Where paper ballots are transparent and accountable, electronic voting machines have closed source and unaudited software. They go against the core tenets of transparency and fairness that make democracy work.
I think it's more persuasive to focus on the transparency/auditability/fairness argument. Perhaps as an extension, an emphasis on the ability of the average participant/voter to understand the mechanisms behind how the system works?
No. Doing that badly might have that effect, but there is no axiom which states that accurate counting must be slow or manual. Have electronic voting with instant tallying, with a parallel optical-scanning verification of the generated paper ballot. Then have manual spot checking of the automated counting process, with whatever sample rate you choose. This is a solved problem (ask the USPS if you want details).
Instant results which are "the ballots got wet" proof and have a totally auditable record.
No, but there is an axiom that says the more expensive an attack is, the less likely it will be carried out. Hacking manual counting requires so absurd amounts of coordination between so many individuals, that you can pretty much discount the possibility. High technology is a vehicle of multiplying the power of individuals. The same process that makes electronic counting more efficient, makes it also much cheaper to attack.
> This is a solved problem (ask the USPS if you want details).
TBH, postal services screw up in that department regularly, but nobody cares, as the impact is very small.
Leaving aside other countries and their transition times, in the U.S. at least, there is always more than enough time to have a recount before the winner takes office. There is also enough time to do the same for things like ballot initiatives and referenda, which don't go into effect immediately, but some reasonable amount of time after the vote.
With reference to the 2000 election, the legal fight over the process to perform manual recounts in Florida took far longer than the actual recounts would have taken, dragging it out to December 12. Interestingly enough, while I have heard some still claim that "Bush stole the election," when the press actually finished a manual recount, the conclusion was that Bush had, in fact, won the vote. But people will believe what they want to believe about the fairness of elections when it doesn't go their way, as has been amply demonstrated recently.
https://en.wikipedia.org/wiki/2000_United_States_presidentia...
With paper, that's a laborious process, requiring physically adding up millions of pieces of information. And many other things - like horses, sailboats, and slavery existed for hundreds of years but have been phased out for superior technology. An electronic voting machine or computer would, in theory, be able to take votes and output a result without this effort. Electronic voting machines are, at first pass, a good idea.
The presence or lack of transparency, accountability, and auditability are implementation details, not principles of electronic voting machines. In the absence of bad decision making and the presence of properly aligned incentives, the issues current voting machines suffer from could be worked around with a different implementation.
Before computers were an option, paper was not chosen because of these properties it's now lauded to have.
There are middle grounds. Paper doesn't have to be manually tabulated.
Punch-hole ballots can be mechanically tabulated, fill-in-the-bubble ballots can be read with minimal software. Results can be aggregated by software and communicated over networks because the results can be audited with the paper trail (both cheap sampling/statistical auditing and an expensive total manual tabulation).
If chads and improperly filled ballots cause problems, create a machine to fill in the paper ballot for people - but give the voter the ballot, let them verify, then walk over and drop it in a ballot box.
If the NSA can't lock down their espionage weapons, we can't trust some second-rate politically-connected software vendors to run our elections. We need auditing, we need paper.
I'd argue that this isn't a huge deal since the amount of labor available scales essentially linearly with the amount of votes cast.
The core feature of a car is to go places fast, but it's also crucial it doesn't kill its occupants. Similarly, the essential aspects of a voting system are things like perception of fairness (otherwise we're back to killing each other for the seat at the table) and protecting individuals from being bribed or coerced into voting in a particular way. Electronic voting systems fail to provide those features in a reliable way.
Consider that there are, and will always be, people on the losing side that argue the elections were rigged. In the paper version, the scenario is so implausible that it's not worth much attention. In an electronic system, where maybe 1% of the electorate can actually understand how it works, and only 0.1% of that 1% have enough access to actually verify it works the way it says it works, it will be much easier to argue that the other side rigged the election. For democracy to work, it's less important who is elected, and more important that everyone accepts the result of the process.
That is a feature of paper ballots, not a bug. We have plenty of volunteers to count ballots and there's no necessary equipment or domain knowledge to do so. The attack surface is thin and well-known with paper.
Of course properly implementing the civlservice reforms (of the 19th century) and not electing Judges and other positions that should be filled on merit by civil servants might help
In general, we'd have to close the loop over hardware the way we did with software.
In software, you can write open-source code that depends only on other open-source code, and you write and distribute it with open-source tools. Trusting-trust-style attacks aside[0], everything on the software layer can be inspectable by anyone, and in principle you could read through all of the code and understand what's doing[1].
