Online voting in Finland: Conclusions and recommendations (2017) [pdf]
oikeusministerio.fi
oikeusministerio.fi
So to all the blockchain-proponents etc: remember that it’s not enough for elections to just be safe. They also need to be safe in a way that is obvious to non-cryptographers.
Many countries run elections on paper ballots and with public ally-observeable counting of votes. They do so in rural communities as well as cities with millions of voters. They rarely see voters waiting in line for more than a few minutes. And the costs are neglible in the grand scheme of things.
That is the gold standard for elections, and it’s actually damn easy to achieve.
How? Here's the main conclusion from the report
> The monitoring group came into the conclusion that online voting should not be introduced in general elections, because the risks involved are greater than the benefits.
This report, and others by professional organizations like the EFF still follow the old consensus, possibly because they are run by people socialized in that environment. But I’m worried what such reports will say in 2030 if the arguments I made above are not universally understood.
What is excellent about this? Paper ballots, with multi-party observers are incredibly secure, auditable, and transparently fair ways of running an election.
Yes, you can have shitty ballot designs, and insane voting machines (Florida, 2000), and your entire electoral process may be infiltrated by Reptilians, who take the ballot boxes out into the woods, to use for kindling, but the same can be said for electronic devices. The UX, and security procedures for the Canadian elctions I have voted in was very simple.
Shade in the circle by the name of the candidate you want to vote for. Fold your ballot. Drop it in a box. At the end of the night, the box is opened, and the ballots get counted. There are eyes on the ballot box, for the entire duration of the process.
Adding a closed-source, opaque electronic voting machine to this process solves a non-problem that nobody has.
https://www.verifiedvoting.org/resources/voting-equipment/se...
Also a note for international HN readers - elections in the USA often have 20+ races on the same ballot - we really like elective offices - and that makes hand counting more difficult.
Anyone who is interested in election processes should volunteer to work an election, either helping operate a polling place, or as a poll watcher, or similar. This is one of those areas that looks simple, but has a lot of difficult edge and corner cases. I've been a poll worker and a registrar of voters, and it is not as simple as most people would think.
Sorry to pendant, because I know you already know this: some jurisdictions have (selectively) disabled the second chance feature for spoiled (or unreadable) ballots, effectively disenfranchising voters.
One newspaper called me "a sweaty paranoid kook" for having the audacity to explain, citing the procedures and rules, how central count works.
Even today, you'll still see some yahoos pitching Chaum or RSA or Pret-a-Vote (?) based whackadoodle solutions. Completely divorced from how real world election administration works. But someday Tinkerbell will fly, if we all just clap hard enough, so stop interrupting with physics, logic, experience, thank you very much.
The crew that played the long game, and moved the needle, are the various members of the Election Verification Network. Unlike me, who burned out early.
We all owe the EVN a huge debt of gratitude.
Moreover, physical observation doesn't scale. Only a handful of people can observe due to the physical limitations of meatspace. A simple attack could be to "DDoS" the count observations by crowding them out with your agents.
Typically there's a member of each party represented in teh election present for the counting, and often they're open to observers from the outside.
This means that you'd have to collude with your political enemies to steal their votes....
The polling stations are open 7am-10pm, so 15 hours, before being driven to a central location for counting.
Thus, many polling stations don't have observers from the party at all - let alone the 2-4 observers needed to keep a constant watch from the first vote to the count.
[1] http://www.bbc.co.uk/news/election-2015-32229745 [2] https://en.wikipedia.org/wiki/Conservative_Party_(UK)#Member...
This is particularly noticeable at the spread-out constituencies like Na h-Eileanan an Iar, where the count has to wait for ballot boxes to arrive by boat or, if the budget is available, helicopter.
The ballot papers themselves are traceable, so if you're going to stuff the box you need to add the relevant number of ballots to the record and fake their issue to particular voters.
They're also in the custody of ballot officials; in the UK this is one area where I genuinely trust the ability of those people making up the system to operate genuinely according to the rules. We've even managed to hold fair elections in occupied Belfast.
Switching to e-voting would turn the whole thing over to known insecure consumer PCs and known suspect contractors like Diebold and Capita, all of whom I trust about as far as I can throw them; I trust the small army of ordinary people who make the paper count happen far more.
Maybe next election I'll volunteer as an observer.
The electronic solution is the one where malicious actors can substitute key parts of the process and things may be vulnerable to attacks that nobody has thought of (Meltdown/Spectre passim).
If you can pull that off you might as well say fuck it and take over the country with force.
certainly shady deals between a couple of folks at the tops of parties is a possibility, but collusion between the thousands or tens of thousands of local volunteers of both parties?
It'd take quite a bit of money, though, this.
That is literally the definition of collusion.
https://en.m.wikipedia.org/wiki/Collusion#Examples
https://www.cambridge.org/core/journals/world-politics/artic...
Not as much so in nations where people generally trust experts and government officials, and where conspiracy theories are mostly on the fringe (i.e. not the U.S.). Although I agree that it's preferable if non-techies can understand the mechanisms, and the downside of paper ballots plus mail-in is already pretty small.
