Let's put e-voting where it belongs: on the trash-heap of bad ideas (2016)
theguardian.com
theguardian.com
What more software could do though, is create more transparency. And I can't believe I'm saying this, but this may actually be one of those cases where blockchain could be useful.
It is absolutely absurd to me that we have thousands of non-experts deciding to keep or throw out ballots based on comparing a signature.
With a more electronic method, a citizen's vote could be signed with a key generated from a few unique identifiers like social security number, numbers in your street address and maybe a credit card number. My vote could then be forever logged in the blockchain. This could create more transparency because everyone could see and count the votes.
After voting, you could also give every voter a "receipt" where they could go online and check in the public blockchain to confirm that their vote was counted successfully.
And I don't think we would need any sort of shared and distributed blockchain. Just a public one that can be verified by 3rd parties.
AWS has a managed blockchain service that I'm sure would work fine.
So while it may not be a good idea to open the actual voting to the entire public internet, that doesn't mean that sound math and technology couldn't be used to make elections more transparent and thus, secure.
I do agree with you that the US needs to adopt something like Estonia's national ID system [2], with cryptographic signing capabilities for official purposes, but this should only (for elections) be used to digitally sign your paper ballot (with similar weight that your hand signature on a paper ballot would carry). We should also encourage mail/absentee ballots for everyone in every state.
[1] https://www.pcmag.com/how-to/how-to-track-your-absentee-ball... (How to Track Your Absentee Ballot by State)
I think the best option is everyone has an issued id, don't remember it? You can use your SSN or state id (drivers license), the # is mailed to you when you register/re-register or get your ballot.
You can vote as you normally would, you can setup 2-factor methods on your id's. If you have a phone 2-factor set, the minute your vote is tallied you get notified of the result, if it's not what you chose, you can contest it.
Easy one-click-at-all-times access to voting trail, also uniformity, we need a system like this to be uniform, we need to end 50 states with different rules per county on how things are run.
I went to look at this. It operates on the honor system; what purpose is it supposed to serve?
An actual ballot-tracking system would need to provide me some evidence that they knew something about my ballot. This doesn't.
However, vote buying literally stopped being an issue the day it started being prosecuted seriously and never came back. You simply can't do it at meaningful scale without getting caught.
Why not? Just run a Tor site, where users can submit their receipt/verification and get crypto. "Free money" will spread fast with barely any marketing, and as we've seen from voter turnouts, lots of people don't give a shit and will happily sell their vote to the highest bidder.
Which of the 11 tor sites will you submit your receipt to now?
The problem with verifiable voting has always been that it opens the market to vote-selling. If you can prove how you voted, your vote can be sold for a significant amount of money -- or worse, your employer insisting you vote a certain way, and asking for your receipt after. This won't work until there's a mechanism where you can confirm your vote while also having plausible deniability.
For example, an employer who threatens to fire employees who "vote wrong" would not be blackmail.
i.e. I can go look online and knowing that I am voter abc123, I can confirm my vote was counted correctly. I can also see vote def456 but I don't know who it belongs to.
abc - A
def - A
ghi - B
jkl - B
mno - B
First of all: using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea. All of those have been leaked and are present on things you present to identify yourself or pay. Also requiring a credit card or home to vote would almost certainly be unconstitutional.
Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it.
I'm not saying it's impossible but there are so many problems with electronic voting that I don't even know where to start. At least with physical ballots we can manually recount if we need.
And that's before we even start talking about how current systems are basically swiss cheese for hacks, just look at the voting village for the last couple of defcons.
Related (and amusing) links:
https://www.youtube.com/watch?v=w3_0x6oaDmI
If it does do you think that you can make the general public trust/understand it enough to run a election?
I agree that the more difficult part of this would be encouraging adoption and supporting use. There are hardware keys like yubikeys or hardware crypto wallets that can be populated with voter-generated keys to be used in the voting process, and these hardware keys could be populated in a process similar to getting a driver's license perhaps, except not waiting for it to arrive in the mail. Perhaps you go into your local clerk's office and they have a one-time key generator that populates your hardware key. I definitely haven't fleshed this idea out beyond some basic musings.
