Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Eight states[0] still have electronic voting systems without paper backups. They're un-auditable. I'm not going to weigh in on the current politics of this situation, but US Election security is awful, now, and since at least 2000.

I actually did my degree thesis on designing electronic voting systems (and built one), and ultimately concluded it was impossible to make them fully secure. The best you can do is paper backups and random audits to detect anything illicit followed by a full audit if that fails. No paper backups results in it being undetectable.

Computers are good at making things more efficient, but in terms of election security the inefficiency is a feature (i.e. it takes more people to alter votes, and the more people you add the harder a lie is to keep).

[0] https://thehill.com/policy/cybersecurity/457168-report-says-...

View on HN

Canadian here. We still count ballots the old fashioned way and get our election results out the night of the election (typically). Presumably that scales linearly.. more voters means more ballot boxes and more officials counting and auditing. This seems like a solved problem to me.

Why doesn't/wouldn't this work in the US? My guess is the complexity of your ballots -- we typically vote for one person and every couple of years there might be a referendum question.

That and having Elections Canada run everything instead of each province rolling their own protocols.

Imagine that: a non-partisan agency, much as the police and fire services are also non-partisan.

It's always non-partisan until it becomes partisan somewhere along the line

The police are not non-partisan, at least in USA.

It's hard to imagine any worker staying non-partisan when one party is threatening their paycheck.

One of the main reasons it is taking so long is the volume of mail-in ballots is extremely high compared to prior elections. And on top of that, in several states, Republicans were adamant that vote tabulation not begin early to deal with this volume, with the entirely foreseeable result that counting took far longer than necessary.

Right. That's this year. What about the last 20 years of US elections?

What about them?

Presumably you’re thinking of Florida in 2000, where the margin of victory was 0.0092%, and thus exceptional care in counting was merited. As far as I can recall other national elections have been timely in the last 20 years.

In most elections, the election results are clear by the time I go to bed normally.

I'd also like a citation on the Canadian counting.

There last election wasn't particularly close and from my understanding the mathematics of someone other than Trudeau + Liberal party winning were pretty much set.

Republicans wanted ballots to be tabulated up front. This is completely false. The debacle of overnight ballots showing up at the 11th hour past the closing of the polls is another reason to tabulate them as they come in.

But it still doesn’t answer the question - in Canada we count all the ballots the same day BY HAND. Why is this so hard in the US?

The only thing that I can think of is that your elections staff are grossly under-allocated?

17 million votes don’t take as long to count as 175 million?

Why not? Larger countries have more places voting happens and more people counting. It parallelizes almost perfectly. Slow counting is almost entirely down to resource allocation.

Another possible factor is that US elections generally see far more races on the ballot. In my ballot this year, I had to vote for US President, US House, US Senate, State House, State Senate, Councillor, Register of Probate, and three referendums. That's actually a pretty light ballot; in the past, I've also had to vote for races such as County Auditor, Recorder of Deeds, County Clerk, Soil & Water Conservation District Commissioner.

It obviously takes far longer to count ballots by hand when you're dealing with a dozen races instead of one or two.

Actually most places I'm aware of count paper ballots. Germany, Sweden, Australia all use paper ballots as far as I'm aware (unless something changed recently) and in all of the countries results are typically in during the night of the election. And many of these countries have also significant option in their votes, I mean Australia's preferential system means you have a lot of choices (if not going with the party preferences).

I think one reason for the US system to be this complex is essentially corruption, i.e. funnelling money to the makers of voting machines. The other reason is that the US system highly encourages parties to try to get votes of the other party discounted based on technicalities.

It still boggles my mind that in the US, the first modern democracy the system developed to discourage voter participation

My ballot had 35 positions to vote on.

I sometimes wish we had a separate federal / state / county / town vote to keep the practice up and reduce the overhead of individual voting periods.

It isn’t unless you have valid mail in ballots that haven’t even arrived by Election Day.

The ballots are much simpler in Canada. I remember getting a ballot that was the size of a 4' x 6' card. Put a check next to the candidate you want as the MP in your riding. Done.