It’s a really easy call in this debate, because the downsides of the process are neglible: the paper and pen process in my country produces results just as fast as what I see in the US.
Among the only substantive arguments I can think of is that US elections have a lot more items up for vote (ballot initiatives and the proverbial dog catchers), which makes hand-counting more cumbersome.
The election is where that trust is anchored at. Whether people trust the current government can change. If trust in the election result and thus trust in the next government's legitimacy depends on trust in the current government, you have no safe way out of a situation where trust in the current government is gone--which ultimately is the reason we have elections in the first place: As long as everyone is content with the current government, you don't really need elections at all. The whole point of having elections is that you can change a government that you don't trust, should the need arise.
and it’s actually damn easy to achieve
http://www.bbc.co.uk/news/election-2017-39882972
The Irish e-voting debacle cost €55m for an electorate of roughly 3 million people: https://www.independent.ie/irish-news/54m-voting-machines-sc...
But you need to take into account people transportation and opportunity cost (if I lose 1 hour going to vote, this time could have been directed at working, thus it cost me ten or twenty the price you just spoke about).
But yes a distributed e-voting system based on blockchain or whatever could work and maybe much cheaper as it would only take a few minutes online to vote. The result could be that more referendums would be held more often.
In other words, it's not the backend that's the worry so much as the frontend. (Leaving aside all the blockchain-specific issues)
Block chains record votes cast in order. Which correlate with the order those same ballots were issued (or received, as with postal ballots). Voila, no more secret ballot.
The proposal to fudge the time stamps (chunking, roundoff or jitter) does not work for real world USA elections. Because the smallest administrative unit is the precinct (from 0 to 1000 voters) and ballot casting is bursty (vs spread evenly over time).
(Should also take into account people transportation to the location, and the opportunity cost of their time)
We also have many thousands of voting booths, so waiting times are low. One hour is rare.
Online voting is a means of handing the election directly to hackers, without having to go through the tedious intermediary of "fake news" and so on.
https://e-estonia.com/solutions/e-governance/i-voting/
https://www.valimised.ee/en/internet-voting/internet-voting-...
Money quote: "What we found alarmed us. There were staggering gaps in procedural and operational security, and the architecture of the system leaves it open to cyberattacks from foreign powers, such as Russia. These attacks could alter votes or leave election outcomes in dispute. We have confirmed these attacks in our lab — they are real threats. We urgently recommend that Estonia discontinue use of the system."
I wish some countries would look carefully at this conclusion. I think I'll even send this to some "media influentiers". I think I'll send to some friends. I think I'm gonna cry a bit.
This was easily my favorite part.
In that sense, I don't think anyone advocating electronic voting is trying to 'Change for the sake of change' (compared to, say, a police force trying to replace desktops with iPads). The naivety of it, though, is more the discussion that is being had.
Being coerced into voting for a certain party is a whole different problem, with different actors. You're not going to run the election again when the spouse of someone pressured them into voting against their will. How would you even want to prove it had happened in the first place? There's not going to be a paper trail without giving up voter secrecy, which is yet another problem.
For voting you don't need to order or timestamp anything, so blockchains are mostly irrelevant.
Historical accounts seem like a good place to start.
He verifies that your hash corresponds to the vote he purchased, and pays you the money (or doesn't beat you up, fire you, etc. I'm using "sell" in the generic coercion sense)
The grandparent proposes a perfect counting guarantee, at the cost of providing every voter and coercer a crypto proof of the ballot value, a very bad compromise.
Real world security works on "just hard enough not to be worthwhile", not absolute guarantees.
So instead of waiting for specific large event to put some question on a ballot, state could send push notification to cellphones asking to vote for specific proposition and quickly get response.
This would enable democratic process for much larger number of state projects instead of relying on elected officials and people hired by elected officials.
Voter fatigue is already a severe problem. More direct democracy has plenty of down sides.
The alternative is to organize, lobby, participate. Bring the heat. So much that whoever's in the way sees the light.
Campaigns and elections are just the opening acts of democracy.
It's my belief that people will vote, Americans included, if they think it matters. In Denmark fewer than 80% vote for the EU parliament, because very few actually care, even though the EU have a huge influence on our laws, it's just not clear to the public. Similarly I find it more plausible that the average non-voting American simply don't believe voting will have any real impact, rather than choice to stay home because they don't can't spare an hour every two years.
There's a number of things I personally believe the US should do before looking into online voting, if the goal is increase voter turn out. Losing the "winner take all" system for one. Having more parties represented in the congress and senate could help people feeling that they're better represented and that their votes actually matter.
2. In Presidential elections, #1 holds true. But, even worse, due to the electoral college, some states have outsized influence on the outcome. Voters in CA have less voting power than voters in North Dakota. This is due to each state having a minimum number of electors, but a fixed total number.
3. Even ignoring #1 and #2, at the national level, there aren't big differences between the GOP and Dem positions on the things that will impact an average person's day to day life. Elections always come down to "those guys kill babies" or "those guys like to arrest black people". This is less true at the local level, where property taxes, schools, etc actually do impact daily life, but for whatever reason, those elections are less interesting to most people.
