Is it really impossible though? I feel like we could eventually figure it out.
And if you find problems after the winner is declared? “Only the losing side cares, and they’re just sore losers”
Or an adversary could not commit fraud, just trip the fraud alarms in areas their opponent is strong.
So it’s very, very difficult to secure.
Electronic systems can provide a much better level of security than this through not only all the regular security techniques you'd apply to regular workers (no individual access, surveillance, etc) but also a wide array of electronic means including logging, 'ballot' validation, and much more. And you can also burn everything including the operating system and election software onto a non-flashable ROM meaning software modifications become all but impossible, and even if somehow achieved, would be trivial to detect.
This isn't true at all. There is not way to tamper with paper to make it change its properties that isn't obvious and easily detectable. And once votes are cast the ballots are handled with significantly more care.
Additionally, can the precinct be subverted in a manner that can withstand outside auditing by non-corrupt district/state-wide election officials? Keep in mind that if one party in the election has substantial reason to suspect the results were broadly rigged, they could demand a recount (even at their own cost, as happened with the Dayton/Emmer recount in MN), thus triggering all those downstream audit controls.
Besides an important part of banks fixing issues like this (when they do fix them) is that someone (often the bank itself) must lose money, which they inevitably notice. In the case of an election, no one would ever know if their vote was stolen because they have no way of tracking it once they cast it. You seem to be blindly assuming that every problem will get detected and fixed which is mindbogglingly niave.
2000 presidential election. Bush declared victor, but a Florida state law called for a recount as the margin was close. Recount was stopped, original election result stands. [1]
2016 brexit referendum. Leave campaign wins - and is later found to have broken campaign finance laws [2]. Original election result stands.
2016 presidential election. Trump declared victor, but evidence emerges of Russian interference [3]. Original election result stands.
There's no point in detecting irregularities after an election is over if they aren't going to be fixed - and history shows they won't be fixed. I'll stick with pencil-and-paper ballots thanks very much.
[1] https://en.wikipedia.org/wiki/2000_United_States_presidentia...
[2] https://www.standard.co.uk/news/politics/brexit-news-latest-...
[3] https://en.wikipedia.org/wiki/Russian_interference_in_the_20...
Quite a bold statement. Electronic banking is primarily secured by the means of insurance.
If you could have a third party verify the count within your system as accurate/inaccurate, then you wouldn't need that system in the first place.
In fact, people are still digging into whether voting machine fraud happened in some states in the 2016 election. Any result now is too late.
Also, the nature of hacks is that you can often detect that one occurred, but not exactly what was changed. How would you take the news, "It looks like the Russians had root on every voting machine. But we've reconstructed the correct vote counts from analyzing deleted database files found in the free block list, and the winner is..." Not too convincing.
(1) The software is not doing anything nefarious
(2) The software toolchain is not modifying the software in (1) to cause it to do something nefarious
(3) The software loaded onto the machines is actually the software verified in (1) and compiled by the verified toolchain in (2)
(4) The machine doesn't have any kind of hardware/firmware-based defeat device to trick you into falsely confirming (3)
This is essentially the same problem as is outlined in Ken Thompson's Reflections on Trusting Trust [1].
[1] https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...
Open source
> (2) The software toolchain is not modifying the software in (1) to cause it to do something nefarious
Use open source toolchains and hash the result.
> (3) The software loaded onto the machines is actually the software verified in (1) and compiled by the verified toolchain in (2)
Maybe some kind of cryptographic puzzle, question/response, you need to make a hash with the program, and make the HDD not large enough to contain more than that. Or maybe read only storage. Even a combination.
> (4) The machine doesn't have any kind of hardware/firmware-based defeat device to trick you into falsely confirming (3)
Your voting results are confirmable on the blockchain, but not specific, you can check that your vote hasn't been changed, but not the vote itself.
But elections are not about my vote. They're about everyone's vote. I care about not just the integrity of my own ballot, but the integrity of every other voter's ballot as well. And, given a system where most people will never do a complex blockchain verification of their ballot, or have a mechanism to be certain that no additional machine-generated ballots were added to the results... blockchain isn't solving the actual problem.
Don't be in love with technology when looking for actual solutions to actual problems.
People don't verify their vote now, so this is unimportant.
> have a mechanism to be certain that no additional machine-generated ballots were added to the results
This should only require a hand full of people to check.
A counting room full of people counting paper ballots is a machine, and it's a transparent machine where everyone inside it and outside of it can understand how it works, and trust that it's working properly.
But the biggest argument against electronic voting is that you're not solving any problems, you're just adding problems and decreasing the trust in the elections massively. And for what? To get election results a few hours faster? That's ridiculous.