The US ones can be multiple pages where you end up voting for a dozen candidates across multiple federal, state and local offices, plus a number of ballot initiatives. It's kind of nuts.

But I agree the old fashion paper and pen is the best system. It doesn't matter how theoretically secure some high-tech digital voting system is - unless every voter can understand how it works you'll always have people who think it's fixed. Actually, even with paper and pen people will think it's fixed, but you at least eliminate a ton of the unknown because of the physical record.

I mean, Canadians also have local and provincial elections and referenda, no?

Yup. But local, provincial and national elections are different events. Referendums are occasionally attached. Ballots are almost always one question for provincial and national.

And regardless, all elections are run by a non-partisan agency. Just like the health service, the police service, the fire service, and the garbage service.

I really don’t think that that’s going to be the savings you think it is. Counting votes isn’t front-loaded with a flat rate cost or subject to duplication of effort. Having a single federal elections agency isn’t going to help if you have a super complicated ballot.

There are plenty of things to vote for though, and usually it's considered a good thing to put things on the ballot in presidential years because presidential elections have the highest turnout.

My Washington ballot this year was a double-sided single page bubble sheet. I'm not sure how much easier it's supposed to get.

Why do you keep bringing this up? Do you mean that these services are centralized? Because elections are indeed run by “non-partisan” (whatever that is supposed to mean in this context) agencies here in the US, but they are not centralized at the federal level.

Nonpartisan would mean not dependent on elected officials declaring a party.

Generally speaking, in most US states the person certifying the election result is the Secretary of State, an elected official elected while affiliated to a party. There was a whole brouhaha when Brian Kemp was running for governor of Georgia while also the Secretary of State, because that looked like a conflict of interest in a hotly contested election.

The only way to get non-partisan would be elect panel to oversee the administration of an office, and let each major party with 30% or more in office have equal # of votes. Like picking teams for school sports. It'll end up 50/50. Let the speaker of the house be the deciding vote for ties.

Judges shouldn't be appointed by the fed but be randomized by computers for a database of vetted lawyers/judges who could assume the role, and all federal judges only serve for the case they're called in for (basically reverse jury duty).

Non-partisan? I mean, they are controlled by the elected government, who appoint people to do what they want. With the exception of elected sheriff's in the US, I wouldn't say it's less partisan. Take a look at what's going on in Alberta with the new Conservative gov't. Plenty of "non-partisan" government agencies are raising hell over the new policy direction.

The argument against this is that generally speaking, US presidential elections are considered the most important, so turnout on any election on “off” years, or even “off” days, is considered a sure way to get less voter turnout. Is this not a pattern observed in Canadian elections?

I'm not sure I follow. Assuming I have this right, there are no "off year" elections in a parliamentary system like in Canada. Elections occur when the government in power receives a vote of no confidence. In a minority government situation this could be the first session after an election. In the rare occasion that a government makes its 5 year term limit, the PM will "drop the writ" at a strategic point to queue up an election.

Municipal elections do occur on a schedule here, but I don't think that's relevant since it's hyper local.

American elections for president are every 4 years, as are most other offices.

Pretty much without fail, any election that isn't a presidential one has lower turnout if not also scheduled with the presidential one, since many Americans will only show up for the presidential elections. Which is why the ballots tend to be long.

Granted, I don't think this makes them very complicated; my ballot had plenty of offices this year, and it was essentially a one-page double sided bubble sheet, with accompanying voter guides sent in the mail. It's not very hard.

Your population is also less than that of California alone.

Yes, and of course this should be irrelevant given that as the poster said, presumably these things scale linearly.

There has been progress since 2000. While some states still have electronic-only voting machines, the trend seems to be away from them toward paper mark-and-scan. In addition there is greater awareness of the value of risk-limiting audits. Heck, Georgia is voluntarily hand-recounting their entire presidential ballot. And the debacle in Florida in 2000 has arguably led to better ballot design as well.

