But such a system is incompatible with the secret ballot, and is therefore vulnerable to voter coercion.
Didn't vote for the right candidate? You're fired "for performance reasons".
Didn't vote for the right candidate? You're fired "for performance reasons".
This has the same problem. Didn't waive your right to privacy and provably vote for the right candidate - you're fired (or worse). That's why taking photos of a ballot isn't allowed, you can't have any way to show who you voted for.
However, your "or worse" note still applies. E.g. a local gang could do the same thing, and they are unlikely to be stymied by illegality.
So, yes, it is quite different - an employer has no way to validate that an employee has voted a specific way. Any proof is not indicative of the final vote, unlike the proposed Blockchain solution.
Somewhat related, it reminds me of this anecdote about hand-warming handlebars on bikes: http://thedailywtf.com/articles/The_Complicator_0x27_s_Glove...
This all takes time, tight tolerances, and automation to a happen at an impactful scale, which minimal oversight would mostly prevent.
Compare this to an SQL statement to change a whole states worth of votes in a few hundred milliseconds.
You can always recount the paper.
Whatever solution, it require the limitation of involving something physical and difficult to manipulate.
A blockchain voting system would enable us to detect vote tampering, and then law enforcement would or would not do something about it.
What's the difference?
IMO, 99% of the people wont understand a blockchain system. To them it will just be "X won because a computer said so". So the question is do we want society to be filled with people thinking "I know those votes were made with pen on paper and were counted by my neighbors and trusted friends" or do we want society filled with people who think "it must be true because a computer said so"?
It’s easy to tamper with one ballot, but the level of coordination required to tamper with a large number of them quickly enough trends into the impossible category. Especially if you’re trying to keep such an operation a secret.
Like mandatory armbands for your religion, a public record of your voting activities is a terrible and dangerous idea.
None of those things you mention should be something employers can act on. In many states it would be illegal to factor those things into decisions about hiring, retention, compensation or promotion.
Now they do not come with who the individual voted for which is probably how they get around this.
So many times when you would call someone and say, "Records show you are a registered as a democrat/republican, is that correct?"
Rebuttal, "How do you know what I'm registered as isn't that illegal?"
Candid response, "Knowing who you voted for is illegal, I do not have that information, however your registered party is public information and any questions about who you voted for you can refuse."
Most of the time they didn't like that and hung up but meh throws arms up in the air not caring
This isn’t just a theoretical concern - there are various real-life allegations of it happening, in Southeastern Europe and other places.
Plus such coercion isn't impossible now, like you said it can be done with a camera. Presumably if you're being coerced by threat the "illegal" doesn't really help you at all.
It seems obscene to me to pass up such an obvious improvement like a verifiable record over such a theoretical concern.
1) Coercion is literally the biggest concern within elections. You put a big guy with a pair of brass knuckles outside of the polling location and he beats up everyone who comes out without a picture of his ballot with the right vote in place.
Theoretical? Lol. This WAS and IS common. This is why we have international election observers.
2) There's no integrity loss with paper if things are done right. Every ballot given out at a voting booth is recorded - you can't stuff the box as a voter. The only way you can do so is if election officials from all parties collude to fudge the books together, which they would need to do in view of the public as they man the voting desks, or under the supervision of the locale manager during the end-of-night count.
Paper.
See the paper "Backpage and Bitcoin: Uncovering Human Traffickers" which talks about using timing based reconciliation, relationships between wallets, and superficial metadata within Bitcoin to deanonymize human traffickers:
http://www.sysnet.ucsd.edu/sysnet/miscpapers/backcoin-kdd17....
Blockchain voting doesn’t mean you can then vote over the Internet — you’d just have a better type of system in place at the voting locations.
Edit: undo auto'correct'
Secrecy is also what makes it possible to stuff the ballot box with fake votes.
Thanks.
Not likely. Social stigma means the "acceptable" candidate would have a larger proportion of the public votes than total votes. For example, the Democrat candidate in Chicago.
This key can be used with a personal computer, or public voting computer, each using the same open-source, audited software, to produce a printed ballot with a 2D barcode on it, and a printed voting token with a 2D barcode on it.
The ballot printout can be scanned and verified independently, before casting it, that all the choices are correct. Again, all using the same open-source, audited software as the public vote-recording computers. This printout contains a hash of the voting token. This is so a party can't just print out a bunch of pre-filled ballots, and then hand them out for voters to cast, and also useful for recounts and audits.
A separate printout encodes the voting token. It cryptographically verifies that a registered voter is voting now. The voter registration system associates a different hash of the voting token, a voter hash, with the voter. The voting system can associate the ballot hash of the voting token with the voting choices. If you have a voting token, you can compute the voter hash, look up the registered voter on the voter site, compute the ballot hash, and look up what their votes were on the vote-counting site. You can't tell whether that particular ballot is the one that counts for that voter.
Because up until the end of the election, the voter can also request a new token, which invalidates their previous ballot, and cast a new one. That token will also be associated with their votes and their name, but the official election system knows to count that one, and not another one. Or they can request a "provisional", "test", or "decoy" token, which can be used to cast a ballot that will never be counted.
Anyone that attempts to coerce a voter into voting a particular way, or who tries to pay for votes, can be given a genuine token that is later cancelled, or a dummy token that was never valid to begin with. They have no means of validating if the token represents a vote that counts until after the election is over. At that time, an audit or recount might show that it was a decoy vote. You can't work backwards from a ballot to see who cast it. You can't work backwards from a public voter registration to see how they voted in any election. You can only start from the set of tokens, verify that one belongs to a registered voter, verify that it was used to cast a ballot, and if you also have privileged access to the voter registration system, determine whether or not that token is the single authoritative voting token for that voter in the current election.
