>Checksums and verified hardware.

Nah, that won't work. Who checks that? Who makes sure nobody tampers with the hardware after it's been verified? How can you even verify a piece of hardware, it could tell you it's running code X when really it runs code Y, no amount of checksumming will help. You could easily backdoor a processor to run a special ROM instead of the official one. Good luck detecting that.

Are we supposed to send electronic engineers at every poling station to check for any tampering with the hardware? How about people making copies of the chips that look exactly the same from the outside but are backdoored? You can't just trust whatever is printed on the package.

So what do you do? Take a random sample of machines during every election and decap all the chips to look for something abnormal?

IMO it's just too much hassle for very little benefit.

Take a random sample of machines and compare a number of pretend-votes to the outcome. But if cars change their behavior based on detecting a test environment, how would you trust a voting machine to not do something similar?

In the end a trusted minor miscount would be less bad than a count that is widely untrusted despite being correct: one would mean living through a "what if some people would have cast a different vote" alternative reality, the other would be a full blown legitimacy crisis, with unconstrained cheating in the next election as the least bad of all possible outcome.

Just stick to paper ballots.

In Oregon we're 100% mail-in paper ballots. I've come around to this idea too, especially after seeing some of the processing operations. Bulk counting in managed/secure facilities, along with secure storage of archival votes, seems like the way to go.

Do you know how they protect votes against being destroyed, either on the way or by an insider, and allow enough transparency to verify this hasn't happened?

and how do they deal with "Granny Farming" goinmg to old people homes and "helping" them with their ballots

In general, the way to avoid this problem is for everyone to be vigilant and work together to keep the process fair. Blow the whistle if you see anything shady going on. To make a big change to the results, you need a big conspiracy, and the bigger the conspiracy the easier it is to spot.

When the process is simple and low-tech, like pen and paper ballots, it's possible for all ordinary people to contribute to keeping the process fair.

With electronic voting, you just have to trust the manufacturers and the voting officials. Everybody else is out of the loop.

This does away with one of the key characteristics of the vote, not being able to demonstrate to someone else who you voted for. This makes it easy to coerce/buy votes in Oregon. If you don't want this property in your voting system (and you definitely should) doing Internet voting can actually be a safer solution in plenty of ways although it's still extremely tricky to implement properly. And I'm strongly against any form of electronic voting.

Doesn't pretty much any kind of mail-in option* already have that limitation, and don't most jurisdictions already have some kind of mail-in option?

*(maybe not ones where you actually have to product a documented reason why you can't vote in person)

Oregon does 100% mail-in. In most other places it's only used by a very small proportion of the population if it exists at all. But yes, any time you enable mail-in you've thrown away a big guarantee of a voting system.

It does not take long to aggregate votes using paper ballots. I was counting paper ballots in a national election, and we were done before 11 PM the same day.

In the UK some constituencies compete to be the fastest 48 mins after the close of polls

I've always found it bizarre that nobody questions this behaviour - where is the discussion of accuracy?

You can start counting during the election. So, counting the last hundred or so ballets in ~1hour gives plenty of time for accuracy.

> You can start counting during the election.

That seems very odd. Can you actually do that? Around here the polling location must first ensure that the number of votes cast matches the number of votes recorded during voting, only after that can they open the urns and start tallying.

The UK throws body's at the problem. But, in theory you can have say 2 hour windows keeping track of the voters and start counting that.

Not in the UK you can't. All boxes are sealed until "the count" which only starts after the election has ended.

Sure, not in the UK, but the US for example starts early. There is also little reason to wait to count absentee ballots.

PS: Saying you need to change the law when that must happen with any significant change anyway is kind of a minor hurdle.

What would you question about it?

There are normally multiple observers from all parties, plus election officials, that scrutinize the counting process in real-time. Disputes are raised and resolved on the spot where possible, and it not are normally escalated. This is why elections can have provisional results on the same day/night, and the official results are a few days later.

I thought it was obvious the speed is essentially irrelevant to the democratic process in the context of minutes to count.

The extent of the competition over seconds and minutes here is bound to lead to some mistkaes, and I would question whether the checks are sufficient (the checks themselves may also be susceptible to mistkaes). The word "childish" comes to mind. We are talking about the future of the country and it's treated like a TV reality/quiz show.

Ballots are split in batches. Each ballot in a batch is counted twice, by two different people, and results are then compared. If the counts don't match, the batch is recounted.

End to End Verifiable Voting, from Ron Rivest (the R in RSA):

https://www.youtube.com/watch?v=BYRTvoZ3Rho

>Electronic banking comes with many types of federal guarantees to protect against fraud. The government can step in to investigate and prosecute the fraud as well. But there is no such guarantee for the voting to select the government itself!

That's only because the government hasn't bothered to invest in electronic voting security, regulations, and rigor to the extend that they invested in fraud protection and financial regulations. I'm willing to be that if the government cared more about modernizing, securing, and distributing our voting systems, we'd see improvement on the level of electronic banking and finance.

Not that I expect this to happen anytime soon. For various reasons, voting rights and opportunities in the US are steadily declining and don't seem to be taken seriously. You can fill in the blanks yourself there.

I think a hybrid solution makes the most sense.

Each voting machine tallies votes and prints out a filled-in paper ballot. Then you get quick electronic counting but with an auditable trail.

We already have the reverse and it works better. You fill out a paper ballot. You feed the ballot into an optical tallying machine. The tallying machine is just an efficiency measure. The paper ballot is the record of the vote. It can be audited statistically and/or manually.

I'm going to disagree that that is a clear win over my idea.

There are definitely issues with printing paper ballots (low toner, running out of supplies at polling locations, handling cases where the voter discovers an error after printing &c.), but similarly there are problems with optical tallying machines (e.g. hanging chads, incompletely filled in bubbles).

Optical machines do not have chads. Those are "punch card" machines. The low toner comment doesn't make any sense. The ballots are printed BEFORE the election. If you get a ballot that you can't read, you can return it to the pollster, they will mark the ballot as "unusable" and give you another. I know this because I've done this when I accidentally filled in the wrong circle. It's SOP.

Incompletely filled-in bubbles is a real problem, true, but in my experience I've never seen this.

Also, you can teach nearly anyone to be a scrutineer. Good luck teaching a layman to audit voting machine source code.

Reply on news.ycombinator.com