Hacker News Reader

Comment by mulmen | Hacker News Reader

I fill out my paper ballot in my kitchen then put it in a tamper evident envelope and stick it in my mailbox or personally drop it off at a designated location where any member of the public can watch.

The ballot has a removable serial number on it which is detached before returning the envelope. I can use this to look up the status of my ballot online and see that it was counted.

What part of this process is not secure?

View on HN

It's possible for you to easily and reliably prove to a third party how you voted, by doing these things not in your kitchen but in a place and time of their choosing with them watching you put the vote in a tamper resistant envelope that they can collect and put in a mailbox. This enables buying or coercing votes, which has been a big issue historically. Ballot secrecy is a must-have feature - it's appropriate to risk it if (and only if) it's necessary to enable voting at all - e.g. the current practice in many countries, where you can vote in absentia if it's not possible for you to vote 'properly', but it's an exception forming a relatively tiny proportion of votes.

A goal there is to have absolute plausible deniability - that even if you absolutely wanted to show to someone that you voted for A, then we need to ensure that you could do that show even while actually voting for B. If you want to fill out a paper ballot and put it in a tamper evident envelope, then it's important to ensure that nobody can watch (current solutions include in-person voting, and for people who physically can't come, my local elections include an election committee visiting these pre-arranged houses and collecting ballots while ensuring secrecy, i.e. that it can't be filled by a family member). If you want to take a picture of a filled ballot, then we need to ensure that either you can very easily take a picture of a ballot filled differently than you actually voted, or that you can't take such a picture. In systems where you have multiple ballot sheets (e.g. one for each party) and put the one you choose in the ballot box, and the others (for whom you didn't vote) stay outside, then you need to ensure that either everyone can easily and anonymously leave with a set of ballots as if they voted for someone else, or either noone can leave with these ballots.

This is a problem with digital voting. For example, there are various schemes of digital voting you can verify that your vote was counted properly while still remaining anonymous without your cooperation. But it needs to ensure that the vote remains anonymous even if your cooperation can be forced or bought.

Right but you forgot the escape hatch, that you can vote in-person on Election Day to override your mail-in ballot. This gives you the ability to vote for B while appearing to vote for A.

Correct me if I'm misunderstanding, but at least in California this doesn't seem to be the case: https://www.sos.ca.gov/elections/voting-resources/voting-cal...

It says you should bring in your mail-in ballot to the polling place, and if you don't then you can cast a provisional ballot "which will be counted after your county elections official has confirmed you are registered to vote in that county and did not vote more than once in that election." Based on that wording it sounds like if you already submitted a vote-by-mail ballot, then you would have already voted and your provisional ballot won't be counted.

> This gives you the ability to vote for B while appearing to vote for A.

Sure, as long as you're fine with whatever retribution the guy you sold your vote to chooses to take.

You're right. Someone who can afford buying votes can also afford people to watch the polling stations and report those who try to correct their vote.

Isn't this a problem with all voting? Even if you do it in a secluded booth, you could just take a picture with a discrete camera.

You could fill out the ballot as you were instructed, take a picture, and ask for a new one which you actually cast. We could even give everyone two ballots by default since asking for a replacement would be suspicious.

Even before cameras, you could go in with a pre-filled ballot and go out with a blank one. All someone needed to verify paid votes was one ballot per polling station (or 2 if voters get 2 ballots).

The part where your reverend demands that everyone who wants to maintain good standing will bring their envelopes with them to church where they will be filled out, sealed, and mailed together. Failure to do this will lead to expulsion, and family shunning.

Or even the part where I offer $10 per ballot.

Expulsion and shunning would make the Rev seem mean. But you're exactly right, just that it will happen under the guise of a free Sunday BBQ feast. Got to bring your ballot if you want to eat though!

The part where envelopes are mailed out en masse and are therefore trivial for fraudsters to obtain[0], and the complementary part where the envelopes are not properly delivered and are just dumped somewhere[1].

[0] https://nypost.com/2020/08/29/political-insider-explains-vot... [1] https://newjerseyglobe.com/local/postal-service-finds-some-p...

If I don't receive my ballot I can simply request a new one which invalidates the old envelope and ballot.

That only stops fraud if everyone knows how to and takes the time to do it. What about the tens of thousands of dead people still registered to vote[0]? How do they request a new envelope?

Do you have any answers for my 3 sourced statements other than naked assertions?

[0] https://www.washingtonexaminer.com/news/more-than-20-000-dea...

California has ~39,500,000 residents. 23,000 is 0.058% of the population.

Unless it's right before the election. Or maybe your ballot left your house and didn't make it back to the counting location. These aren't theoretical concerns, they're happening today [1][2][3]. And we see in some cases, there is a political bias pattern involved in election-related mail getting "lost"[4]. People affiliated with both parties have been involved in wrongdoing.

