Hacker News Reader

Comment by atoav | Hacker News Reader

I shall repeat it like a mantra: voting beeing slow inefficient is a side effect of it’s transparency. You want a voting system were a average voting helper can look at it and say: “There was nothing fishy there, I saw it”. This is because it is about trust and not only about secrecy and security.

Your electronic voting system can be mathematically perfect, but if nobody average can say from the outside that everything is going by the rules and it makes sense, then it is worthless.

This is why paper works so well: it takes not much skill to count it, it has to have a physical place (harder to make it vanish) and everybody can have their eyeballs glued to it, and if something fishy is going on, it is harder to hide from the average voting helper.

Even I as a programmer with some crypto knowledge would never be able to fully gurantee for the integrity of a voting system, because who knows what software version is running out there in the wild, and whom I have to trust on that one.

Paper has no software version and errors in the process can (and are) catched more easily.

Electronic voting is good for decision were power is not involved, or where the outcome doesn’t really matter. I’d rather improve what we have instead of replacing it with a mathematical sound blackbox that everybody can with perfectly rational reasons distrust when the vote went into the wrong direction.

View on HN

Electronic voting is the classical solution to a nonexistent problem.

Just so the results of voting can be displayed on TV a bit earlier, we are supposed to accept substantial risks to democracy posed by blatantly insecure endpoints, blatantly insecure company infrastructure, insecure network communications and devices (routers, etc.), private companies that often have a track record of insecure and sloppy programming, voting machines that have been shown to be hackable easily (people from CCC and similar groups do that routinely when they get hold of a machine), voting program code that has been improperly audited and/or cannot be verified by the public, flawed patching mechanisms, flawed and insecure operating systems of voting machines, and on and so forth. The list of flaws of electronic voting systems is nearly endless, and, what's worse, there is no mathematical proof that the encryption used in those systems cannot be broken. (There are lots of proofs in cryptography, but almost all of them are based on very strong idealizing assumptions. In the end, only OTPs are provably secure. We do not even have a proof that P!=NP yet.)

> Electronic voting is the classical solution to a nonexistent problem.

That is incorrect. Voting is a feedback loop for the will of the voters. The slower the process is, the less representative it is. The fidelity of the loop is paramount, but the issue remains.

EDIT: do the downvoters understand that there is setup involved in a paper process and getting results is not the end of the feedback loop (not race)? SMH

"The slower the process is, the less representative it is"

If we are talking about months perhaps, but as long as a result is known within a day or two (at most) I'm not sure it really makes that much difference.

Surely the relevant feedback-loop time is the interval between elections, not how long it takes for votes to be counted.

The uk manages to get a result in general elections in < a day

This is only relevant if you propose to have weekly/monthly elections.

For elections every few years even a week of counting would not be a problem.

Although the longer counting takes, the more difficult it becomes for a substantial number of people to monitor the entire process. In the UK, counting takes place overnight, immediately after the polls close; it's feasible for multiple parties to ensure they have people at every location for the entire time, keeping an eye out for irregularities.

If the process were extended over a week instead of a night, it becomes correspondingly harder to ensure that there was never an opportunity for someone to tamper.

That is true, but if they happen digitally then that becomes completely impossible.

As things are now I see no reason of sort not to use paper ballots as the main proof of vote. Especially for big nation wide elections.

If that happens digitally (and using correctly distributed crypto signatures), then we can provide the public with the necessary tools to check every single vote.

> and using correctly distributed crypto signatures

you sort of lost me here. I will not say it is a bad idea, but it would never work in any country I know. Thee sheer size and cultural innovation required would still need to place an inordinate amount of trust in the system.

Again, it is not that it is evil, as much as there are so many possible problems for so little gain

(IIRC Estonia has a nice program where you have a state-SIM and you can vote via telephone, so there it actually might work)

>> you sort of lost me here. I will not say it is a bad idea, but it would never work in any country I know.

Bitcoin works this way though. It is a set of tools to manipulate a highly abstract data structure. These tools are developed by a minority of the population, but the rest of the population trusts them.

This works because it has value for the folk.

Now you're speaking about elections. Most of the people speaking of e-elections are _mostly_ trying to get to the public that if you could make the elections work electronically - then there's a bunch of other things that could be done digitally too.

One example - company board voting. What if you could be present at any board meeting because everything that is said over there is cryptographically signed by each party thus providing non-repudiation of whatever they said?

What if every newspaper reporter had to sign their articles with their signature which is linked to a news trust network?

