Norway tightens IT security to prevent ballot tampering

Millions of ballots.

You can go further. Australia has independent electoral commissions which run the elections. Voting is compulsory and preferential. The entire process is overseen by scrutineers -- individuals appointed by candidates -- so there are always multiple mutually-suspicious observers in the room. Many of the most subversible steps in the voting process, for example replacing a ballot box that is full, have to be cross-signed by an electoral official and at least two scrutineers appointed by different candidates.

A hand count is performed three times, again under the supervision of scrutineers.

If there is a arithmetical doubt about the outcome of the election, it can be voided and is re-run from scratch. This has actually happened once when several ballot boxes for the Western Australian senators were lost during a federal election. It was very unlikely, but possible, that those votes could have changed the outcome of the final senate position.

The High Court voided the entire Senate election and it was redone.

Elections must be trustworthy. Cumbersome, people-intensive systems are paradoxically better at this. The odds that a malicious attacker could replace millions of hand-written ballots, subvert hundreds of independent professionals, subvert thousands of independent volunteers, subvert thousands of mutually-hostile scrutineers and also fool thousands of journalists is low.

I would say substantially lower than the odds for being able to subvert a single programmer or sysadmin.

If governments were actually serious about electronic voting, they need dedicated committees and bureaucratic entities whose sole responsibility is the maintenance and security of these systems.

I expect the United State to be absolutely crippled by cyber-warfare in the coming decades. On a state level, our government is simply incapable of recognizing the many vulnerabilities their systems have and compensating for them.

While personally I think electronic voting is a trash idea (couldn't we instead still vote via paper, and then read the results via ML? This would give us a "margin of error" of votes, but we would always have the paper ballots to fall back on), I think that tightening IT security is a good thing for governments to do. Especially considering just how poor computer security is for government entities.

[1]. Just want to mention I'm not a security guru. This is just my interpretation after visiting many government websites, reading stories, etc

The problem is this: we don't have any machine that simplifies vote counting while being as trustworthy as having many people count marks on many sheets of paper. And since that is prone to errors and manipulation as well, so the bar is actually much lower than "perfection".

Can we really not do trustworthy vote counting better than humans? Can we not make a computer that defeats a human at reliable counting? If we cannot do that, we should reconsider our craft and wonder why. I am not enough of a computer scientist to come up with a good verification plan, but I'd be very surprised if we couldn't do it.

Gullible or corrupt government officials, sneaky sales people and shady politicians are a very different problem. Our job should be to make the machine so good and reliable that these people are driven out of the game.

(sidenote: direct democracies aren't always pleasant..)

All digital makes me nervous.

Like are we gonna read about the U.S. power grid being shut down, or an entire state / nation wide election tampering?

It's absolutely terrifying how incompetent these folks are. Why is there no one marketing their skills to governments who have actual skills? Why aren't governments hiring employees with actual skills?

We used to have the most talented structural, mechanical, and industrial engineers in government positions or as government contractors. Is tech simply too young for that to have happened yet? Or are governments failing to adequately respond to their massive skills' gaps?

Yes, rather than "recounting" votes on the same/similar machine - you now need a large conspiracy for large scale election fraud, rather than a single software exploit...

Microsoft taking a page from Google, how quaint.

You receive an election card (valgkort) in the mail to bring to the polling station containing all your info. ID is also required.

If you forget this card, they can print it out for you.

Then you enter the booth containing party lists. You can't "punch" the wrong party as each have their own ballot. You can erase/add/reprioritize names on the party list you choose though.

Then you put this ballot into an anonymous envelope. This envelope is then put into another envelope along with your election card.

When they count it, they pull out the ballot envelope and the election card, register that you have voted, then someone else will open and count the actual vote.

It seems to me to be pretty secure and anonymous.