Can Our Ballots Be Both Secret and Secure?

If we really want to use new technologies to make things even safer, we could film and broadcast everything so anyone could check that there was no cheating (and I assume some people would record it so we could check also after the fact)

I am not saying digital election is better, but I would like to see a formal securirty/risk assesment of both options against known voter hostile counties.

With mail-in ballots for example, what if small groups of mail persons(1-5) manipulate absentee ballott mail when sent to and collected from voters, how does that risk compare to say insecure network connections and poor authentication with digital voting systems. A formal threar model for both approaches and risk assesment that is. Both methods are not secure, as a techie, the vulnerabilities of digital systems is glaring and obvious but they mean little in terms of risk wihout applying a threat model.

You said paper ballots make mass fraud hard, that is because of the threat model you had in mind. The chaos of the 2000 presidential election shows a slightly diffrent threat model where organizing large number of people was not needed. Bad guys will always find a way, what I like to do is to take an empirical approach at making thier mischief harder to pull off.

Really, really smart people, even in technology, who should know often cannot see this. It seems like one of those magic eye pictures https://www.magiceye.com/stwkdisp.htm

If you don’t see it, you don’t see it.

Also - not sure about the implications of Corona virus and social distancing. The in person requirement becomes a potential to die or potentially spread a deadly disease.

Making voting hard makes the system ripe for abuse, and that's exactly what we see happen all the time.

What we need is a system that is efficient and safe. There are cryptographic voting systems in which the government publishes the entire result; everyone can see that their own vote (only) was counted appropriately; anyone can see that the overall vote was fairly counted; empowered auditors can randomly audit to ensure all votes are real. That is far superior to the existing, corruptible system.

Edit: adding some conditions on the crypto voting systems.

No, all you need to do is play with the distribution of those hundreds of thousands of locations such that "your" voters have an easier time getting to them, on average, than your opponents' voters.

Your threat model isn't quite right. A deliberate third party attempt to fabricate votes isn't the only attack vector. You need a system that is robust against untrustworthy insiders too.

However, if you want to tamper with a whole state of paper ballots, you have to stuff a thousand ballot boxes. The chances of getting caught are far higher.

It is disturbing how much voter disenfranchisement is allowed in this system.

If there's a disagreement the human counts are repeated until within 0.001% and then they're official.

How does it handle people who can't leave their home? Or people who are away on the voting day?

Do I have that kind of time? No.

Am I going to give more than a cursory glance at open source voting software? No.

Am I going to catch 100% of accidental bugs? No way!

Even if I do, am I going to catch 100% of deliberate and obfuscated bugs? Hell no.

Even for me, a very technical person, purely electronic voting is fatally flawed in terms of trust.

Can you tell me how current voting systems work, because it is a black box to me and I can't even verify that my vote counted for the person I picked. From what I can tell, the local election officials can tally the votes however they want.

then just list all results (by that id) on a website somewhere.

you hang onto your id stub, and can tell if your vote was mistallied or left out.

this can work w/ a digital or traditional analog system.

(maybe need some more work to figure out how to ensure there aren't just extra "ghost" votes padding the results.)

And it doesn't always work. I assume you're German, so I'm inclined to remind you of Bremen's election 2015 where a group of students change votes to advance one party. When you have a very politicized election, you're going to need more than trust in procedures.

I don't know that some software will help there, but "we're doing it on paper" doesn't solve the problem.

https://www.reuters.com/article/us-usa-election-north-caroli...

https://www.npr.org/2019/07/30/746800630/north-carolina-gop-...

So obviously the voter needs to be careful to place the mail-in ballot correctly into the USPS and then the USPS has to be trusted to deliver the ballots correctly.

Beyond that, the mail-in ballots are checked against the registered voter rolls. So the state has to maintain clean voter rolls.

But this is not much different really from in-person voting. In theory, I could go to my local polling location and claim to be one of my neighbors, sign their name, and take their vote. They'd only notice if they showed up to vote later. But I'd likely get caught if they'd already voted. Or maybe the poll worker would recognize me. There are lots of scenarios you could imaging getting away with a handful of fraudulent votes. But it would hard to be able to do anything significant enough to affect the outcome of most elections.

https://www.snopes.com/fact-check/mail-in-ballot-voter-fraud...