PS: Well at least the first two, third one being the mandatory xkcd meta-reference :D
Your receipt does not have to mention who you voted for in a way that's verifiable by a third party. But this problem is also a problem for mail-in ballots.
>using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea.
Agreed, this does not mean that it is not feasible. You could use some zero-knowledge based proof that ensure that the person is allowed to vote and has voted only once without knowing his identity. Mail-in ballots are also problematic in that regard.
I dislike that people say evoting is a bad idea when we already have things like mail in ballots which are analogous to a poor e voting system.
>Also requiring a credit card or home to vote would almost certainly be unconstitutional.
But don't you need a registered address to vote?
I'm not 100% sure here but I thought homeless could vote?
> mail in ballots which are analogous to a poor e voting system.
I think it is mostly about scale. It is hard to impersonate 10000 people it requires physical objects, it is easier if it is digital. One of the videos deals with this, timecode here: https://youtu.be/LkH2r-sNjQs?t=140
The identifiers would simply be used so that the individual could check and validate that their vote was counted and counted correctly. But perhaps those identifiers wouldn't be necessary since you could simply assign a random uuid after the person votes that they can then use to look up.
Also in the US you don’t have a single election, you have 50 individual elections all with different ballots and different rules, the federal government doesn’t run the elections in each state. This means that you’ll have 50 different systems. There is little that technology can do with a system that already provides transparency by having a physical hard copy of each vote cast and allowing essentially any citizen to become an observer.
Then again, I am biased as I am lucky enough to enjoy the benefits of well implemented electronic voting and signing system in Estonia. Source code for Estonian voting system is published in GitHub [2].
[1] http://research.cyber.ee/~jan/publ/mobileverification-ieee.p...
This isn’t possible for nations which do not want mandatory ID laws.
It also then makes the ID card a good target which specifically the Estonian one was found to have quite a few issues.
Lastly trust in a voting system isn’t just can someone alter the vote but how easy it would be to deny people from voting and any electronic voting system will be susceptible to a wide range of denial of service attacks, what’s worse that these systems are susceptible to denial of service attacks that could corrupt votes cast causing not only those votes to be cast out but making the entire system being suspect.
That can be done with open source software running on a PC connected to a punch card machine.
We could also let voters confirm their choices with a punch card reader hooked up to another PC running separately developed software at the polling place.
You can still the votes electronically. But also count the physical ballots. Two counts are better than one. Somebody woould have to change both to hide cheating.
Record the raw ballot in a block at the same time to make it even harder.
These are solvable problems. If we can keep cryptocurrency honest, we can do it with votes.
If each vote took 1 minute instead of 10, would there still be a line?
edit: Or if not shorter lines, maybe 5 voting machines instead of 20? or 4 poll workers instead of 10? Seems more efficient all around.
Estonia's government issued ID card has a chip on it, like a debit card. The card contains a private key. The card uses a two-factor authentication system: you have the physical card itself (with the private key) and 3 PIN codes. PIN1 along with the card is used to identify you. PIN2 along with the card can be used to give electronic signatures. A PUK code along with the card can be used to unblock the card if the user enters a PIN incorrectly 3 times in a row.
The system is pretty convenient. It allows us to do things like online banking, give electronic signatures on documents (you put the file in a container and sign the container), and also electronically vote. Effectively, it's a way to electronically verify whether somebody is who they say they are, and this verification is backed by the government.
It is convenient to electronically vote. Some time before election day people can cast their vote via an application on their PC. They can vote multiple times. Online voting ends before election day and anybody can go vote in person even if they've cast an electronic vote. The last vote cast counts. This makes buying votes ineffective, because a person could sell their vote any number of times to different candidates. After you vote a QR code appears in the application. You can read that QR code with your smartphone to check on your vote for 30 minutes or 1 hour after voting.