> A counting room full of people counting paper ballots is a machine, and it's a transparent machine where everyone inside it and outside of it can understand how it works, and trust that it's working properly.
I agree with this 100%
Electronic voting must be cryptographically secure, and increase trust and security. I think this should be the first rule.
Those two goals are mutually exclusive.
Everyone understands how a room full of people counting paper ballots works, without having to explain it. Everyone understands that the process is transparent, and that by having people of different political persuasions working together, you ensure that the result is fair.
There is also immense value in having the voting "machine" being made up of actual humans, so that everyone in society can take part if they want to, and feel like they're doing their part to defend democracy.
And none of that can be replicated in software. You and I might be able to understand and trust the software, but everyone? Not gonna happen.
I think most people know their passwords are encrypted, but they don't know about hashes at all, they just assume the domain experts have figured it out.
Security in e-voting would probably look similar. You would know there are smart people somewhere who understand the complexity, and ideally you would have ample opportunity to learn.
I find it hard to imagine a plausible scenario where a complex, blockchain-driven election model is met with trust and comfort by a broad cross section of voters. It practically begs for anti-science paranoia.
And there are people that don't have a lot of trust in our current voting methods. Can't stop conspiracy theorists really. I think with global warming there is a degree of uncertainty due to the varying environmental factors. This will be something where you can pretty simply explain what's going on, or at least say this part is encrypted with X algorithm and people are happy. The public is willing to trust encryption, specifically there have been cases where the government's efforts were thwarted by strong encryption.
Is that rhetorical? I can't think of any major bug on a billion dollar ETH contract. The largest "heists" appear to have ranged in the mid 10's M$ (DAO, Parity), with one bug that freezed a sum in the low 100s M$.
Consider the apocryphal story: "NASA spent millions of dollars developing an 'astronaut pen' that would work in outer space, while the Soviets solved the same problem by simply using pencils."
Why go for the complicated solution when the simple one works?
Of course this has its own set of tradeoffs, but so does our current system.
Second, it violates the principle of a secret ballot. Repudiation would require voters to reveal who they voted for, to match ballot to (digital) signature. So it's not viable as a mechanism for a global recount.
The secret ballot could be reproduced a number of ways, but I'm particularly fond of the idea you have an extra password that makes it look like your vote was different, and only your password shows you who you really voted for.
And, in a well designed paper voting system, you do know your vote was not tampered with, because nobody's votes were tampered with.
There are only three mechanisms for tampering with the actual vote count - adding ballots, removing ballots, or altering the content of ballots. (Replacing ballots is a combined add/remove.) The blockchain mechanism only checks for alteration/removal, and only for a single vote. One individual can verify their own ballot, but repudiation requires breaking secrecy. It's simply not a very good solution.
And the reason it's not a good solution is philosophical - it's focused on the individual, when the election is about the collective. Any effective election validation system must validate the collective, not just the individual. The collective is validated by insuring that no tampering happened anywhere. And if we can demonstrate that, then verification/repudiation of individual ballots is irrelevant. If A is true for all B, and C is a B, then A is true for C.
But when you really love your hammer, every problem looks like a nail. Blockchain is basically useless for elections, but people obsess over it anyway.
No matter how you dice it, one of those things gives with electronic voting, even if you had electronic voting machines with no state (all pure circuits, say), but especially with votes on machines like personal computers, where a myriad of systems need to be trusted for the vote to register.
It isn't worth it. Paper ballots are intelligible to everyone, and even when we vote by mail there is such a paper trail it is hard to fake.
It is obviously less secure than voting in person, but it's good enough, and your in-person vote supersedes your mail-in vote.
https://www.kingcounty.gov/depts/elections/education-and-out...
The encryption would need to be written so there is a fail safe password that identifies the opposite party was voted for, to stop voting coercion.
Yes, it really is:
It is purely a fear of federal vs state control that this hasn’t already happened?
I don't think that conclusion follows. Rather, I think that conclusion is too narrow.
In this situation, the astronomic overall cost of such software would overshadow any other impediments, such as profit movite.
Why would anyone task even a public entity with this, if using paper ballots and manual counting is vastly cheaper?
Generally we want only those eligible to cast one vote each and yet the votes must be secret, anonymous and repudiable. But we also want the counting to be auditable by the public and traceable by the individual voter.
The advantage of paper is it's bulky so it's hard to swap out if people from multiple parties and observers etc are paying attention.
PS: Remember the oldies, "Vote early, Vote Often" and "It's Not the People Who Vote That Count, it's the people that count the Vote"