[1] https://www.msn.com/en-us/news/politics/three-tubs-of-ballot...

[2] https://www.realclearpolitics.com/articles/2020/04/24/28_mil...!

[3] https://www.nytimes.com/2020/04/09/us/politics/wisconsin-ele...

[4] https://noqreport.com/2020/06/28/caught-on-camera-postal-wor...

In WA ballots are mailed out to voters a month before the election, giving plenty of time to request a new one. If a voter doesn't mail it in time there are in-person drop off spots (basically big dedicated mailboxes) all over town leading up to and on election day.

I was a voter in Washington during the 2004 Gregoire/Rossi gubernatorial election campaign, and what happened during the recounts[1] has proven to me that mail-in balloting is fundamentally flawed and should be banned.

For those unfamiliar with the story, in the 2004 election for governor of Washington, the Republican candidate (Dino Rossi) won the initial count by a very narrow margin (261 votes), triggering a legally-mandated recount. The recount closed the gap to Rossi only winning by 42 votes. A manual recount was performed, and during the manual recount election workers "found" a bunch of ballots; in arguments before the left-leaning state supreme court, the court rejected requests for applying the same recount methodologies in all counties (in opposition to Washington state law) and the "found" votes, mostly from D-leaning counties, put Gregoire into the lead. The Democrats in the state then successfully argued in court against any further recounts, and Rossi conceded without taking his complaint to the state supreme court. Gregoire took office shortly thereafter.

I don't know who should have won that election, but to an outsider it sure LOOKED like some fraud was occurring, especially since the "found" ballots didn't match the statistical distribution of the rest of the votes in the counties, and leaned D significantly more heavily than the counties' original ballots.

So THAT is why I oppose mail in voting. Mail in ballots introduce custody, integrity and identity issues, as well as enable vote-buying and selective vote harvesting, and so are amenable to fraud. We have seen all of these things happen; they aren't theoretical.

[1] https://en.wikipedia.org/wiki/2004_Washington_gubernatorial_...

Thanks for sharing this. It was well before my time in WA.

I'm not sure how this relates to mail in voting though? If there was fraud and D ballots were being hidden where was that happening? Wouldn't it be during counting, not transportation? Would voting in person have changed this or made it impossible?

Oh, my bad, I didn't tie things together.

The found ballots were absentee ballots, which were the only form of mail-in balloting available at the time.

Thanks, I'll have to do some more research on how those absentee ballots differ from the current system. Do you recall if there were changes to mail in voting based on this election?

  A manual recount was performed, and during the manual recount election workers "found" a bunch of ballots

This is exactly what happened with the Santa Clara County (CA, USA) transit tax a few years ago. It initially failed by several hundred votes (2/3 majority was needed). Over the next few weeks, they kept "finding" additional ballots, and every batch had disproportionately high Yes vote percentages on the measure (although all other races were unaffected). Then the second they reached the needed threshold, they conveniently stopped finding ballots.

How are the serial numbers allocated? If I can predict the serial numbers used over a swath of land, I can replace a large number of ballots dropped in its boxes with my own that have the same serial number. Those I can't predict, I just deliver as-is.

Probably need the equivalent of poll watchers to pick them up from the drop box and deliver to the monitored counting center. I'll believe the tamper-evident nature of the envelopes when I understand the solvent or process required to remove the adhesive without tearing the cover.

The drop box pickup has poll watchers.

The serial numbers are also tied to my address and name so you'd have to both decode the system used for generating the numbers and know the number the state assigned to me.

Do you know the system that encodes your name and address into the serial number? I hope it's a strong one-way hash in order to preserve your anonymity. I also hope it's valid, and not easily identified as one to discard in favor of the right one. Since the state generates the serial number encoded from your personal deets, it's not anonymous until the vote has been separated from the envelope without any association of its contents to your serial number. If there's any such association, your vote is no longer anonymous.

And a root of trust here is state IT systems. In addition to state actors (the nation-state type), we have the classic insider threats driven by both elected and career officials. Need to assume a higher level of competence at least than election commissions have deserved in the past.

The poll watchers are interesting. Do they watch each box from the time it's placed on the curb until the time its contents are entered into the counting system? (What's the overnight security like on them?, what's the transit security?)

Yes I sound like I'm trying to find problems...

So tamper evident mail was never opened before?

https://archive.is/jx8Ey

Edit: fixed URL

> Spanish officials have violated the most sacred rule of international relations by opening a British diplomatic bag at the border with Gibraltar.

Huh?

I stopped reading after the first sentence but did a quick search. The words "tamper" and "mail" don't appear in the article.

Reply on news.ycombinator.com