I took the CISA statement to be relative to this progress, not a statement of absolute quality.

Touch screen systems were encouraged by the "Help America Vote Act", which was supposed to make voting easier for disabled people while making it less reliable for everyone else.

The best technology was probably the big mark-sense forms, where you filled out a huge paper ballot on card stock, and then took it to the ballot box and put it in a slot on the side. The box pulled the ballot in with rollers, scanned it, and dropped it in the sealed translucent box underneath, where you could see it, blurred. So there was an immediate electronic tally, and paper ballots for re-counting.

Ballot printing was a big cost with that system, but the machines were cheap.

From the article:

"Pennsylvania, Georgia and South Carolina are on course to replace all paperless voting machines by 2020, while Arkansas, Virginia and Delaware have already completed this process."

We're lucky; they made it just in time. Imagine if this was a potential concern for Georgia or Pennsylvania right now.

To save you a click, the 8 remaining states are Texas, Louisiana, Tennessee, Mississippi, Kansas, Indiana, Kentucky and New Jersey. I hope Texas and Indiana, at least, follow suit soon.

I’m in Kansas—we had a mark-and-scan thing this year. Maybe it’s not that way statewide?

What’s your thinking on the “request” process of mail-in ballots?

To me, it’s wild to think all one needs to request a ballot is a name, address and ssn... and on top of all of that, you can get the ballot sent to a different address...

This quickly goes down the rabbit hole of identity and identity theft in the USA in a more broad sense. Our entire system is build on similarly flimsy "identity" from banking, to medical records, and even getting copies of a birth certificate/driver's license.

I would say though that "scale matters." If an electronic voting system is compromised the "scale" could be the entire state, and millions of votes, but each time a mail ballot is stolen via identity theft, you're risking it being detected/getting caught, so it ultimately scales to fewer than thousands of potentially problematic votes (which is bad, but not democracy breakingly so, like electronic/computer voting insecurity).

Right on — the thing that worries me most is that Equifax’s breach didn’t cause much of a stir... someone was/is sitting on that trove of 140m records.

To me it’s wild that anyone would want voting to be anything but universal. Shouldn’t they send ballots to every person legally allowed to vote?

Riiiiight. Just look at how districts are gerrymandered to realize this is not what politicians of either side want.

Every person legally allowed to vote should be able to vote.

No votes should be cast by people not allowed to vote.

Mail-in ballots are not secret ballots and that's dangerous. There's a reason a workplace cannot be unionized in the US without a true secret ballot.

Mail-in ballots are secret ballots. The way they work is that they have two envelopes: you put your ballot in the inner envelope, which has no indication of who is casting the ballot. All of that information is on the outer envelope. When processing the ballot, the information is checked on the outer envelope; once verified, the inner envelope is then handed to another station to be opened and fed into the counting machine while the outer envelope is discarded.

> Mail-in ballots are secret ballots

I’ve knocked on doors in New Jersey and Pennsylvania. Many registered Democrats (usually the wife) denied being Democrats when their partners were around. I thought this was an error in our data until I revisited the neighbourhood. Husband wasn’t home. Wife scolded us. He is an ardent Republican and wouldn’t appreciate how she votes.

Mail-in ballots let voters verify their vote to third parties. That opens them up to external influence, positive (pay for votes) or negative (fired for voting wrong).

We had no choice this year. But there is a real tradeoff in privacy for vulnerable people. We shouldn't lose sight of that trade-off while pushing for turnout.

Isn't the actual problem the abusive relationship and that pressure to vote a certain way a symptom? The solution isn't to ban mail in ballots for those that want to vote that way, but to offer assistance to empower people to get out of that situation. It's already illegal to take a picture of your ballot to address these kinds of abuses.

> Isn't the actual problem the abusive relationship and that pressure to vote a certain way a symptom? The solution isn't to ban no mail in ballots for those that want to vote that way, but to offer assistance to empower people to get out of that situation.

If a voting system requires zero abusive power dynamics to work, it’s a bad system.