With hardware though, there pretty much isn't any usable open-source hardware stack that's a) fully open-source at every level, and b) verifiable. The latter is particularly damning, because chips are made in commercial factories you can't inspect, and the actual process is secret. (1/2)
Until the day you can literally print[2] your own circuits from sand, using an open-source designed and manufactured electronics printer, you can't trust hardware without trusting people who manufactured it.
Ultimately, I doubt we'll ever be able to have 100% trust in any human-created system. The one thing we can do, though, is to structure our systems to maximize cost of a successful attack, trying to push it so high that the results are not worth the effort.
--
[0] - http://vxer.org/lib/pdf/Reflections%20on%20Trusting%20Trust....
[1] - it's obviously not true in practice, due to complexity, bugs, and finite lifespan of humans.
[2] - or "nanolathe", as we called it in the late 90s; cheers Total Annihilation fans!
Once you've handed off your paper ballot, it's no longer "transparent". You have no signature (physical or digital) that verifies that your vote was counted in the final tally. You also have no proof that all other votes submitted in that election were legitimate votes from real, identified eligible voters. Ballot stuffing and mis-recording of votes are both forms of fraud that have been performed under the so-called "transparent" paper voting systems...
"Accountable" implies that you have adequate identification. Last time I checked (last presidential election), I only needed to provide a name and a birthday in order to vote, which are both things that are publicly available information. Without adequate identification of people (see: biometrics + smart cards, ideally), you don't have accountability or even the ability to reliably detect voter fraud. Why would you want to favor a paper system which relies on people (who can be paid off, blackmailed) when better solutions exist that get rid of some of the possibility of human error?
Personally, I'd rather have a public electronic voting system where all voting transactions are stored on a public blockchain. That way I can verify the vote tallies for myself and I can also verify that the vote that I submitted was actually recorded and included on the public blockchain. You add in the assumption that all voting machines must be closed source and un-audited - but that's not an inherent property of voting machines. Governments could just as easily use open source and publicly-audited voting machines.
Would this allow you to prove to someone else how you voted in the election? If so, that's not a desired property.
Currently there is no way for you to prove, to yourself or someone else, who you voted for in an election because nobody gets to see your ballot and you cannot take a photo. This makes vote buying and coercion much more difficult. I'd like our voting system to keep this feature.
You could have a blockchain-based system where everything is public (say, like Bitcoin), which from your perspective would be bad.
You could have a blockchain-based system where you need a "view key" in order to actually view the details of a particular transaction (say, like Monero), which from your perspective would also be bad.
In the latter system I'm describing, you could have a procedural control that you have a choice of receiving your "view key" or something along those lines to deter coercion and vote buying.
Other possibilities would be allowing voters to change their votes at a later date, or creating a system that allows voters to vote remotely such that they could do so in the comfort of their own home where they'd be (presumably) free from coercion and other influences.
The system needs to retain the current property of being able to lie about having voted a certain way with 0 chance that you will be discovered because getting proof is impossible.
Consider that it won't be "comfort of their own home" it'll be the comfort of their union bosses office so he can be sure they voted as directed.
Regardless, I said that it was dependent on the implementation. If I am able to change my votes at a later date, then who cares if my union boss can pull me into his office and force me to vote a certain way? I'll just go in that evening and issue a corrective vote and be issued a new "view key" associated with that transaction and my boss would be none the wiser.
Or you could have a system where the blockchain isn't public, but rather it's only accessible by a few designated government machines. Then for auditing purposes if you want to verify your vote, you go into a facility (no electronics [besides your identification] allowed) with your "view key" and prove your identity (biometrics, smart card) and then you're able to then receive assurance that your vote was recorded as expected by viewing the transaction from one of the government machines.
Then your union boss doesn't have the ability to check your votes.
You know what I love though - people who make all discussions black and white and don't consider the large spectrum of possibilities.
Your threat model is nonsense.
Yes, people do commit fraud in elections, but they do it as insiders where they have the opportunity to covertly meddle with large numbers of votes.
They do not do it by walking into a precinct in plain sight and claiming to be someone else, risking everything for the chance to cast one vote, unless they are very, very dumb.
We can have sophisticated and safe electronic voting, but we have to introduce it gradually, with transparency and major, sustained investment.
We must also do something that doesn't come naturally: Critically review and audit progress to-date, and use this information to conservatively set direction for future effort. The aviation industry's approach to technology is the kind of model that is needed here, not that of startups or big corporate.
[0] https://www.schneier.com/essays/archives/1999/11/a_plea_for_...
It was not my intent to suggest that the system itself would need to be greatly complex. Perhaps my use of the term was incorrect.
