Ask HN: Why do you trust electronic voting machines?

Where are the untrustworthy systems you're worried about?

There are no 100% digital voting systems in the US to my knowledge. Where I live, we have a printout that we can review and then hand over to be stored securely as a paper trail.

There are also multiple checks and balances where they confirm that final votes make sense, and if the counts are off, they count the paper ballots.

To compromise an election, you'd have to take over thousands of machines in multiple states, bypass multiple independent human reviews, and be able to predict where the important counties were going to be. It's impossible.

The early push to electronic voting in the US after the hanging chad debacle of 2000 did include electronic only voting machines in a number of states. Congress allocated all sorts of funds for states, but almost zero oversight or rules about secure machines and processes.

Those early mistakes have been corrected and I believe you are correct, all voting machines in the US now produce a paper trail.

> multiple checks and balances where they confirm that final votes make sense

A term we heard a lot in the lead up and aftermath of the 2020 election was 'risk limiting audits'. It would be irresponsible not to have a strong audit program in place to verify the count, which is what I believe you're referring to.

The fact the US runs 50 independent elections is an interesting double edged sword as a Canadian observer. I'm used to incredibly simple ballots administered by either Elections Canada or Elections Ontario. The US has massively complex ballots administered by their state for county, state and federal office.

In some circumstances the US system makes nation-wide election fraud nearly impossible (election fraud does happen and is different from so-called 'voter fraud' that doesn't). The small scale of some offices and elections does make election fraud more achievable on some scales.

A new weakness has been revealed. Various local election officials (particularly Secretaries of State) wield enormous power to affect the process and outcome of the election. Elections Canada runs exactly the same election under exactly the same rules in every polling place across the country. Experiences state to state, county to country, and even at different polling places within a county can vary wildly in the US. This is exacerbated in Presidential elections by the fact only a handful of states are actually up for grabs in the election. A Secretary of State in any of Pennsylvania, Florida, Georgia, Nevada, Arizona, Minnesota, or Michigan potentially has the power to throw the next election into chaos. 2024 is not going to be fun and I'm not even American.

> The fact the US runs 50 independent elections is an interesting double edged sword as a Canadian observer.

I personally wouldn't say 50 -- more like 3,000 independent elections. Each county is arguably its own election. They get funding and voting machines from the state, but personnel and operations of the county are run locally and often reflect the population of that area.

> A Secretary of State in any of Pennsylvania, Florida, Georgia, Nevada, Arizona, Minnesota, or Michigan potentially has the power to throw the next election into chaos.

This is true, although I think they'd have some difficulty doing it out in the open. We'll have to see.

Risk limiting audits aka statistical sampling. There is no way to be absolutely certain the final count is 100% correct. Which is sorta okay most of the time, when the margin of victory is greater than the error rate.

Our FPTP voting system is the most brittle. 50% + 1 vote.

Election integrity would be greatly improved by switching to voting systems more resilient to errors. Specifically Approval Voting (or RCV) for single seat contests and Proportional Representation for assemblies.

I would certainly agree first past the post is a deeply broken system. I’m strongly in favour of reform there, but am increasingly concerned that any replacement needs to be as simple a counting process as possible to ensure everyone fully grasps it. Nothing is worse for trust in the electoral process than distrust in the counting mechanism. If there is anything to be learned from 2020 it’s that elections are actually about showing who lost and not just who won. If people don’t agree on who lost chaos ensues.

Any election system using DREs is fully digital. That's the whole point.

I'm not aware of any jurisdiction that uses VVPAT for the final count. And most don't even use the VVPAT for auditing or manual recounts. Which is probably just as well, because the VVPAT is just thermal paper (like at the store) and is easily damaged, assuming it was working at all.

Jurisdictions are always changing things. You'd have to get your jurisdiction's manual to learn how they do counts, recounts, audits. And then actually observe to ensure they follow their own rules.

Details matter. Procedures and process matter. Technology is not a cure-all.

Voting machine manufacturers and election overseers responded to the criticisms! The vast majority of electronic voting in the US today is done with a physical paper receipt paper trail: https://www.ncsl.org/research/elections-and-campaigns/voting...

Notice that nearly every state requires voters to approve the paper copy of their vote.

The digital record is only used to speed up tabulation. In the case of recounts or contested elections, paper records are hand tabulated by humans (a recent example were the Arizona recounts for the 2020 election).

Where are you located that you didn't have a paper receipt you were asked to approve when you voted?