Also, banning mail-in ballots isn’t the only solution. Early voting is an alternative to mailed ballots. Letting someone re-vote a mailed-in ballot at a poll site is a fix to the cited problem, though it introduces complexity.

All of the above seems like the best solution

I agree. Was just responding to OP saying “mail-in ballots are secret ballots.” They are not. To return to our status quo of secret ballots, a mail-in ballot system needs additional thought.

How exactly do mail in ballots let voters verify their vote to third parties?

They fill-in the ballot in front of them and seal the envelope.

Or worse the voter gives the other person the empty ballot with a signed envelope.

Mail-in ballots are absolutely not a secret ballot.

A secret ballot is one in which each voters vote is anonymous to EVERYBODY.

Spouse, parent, landlord, employer, union boss, social worker.

Case in point https://www.texasattorneygeneral.gov/news/releases/limestone...

This doesn’t work the same way in every state. In my county of CA you only send back a single envelope with the ballots folded over. Instead there is a serial number you can tear off to validate that the ballot was counted.

So it’s not doubly secret in the way you describe: https://elections.cdn.sos.ca.gov/vote-by-mail/pdf/guidance.p...

They're not secret at all. They can be canvassed and frequently are, by pushers who pressure people to vote a particular way.

Isn’t it reasonable to want the people who make a decision to know what they’re making a decision about? I want all the informed voters to vote but, by and large, uninformed voters make the outcome arbitrary.

I forget who said it and I won't even get the quote exactly right, but I'm reminded of something I once heard:

> The greatest thing about a democracy is that every idiot is allowed to vote.

> The worst thing about a democracy is that every idiot is allowed to vote.

Yeah, the problem is coming up with a test that actually identifies who’s “informed” without biasing the electorate unfairly.

If democracies don't allow idiots to vote, that creates a disenfranchised class that does not accept the government as legitimate. An important role of democracy is to stave off class conflict, arguably just as important or moreso than having a government that serves the people efficiently.

A proper long-term solution is to have governments invest in critical thinking skills and education, but of course, it's a catch-22 situation.

Mail in voting is probably secure, but there are enough concerns where many countries with healthy democracies limit who can vote by mail: https://www.newsweek.com/voting-fraud-real-concern-just-look...

> Here is what we found. Besides the United States, there are 36 member states in the Organization for Economic Cooperation and Development (OECD). Forty-seven percent ban mail-in voting unless the citizen is living abroad, and 30 percent require a photo ID to obtain a mail-in ballot. Fourteen percent of the countries ban mail-in voting even for those living abroad.

But to return the ballot, you need to match the signature with the one on file, which is very difficult to do at scale.

Unless signature matching is deemed unnecessary as in PA

I'm fully for a fast electronic count for preliminary results, that are then hand-recounted for the formal validation and final results (up to a month later).

yeah I just don't understand the downside of having a paper backup just in case. Is it the cost? The US already spends a ton on election, what is an extra paper print gonna do?

I'd rather have someone hack 1700 local elections than one 'national standard' quite frankly. The inefficiency delights me

People are always rallying to add blockchain for voting without realizing that the paper ballot is a proof of work that predates it by a significant margin.

Yep. I approve both measures

I don't think you need to hack 1700 local elections to swing the vote.

I don't think you can avoid the politics of the situation because when it comes to presidential candidates, when the R candidate wins, much will be made of how broken the system is, from vulnerabilities in voting machines to fatal flaws in the Constitution itself (viz., the Electoral College). When the D candidate wins, we are assured that election security is airtight, there's no evidence of significant irregularities, and "the system works".

This has nothing to do with the factuality or legitimacy of flaws in the system -- in short, yes, I believe you that there are severe problems with the apparatus we use to conduct elections, but there is strong pressure to ignore and even deny these problems, because doing so helps solve the bigger, more important problem of getting Trump out of office. I don't want Trump in office, but I cannot admit to any legitimacy to the claims of vote irregularity in the 2020 election, even theoretically based on your expertise because even if it were true, it would be a "fact that gives power to the enemy" and thus must be treated as a falsehood. That's why if you post about it on Twitter, a little note will be attached to your tweet with a link that says the U.S. elections were perfectly conducted with no chance of fraud.