The server side source code is open.[0] The votes get moved to a counting server and get counted. There are quite a few issues in this process as found by an independent audit.[1] (I really recommend reading it if you're interested in this topic.) However, most of those problems seem to be relatively unlikely or at least there's a good chance we would know that something is fishy.
However, I don't like e-voting. I have three main problems with this system:
1. The system is opaque to the layman. The government can take every step to ensure transparency in the e-voting process, but it doesn't matter to the average person. An average person doesn't understand enough about how software and computers work to be able to tell whether foul-play was happening or not. The process of voting in person, counting those votes and tallying them up are much easier to understand. It's easier for an average person to tell whether the in-person voting process is being tampered with or not. I think this point alone makes e-voting a bad choice.
2. It relies on the security of the average user's devices. It's conceivable that a large scale malware attack could compromise the machine the user votes on and the device the user uses to verify their vote. It's unlikely, but Estonia is small - it can never put in the resources that a large country could.
3. It relies on the security of third party software and hardware. If consumer/enterprise hardware is compromised on a global scale, then that likely means that the e-voting system is vulnerable too.
E-voting is more convenient, but ultimately I think that such convenience is overshadowed by the risk. In person voting in Estonia is very easy (at least in cities). It has never taken me more than 10 minutes from arriving at the voting location to leaving. If the goal was to just make voting more convenient, then they could've just added more voting booths and put them in supermarkets.
I think this article can give you a better overview.[0] It talks about a vulnerability previous generation id cards had, but it also explains more on how they work in general.
[0] https://news.postimees.ee/4234809/criminals-could-have-theor...
Briefly: an election only counts if everybody can believe the results. Making an expert level understanding of CS a requirement to verify your voting system means that Joe Q. Average who doesn't hold a PhD (or maybe even a college degree) has to rely on spooky experts telling him what to believe. If I were in his shoes then I would have no confidence that I participated in a fair and valid election.
We kind of live in a bubble here on HN where most people are sort of in the tech space and could take a weekend or two to understand blockchain. I think its easy to forget that most people don't have the required background to learn it easily (or would want to use up their time to understand it). I almost have a PhD in the hard sciences and I don't fully understand the finer details of block chain. I think I would have to write my own implementation to fully appreciate it.
Simplicity and the ability to explain the system to every American is a requirement of any voting system.
The Joe is for example driving a car full of electronics and somehow he doesn't have issue trusting his life to it. And, if anything, i'm pretty sure that deep understanding of that car's electronics and software would make the Joe to only trust his car less (one can google the software expert's opinions during the Prius self-acceleration story)
Now, I do believe that my vote was actually counted, but I have no rational basis for this, as I don't have any kind of record or visibility into the process.
I don't think any voting process can actually really tell you that your vote was counted. At the end of the day you're just trusting that the people running it aren't corrupt, or at least that there are enough people involved that keeping shenanigans a secret would be incredibly difficult.
In a digital system, I'm not finding jack shit. It doesn't exist anywhere except as a counter, I can't check whether it's my vote or randomly created after the fact (after suspicion was announced), and I can't trust the system itself, because it's defined by, developed by, and operated by some random group of people who managed to slap the thing together and make a sale. I can't get in there and check out any of it myself (even as just a vague threat), and the conspiracy group is sufficiently small as to be viable (I only have to "convince", what, 40 people, to cheat the votes?).
What I don't understand is why not use something like the SAT exams -- trivially hardware-counted, but also physically transparent and available -- and solve like 90% of the problem that way?
If people don't believe the results of an election, then it is de facto illegitimate.
I can see how the argument still holds water if half the time the outcome of the election didn't go his way.
We know many people want to tamper with elections. The CIA has done that much. The same is not true for cars. Steal cars, yes. But cause a random car to crash on purpose? Thats pretty rare. If were common, I personally would not trust my cars electronics either. And neither should you.
