We should really just go back to paper ballots, which are not perfect but are a lots less hackable at scale and are much more trackable than electronic machines are.
I went to watch a count for the local elections in May in the UK (I was a candidate)
The papers were counted in front of me and dozens of other people from the various parties. I could see each one going into each pile of ten, each pile of ten being bundled as a pile of 100 and put into a basket, the ambiguous ones (blank, voting for multiple candidates, writing "WANK" next to all candidates but one (which had "NOT WANK" written next to it), went into a separate pile.
At the end of the counting the returning officer went through the ambiguous ones with the candidate or agent and explained if he would accept it or not.
This doesn't take long - it scales, and is fully repeatable by completely different people if needed. The problems that seem to occur are not in the count, but in the returning officers (who tend to be doddery old men) writing the wrong result down, and for some reason this result is final, but that's the same whatever the counting method.
That's not complicated -- just post each vote in a different box (paper can be different colours) and count them separately. OK it may take a day or two to find out who your local parish councillor is. Whoopee.
You probably start to get fuzzy about your state rep/senator. And are pretty much clueless about the county Sheriff, Board of Selectmen, and Register of Deeds.
In practice, a lot of the positions lower down on the list are running unopposed or have been in their position and seemed to have done fine for a while. Of course, this being Massachusetts, a lot of these seats are pretty much Democrat locks anyway.
We tend to have 5 or 6 layers of government too so I don’t see the problem there.
I have no issue with European countries sovereign decisions, but when Europeans project their ideas on Americans I take great offense.
Reminds me of the line from some American tv show where one character says "I don't vote, I just write down Jesus," and another says "we count that as a Republican vote."
https://www.joe.co.uk/politics/voter-writes-wnk-all-over-bal...
[0] https://www.google.com/amp/s/amp.cnn.com/cnn/2019/07/26/poli...
But you'd need mandatory random audits, and a legal requirement to keep the paper originals for up to years.
There's been cases of the paper ballots being destroyed while legal action was ongoing, and a never audited system cannot be trusted (because there's implied trust, not tested trust).
Mandatory random audits are part of the system. We get automated counts from the Scantron machines, but those are unofficial, preliminary. On election night, there are random audits of some number of voting machines for hand-counts, to detect systematic fraud. And the total number of ballots in each machine is hand-counted to make sure it matches the totals given by the machine.
Paper ballots that are hand counted. Ideally, streamed live.
More seriously, France has paper voting, yet results are published at 8:00:00pm, closing time of the last voting offices. How? Statistics. And only takes the night to confirm, when we’re on a 50,3% kind of results. And it’s already 60m voters; If it works for 60m people, it will work for 300m (especially if only 120m vote in USA).
Or you publish all the marked ballots, so that anyone who wanted to could do their own count to verify the results.
You can also design this so that any individual voter can check to see that their ballot was included in the count, and counted correctly, without being able to prove to someone else that they voted for a particular candidate (so that vote buying schemes aren't enforceable).
See Scantegrity [1] for a specific system with these properties, which can be implemented on top of existing optical scan vote counting machines. For a more general look at securing voting, see end-to-end auditable voting systems [2].
[1] https://en.wikipedia.org/wiki/Scantegrity
[2] https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy...
To use a metaphor, it's not having 2 locks on your front door, it's having 2 different keys that open the same lock.
Say you have a hybrid system, and the numbers come in and the electronic and paper counts disagree. Which one is used as the true vote?
If you take the paper, then what was the point of the electronic? If you take the electronic what was the point of the paper? If you throw out all votes where the paper and electronic disagree, you just enabled any "fraudster" the ability to disenfranchise any subset of votes by breaking either system.
You also can't exactly pick and choose which to accept per instance (could you imagine the abuse that could come from that!?), and methods of "averaging" them don't really solve the problem as much as they make it marginally harder to pull off (to sway 1% of votes in a 50%/50% weighted system, you'd only need to hack 2% of the electronic machines). And of course using a significant "disagreement" between paper and electronic to trigger re-doing an election isn't a solution either because if they hacked it the first time, chances are they can do it again. Not mention that having a second voting day because the first was taken over by fraud is going to be a logistical nightmare, it will change who can come out to vote, and it may even change who/what people will vote for.