Mail-in ballots are sealed in a tamper evident fashion inside of the permit, to prevent modification. Because opening the envelope would probably damage it, a duplicate enveloped (forged permit) would need to be produced to modify the ballot. In most cases a duplicate ballot would also be needed, which presents its own obstacle, although ballots are not generally intended to be protected against forgery.

The postal service is backed by a particularly strong set of criminal laws which generally make a felony to interfere with the mail. This is of course on top of laws protecting the voting system from tampering.

The outer envelope (permit) is a sworn statement and signing for someone else's ballot would be perjury, a felony, in addition to other laws around voting that likely exist in the state.

None of these measure are perfect, but combined they make vote-by-mail fraud difficult to achieve on a meaningful scale. Remember that, to be effective, voter fraud needs to be successfully committed not once, but many times. The difficulty of each case and general history of harsh prosecution of small-time fraud creates a significant disincentive to try.

The voter will mess this up a disturbing fraction of the time. It will be rejected. The voter will try again, possibly have it rejected again, give up, and go on Twitter to complain about the new system.

Also, I can go to vote, surreptitiously take two strips of paper, use one, pocket the other. I coerce my spouse into using that one, and pocket the one they took.

> It becomes difficult to coerce a voter because they can say any one of the published ballots is theirs.

Maybe for simple ballots. A question including e.g. a ranking of ten candidates has about 3.6 million possible configurations -- more if undervotes or other ties are permitted. The voter can be coerced to fill this out in a specific way to self-identify, and then vote in a prescribed way on another question.

edit: Of course, this vulnerability already exists: the voter could be given that same instruction. An observer of the ballot counting process can tell if the correct ballot was cast.

1) Current election systems, with few exceptions, do not retain per-ballot voting information, only tallies. This is in large part a practical matter, ballots go through various channels of handling including exceptional cases (e.g. hand entry of damaged ballots) and many of these paths become much more complicated if you need to electronically record the individual selections on each ballot.

2) The risk of re-identification of voters to ballots is high and extremely difficult or impossible to satisfactorily resolve. There are many, many potential ways to establish which specific ballot was cast by a given voter. This is especially important considering that in many elections the number of voters per ballot style (which may be equivalent to a precinct in your area, the exact combination of questions which appears on the ballot based on voter location and potentially party affiliation) will often not be very large, even in densely populated areas, because of course as the area becomes more densely populated the electoral precincts become smaller.

Finally, your step 2 is quite unnecessary for current purposes, the physical possession of both the ballot and permit are sufficient to prevent overvoting. One permit entitles an individual to cast one ballot. In the case of mail-in voting the ballot is sealed inside of the permit in a tamper-evident fashion (the outer envelope serves as permit). It also presents a more complicated and worse privacy proposition than the existing system, as the ballots can be post facto linked to the permits and someone could have (likely did) observe the voter take the permit. In current practice ballots cannot be linked to permits after they are physically separated when the voter casts their ballot. This protects the voter by reducing the time period during which their ballot can be identified.

[1] https://en.wikipedia.org/wiki/Scantegrity

"digital voting systems can be hacked, exploited, or otherwise..."

Paper mediated systems have visible failure modes. Missing ballots. Spoiled ballots. Etc.

Black box voting systems fail silently.

2. Someone can coerce you to vote a specific way by forcing you to provide them with your private key.

Voting needs to be available to all voters - we need to avoid putting in a barrier the would turn elections into "all voters who have smartphones".

Observers are present to ensure nobody correlates the the information with the ballot or tampers with the post-opening process.

Instead, it is its potential for giving the people with power more ability to control and enforce the voting behavior of the people over which they have some kind of influence.

For example, a boss can offer a bonus to employees who would verifiably (e.g. under supervision) cast an online vote according to the "company's recommendation". Or a landlord can say that the rent will be raised next month unless the tenant votes under the landlord's supervision and according to the landlord's preferences.

Such practices probably exist today as well. But the difference is that in the physical voting system, even the people who are being pressured to vote in a certain way are in the end required to be alone and behind a privacy screen while casting their vote. So, even if they have been forced to promise to vote in a certain way, they eventually have the freedom to vote as they like without having to fear that their actual voting behavior will be revealed.

That freedom originates from the requirement to cast a vote in private. Availability of online voting removes such a requirement.