Hacker News Reader

Comment by mshook | Hacker News Reader

The issue I have with pure electronic voting machines are numerous: it's hard to audit them and it's been shown many times in the past how easy it is to compromise them.

But if you put aside the security or the bug free status of the whole thing, a true democratic vote has at least 2 properties:

1. it's anonymous

2. it can be audited by a layman

Because of the complexity or bugs or whatever, #1 cannot really be guaranteed. Voting machine vendors will say they have no way to track voters until someone finds a flow or figure it out. Or machines could be altered or hacked or...

But really the biggest problem is #2: because if there's a problem, you need a paper trail. Because in the event of a recount, you want your average joe or jane to be able to recount ballots.

You could bring all the blockchain stuff (because I often hear that) or what not into the argument, you still wouldn't be able to do both #1 and #2.

So to me, voting must remain a paper thing.

View on HN

A voting machine can produce a printed ballot which is scanned by a separate counting machine. This can be checked for consistency by the voter. Also, you can have more than one scanning machine to verify the ballots are counted properly. And you have a paper trail if a recount is necessary.

So the voter would not only "print" his own ballot but check the consistency? That's not what I call audit. Audit is supposed to be multiple pair of eyes during counting. Plus you'd possibly lose the anonymity of the vote if the voter did both (timestamping transactions and so on).

If all counting machines are the same, how do you know they're not all wrong? Or not all tampered with?

And even if they all give you the same results, how do you know it's actually correct or how do you decide to recount? You have no real way to: you have to count. So at that point you might as well have counted in the first place.

Ideally you should have multiple vendors and make sure they all give the same results. But who's going to do that?

> You could bring all the blockchain stuff (because I often hear that) or what not into the argument, you still wouldn't be able to do both #1 and #2.

You can't do both #1 and #2 now. An anonymous ballot can't be audited, because it has no provenance -- if somebody slips an extra ballot in, how would you tell?

It is very hard to split in more than a few ballots, i.e. an amount that will change the result.

In Denmark you don't know what the ballots look like before election day, so you can't produce them in advance, and they aren't printed on printerpaper but is larger and the paper has a distinct texture/feeling.

Here it's almost impossible to slip an anonymous ballot.

The ballot box is made of transparent plastic (something like [1]), and you don't slide the envelope in it yourself. The slot is blocked until an official pulls a lever to let it go through.

So you put the envelope by the slot, if you keep holding it you will be asked you to let it go (so you can't cleverly hold multiple of them while it looks like one). They'll check again who you are and if you can actually vote and so on. If all is good, an official will pull the lever.

[1] https://www.jpg.fr/content/images/product/09812-00J_1_xnl.jp...

That's not the end of the process. At some point, the ballots are coming out of the box. Slip your extras in after that.

You can't do that either because the way it works here is you're being given a sealed bag with all envelopes coming straight for the ballot boxes and that process was supervised by multiple persons.

And then you have:

- one person who opens the envelope containing the ballot and unfolds it

- one who reads out loud the ballot

- at least two who write down what the person above said

And all that is supervised by the same people who were manning the polling station (at least 4 them).

So if you have multiple ballots in the same envelope, they will call it. The only way it'd work is if they all worked together. And you'd have to do that for a couple counting stations in many given polling stations... That sounds like an inside job you couldn't keep secret for long.

Because one thing I forgot to mention: counting is done at the polling station, it's not centralized, only results are.

Again, this sounds like something that happens before the theoretical audit. An audit by definition happens after the results are reported. It is a process meant to double-check that the original process, which you describe above, gave an accurate result.

If you stake everything you have on the original process being incorruptible, then your only response to an audit that shows a discrepancy must be "the audit is wrong". That's unlikely to satisfy many people; if that is your only strategy for dealing with audits, you are running an inauditable process.

Reply on news.ycombinator.com