Contract signatures. Inheritance.

This is a reply to your:

>> Again, it is not that it is evil, as much as there are so many possible problems for so little gain

Little gain is only for people who have no idea of what you can do with "digital".

I don't think I understand what feedback loop we are talking about?

Everyone who wants to be on the ballot registers a few months in advance, which is usually a short enough time. Since people are usually voted into a job they have to do for 4-6 years you don't want hasty decisions anyways.

Getting poll results while the voting stations are open is usually not a desired feature because of how it influences voters.

The delay for counting the votes measures in days, which is a tiny amount in a feedback loop where one iteration takes 4-6 years. Other steps, like forming a government, routinely take an order of magnitude more time in many nations.

> The delay for counting the votes measures in days, which is a tiny amount in a feedback loop where one iteration takes 4-6 years.

I think their argument is precisely that that's too slow of a time to reflect what the voters want and that a faster turnaround time would allow referendums and more of a direct democracy, even when it comes to minor issues, since 'representatives' often don't quite represent.

Such a system does need informed voters, otherwise it opens up to reactionary activism, but that's a whole another debate.

Canadian elections (federal and provincial) are done with paper ballots, and are always available the same day.

> Voting is a feedback loop for the will of the voters

Why should it go on both direction ? Even if it's true, is it a good thing ? You should change your opinion if you hear good arguments and not because you want to vote like the others.

> Electronic voting is the classical solution to a nonexistent problem.

And some may argue that voting is a pretty bad "solution" by itself.

And some may argue that democracy is a pretty bad "solution" by itself.

https://reason.com/2018/11/10/libertarian-critiques-of-democ...

And some may argue.

"Indeed it has been said that democracy is the worst form of Government except for all those other forms that have been tried from time to time.…" - Winston Churchil

https://winstonchurchill.org/resources/quotes/the-worst-form...

Electronic voting may be a harder to implement solution in terms of trust but the problem is not non-existent.

Voting today is a complex and costly process. Hence, it cannot be carried out frequently and hence the accountability/ feedback loop is slower.

Imagine if we could conduct voting in a day (even in large democracies). We would be able to remove bad representatives faster.

> Imagine if we could conduct voting in a day (even in large democracies).

That would be horrible. "direct democracy" does not work (Switzerland is also a representative democracy), practical policy making requires some domain knowledge, patience and the ability to make compromises that the Internet mob could not possibly deliver. People are generally very good at judging the trustworthiness of other people, however, and at being critical about other people (rather themselves). Both traits work well for a representative democracy.

Have you seen who represents the people?

just have a test we can take to illustrate competence in a domain. Passing the test grants us the right to vote on laws in that domain.

Then, those who represent us are those who have illustrated the intellectual capacity to make good decisions.

Who makes the tests, and who decides which domain a given policy proposal falls under?

> Just so the results of voting can be displayed on TV a bit earlier, we are supposed to accept substantial risks to democracy

You already accept the influence of corporate PACs, which arguably are a much bigger threat to democracy. Not saying you should add another vector, (electronic voting), just that the argument that there's a solid democratic system now is not quite true.

> You already accept the influence of corporate PACs

This is leading astray but just to make this clear for anyone looking up this thread later: I do not accept the influence of corporate PACs at all, and believe (but IANAL) that where I live these would be illegal.

> I do not accept the influence of corporate PACs at all

Good, but I meant "you" as in the broader society concerned about electronic voting, not "you" as the individual.

A corporate PAC is simply a group of people joining together to create political speech, with the added legal protection of incorporation. The Citizens United case was in direct response to the FEC approving nearly all corporate speech from liberal sources, while stopping conservative versions. Explicitly in the Michael Moore v Citizens United FEC complaints. Nothing changed for liberals voices in Citizens United, only for conservatives. Which is why this is such a polarizing issue as one side lost a hugely unfair advantage.

that is a version of the story I never heard before!

Can you share some links?

Where I brushed up on my info:

https://en.wikipedia.org/wiki/Citizens_United_v._FEC

A bit earlier?

Election recounts were triggered and entire countries and regions were affected because a recount couldn’t be completed in time.

Take for example Al Gore vs George W Bush: https://m.youtube.com/watch?v=qcz6NSyxrfQ

Because the recount was stopped earlier than it could be completed, Bush became President, stopped watching Bin Laden and we got 9/11, then invaded Iraq and Afghanistan and the entire region was heavily destabilized and overrun with Islamic terrorists. The largest geopolitical disaster of the last 50 years with effects as far reaching as Syrian civil war, Libyan anarchy, and millions of refugees and families broken.