In a recount or audit, the voter registration authority consults its database, finds all the tokens valid for a given election, computes the ballot hashes for each, and prints out all the ballot hashes, including machine-readable barcodes. A sorting machine could be loaded with the list, and automatically spit out a pile of ballots to be counted, and a pile of ballots that don't count. Or a human could sort them by hand, by consulting the list of valid ballot hashes, and crossing out the one printed on the ballot they are looking at. Any ballot not on the list, or already crossed off of it, goes in the "don't count" pile. Then, once again, by machine or by human, the ballots in the "valid" pile can be independently counted for the office or issue in question, and compared against the original automated count.
The secret part of this voting system is the secret kept between the voter and the government with respect to "does this specific ballot count or not?".
Now explain how that works to non-programmers. You may not hand-wave, you may not ask them to trust a black box, and they must truly understand and trust your system.
And then you can compare that explanation to the explanation for paper ballots, envelopes, and voting urns.
The public's trust in a voting system is a very important feature of that voting system. That the public can participate in voting is also a very important feature. If voting is relegated to a black box that everyone should trust, because, pinky promise, a very clever person designed the black box, then people will stop trusting voting.
I believe a foolproof computer system could count votes perfectly, but it may make our society less stable in the process. Our current population is not ready to understand a fancy computer voting system, and are not capable of distinguishing between a foolproof system and `print "I win!"`.
I currently have to trust a black box whose inner functions are hand-waved away such that I cannot understand it even if I wanted to. Established systems of voting have equally established attack vectors.
If someone cannot understand what a cryptographic hash function does, even if they don't need to understand how, they cannot function in civil society without trusting someone else who can. Someone might go to a hundred HTTPS sites a day, and the security works invisibly to them, with no complaints, and yet while voting once every two years, one of the simplest concepts in all of cryptography is suddenly a problem? It's simpler than Bitcoin. The public can handle it.
They are absolutely part of the voting system currently in use.
I strongly suggest that you follow tptacek's advice in the top comment and volunteer as an election worker a couple of times so you get a feel for how the process actually works.
> Someone might go to a hundred HTTPS sites a day, and the security works invisibly to them
Most people have no idea why or how that is more secure than HTTP, they can't tell the difference, they don't need to know the difference. But the biggest difference is that in online banking or whatever, there are humans who can check if something's gone wrong, if your account has been hacked, you can call your bank and ask them what happened, and you can usually trust them to know what's going on and what went wrong, and you'll get your money back. Or not, and then you can sue them. Either way, it's fixable.
Voting has no authority that can fix things if something went wrong. The voters are the authority, which means that all the voters need to understand and trust the entire system for it to be authoritative.
The black box I am referring to specifically is the optical scan vote tabulator machine that sits between me and the ballot box, in my current polling place. I have seen it multiple times, and examined it to the extent that I am able. When I lived elsewhere, there were different machines. Every one of them has been a black box to the voting public.
I very explicitly do not trust those machines, because I know how the grey boxes that build the black boxes typically work. The publicly available information about them does not inspire trust. They are defective by design, and stink of corruption.
Some places do have trustworthy elections, using publicly-observable hand-counted paper ballots, like in Minnesota; or slightly less trustworthy vote-by-mail for everyone, like in Oregon. Good for them. I have never voted in those places. Bad for me.
And voting does have an authority that can "fix" things. It's usually the secretary of state for the state, then the supreme courts for that state and for the US. I remember when the SCotUS threw the PotUS election to GW Bush by interfering in Florida's lawful elections process. They didn't back up the voters' authority in that instance. I have felt the frustration of statewide elections where I had a sense that someone was dicking with the results, and there was nothing I could do about it without putting so much effort in that I'd be turning elections activism into an expensive, thankless hobby.
I have zero trust in the current US elections process, and never believed that my vote actually counted for anything. I honestly don't know why I keep voting--gesture of defiance, maybe. I think the voting systems in every place I have voted have all been broken, from the enabling legislation all the way down to local procedures at the polling place. First-past-the-post is broken mathematically. Ballot access laws are cheating. Gerrymandered district boundaries are cheating. Restricted primary voting is cheating.
I can't do anything to fix the systemic flaws without spending 20 years becoming the controlling authority of a single-issue political bloc and fundraising it all the way to actual significance, but encryption math and open, publicly-auditable software is a lot less work, and could still help with the local procedures. Of course, we'd also need a trustworthy compiler that can produce bitwise-identical binaries of different machines, and a trustworthy computer to run the compiler on, and some way for the public to verify that the software running during the election is the same software that was compiled at the public ceremony. And then also assume that an attack on integrity might still succeed, and proceed under the assumption that the system is compromised, whether by intentional act or accidental mistake, by auditing the final results in a non-predictable way.
Buuuuuut... it's not really my job to restore trust in the system. That's up to the ones profiting from it. I have named a system that I, personally, could possibly trust. But it will probably not be adopted, because the trust comes from the tamper-resistance, and elections tampering is a feature desired by those currently holding elected office. In my estimation, voting in the US won't be fixed within the next 5 years, because there is currently profit to be taken by keeping it broken.
Oregon has had vote-by-mail for more than two decades; there are present-day voters who were born after Oregon dropped polling places entirely.
Vote coercion is not a concern, after 20 years of practical experience with the system. Neither is voter fraud (something like 54 fraudulent ballots cast, out of 2+ million, in 2016; the vast majority of those were people voting in Oregon and in another state.)
The benefit, however, comes in the form of increased turnout; no need to rush to a polling place on a day that's very likely not a holiday for you.
I wish everyone would switch to vote-by-mail the way Oregon does it.