Hacker News Reader

Comment by CydeWeys | Hacker News Reader

Here in NY (and I'm sure in many other places), you manually mark up a paper ballot with your vote. You then insert it into a scanner which confirms the ballot's validity and then drops it into a lockbox.

The votes can be tallied instantaneously through the electronic system, but if there's any irregularities the lockboxes can be opened and manually counted as verification. And you can open a small number of randomly selected lockboxes every election anyway, even absent any suspected wrongdoing, just as a check to verify that the electronic counts are working as expected.

How is this not the standard everywhere? Yes, there's more paper (and thus expense) involved, but surely having a non-hackable paper trail is worth it to protect our democracy?

I was at DEF CON the first time they did the voting machine hacking. Those did not fill me with confidence.

View on HN

NY's system is pretty good.

Something you don't mention but is another nice bit is they have poll observers from each major party watching at each elction site.

One thing they don't have but I wish for is that, after the machine-count totals are in, each party represented should be able to name a small number of precincts for an audit/hand recount. Parties at this point have pretty good modelling of expected results at a precinct level. That would give a cheap way to get lots of certainty against tampering of the machine vote counting.

> How is this not the standard everywhere?

Largely because election officials are also not computer security experts (or even serious amateurs). Therefore when "big corp" comes knocking with their newfangled electronic touch screen voting system that promises fast, effortless tallies and "security" (it's, right there, the box is checked on the ad brochure...) the election officials have no background with which to be skeptical of "big corp"'s products re. security. And with the promise of "effortless, instant, tallies" (vs. a long overnight counting paper manually) they see the newfangled thing as an improvement over that which they do understand (the long overnight counting paper).

The election administrators I've met are knowledgable.

This is IT. When have the technical experts been empowered to make purchasing decisions?

To know, is to know what you don’t know.

If you are buying IT and you aren’t sure about some spec, security apparatus or venerability, then you can’t be considered knowledgeable.

No one can be expected to know everything but then they should be surrounding themselves with experts and counseling with them ad nauseam

How do you tell if something goes wrong? I think what's often missing in these discussions is a need for automatic audits, too, even if not full audits initially but only for a small sample.

If there is anything wrong found in that first series of audits, then a full audit should be requiered by law and there should be severe prison punishments for those state officials failing to start and finish those audits in the specified time after the election.

Corrupt state officials should not be able to create any sort of delays or use them as an excuse.

I'm not sure how it's handled now, but what I'd like to see is after the election closes, a random method to select poll locations is used -- such as a lottery ball machine -- and those locations are then required to do a manual recount. No one has advance notice of which poll locations will do this, so there's no opportunity for cheating (eg, turning off a defeat device at the locations that will be audited).

If there are any differences in the count then additional locations are required to also do a manual count, and if more than two locations have differences, all electronic numbers are trashed and the whole election is counted manually.

In order to defeat this system, the attacker would need control of the lottery ball machine. But we're already assuming that the attacker has control over some of the election machines, so while this is still strictly better, it's small comfort.

This is basically what San Francisco, CA does. They use 3 10-sided dice to randomly choose 1% of ~600 precincts to manually audit. You can watch the random selection for the June 2018 election here: https://www.youtube.com/watch?v=wLSLlBkFY-Y

How do you tell if something goes wrong? Well, if you hand-count a voting machine, and it gives you a different result from the machine, then you know something went wrong. And if you hand-count a bunch of machines and they all have the same misbehavior, then it's time for throwing out the machine count altogether.

In Australia it's all hand-count, with machine count for verification. Specifically ballots are sorted by volunteers on election night to do the preferential voting, and then the stacks are counted and checked by essentially bill-counting style machines. Discrepancies mean someone else does a count and recount.

The key to all of this is involving as much of the public as possible though: democracy is government by the people for the people, the people need to be involved in its operation. The only way you dispel the idea of rigging is by ensuring a large plurality of your population was involved each time and would attest to their neighbors that they saw no misbehavior.

Electronic voting is based on trying to take people out of the process - it misses the point.

This is the point I always try to hammer home.

The inclusivity of paper voting is amazing. It doesn't matter if you are young or old, black or white, highly educated or illiterate, rich or poor, just about everyone can count ballots.