If what you want is an audit or a second count, then call for more exit polls or an explicitly secondary system. But this whole dual-voting idea isn't really a good one when you really dive into the dirty details of how it would work.
If the result is 49.999% vs. 50.001%, you cannot conclude anything meaningful about the will of the people. Maybe the weather was just slightly worse in a neighborhood supporting the losing candidate and it tipped the result slightly.
So even if the voting process is perfect, that close of a result is totally random for other reasons.
Most people don't seem to be capable of thinking about non-determinism like this, though. Witness the huge number of Americans who think the presidential election is illegitimate because Trump got 46% of the vote to Clinton's 48%, when honestly 46 vs. 48 is very little difference in terms of what they mean about the general will about Americans.
On the other end of the political spectrum, witness the amount of Brits who think a 52-48 vote to leave the EU is somehow relevant.
In calculus/analysis terms: this is why proportional representation parliamentary systems are better -- because the function from "how many people support which parties" to "what policies you end up with" is not discontinuous.
If the UK ran on a proportional system, they'd be getting some sort of very soft, Norway model Brexit. If the US did, a center-right Democrat like Clinton or Biden would be PM.
Routine double counting all votes would be controversial due to the high cost.
The whole electronic voting movement started because people had difficulty with ballots in Florida; a _good_ UI would help alleviate this.
Still, better than touchscreens, if you can mandate audits and that recounts actually mean counting the physical ballots themselves.
This is not a vote of confidence for this particular method.
https://www.quora.com/Why-does-India-not-use-ballot-papers-f...
Paper ballot boxes are just as hackable at scale with those requirements.
For that to be any consolation, we’d have to unconditionally trust those who have physical access to the machine and tools/keys.
Such trust is not necessary with paper ballots because they can always be hand-counted with supervision from both sides of a disputed election.
A vote count given by an electronic machine has no such auditability.
> Paper ballot boxes are just as hackable at scale with those requirements.
“Hacking” a stack of paper, e.g. ballot stuffing or destroying ballots, is something people can see happen. It’s not impossible, but it is very difficult to do out in the open with security cameras and the public there to watch. Not to say it doesn’t happen, but you tend to make a much bigger mess doing it.
That assumes they aren't replaced at some point. For a nation-level election this is probably too difficult to significantly influence an election but at even a state level it's relatively doable with a little coercion and/or carefully placed individuals even in 2019 in the United States.
You also have the option to do voter impersonation in states without voting ID laws, again this would mostly only work at a more local level.
https://www.heritage.org/voterfraud documents 1052 CONVICTIONS of voter fraud in the United States with 1,216 proven instances.
Outside of the United States there are all sorts of examples, including standing out the polling places with force to let people know vote our way or we'll shoot you.
Have you never heard of bribes or threats? It happens with juries, I imagine it happens with poling places, and I imagine some of those convictions involved exactly that.
If you've reached a point where you are willing to tamper with an election, greasing some palms or finding something to threaten key people with is not going to make you lose a single wink of sleep or have any mental reservations or other hesitations. People like money, like a lot, and if you haven't the funds to bribe them with the 21st century offers a horde easily discoverable information about people and those close to them.
Also, with presidential elections in 2018, there were no prior notifications and the government didn't know who was going to become an observer before the voting day, which was nice.
Sadly, you cannot become an observer by yourself, I don't like that.
I haven't heard about bribes or threats, but there were cases when an observer was taken away by police for allegedly being too loud and obstructing the voting. In recent elections, independent observers used a Telegram chat for coordination, so that they could ask for consultation or ask someone else to come to the polling station if something happened.
In Russia fraud is usually committed by election staff who often are public school employees, social care or government workers, people who are paid by the government. And typically they prefer to falsify results when there is no observers, they don't want to appear in Youtube videos.
Of course, in other countries the situation may be different.
