Hacker News Reader

Comment by nathan_long | Hacker News Reader

> I hate being outright dismissive but it sounds like an expensive html/pdf form with a printer attached.

I don't think that's dismissive at all. That's what it is, and it sounds good to me. Basically the computer is a scribe with perfect handwriting that fills out the paper ballot for the voter while the voter watches. Absolutely any voter is qualified to assert whether the ballot contains the votes they intended to cast.

From there, you could have the voter carry the ballot and drop it in a box that's being observed by any number of interested parties, providing old-fashioned accountability. Counting by scanner is an optional time saver, with hand counts as the alternative / double-check.

View on HN

Don't forget that electronic voting machines can have accessibility features that paper ballots lack - having a glorified form printer is actually a sound design that lets us gain these benefits without the negatives.

There is no reason an electronic count can't be kept along with the paper ballots.

How does that help? The paper ballots still need to be counted as they are the authoritative source of the final tally. An electronic tally does nothing useful and adds complexity.

Speed. One of the reasons some politicians want electronic voting is to have the tentative results in as fast as possible, so they can sod off to their respective celebration/mourning shindigs and call it a night. That the actual, lawful count follows in the course of hours or even days is, to them, then acceptable.

Having these machines do a preliminary tally gives you a more accurate forecast of the votes cast than exit polls.

Optical scan machines solve that issue quite nicely and more robustly, especially when a ballot needs to be spoiled due to error (it can be physically destoryed before tally instead of needing to support deletion or modification of records in the voting machine).

This is missing two completely unnecessary failure modes that pen and paper don't have:

1. You cannot know whether the device leaks your vote, i.e., whether your vote is secret. Mind you that in addition to an attack inside the device, this can also happen via simple electromagnetic side channels inherent in the device--as has been demonstrated quite a while ago for Nedap voting computers by the dutch campaign against voting computers, where you could distinguish selected candicates by tuning an AM radio to the right frequency.

2. When the device malfunctions, whether due to a defect or sabotage, and only particular candidates can not be selected, that creates a side channel where the voter is effectively forced to unveil who they want to vote for.

Neither of those failure modes exist with paper ballots.

> Neither of those failure modes exist with paper ballots.

Paper ballots stop secret cameras in the ballot room? I mean, they really don't. It depends on your threat-model. A lot of things will come down to trust.

> 2. When the device malfunctions, whether due to a defect or sabotage, and only particular candidates can not be selected, that creates a side channel where the voter is effectively forced to unveil who they want to vote for.

See Butterfly ballots. Paper ballots in USA (Florida specifically) which basically had this flaw. It was confusing to know which circles and lines were going to the correct candidate you wished to vote for. Asking for help on the ballot would leak information on who you wanted to vote for.

A poorly done paper-ballot has its own set of issues.

And the solution to the flaws of butterfly ballots was the proliferation of insecure, dangerous touchscreen machines. Screw that. Give me a well-designed paper ballot.

> Paper ballots stop secret cameras in the ballot room?

And neither do touchscreens. Paper is better if it's not done comically wrong.

And even the worst paper ballots have a much smaller attack surface for plain old analog rumors than the best possible electronic system. The most powerful way to undermine a democracy is not flipping some votes to one candidate in perfect secrecy, it's making all candidates/camps believe that the other did. This could destroy a democracy even without a single vote having actually been tampered with.

Electronic voting, only understood by experts, is perfect soil for such rumors and no amount of open sourcing can change that. The many human counters involved in a hierarchical paper vote counting scheme are not just an unfortunate inefficiency left over from a time when machines could not count yet, they also serve as witnesses, not only for keeping their peers in check but also for dampening any unfounded rumors that might come up. They increase trust even when they are not actively speaking up against rumors, just by being there, in numbers, as passive dampening elements like the moderator rods in a fission plant.

> Paper ballots stop secret cameras in the ballot room?

Ballot rooms are just about as decentralised and non-standard as it's possible to get your head around. Voting machines are the exact opposite.

Are we actually discussing that someone could or would roll out a (nationwide?) network of hidden cameras across church halls, schools, and other places[0] where people go to cast paper ballots. Undetected?

Distributing compromised software - or designing your attack into the hardware - for voting machines would be child's play by comparison.

[0] https://www.theguardian.com/politics/gallery/2015/may/07/wei...

> You cannot know whether the device leaks your vote, i.e., whether your vote is secret.

The electronic voting machine never is granted your identity. But I'll grant it's possible that records of the voter identity with the ballot identity exist and could be used to map the voter's vote.

These might be good arguments for letting people fill the ballot in manually, if they wish. Based on the design as I understand it, it seems like users aren't prohibited from printing a blank ballot and taking a pen to it themselves.

If these are open source hardware and software, then it is unlikely bugs like what you are talking about will slip through.

Could any of these problems be at least partially fixed by randomising how the choices are displayed in the input UI and on the printouts?

Reply on news.ycombinator.com