While you've been downvoted, just to answer your points, this was an announcement by CISA, which is the government department specifically entrusted with the responsibility of ensuring the system was secure from fraud.

The argument about the Electoral College is one about the process, not the mechanisms. By definition, the Electoral College is undemocratic in that for a choice of a national leader, people in smaller population states have a greater say than those in larger states.

You can argue that as the United States of America, that is a majority of the States that get to vote for the President, but not even the original writers of the Constitution thought that. The reason for the Electoral College was to put a break on the possibility of a populist being elected.

So the original purpose has proven to be unachieved, the argument that States should vote for the President instead of people is completely undemocratic.

Are banks auditable? (Yes.) Do they have paper backups of everything? (Not that I'm aware of.) What's the difference? Honest question.

If your bank account balance is wrong, you can tell for sure that it's wrong and then explain it to the bank and get it fixed. If your vote was counted wrong, you'd never know. For them to be equivalent, the secret ballot would have to be abolished.

Maybe each ballot could include a one time pad that you keep to verify the vote.

You could verify your own vote but nobody else could.

It could be very simple to use, like a qr code that links to a public api showing the encoded ballot data, and a second qr code that you scan to decrypt it.

Not being able to verify who you voted for is by design, it's an important feature to prevent people from being pressured into/persecuted for voting a certain way, or selling their vote.

If there's no way to verify your specific vote you can just lie about who you voted for.

Hence why you would want to use a one time pad... It would be easy to choose a key that would show any particular vote cast any way you want. Only you would know how to verify your ballot.

It's utterly insane to me that you can't even verify your vote was counted and for which candidate. But a communities of hackers defends the security of voting.

> and for which candidate

That's by design, it's an important feature to prevent people from being pressured into/persecuted for voting a certain way, or selling their vote.

If there's no way to verify your specific vote you can just lie about who you voted for.

People notice when you take money from them directly but seldom take notice when its taken from the community chest.

The difference is that transactions at banks aren’t anonymous.

If you could only see the bank’s final balance with no insight into how much each person deposited and no cash in the vaults, the bank’s reported balance would be pretty meaningless for audit purposes.

How are votes anonymous? You write your name on the ballots and they have a barcode.

We can know _who_ voted, but not _how_ they voted. These are explicitly kept separate so that you can’t sell your vote or be persecuted for how you voted.

We might know which 10 people put money in a bank, but without transaction amounts, it still doesn’t help with the audit.

To be fair, that's very true for many places. Although I would also argue that there are many places (not referring to US) where electronic voting is safer than paper ballots purely because politicians know how to hire gangsters to blow up trucks carrying votes or trace and blackmail voters due to corrupt officials.

I did an undergrad in Cybersecurity. Every system can never be fully secure, so election systems therefore can’t be an exception. I did physical security in the USAF long ago, same, you can’t be fully secure.

Layers, more of them, help to secure a system.

Do you have a copy of your thesis online? I’d be curious to learn more.

Sorry no, my college only publishes Master's and PhD level thesis.

I'm not fully familiar with American politics, but out of those states the only that comes close to mattering in terms of EC outcome (this election) was Texas I think? And even then, it's unclear if it was that close considering most of the polling was off by 3-4 points. Then again some other states were spot on, so we'll never know if that was the case for Texas or if they were hacked.

Hmm, I voted in Texas and there were definitely paper ballots, the vote was on a machine with a printer and a scanner was used to actually place the vote.

Yep, these new machines seem really good.

I heard (discussions with folks online) that in other parts of the state they are still using the older machines, which the voter just has to trust to record their selections correctly. I think I've heard they are transitioning away from these.

I see, I guess the article is outdated. I was just going off the 8 states listed there.

Can I read your thesis?

Reply on news.ycombinator.com