The Russian Revolution established a control-freak government that hated freedom; Lenin was a self-annointed genius. The USSR failed because the incentives were misaligned.
My grandparents immigrated from Russia when their parents saw the pogroms in the 1890s. Using scapegoats, promising free stuff, and fear mongering is over 100 year tradition. Emotion and anecdotes over data.
[0] https://www.nytimes.com/2019/07/27/world/europe/moscow-prote...
But this allows us to see what measures to ensure transparency work in such circumstances and what don't. We see that independent observers and paper voting at polling stations help to prevent fraud and electronic voting would be completely opaque and uncontrollable.
I'm sorry to report that I feel your government is at war with my country.
Holy whataboutism. Yes Russia is a far cry from a healthy democracy but that has no bearing in any way on paper ballots. You seem to have just changed the subject entirely.
A successful voting process both accurately counts the votes, and is trusted by the people. Computers can count, but they are not seen as trustworthy by the people. Paper is more understandable and trustworthy. Even as a computer programmer I'm not sure I can trust electronic voting.
Thus, even in the absence of any actual hacks or fraud, electronic voting is inferior at a primary objective of the voting system, being understandable and perceived as trustworthy.
Unlike electronic voting, paper ballots are much more difficult to manipulate. If a voter has marked a box for candidate X, you cannot change it or ignore it if there are observers. An observer can verify that voting goes according to the rules and votes are counted properly. The most popular way to "hack" paper voting is to organise groups of people and ride them on a bus from one polling station to other so that they can vote multiple times, but it is more difficult to do, and easier to spot than simply replace the firmware in a voting machine.
In the case with an electronic machine, you cannot see what's happening inside.
You have the option to mail in your vote or to vote in an advance poll, but these options close a week before the main poll, so if your name appears on the list at your polling station, they're pretty confident you haven't voted yet.
Assuming there is no external IO such as USB or Ethernet, someone would have to disassemble the machine and solder a programming header in order to re-flash the device.
> to disassemble the machine
Is it that difficult?
Hack paper ballots: bribe the multiple people, including representatives from each party who cares to send one, to look the other way while you steal a box full of paper ballots and substitute your own.
It’s not impossible, but it’s much harder to mess with paper ballots at scale and much easier to secure them.
No they arent. You need one guy with physical access to to a machine, at any time, to screw an election, with manual counting you need everyone in the room conspiring to rig the election during the voting hours. With the possibility to volunteer to count votes and publishing the voting numbers for each voting station, you just dont get those situations.
I know its an unpopular statement, but having a democratic election is not a new problem to solve. Most western countries do it just fine. This is not a problem with the concept of paper ballots but a absurdly broken system.
How can you trust that the machine will behave as you expect in a "real world" setting, when the results truly count?
IMHO, the biggest risk from electronic voting machines isn't some rando swinging the elections with their 1337 haxx0r skills: the biggest risk is that the machines basically come "pre-hacked" from the factory - either intentionally, or unintentionally (bugs happen).
So simple, so effective.
in-person paper voting doesn't suffer from that problem, because you walk into the voting area, write your vote on a piece of paper, then you yourself place it into the box, and you can then stand there and watch the ballot box with your own eyes until they are counted, at which point you can count along.
Let's say your parks department were headed by a libertarian guy who vehemently opposes using public funds to fill a landfill and turn it into a park and he finds out his deputy voted for the ordinance to spend the money on said park. He could retaliate.
Another hypothetical could involve your local councilman finding out which members of his district voted for him and which didn't, and using that knowledge to influence who's streets get priority when plowing snow this winter and which don't.
Any voting system, including those based on blockchain, should be designed in such a way that disclosure of someone's vote is entirely up to them.
You get the speed of automation with a paper trail in case you have to go back and audit.
EDIT for those replying that you feel voting should be anonymous. With anonymous voting, how do you stop the "hey we just found this box of filled in ballots" ala Broward County Florida every election? If you can't tie a ballot back to a voter, how do you know the ballot is legitimate?
Just because Florida is unwilling to do it doesn't mean it can't be done.