If only a recount could have been done faster...

Has anybody even read the article? Jesus. Your comment is a complete non-sequiter.

There are two ENTIRELY UNRELATED questions. One question is "cryptographic verification." One is "Paper/electronic"

You can have any combination. You can have a crypographical, verifiable, PAPER voting system, for example (and that's what this article is about).

Did you read the comment you're replying to? Its whole point is that lay people don't understand sophisticated cryptography like homomorphic encryption, which makes it difficult to trust, whereas they do understand and trust paper. A cryptographic paper voting system that required advanced math to understand would have the same legitimacy problem as a cryptographic electronic voting system.

> A cryptographic paper voting system that required advanced math to understand would have the same legitimacy problem as a cryptographic electronic voting system.

No, because it'll still be counted manually by humans. What the cryptographic layer allows you to do is verify that your vote was properly counted or allow a trusted third-party to verify that for you. It doesn't take anything away from the paper voting system but only adds to it. That said, you'd still have to trust the device that generates your tracker, but maybe they've found a way to deal with that.

Paper ballots are vulnerable to systemic voter suppression of the kind that’s hard to eliminate. Voter ID laws. Complicated ballots. Overloaded polling stations. Worst, all these weaknesses are difficult to eliminate because they are both difficult to sincerely debate and difficult to generate the public interest necessary to generate enough activism.

Electronic voting can reduce the friction enough to where we can address these issues with common-sense approaches.

These are mostly solved problems in all western nations (except for the US). E.g. I am Austrian living in Germany and I vote by mail since a decade.

Mail voting has the downside that it invites the kind of problems where some guy tricks elderly people into giving them their vote etc. But all in all it works quite well.

AKA Granny Farming - which is a downside to postal voting which should be limited to those that need it medical reasons troops aboard etc

>>> These are mostly solved problems in all western nations (except for the US). E.g. I am Austrian living in Germany and I vote by mail since a decade.

The US has had vote-by-mail for as long as I can remember [0]... So what is an example of a "mostly solved problems in all western nations (except for the US)" other than an example that you posted that is inaccurate?

I'm not arguing that we have solved all election problems, but it's unfair to say we haven't solved something and share a solution that your country has that our country has too. Maybe Austria does something different with their vote-by-mail system than what the US does, if so please share what that is.

[0]https://dos.myflorida.com/elections/for-voters/voting/vote-b...

The US doesn't have vote-by-mail, we have mail-in absentee ballots and they're intended to be a last resort. You can only request an absentee ballot if you're unable to vote in person. You can't request an absentee ballot simply because it's more convenient.

That is an incorrect statement in many states. [0] I voted by mail in Colorado in elections that were held at least 20 years ago. [1]

[0] http://www.ncsl.org/research/elections-and-campaigns/all-mai...

[1] https://www.sos.state.co.us/pubs/elections/FAQs/mailBallotsF...

I'm not sure what state you are in, but that entire statement is not true in the state of FL.

Per the link I cited above as a sample reference to vote-by-mail in the US - "Vote-by-mail refers to voting a ballot received by mail or picked up by or for a voter instead of going to the polls to vote during early voting period or Election Day. Except on Election Day, no excuse is needed to vote a vote-by-mail ballot (see Who Can Pick Up a Vote-by-Mail Ballot below)."

The key phrase being that last one, "no excuse is needed to vote a vote-by-mail ballot". There is no verbiage about it being a "last resort" and that you can only vote-by-mail if "you're unable to vote in person". The Florida Division of Elections even titles the page "Vote-by-mail".

https://dos.myflorida.com/elections/for-voters/voting/vote-b...

How does electronic voting solve any of those?

- With electronic voting the identification problem is at least as hard as with paper ballots, so Voter ID is at least as hard (an honestly, I've never heard of any problem of this kind outside of the US)

- Electronic ballots could be simpler than paper ballots, but they can also be a lot more complicated. Under the assumption that voter suppression is taking place we have to assume that the electronic ballot would be more complicated than the paper equivalent

- Electronic voting still requires voting booths, meaning you can still overload polling stations. Voting from home is equivalent to mail voting (already a thing) and has a lot of problems if it's how the majority votes

Also all these problems have common sense solutions already:

- If the nation for some reason doesn't have a ubiquitous national identity system the government should take some of that tax money and hand out free Voter ID cards (perferably delivered by certified mail or similar)

- Designing ballots that are not complicated is a solved problem in most of the Western World

- Have enough polling stations that queue times never exceed 10 minutes. If queues are too long take note to make that polling station bigger in the next election.