You can't compare the difficulty of faking a real human entering a ballot into an observed sealed container, during a short period of a day, versus just faking an output of a machine and then faking unobserved stacks of paper which have all be gathered into a centralized location and then left for months, and then when irregularities are found they are simply ignored.

The first requires a high number of conspirators per votes faked. You will at best get a ratio of hundreds of votes per conspirator. The second only requires a handful of conspirators with good access to essentially overturn entire elections with leads of hundreds of thousands of votes.

And it's not even the electronic part that is the most crucial. The fact that a single election worker is officially in charge of the integrity of tens of thousands votes, only made possible with the assistance of the machine, is the real issue here. That machine could've been 100% OK but it's not designed to protect against the election worker - on the contrary, it's designed to give him oversized power.

All you need to realize the farce is just watch a video where a single person counts tens of thousands of votes, and see the officials response to the video is to admit that indeed that is what happened, but "the votes were legitimate". A single person isn't responsible for thousands of votes in a real democracy.

> versus just faking an output of a machine and then faking unobserved stacks of paper

If you bothered to follow the link, you would see that most states require voters to review and sign their ballots.

Again, even if you tried to sneak a small amount of fraud into the system, would no one catch it?

Yes and: I just reread that (excellent) ncsl.org link from 2019. Some tidbits:

Ballots are not signed. In my jurisdiction, if a voter signs their ballot it spoils the ballot.

NCSL links to (also excellent) Verified Voting, which is kept current. (D'oh. That would have saved me some research effort.)

https://verifiedvoting.org/verifier/#mode/navigate/map/ppEqu...

Note that Arizona does not use DREs and so does not have (or need) VVPAT. Instead, Arizona went with the much superior ballot marking device (BMD) for enfranchising disabled voters.

When only a single person alone is responsible for thousands of ballots, who do you expect to catch it?

Come to Israel, watch our elections. You'll understand how real democratic elections look like, where from the process itself you can dismiss most fraud allegations. It would take hundreds of independent fraud instances to change a single seat. These security guaranties do not exist in the US. It's like the difference between encrypted and unencrypted communications, where the American gaslighting is the equivalent of saying man in the middle is a conspiracy theory.

> When only a single person alone is responsible for thousands of ballots, who do you expect to catch it?

We catch voter fraud all the time in the US. Part of the reason we know it's not a big issue is that we catch so many people in a given year. If you read up on the multiple rounds of recounts and audits Arizona or Pennsylvania did this last federal election, I think you would have a lot of respect for the people who designed these systems to withstand the scrutiny of endless lawsuits.

> It would take hundreds of independent fraud instances to change a single seat. These security guaranties do not exist in the US.

It sounds like you are getting bad information about US elections from second hand sources. Anyone who actually takes the time to analyze their local election would probably come to the same conclusion you do about yours. They are remarkably transparent and well audited.

That does not stop bad actors from using endless speculation to try to undermine people's faith in elections. But I can attest that I would trust our local elections as much as anywhere else's in the world.

In Brazil there is no paper or paper trail to audit later.[1]

Indeed it is a very contentious matter because opposition claims paper trail will allow people to get a receipt and sell its vote (not true) but they don't want the paper trail system were after you confirm your vote is cast in a lacred box.

You are supposed to trust it because it is.

If you don't you are against the democracy.

[1] - You can at final hour generate a report from all electoral zone but there is no way to "go back" and audit it with paper trail.

VVPAT is worse than useless; creating the illusion of physical chain of custody. Most voters don't even look at it.

How can any one verify the recorded and tabulated votes match the VVPAT?

I've attended the "auditing" of VVPAT machines. The "audit" only demonstrates the printer is functioning. And each time, at least one of the printers failed (paper jam, bad hardware, etc). So they swap gear and reprint the VVPAT.

All DREs should be banned outright. They are and always have been an existential threat to election integrity.

--

PS- The VVPAT is not a receipt. Giving voters a receipt allows vote buying, coercion, etc.

It's been a while, and election administration is the wild west, so although I don't recall any jurisdiction issuing voting receipts, I wouldn't be surprised if someone does.

This is all the same whataboutism propogandists use to undermine normal democratic elections.

> creating the illusion of physical chain of custody

How is this any different than paper ballot voting? Someone is going to collect the paper ballots and count them and put them into spreadsheets.

> How can any one verify the recorded and tabulated votes match the VVPAT?

In the US they literally pay hundreds of election workers to hand count paper receipts in the event of a recount. This is what happened in Arizona in the US.