To be fair, I believe that is not the case across the state, just certain areas (i.e. county level).
Florida's electoral incompetence and corruption (probably) handed the 2000 presidential election to Bush. Because of that, we wound up with the Iraq war, and a mind-boggling amount of American blood and treasure (not to mention Iraqi lives) wasted on lies. Florida's inability to conduct free and fair elections has tangible consequences on me as a Minnesotan. So yes, I want to impose some standards and values on their elections, because their elections lead to MY president.
I'm not suggesting a federal takeover of elections. I am, however, pointing out that some states, like Florida, are running elections so badly that it harms other states.
Edit: thanks for all these clarifications!
Thus, if they audit they can be sure the ballot was cast by a legitimate voter.
If you don't tie ballots to voters, you go full Florida where they just keep "finding" boxes of prefilled ballots.
You MUST tie a ballot to a voter if you want your elections to have any integrity at all. There is no other way to prevent double voting, voting out of precinct, etc.
Broward county, 2016 election. They found a box of filled out ballots at the airport return in a rental car trunk... never a word about it again. Same county, defying a judges orders, the police stopped anyone from entering/auditing the count under direction of then admin Brenda Snipes.
Guess who oversaw Bush / Gore recount? Brenda Snipes.
What is the definition of insanity again?
A lock generally needs to be stronger than the motivation of a would be thief. In this case we are talking about controlling the disposition of trillions of dollars so there probably isn't a lock in the world that is good enough.
Based on prior stories many of the machines aren't merely not good enough they are quite laughable and indeed often so old that no parts can be sourced anywhere because they haven't been made in decades.
There's no way to do that without tying the voter to the vote somehow. Why not hash the voter ID + a secret of your choosing and store that with the vote? Then, even if counting by hand, you can verify your vote was indeed cast for X candidate.
I would rather be able to verify that my vote was cast to the desired candidate than to have a strictly anonymous (but unverifiable) voting system.
EDIT: Mail in voting is skimmed with little to no risk. Oops, lost 1% of that zip code...
Assume a million votes are cast in an election. To move the needle 1%, you need 10,000 votes. And let's assume a single fake voter can realistically cast ten votes in different precincts, considering vote time and travel time (they can't just keep coming to the same precinct, for fear of recognition).
So you need 10,000 fake registrations, that must match real addresses, and you need 1000 people working all day at fake voting. One voter out of every thousand would be working for this conspiracy.
Now, you need to do this in complete secrecy. Nobody can talk. Nobody can gather evidence. They can't go to the police, or the media. Even one leak is enough to not only ruin the scheme, but create a nationally known scandal. And if it can be connected in any way to a particular political party, that party's name would be dragged through the mud across the country.
It's insanity. No one could safely pull it off.
You know what can be pulled off, though? Voter suppression. Make it much more difficult for certain categories of voters to actually vote. Such as poor people who might not have ID (or might hesitate to use it). Then, convince a large swath of the public - people like you - that this is about security, not suppression. That form of election manipulation is now seen as patriotism, not corruption.
I can see that happening maybe a few times, but it seems ineffective on a large scale.
If they already voted? "Oops, I forgot."
If they haven't voted and come in later, so what? You're long gone.
This may sound laborious and slow but it should be enough to block repeat voting, IMHO.
Voter ID is entirely orthogonal to this issue. Tying ballots to a voter is not desirable, since it opens the door for voter intimidation.
Edit to respond to the "hey we just found this box of filled in ballots" comment: anonymous voting means you don't know how someone voted, but whether or not they voted is still public record. The number of ballots counted still needs to match up with the number of votes cast.
> Paper ballot tied to a voter via a strong voter ID + electronic counting is the best of both worlds.
Hand counted paper ballots are the only way to be sure, and elections are important enough to be worth it.
Nope. Ballots need to be anonymous. Otherwise you can be coerced into voting a particular way.
With anonymous ballots, you can just "Find a box of ballots" and have no way to authenticate that they came from actual voters vs fraudsters.