There are professional security people who disagree, at least in practice, with Mr. Schneier, and would make Rube Goldberg envious with the needless complexity of their constructions.
Given how obvious and easy to execute this is, it seems impossible to imagine any justification for the change that does not at least consider this an acceptable plausible consequence of the choice.
That said I believe that, absent major changes to regulations around voting machines, the labor cost is worth the security, transparency, and accountability benefits.
Automating the counting process must be done in a way that preserves the ability to manually verify the count - voting machines that do not produce a paper audit trail that can be verified by humans are fundamentally insecure.
Computers represent a single point of failure, one piece of malicious software could affect an election and nobody would even know. This problem is made even worse by the closed source machines in use right now.
Assuming perfect security and absence of software bugs, we'd be insane to prefer human counters to machine counters.
My point was just that there are obvious up-sides... so it's not like e-voting is some pointlessly insane thing.
I happen to think it's a bad idea even with dead tree audit trails, but I can respect the position that, with appropriate audit trails, it makes the voting process more robust.
Sometimes you gain a lot by having deliberate inefficiencies.
Hence electronic paperless voting with no tamper proof audit trail.
The reason for the existence of electronic machines is often something as mundane as the cousin of the governor owns a company which happens to make the machines.
That's not to dismiss the claims of cost (projected to be cheaper than armies of manual counters) and speed (instant results on election night!) that also likely spurred this decision. In hindsight though we are learning of the other issues we have created while trying to solve the originals.
It's techno-philia from the techno-ignorant.
We just had our municipal elections. Plenty of regular people saw the slowness and the expense of paper ballots. Some asked about switching to electronic voting, because even to a layman it's obvious how computers could potentially make tallying votes faster and cheaper.
The part that's not obvious is security and making results auditable. That's much harder for electronic voting, but it's not as obvious to a layman.
If most of those people is chosen randomly between the population, as it happens in my country, the system is pretty robust. As this is HN: It's a distributed system, every node making its own checks.
So, the answer to the complains is that the slowness and the expense are a feature, not a bug.
It's insane anybody thought electronic baking was a good idea when paper money has worked for hundreds of years.
Electronic voting machines aren't problem.
Bad implementations are the potential problem.
The problem with voting is that trust doesn't really exist, you have large blocs that are historically willing to undermine the integrity of the process itself because the risks of getting caught the penalties associated with same are low and mild compared to the potential payoffs of success. I would argue that too much power is concenrtated in elective offices, such that the incentives for cheating so vastly outweight the downside risks that shenanigans become inevitable.
The American approach to this has been to distribute power across as many elective offices as possible. This may have been a mistake, and furthermore it makes voting enormously elaborate and complex. American ballots are huge. That's better than the paternalism that obtains in parliamentarian systems, where you get to vote for a small number representatives once every few years and on a referendum maybe once a decade, which makes it easy to do all the ballot-counting by hand.
Paper ballots can't be counted by hand in the US. I mean, yeah, it's theoretically possible, but when ballot papers in a general election can have 40 ro 50 candidates and referendum items, counting has to be automated (eg by scanning) and recounts are limited to specific races in specific precincts. To be frank, it would be very easy for a determined attacker to throw an entire election into doubt by subverting just a few key points. All I need to do is force votes close enough to trigger the recount threshold in multiple (>=3) disparate races in multiple (>=3) busy precincts and then have a few Outraged Citizens show up to protest the injustice simultaneously. To be honest you could probably do that with ad buys and not even use knowing operatives. The amplifying effect of the media will do the rest. On top of the commercial impulses that drive the media to seek spectacle first and substance alter, the wide availability of camera and communications technology is a double-edged sword; on one level it provides an economic and cultural stimulus which is great, but that also means that it's extremely subject to manipulation as the capacity for media production outstrips that of critical consumption - that is to say, our capacity to create rumors often exceeds our capacity to filter them out, and leveraging this at a critical time like an election makes it easy to provoke political instability.
Sp, while paper ballots seem to have greater integrity than electronic voting, they're really not that much harder to undermine and require the acceptance of all kinds of practical problems that come with fetishizing tradition.
Could we not instead have voting machines with open source and audited software, or better yet voting software that we could all have on our phones that met the same standards? That'd be the ideal, but it hasn't happened until now because procurement and the political process itself are deeply corrupted, and in addition to the basic corruption of two sides spending vast sums of money to struggle over power, there's the bigger issue that if you could gain popular acceptance for a solid verifiable open-source voting mechanism we wouldn't need much of our political infrastructure; that is to say, instantaneous, reliable, and credible electronic voting is a threat to the existence of the political class, and by extension to the buyers of said political class's services.