4. Voting in the US is during work hours; it is not a holiday. Hourly wage-earners are frequently forced to forgo income to vote. The GOP deliberately understaffs polling places where possible to increase wait times and make voting as tedious as possible. They also regularly attempt to stymy voting through ID programs, misinformation campaigns, intimidation, etc.
5. 24-7 news cycle has many people worn out and frustrated with the system. There is a growing sense of "fuck it, let the whole thing burn" on both sides of the aisle.
Also, if people are only voting once every 2 years, then they're still opting not to vote in a lot of elections (elections where there vote has a lot more impact).
[1] https://www.nytimes.com/2016/11/09/upshot/why-long-voting-li...
[1] https://www.nytimes.com/2016/09/17/us/some-republicans-ackno...
I think some people have a principled stance against voting. You may not agree with that but it is another reason why people may still not vote.
About one month before elections, or a referendum (ca. 3 times a year) you get a resealable envelope containing all voting materials.
You cast your votes and put the slips into a sealed envelope (which ensures confidentiality). Then you sign the voter eligibilty card (which also serves as the return address), stick it into the envelope in which you received the materials and drop it into the next letter box.
The materials are checked and the sealed envelopes are stored until voting day, when the votes are counted.
Inconvenience, even if you live out in the total sticks, is really no excuse for not voting in Switzerland.
Can the system be gamed? On a very small scale probably yes if you really, really want to and are really careful. Gaming it on a significant scale? i really don't see how.
Edited for clarity
There can certainly be coercion even in countries that maintain secret ballots. In Russian regions, it is not unheard of for civil servants and teachers to be told by their superiors that they must vote the favoured party “or else”, and a mobile phone picture of their ballot might be demanded as proof that they did so.
If I am able enough to tweak my stuff to take such a picture I'd be surely able enough to provide a fake picture. The attacker would need to provide the device which in turn does not scale very well. So, apart form husbands, this attack would not make much sense.
If that was to be done in scale, it'd be noticed fast. And people would ask questions quickly. That might be different for Russia, I admit. In US, no need for all that, you have electronic voting boxes, which are completely opaque to voters and counters.
EDIT: spelling.
whatever increasingly convoluted suggestion you'll make next probably doesn't work either.
I also don't appreciate your arrogance in trying to shut down this discussion pre-emptively. Maybe try listening more in the future, you might discover interesting things even if they don't agree with your pre-set ideas.
There are ways to avoid being coerced when enabling online vote: have an online vote for a week, then a few days after the online vote ends, have one day of paper voting. If you were coerced during the online vote, you can still go to the paper vote later, at which point your online vote will be overwritten by the paper vote[0]. This is still not fool proof (i.e. one can force people not to go to the paper vote after coercing their online vote) but as explained above, neither is normal voting.
It's like open source software. I am not able to check everything I use. But there are parts where I am capable enough to do so. For the rest I rely on others to do so.
You can't run a society without trust. It's about the ability to verify or have persons you trust to verify for you.
The hard bit of online voting is eliminating traceability of individual votes.
Online voting affects all the people at the same time. Your vote being tampered with or changed affects all the result. It is not your personal decision to vote online and it is not your personal risk.
This is false. All banks are conducting their business electronically whether you like it or not. The global economy is run primarily on the transfer of electronic bits, not physical paper.
And it was just as way of exemplifying the problems with voting.
That was my point.
I really do not care about banks, in this context.
Would you consider taking a few minutes to read this? http://zesty.ca/pubs/yee-phd-ch1to3.pdf
I put a bunch of effort into explaining these issues as well as I could, and that's the result. I'm pretty happy with it and sometimes wish that it were required reading for people participating in discussions about electronic voting.
Perhaps you can enlighten me on this point:
> "Voting machines aren’t supposed to record video or keep any record that associates you with your votes, because your ballot is supposed to be secret"
Is this definitely impossible even allowing for (possibly impractical) secret-sharing schemes where you provide enough information to prove you're a valid voter and to check afterwards that your vote was counted, without giving away to anyone else how you voted?
The additional problem with online elections, not covered in the video, is loss of anonymity (or deniability).
Because with online banking, all the problems - theft due to security problems, unauthorized access, the bank not giving access to an authroized user, etc, are all reversible and solvable.
With secret ballot voting, it's not. If some Martian hacker someone votes in your place, you have no recourse. If your vote gets eaten by the system, you have no proof, or recourse.
You can either relax the secret ballot restriction (Which causes a lot more problems), or use paper ballots.
Who will insure elections in case of hacks?
Also, more electronic voting means maybe more centralization which can increase the scale of hacks.
If someone breaks in to your online bank account, they can steal some money - at best it's insured and you lose nothing, at worst a single person's life savings are gone.
Now apply that to online voting. If it was in any way hacked or compromised it would throw the country in to turmoil - possibly even civil war.
The stakes are far greater for elections vs banking, so more caution is needed.
You're framing this completely wrong. Hackers have the ability to break into much more than just "a single person's life savings".