We regularly get precincts reporting more votes than are even possible given their total number of eligible voters.
Fraud in anonymous voting states is rampant here.
Any precinct reporting more votes than possible given the numbers of eligible voters is recounted. If the recounts can't manage to arrive at results that make any sense at all the entire precinct is ignored. Where's the problem?
It was across both parties in multiple states wherein the "found" votes were heavily favoring one party or the other (a few were well outside 3 standard deviations from the current votes, even in areas that were normally not heavily favoring one side).
It continues to be implausible and easily prevented without de-anonymizing the vote or resorting to strong voter ID.
And those IDs usually require proof of residency and/or a copy of a US birth certificate, which can be problematic to acquire or prove in their own ways for the more vulnerable to disenfranchisement (such as the homeless) in our society.
If an election method cannot be audited, it cannot be trusted.
Note I said nothing about whether recountability is a good thing. It's clearly a good thing. Hence we should stick with hand counted paper ballots since machine counting introduces trivial ways to game the vote.
Finally, the punishments need to be strong, swift, and decisive if something does come up as being wrong. You can't just be "oh well, mistakes were made with the hundreds of thousands of mis-counted votes/purged voters. What can you do?!"
No way. None of that. All the people responsible in such a situation should be investigated, and if found guilty punished. Otherwise, there will be no fear of trying to steal the elections, especially if the upside is big.
Without a massive outreach program intended to reach all voters and supply them with convenient, free of charge voter IDs, and a system that can continuously and quickly resolve errors, such a "strong voter ID" would be unconstitutional (for good reason).
It's ridiculous to assert that it doesn't exist in practice due to lack of evidence when in reality pretending to be someone else to vote leaves virtually no evidence. You can't even begin to analyze the problem so its laughable for you to assert such things.
If it's happening at any significant rate, without perfect knowledge of which eligible voters won't vote (or have someone else try to steal their vote, which is just as bad for the prospective vote thief), it leaves quite tangible evidence in the form of people presenting themselves to vote under names that have already voted.
The absence of this occurring fairly strongly indicates that vote stealing by impersonation isn't a thing that happens at any meaningful rate.
If there was more than what vote theft operation in the same area, you'd still expect them to have collisions.
> 2 out of 3 people don't vote.
Wrong. A majority of the voting-eligible population votes in Presidential elections.
> If you have ever volunteered at a precinct you would know that it's literally just an excel sheet of names
A printed paper sheet, sure. Whether Excel is used in making it or not is immaterial (I assume it's generated straight from the voter database, which I hope isn't Excel.)
> and you're supposed to check someone off.
California state law requires the actual voter to sign in on the list; I would think that this is normal.
> It's very easy to check the wrong line
If it was a just a check off, maybe it would be easy.
> It's very easy to check the wrong line and your failsafe is easily explained away as a mistake instead of raising any sort of alarm.
Even if it was just a check box, you'd also need to have extremely lax procedures that all the poll workers and any observers were all in on for this basic integrity check to be routinely ignored.
Given the political factions interested in selling the idea of rampant voter fraud, you'd expect them to raise a ruckus if there were actual instances of this going on routinely.
You'd also have to either randomly mark off some non-voter (potentially creating a new instance of the problem) each time this happened or turn in a tally sheet where the count of marked voters didn't match the ballot count. The former would magnify the visibility of the casual disregard of integrity, the latter would definitely raise an alarm in counts.
Also, here in Russia, voters put a signature in the voters registry when receiving a ballot.
It's especially ironic.
How often do any of these things actually happen? It’s all public record. The data is there for analysis. And yet nobody can point to more than a handful of examples.
The common reply to this is that you need these documents anyway to work, to drive etc. This is true but ignores all the peripheral people you don't see. People whose roles in their family are support or who themselves are in need of support because of illness. Not all of them drive or work and they are citizens too.
It seems to me that the easier solution is to make public records free. Let the taxes you already pay serve to pay the salary of the peon at the printer. Then the people clamoring for us to check ID's to keep the "illegals" from voting can be happy and those people can be enfranchised.