> This is all the same whataboutism propogandists use to undermine normal democratic elections.

Yup.

Bush v Gore and then Bush v Kerry motivated me to become an election integrity activist. Along with some chicanery in my own state. My friends proved, in court, that Kerry actually won New Mexico (the machines didn't record spanish language ballots), and compelled them to dump the DREs and switch to paper ballots. I also knew people in Ohio, NC, Georgian, Kentucky who uncovered similar problems. But those state's laws didn't permit challenges, or the records (evidence) was destroyed, often illegally.

It's with deep chagrin that all of our findings and talking points have since been weaponized by a cult hell bent on ending our democracy. Sometimes I even wonder if my friend Bev Harris (Black Box Voting) demonstrating how to hack Diebold live on TV was a mistake.

> In the US they literally pay hundreds of election workers to hand count paper receipts in the event of a recount. This is what happened in Arizona in the US.

Ok. I just wasted 30 min quickly figuring out how Arizona currently votes. https://azsos.gov/sites/default/files/2022_Election_Cycle_Vo...

Paper ballots. Optical scanners for poll sites. Image scanners for central count. Ballot marking devices for accessibility.

No VVPAT.

No receipts.

Whatever you think about Arizona's 2020 recount circus, the end result was greater confidence in the outcome (for the reality based community). Only because Arizona uses paper ballots.

> Paper ballots. Optical scanners for poll sites.

Okay, again - what's the big picture difference between VVPAT and paper ballots that are scanned by a computer? If the computer leaves a receipt that I have to sign and confirm and leave with them - how's that different than one I do by hand and have scanned? It's just a difference in the order of operation.

Ya, good question. This stuff is confusing and no one explains it properly.

With a DRE (eg a touchscreen) the legal ballot is the memory card. The VVPAT is like a log file printed to a cash register paper roll. VVPATs are not the legal ballot of record. Nor are they used for tabulation. Some jurisdictions may use the VVPAT for recounts or audits, but I wouldn't know. In other words, "Voter Verified Paper Audit Trail" is a lie; It's not used for auditing, and most voters don't even look at it.

The implementation of VVPAT isn't really intended for tabulation. It's thermal paper, easily damaged. There's no standardized format. There's no gear for scanning it. The content doesn't even look like a ballot.

Also, with the Australian ballot system, private voting and public counting, there are no receipts. (Whether or not DREs and postal ballots qualify as Australian ballots is another discussion.)

I think maybe a ballot marking device (BMD) would fit your goals. The UX is like a DRE. But a BMD generates an actual ballot. That is then treated like any other ballot, fed into a separate tabulator. BMDs do not tabulate.

I think BMDs are great. I'd bet that every election integrity activist would agree.

--

Every statement I make should include a "YMMV" caveat. Every jurisdiction (state, county) can potentially do their own thing. Worse, the details (gear, laws, rules, procedures) keep changing. So there's always a lot of thrashing getting everyone onto the same page.

Please keep asking questions. None of this stuff is intuitive, or works how people expect. It took me years of intense effort to get up to speed, which shouldn't be the case.

> Some jurisdictions may use the VVPAT for recounts or audits, but I wouldn't know.

I don't understand your statement. You say you don't know if it's used for auditing... then you claim decisively it's not used for auditing?

> There's no standardized format. There's no gear for scanning it.

That's exactly the point - you are only looking at these by hand in the case of a recount?

Again, if I am trying to perpetrate voter fraud, enough to change an election, how do I do it with a VVPAT? Do I change their answer and hope that no one notices their vote got changed on their receipt? Or send a different answer to tabulation that would be caught in the event of a recount?

Both of these possibilities seem no different than a BMD. How do I know the tabulator machines themselves are not compromised? It seems like a weird distinction to trust one but not the other.

https://www.pewtrusts.org/~/media/legacy/uploadedfiles/wwwpe...

Trust is the wrong word.

Confidence in the results is only possible thru mutual distrust. Meaning all belligerents recognize and honor the count.

The gold standard for our Australian ballot (private voting, public counting) style system is paper ballots cast at poll sites, tabulated using optical scanners, with results posted publicly the moment the polls close.

With postal ballots, the higher volume jurisdictions use image scanners. Think fax scanners with OCR software to identify the votes. Adjudication is done electronically, by updating the database.

Further, many jurisdictions scan postal ballots as they are received, before election day, running daily summary reports. The fiction is that "final tabulation" is the final report.