Even outside of that, elections require trust in the process. Already, with a "simple" system in place, we have to trust that no one is committing fraud, that votes aren't being surreptitiously added or thrown out, etc. E-voting doesn't fundamentally change the trust dynamics at all: people ultimately need to believe that the people in charge of the process aren't up to any funny business or bad at their jobs.
This argument gets used a lot to argue in favor of first past the post. Explaining a Borda count or single non-transferable vote is harder than explaining: most votes = win. But I think it ultimately comes down to trust: if the people voting trust the people involved with the process (even if they don't understand the nitty-gritty details) they will accept the results of an election.
A notable difference is that any John or Jane Doe can become a poll worker or poll watcher with little barrier to entry no matter their background, and verify the integrity of their elections should they choose to do so.
To me, the lack of the ability for an average person to do this would significantly change the trust dynamics.
Widespread distrust of subject matter experts already exists in the US. You can't just tell people to shut up and listen to the experts.
The efficacy of vaccines is one of those things that is almost impossible for the average person to verify. I can get in a plane and confirm for myself that it doesn't fall out of the sky. I can't get a vaccine and directly compare it with my chances of catching the flu without one. That's the reason why people widely trust the safety of planes, but there exists an anti-vax movement in the US.
Even with alternatives to first past the post, the complexity is of a wildly different scale than blockchain. I can sit down with someone and go step by step how ranked-choice works right now without looking up material. I'd have to pull out reference material and then start with the basics of hash functions or something to explain blockchain.
After you cast your vote what happens after that? Who counts them? How are they counted? How are those counts counted toward the total? Who is certifying all of this? How are those people chosen?
We do also have predictions on TV as soon as the polls close at 6PM, and they are always off by a few percentage points, but they rapidly converge, especially because the official results come so fast. By 8 PM there is not much chance for surprises (maybe one or two parliament seats get reallocated as percentages shift), by 10 PM the predictions have pretty much reached their final destination.
(And by the way, we have a ton of mail-in ballots, too. The federal supreme court ruled in 2009 that everyone can have a mail-in ballot if they want, so it's getting more popular every election.)
If a citizen wants to check the election process, they can go to any polling place (including the ones where mail-in ballots are counted) and watch the polling workers count the paper ballots. The volunteers are obligated to announce the final tallies to all citizens that are present to observe. (There are not always people present, but I've seen it happen a few times when volunteering as a polling worker.)
Then afterwards they can go to the state election office's website and verify that the same numbers appear for that particular voting district. I've done it once just to see how the verification process works, and I think the whole process is very easy to understand and verify for every citizen.
There's plenty of other scenarios where we can see discrepancies between trust and understanding (for example, the general public's trust in recycling vs what actually happens w/ plastics). Heck, the US election system is quite complicated today and yet people trust it. For better or for worse, humans are often fallible and illogical.
[1] https://en.wikipedia.org/wiki/Electronic_voting_in_Brazil#Be...
If such a system could improve the visibility and auditability of results down to small regions, and intuitively show how that cascades up to state level results, it could be a win.
Making an e-voting system believable seems more like a UX/design challenge than a technical/engineering challenge.
Again, whichever outcome, USA is going to have half a country that doesn't like or trust the election results. Not the voting booth ones, not the mail-in ones, not the popular vote, not the official result or the "official" result.
Seems to me that if people trust the leadership, they would trust the voting system endorsed by the leadership, not the other way round.
- We don't care about the speed of the results. That is trivially false, everyone is following the reporting, Trump is out there saying he won, people question the delays and suggest they may give time for bad actors to rig the vote.
- It's too expensive - There is no backing to this claim except "it systems routinely go over budget"
- It disregards secrecy as important - secrecy is a vital part of an election process. It allows people to freely have any opinion they want without consequence or fear of people forcing them to vote for someone else (violence or other).
- Accessibility - I'm not sure how they can assert that we can't make e voting accessible?
EDIT: For those downvoting, please do provide a reason why you disagree with what I said. Is any argument in that article actually strong?