Hacker News Reader

Comment by seldo | Hacker News Reader

It is one of the curious facts of modern culture that the people who love technology the most also seem to be the most opposed to electronic voting.

I think it's because the people who most understand how computers work also understand that no data can be considered trustworthy if somebody else has been in possession of the hardware. Yet governments continue to trust the impossible promises of the people who make voting machines that their machines are secure, despite a continuous stream of demonstrations to the contrary, both intentional and accidental.

View on HN

I don't know that we're opposed to it in theory, it's just that every single implementation thus far has been terrifically bad. Making the code open source would go a long way, I think, as would establishing open working groups to establish security standards. I may be an optimist, but I do believe that theoretically (at least information-theoretically[1]), it can be done well.

[1] http://scholar.google.com/scholar?q=Information-theoreticall...

It's also fairly easy for us techies to grasp the hacking of computer systems. But we often forget how insecure and error prone paper systems can also be:

http://www.youtube.com/watch?v=sJfj9ySYg0Q

Massive voter fraud could be happening every election - it's pretty easy to vote fraudulently and there is almost no way to find out after the fact (I've done it unintentionally). For whatever reason, we are insanely afraid of hackers pushing an election over the edge, and yet we don't even ask for photo ID at the voting booth.

We're more concerned about electronic voting because it lowers the effort and manpower needed to defraud immensely.

And more likely, in a close election the election can be stolen by a minimal change, which will probably go undetected.

I voted on Saturday (Australian election). No id required, 100% paper votes, all counted by hand (as far as I'm aware) and we normally have a result within a few hours of polls in the West closing.

Seems to work very well, but I guess one advantage we have is that none of the parties here are worth cheating for.

Might also help that Australia's population is about 22M. The USA are at 308M and India is 1180M - hand-counting ballots might just be a bigger problem with those kinds of numbers involved.

Can't see why it would be. That kind of thing parallelizes really well.

Granted, oversight would likely thin a bit.

Germany has 80 m, and hand-counting works well. It does seem to be easy to parallelize.

I do not. As long as the hardware has been in possession of untrusted parties (and polling place workers do not count as trusted) any software solution can be compromised.

I'm not convinced that any method will ever be 100% foolproof, but I think it can be improved immensely, and if we could limit the inaccuracies/fraud to always be less than those incurred by a traditional paper ballot[1], I think I'd approve.

In regards to your comment regarding untrusted parties handling the hardware, here are a few counterpoints:

- We already trust polling place workers with paper ballots, the possibility for fraud already exists.

- The potential for fraud from any one polling place can be limited by implementing a system which makes it impossible (or very very difficult) to spoof the location from which a vote was cast, and ensuring that the number of votes cast per polling place is within an expected range.

- Such a system could also include a paper receipt with an ID number on it. A voter could plug this "tracking number" in on a trusted website (ie. vote.gov) and confirm that their name is associated with their preferred candidates, but not allow them to change these choices. This would go a long way towards identifying fraudulent activity when/if it occurs.

[1] Though figuring out how to quantify this is anybody's guess.

"We already trust polling place workers with paper ballots, the possibility for fraud already exists."

I don't know about the US, but here in Germany _anyone_ can watch the whole process including the counting of the votes.

So it is possible for me to check up on my polling place.

With the current paper ballot system you need a lot of people to cheat significantly. With voting computers you need only a really tiny number of people to steal an election.

Is it not the case in the US that representatives of each party supervise the counting of the ballots? Pretty sure that's how it works locally; though elections are state-governed so I guess there could be some variation.

Having representatives of each party overseeing the process should serve to keep any monkey business in check. Though when people are involved, there's always a chance for corruption.

Certainly we trust the polling workers with paper ballots, and fraud exists there, but IMHO the ease of electronic fraud is much greater than the ease of paper ballot fraud. I'm thinking of the work involved with ballot stuffing - you basically can turn it into a "one click" operation.

(Speaking only of the US voting system)

You can't let people look up their vote or their employers, spouse, etc, could force them to vote for preferred candidates. Ron Rivest has a system to make it verifiable and deniable (Three ballot system). There are others.

Rivest has the right idea in terms of thinking about this cryptographically... But the Three Ballot system would be an absolute mess :-P Remember hanging chads? Try telling people that to vote against a candidate, they have to mark them on one of three ballots...

Usability is a big problem with election systems. Making something anonymous, auditable, fraud resistant, affordable, etc and simultaneously make it usable more or less by everyone is tough.

They recently used a system called Scantegrity in Takoma Park, MD (Rivest also collaborated here). I've been meaning to look up the usability conclusions on this one, but I don't remember seeing much in the way of problems at the time.

I don't think that is necessarily true. Perhaps a public key scheme could be derived that would enable everybody to verify the votes on their home PC.

The challenge is to allow for anonymous voting. I don't think it is necessarily a problem that is impossible to solve. Practical solutions are also a challenge.

I think the issue is the difficulty of auditing electronic votes. Computers and databases have made it so easy to forge data--just look at Bernie Madoff.