Depends if "electronic voting" means "in-person voting at polling stations with existing polling cards and polling booths, but replace paper ballots with touchscreen vote-counting machines" or if it means "Voting by smart phone"

Although there are downsides to vote-by-smartphone, an advocate would argue you should compare it to vote-by-mail rather than vote-in-person, given that almost every election allows vote-by-mail.

Smartphone voting sounds like a recipe for disaster. The fact that votes are cast in private in an otherwise public place is part of what makes the system work. If you let a large number of people vote remotely, you have zero certainty that a) the voters weren't pressured into voting a certain way, say by a domineering parent or b) that the device wasn't compromised.

Personally I agree and am not an advocate of smartphone voting.

However, I can tell you what someone who was an advocate of smartphone voting would say.

To (a) they would say we already allow postal votes, so the pressure/vote-selling is already with us; and furthermore although the pressure/vote-selling is bad for democracy, low turnout and voter suppression like making polling stations hard to access are worse.

To (b) they would say if Apple Pay can be secure, so can online voting. Maybe even more secure! I mean, in my country the ruling party doesn't have enough members to put an activist in each polling station watching the ballot box, even if they worked a 15-hour shift without toilet breaks. So it's not like the current system offers total protection against fraud.

Went to a conference in 1993 or thereabouts, put on by a now defunct organization called "CPSR" (Computer Professionals for Social Responsibility). I rememeber Phil Zimmerman was a speaker. Anyway, one of the topics was the problem of electronic voting.

About 10 years later...

Underhanded V Contest http://graphics.stanford.edu/~danielrh/vote/vote.html

(If I remember correctly, the "Underhanded C Contest" came later.)

http://lcamtuf.coredump.cx/soft/vote.c

Now, a Microsoft SDK with a catchy name, "Defending Democracy".

What next?

Even a mathematically perfect voting system could be substituted in entirety.

Replace the whole damn thing with your own one in an identical case running system.out.println("my favourite candidate wins! ");

The correctness of cryptographic voting systems is determined by their publicly observable behavior, not by their internal implementation. It's the protocol that's secure, not the specific hardware or software implementation. So the attack you're describing doesn't really apply.

Cool, thanks for correcting me there

Having a cryptographically secure voting protocol doesn't protect you if the human-computer interface is compromised to alter the votes as they are being entered into the system. You get a code to verify that "your" vote was counted correctly, but because you're not supposed to be able to prove who you voted for to prevent vote-buying, you can't tell that the voting machine has slipped you the wrong code.

It may not be an admissible attack in the model within which protocols are proven secure, but it's still an attack that could affect real-world systems.

Homomorphic cryptography allows you to track your vote without revealing the vote content (who you votes for), but at the same time vote tallying is possible on the encrypted votes in a process that is verifiable.

Of course the trust only comes with understanding of the mathematics.

"publicly observable behavior" is a bit of a misnomer - general public can indeed observe ElectionGuard in action, but it will not know what it sees. Fortunately, Microsoft advocates using paper ballots as a backup.

But you cannot observe it. You see that someone with a hash X has voted. How do you know whether it was a real person, a real person voting under boss supervision, a real person who actually didn't take part in elections, or just sysadmin inserting records into the database?

That question applies equally to a paper ballot.

Watch person enter booth with fresh ballot, watch person leave booth with filled ballot, and check to see that person doesn't take pictures of their ballot. Seems pretty clear they voted and their vote can't be influenced.

Though the article is light on details, it does seem to provide for an identical level of verification. I'm more than happy to be corrected if I'm missing something, but it sure sounds like they are proposing an effectively identical verification scheme.

- You see the number of records aggregated, it should not exceed the amount of voters

- You can somehow identify your own vote and thus verify it was properly counted

- Everyone else can do the same, thus fraudsters would have to find a protocol weakness to add additional votes

One attack vector might be whatever you use to identify your vote. Aka find a way to make two people think the same record is their own vote, then use the other yourself. This seems like a tricky problem, since everyone shouldn't just be able to see their own vote was included but also not not be able to show others how you voted. The article seems to indicate they solved this somehow, but I'm not familiar enough with the details / homomorphic encryption to understand that or even just trust that specific kind of encryption.

Also prevent uninterested, lazy, people from voting out of spite.

I know it's unpopular to say, but I don't think it's a bad thing that voting requires personal (strictly personal; no corporation should get in your way) effort.