And if you think someone is trying to fuck you over, you too can go count along or watch that ballot box all day to ensure nobody is tampering with it.

Get a few hundred people in the same room that all don't trust one another and all count along. That's how you run an election.

..and we verify that everyone actually voting is who they say they are.

False voting is a severely overrated problem. It doesn't scale. One person might be able to make a fake vote/registration, or even a few of them. But enough to materially affect the outcome of an election? That requires an organized effort with likely thousands of people involved. Such conspiracies are impossible to keep secret.

Don't let something that feels wrong steer you away from much more severe and likely problems.

A large conspiracy would be caught instantly. But it doesn't have to be a conspiracy. If people know they can vote multiple times and can't get caught (and w/o checking ID I don't see how they can) a certain number will decide to do so. I can't say how often this occurs, but how can you even measure it to determine if there is a problem without some sort of ID verification system at the polls?

I don't think it's a problem that happens, though. If you're going to fraudulently rig an election it's vastly cheaper to do so by rigging the polling station than it is by faking the voters.

But by introducing voter ID systems you are very likely to skew elections away from the people least likely to possess accepted ID, i.e. the lowest socio-economic groups.

> I don't think it's a problem that happens, though

But how do you know. That's the issue. If P is the probability of getting caught, and C is the number of people caught then N ~= C/P. With our current system it seems like P is close to 0 so even with C = 0 there could be a lot of successful attempts.

Rigging a polling place is not viable because it would require coordination between multiple people and leave a clear mathematical trail after. So I would say that, including detection after the fact, that P > 0.5 and that the fact that it hasn't been caught means that N = 0.

> But by introducing voter ID systems you are very likely to skew elections away from the people least likely to possess accepted ID, i.e. the lowest socio-economic groups.

This is pretty much separate from my point but I am also skeptical about this. If someone can get to the polling place, stand in a line, and do paperwork to vote, then why could they not do pretty much the same thing to get an ID?

Apples and oranges. Polling costs nothing; ID costs money. Polling places are usually within walking distance of home (at least in urban areas); license bureaus are scattered and distant.

My polling place is two blocks from my house. I can walk there, vote, and be home in 20 minutes. Last time I had to renew my license, it was a three hour ordeal that cost me money and an afternoon of work, and the nearest station is miles from my house (in a dense city).

This is a good point. Would be fine with SSN as a unique identifier with no paperwork presented. Would be as easy to fake as current system, but would generate an obvious signal when there is a fake number or collision.

> Rigging a polling place is not viable because...

This argument is sounds great but doesn't match reality

https://i.redditmedia.com/NITi8srtcW0xIfOQXPZda6zJNrpb_jRbwg...

Edit: Link to the paper: http://www.pnas.org/content/pnas/early/2012/09/20/1210722109...

Ok, rigging a polling place in a well-designed system under rule of law is not viable.

Consider the Minnesota example. In MN, all physical ballot handling, whether marked or unmarked, sealed or unsealed, must be done in the presence of members of at least two different political parties. Since the only ways to rig an election at the polling place are to either add, remove, or substitute ballots, this makes such fraud extremely difficult to do, especially at scale.

Of course it's possible. And it probably happens. But can it realistically affect the outcome of an election?

As I've said, about 1.5M people vote in Minnesota alone. Altering the outcome by 1% would require 15,000 additional votes. And this would need to be completely one-sided, so the "anyone can do it" threat you bring up should cluster around the mean - about the same number of "extra" votes are cast for each side.

Don't get caught up in scope issues. The problem we are trying to solve here is the legitimacy of elections. Does a little noise around the edges actually undermine the legitimacy of the outcome? Can it do so?

Also, remember there ain't no such thing as a free lunch. Any mechanism that detects multiple votes by the same individual will produce a number of false positives - thus denying people who are not cheating of their vote. This is actually the pernicious, immoral logic of Voter ID laws in the US. They're marketed as ways to prevent fraud, but the actual intent is to reduce turnout in certain (mostly poor) communities. This is why support for these laws is so deeply partisan - one party is pushing for them, and one is fighting them, and the party pushing for them isn't actually that interested in fraud. Their political interest is partisan advantage, and their mechanism is misleading citizens about their intent, so people will tolerate what should be intolerable.