The best way to ameliorate these discomforts is to ensure that a list of eligible voters is made available every year (already available under the current system), as well as a list and sum total of those eligible that voted. We would need to assign every voter a UUID every time he votes, and provide the voter a printed receipt of the UUID and selected choices (if desired) on security paper (controlled stock of security paper with its own unique identifier to be accounted for), and publish all election results with the selected choices matched to a UUID on a website every year in CSV and HTML formats.

I'm sure there will always be ways to tamper the system. The key is that if every one is able to watch the system (like open source code auditing), the risk of discrepancies or error is minimized. The UUID will allow the voter to confirm that his choices match the recorded results.

If this system were implemented, it would be better than the status quo. The current system may seem better, but it's prone to human error (Scantrons not being scanned by an optical reader; hanging chads; etc).

At least two obvious ways to hack your proposed system. Hackers could just add phony UUID/vote pairs to the totals. Activists could claim their vote was stolen if their preferred candidate loses.

(We already saw a variant of the latter in 2000. Remember "I couldn't follow the arrow and accidentally voted buchanan"?).

Further, if a person's vote is verifiable, it also opens the door to paying people for their votes.

I can't think of a fix for paying people for their votes since that problem still exists today (albeit to a lesser extent than if a voter's vote were verifiable), but I imagine they wouldn't be able to keep it under wraps for very long. Anyone offering to pay money will definitely risk drawing attention to themselves, and I believe ethical people will report suspicious people to voting investigators.

As far as the UUID/pair frauds, we could mail a confirmation letter to the voters stating that they voted. Since I don't think we could tie the UUID to the actual voter, we could tell them they participated in this year's election and to verify the results to the receipt. This part is compounded in difficulty partly due to federal voting regulations that don't allow us to tie a voter to his votes, so I think the only real way is to verify videotapes verifying that said voters appeared in person to vote.

Again there are flaws and it will take more people to resolve the issues with electronic voting.

Secret voting was brought in pretty much as a direct response to widespread coercion and purchasing of votes in many different places.

It reduced the problem significantly by making it impossible (or at least significantly harder) to verify that you vote the way you promised.

The UUID suggestion is worse than the way it used to be, as in the past you generally required people at the polling place to oversee the voting to ensure your people voted the way they were told/paid to do, while with a receipt available, you can monitor more people with fewer people of your own.

Well firstly these machines should have been riveted shut, leaving the only way to access the machine is by breaking the tamper-seals. (This at least eliminates everyone in the country without corresponding replacement tamper-seals from screwing around inside the machines)

Secondly, the OS on these devices should have been stored into ROM; not only is this a bastard way of ensuring people have to use the manufacturer to upgrade the systems, but it also makes tampering that much more of a pain in the ass.

Thirdly a proprietary data storage should have been used. Preferably one designed so that the voting machines only ever contain a write-only drive, in that it either cannot edit the data, or preferably doesn't even have the necessary hardware to read the data it writes (this would be complicated to get working right, but would be well worth it). This means only the manufacturer would have access to the edit/read connections.

I mean come on, compact flash, seriously. My phone can read flash drives, what were the designers thinking!

Proprietary storage? I'm skeptical. This is contrary to the open-source mentality: let the details of how the system works be known to everyone. Like PGP encryption: nobody's hiding how it works - in fact, more scrutiny helps prove it's safe. You don't hide the mechanism, you just hide your personal key.

Otherewise, you start feeling secure based on your assumptions, like "only we can read these drives" - when maybe your assumption is wrong. Maybe somebody has hacked one machine somewhere and reverse-engineered the connector.

Now you've got an unknown danger out there. Whereas if you're constantly submitting your system to public scrutiny, you'll probably only have known dangers. Which you can fix.

>no data can be considered trustworthy if somebody else has been in possession of the hardware

Actually, this isn't true, given properly-implemented crypto. Or, I suppose I should say, it's true only with very low probability.

So here in Australia we use plain old paper and pencil ballots (it is the same in every state - it's Federal). How does electronic security compare to pencil on (anonymous) paper ? I am sure paper fraud happens - as would manual counting (it is manual but overseen of course). Is it perhaps that with electronic both the scale can be increased and the chance of detection decreased?

How much of the drive for electronic voting is driven by big media? The MSM really covers elections like horse races, and at the finish they want to be able to wrap it before people drift off to sleep for another workday.

I wouldn't mind if election results weren't available for a day or two. The ancient Greeks had a completely tamper-proof voting method (and voting was theoretically obligatory). We should likewise be seeking a tamper-proof voting method, whatever that may be. I would also support obligatory voting (with "abstain" as a choice), and media outlets that cover elections like entertainment should be ridiculed.

As a counterpoint, cryptographers (including Rivest of _R_SA fame) are quite interested in voting. Of course, they generally don't trust the machines at all...

I've often considered open source voting software and hardware as a possible startup idea, but frankly I don't have the balls to go through with it. I'm not an entrepreneur, and it is a legal minefield besides, so I stay away. Still, I have some neat (IMHO) ideas, so maybe I should find a venue in which to express them.

Reply on news.ycombinator.com