I agree. I never understood the notion of same-day registration, nor the constant blasting of voting reminders for months before the midterms. Do we really want people who have to be extremely convinced to vote, to vote? Do we really want people who didn't care at all, got convinced by one team the day of, and decided to vote on a whim, to vote? Thus, are the votes from people who had to be reminded on twitter and google to vote, "real" votes? Or were they gamed?

Yeah... all the talk of emotion-driven-politics makes me dizzy. Politics should be boring (if everything is ok)

Because the amount of spare effort people have available is correlated to class, and thus adding more hoops to jump through is yet another way to favor the idle rich over the working poor.

But I also don't see why the first sentence is inherently bad. Why is it good to police what type of people may vote? Why is it good to police the reason for voting?

I just feel that spiteful voting is damaging and a recent abuse of the confidence in the voter to do what’s right for 4 years.

This isn't an electronic voting system. It's a system for verifiable receipts that attach to paper systems.

> ElectionGuard provides a complete implementation of end-to-end verifiable elections. It is designed to work with systems that use paper ballots, supplementing today’s tabulation process by providing a means of public verification of the accuracy of reported results.

It's digital tabulation, AKA electronic voting.

This is the most common type of attempt to subvert paper voting. The paper becomes the "recount" which is often challenged in court. See? The numbers match, there is no reason for a hand count.

>The numbers match, there is no reason for a hand count.

The whole point of this scheme is to provide strong evidence for when the numbers won't match. This is an advantage over existing optical scan systems, where a recount requires watching every single paper ballot go into the reader.

Optical scan is electronic voting. Gaming optical scan machines was one of the first demonstrated hacks.

Hand counted paper ballots.

Right, but I don't think we should glamorize old-style paper voting either. Yes, it is easier for an observer to spot that something fishy is going on, but it is also easy for authorities to dismiss it as insubstantial. Someone obstructed your view of the ballot box for a few seconds? Sorry, that was an accident. Police evicted you from the poll station? Better behave yourself next time. You saw a blatant incident of fraud and you have hard evidence? Well sure, local officials went a bit over the line, we'll cancel the results of that particular poll station. Our candidate still wins.

My impression from fraud reports from Russian elections is that most fraud occured at the local level (where no one was able to precisely quantify it) and from the point the data was inserted into the centralized database everything was squeaky clean.

So maybe some kind of a centralized panopticon surveillance system that the FAAMG are so fond of is just the right fit for elections.

> most fraud occured at the local level

If it was something that was done at local level, not in conspiracy with central government, then why the investigations in cases of election fraud are so ineffective, and even if the case gets to the court, it typically ends with just a fine? If the central government didn't have relation to the fraud, they would prefer to punish local officials, yet they try to avoid doing it.

Instead, they warn heads of regions that the results of election in their region might affect their evaluation.

Regarding things you have described, they are possible with electronic voting as well. Hashes not matching? You probably made a mistake, verify again, our experts say that everything is correct.

Also, for an average person, seeing a video recording with officials throwing a pack of ballots into the box is easier to understand than some difficult calculations with hashes.

> If it was something that was done at local level, not in conspiracy with central government, then why the investigations in cases of election fraud are so ineffective, and even if the case gets to the court, it typically ends with just a fine? If the central government didn't have relation to the fraud, they would prefer to punish local officials, yet they try to avoid doing it. Instead, they warn heads of regions that the results of election in their region might affect their evaluation.

Maybe I misunderstood your phrasing but that's precisely what enables large-scale fraud. High-ranking officials can maintain plausible deniability by outsourcing fraud to the local level and doing nothing overt themselves. If low-level officials are caught, they suffer token punishment because some semblance of rule of law must be maintained (but punishment cannot be too strict because they were doing what they were supposed to do).

> Regarding things you have described, they are possible with electronic voting as well. Hashes not matching? You probably made a mistake, verify again, our experts say that everything is correct.

Right, but if you have evidence that say 10% of votes are tainted, it is something worth fighting for and going to the streets for. Whereas if all you have is a recording of a handful of ballots thrown into a box at some poll station in rural Yakutia, well who cares about a few 100s of ballots? You can try to string a few of these videos together to provoke an emotional reaction but it will subside quickly as public attention will be redirected to the next outrage du jour.

This is something that cannot be fixed with electronic votes, because if the powers that be cannot corrupt the system, they won't choose to use it.

This is why reproducible (even better; deterministic) builds matter.

Reply on news.ycombinator.com