Scope and distribution is a good point, and I'm not trying to say that this is an issue that routinely affects elections (and if it is I would look at small local elections with tiny turnout), but it can't be disproven in the current system and this is a problem.

A system that ties each registered voter to a unique ID which is basically implemented for you if you require ID at the polls will have a false positive rate of ~0 much lower than our current system. This is actually a side benefit.

That fails to address my points, either that there will be a cost in false positives (have fun stopping that), or that the motivation for making political hay out of this is partisan advantage from the false positives, not actually reducing a threat to democracy.

Actually pretty easy. Thought of it after that post. No physical id requirement. Look into camera and enter SSN/DOB/name into PIN pad. If no match no vote. In case of identity theft there will be a collision and in that case let them through but send the photos and data to the police to arrest the faker.

Fun fact, not everyone has a social security number, and they thus aren't required to vote. There is no single national ID number that would work for this purpose. The closest thing would be some kind of state-based voter registration ID, but no one is going to have that memorized.

Florida's election fiasco in 2000 won Bush the election.

Yes, but that was a completely different issue from fraudulent voting (which wasn't found at any scale there); rather, it was a problem of bad ballot design and bad voting machines that didn't fully punch through the paper.

I would expect there to be a high number of cases where a person goes to vote and is rejected because "they" already voted. Is that not sufficient to raise the voter fraud flag without adding additional friction at the frontend?

This is a non-issue.

As an Australian living in the US now (where voting is ... interesting) I now recognize how awesome the Australian system is.

The other great thing not mentioned here is that elections are run by the AEC, a non-partisan commission.

They are also in charge of redistricting.

So you don’t have gerrymandering and you don’t have BS going on like what happened in Georgia where they “accidentally” wiped all the data 3 times when subpoenaed by the FBI.

Add to that compulsory voting, elections always run on weekends, and a thousand other small things and it’s like one country wants you to vote and the other does not.

> Well, if you hand-count a voting machine, and it gives you a different result from the machine, then you know something went wrong.

And you'll probably have to ask someone who's not in the room about what went wrong. With human hand-counts, the person you need to ask is already sitting there. No mystery, no confusion.

aka a recount. Rules vary by jurisdiction. eg When a contest is close.

Some places already do partial recounts. It is expensive. Most jurisdictions don't have the budget.

One thing I'd like to see is that every ballot gets a UUID assigned when it is cast. You get a receipt. All votes get published on a public web site. You can tally the votes yourself if you want to check the accuracy of the reported totals, and you can check your own ID to see that the vote was recorded accurately.

It's not a perfect idea, but I like the upsides more than the downsides.

This is unfortunately dangerous. It means that you can provide proof of your vote to others. That's no good; it makes buying votes or punishing workers/family members/whoever for voting the wrong way much easier.

That said, there are some really interesting non-interactive zero-knowledge proofs for elections that accomplish what you're intending without this flaw. Their main downside is that, compared to tallying, they're complicated.

Georgia had a very similar system, at least in my county, in the late 1990's. Then after the 2000 election we threw away the convenience of electronic tallies with the security of paper back up for the Diebold touch systems. I always feel like voting with those machines is just theater. There's no way for me to validate my vote.

This is not bad. Need to think about it... edit: Consider it is scanned after voting has closed instead, during counting. Does that change the characteristics of this system with respect to trust etc?

That would give up one very valuable feature, namely, that scanning it at the time you're voting gives you immediate feedback about the validity of your ballot. If you accidentally voided your ballot by voting for more than the allowed # of candidates in any given election, or if you didn't bubble in the ovals properly and it can't read them, then your ballot will be rejected and you can fill in a new one. If you wait to scan until after voting has closed, then the person's vote will be thrown away instead of fixed.

Also, how are you going to scan all these ballots after voting has closed? That would require opening up the lockbox, which tampers with the security of the system. Plus, you're no longer getting results instantly; you'd have to wait until the polling place is closed down, and then open up the box and scan all the ballots. What possible advantage does this have? It'd just slow everything down.

Reply on news.ycombinator.com