For postal ballots, signature verification is being automated. Computers automatically compare ballot's signature with voter's recorded signature. Back when I studied election integrity (20004 thru 2010), the error rate was ~10%, with no independent auditing or verification.

For postal ballots, 1% are lost in transit. What the USPS calls UAA (undelivered as addressed). Meaning a fraction of voters are being silently disenfranchised every election.

So far, none of the machines have passed the Nevada Gaming Commissions inspections. That would be the minimum criteria. Machines that don't at least pass this level of scrutiny (all of them) are not something you can trust.

That commission has long experience inspecting devices to ensure that they are fair and impervious to unobservable tampering.

Once someone actually manufactures such a machine, then it needs to be used in a system that can detect fraudulent behavior, just like banks do. The system must require an official id, and must ensure voting privacy (sorry - mail-in ballots fail on both of these). It does no good to have a great machine if it will be subject to adulterated or coerced input.

You are asking the wrong audience, fairly sure "paper ballots are better" is the dominant opinion here.

agreed

Is anyone doing anything about it?

about what, that people with technical expertise think that using their buggy creations is a bad idea for something as important as choosing leaders?

My main objection to electronic voting is about the general population's trust, and that it is increasingly easy to convince the losing party that the machine was compromised, whether or not it is.

A voting system needs to be understood by the majority, the layman, in order for trust in the electoral process to be maintained.

I would've thought "machine, but also paper receipt" would be the dominant position

I believe there was an MIT study done after the contentious 2000 US election that compared election methods and their error rates.

None had a zero error rate. Fully electronic was not preferable because of the lack of audit trail. The best system seemed to be paper with scanners. The error rate was among the lowest and it is fully auditable.

After this study came out I was disappointed that my state chose fully electronic.

But before this last election we went to paper with scanners. The big advantage of course is the ability to recount by hand to your heart’s content. Which of course we did.

The only way I would trust electronic voting is if we had a secure end-to-end verifiable e-voting system using zero knowledge proofs, so that you can verify that your vote was counted.

For now, paper voting is safer.

Some people think that this will automatically lead to vote buying.

I think theyre very wrong, but a lot of people do think that.

Sorry, but have you met people? Vote buying is inevitable. Especially after digital cameras.

Isn't taking a pic prohibited?

Maybe someone did it anyways even if it is prohibited; I don't know. I think the way to deal with this is that you can get another copy of the voting form if you want to take a picture of it, so that you won't tell if it is the real vote or not.

Yes Ive met people. If there was a small chance that that selling their vote for a £30 amazon gift card would lead to them being embroiled in a sting operation and being sent to prison a miniscule number would try. Benefit too low, risk too high.

And, if political candidates were caught trying to buy those miniscule number of votes from a police sting operation were sent to prison...well, they tend to stop doing that. Benefit too low, risk too high.

Historically vote buying has tended to be widespread when it is officially tolerated (e.g. in the 19th century) and then it disappears entirely even when the police only half-heartedly crack down on it.

From “Some people think that this will automatically lead to vote buying” has morphed to “a minuscule number would try.” I guess we’re in agreement now.

The miniscule number who might risk 12 months of jail for a £30 gift voucher wouldnt do it if they couldnt find a customer.

" slater 4 days ago [–]

I think you've brought this up a couple of times now. Ask yourself, which is likelier:

1) It's a great big conspiracy and everyone hopes nobody sees your posts about this clear backdoor technology, and the mods try their best to delete it every time you post.

-- OR --

2) You're somehow mistaken and it's not all that big of a deal. "

Is there a reason youre bringing this up?

Seems you didn't hear it the first time. Your game is obvious to a lot of us. I'm posting for anyone reading this muckraking tripe.

My “game”? I’m not sure what relevancy the Microsoft Backdoor Conspiracy which I’m in the process of exposing has to the electronic voting machines scandal. Either way, your pathetic attempt to suppress my speech isn’t going to influence anyone’s opinions and certainly not going to discourage me from posting about these topics.

Perhaps the voting system will handle your game just fine.

I would counter by asking, "why do you trust paper voting?" As long as there are people in the process, there's room for corruption; that's just a fact you'll have to live with. With decent encryption, an electronic voting machine is at least as safe as paper ballots.

I don't. Neither does my voting jurisdiction. The electronic counts are only used for early estimates and everything is officially counted by hand.

I asked a very similar question [1] it has some interesting responses from Indian citizens who seems to be the only people who trust them because of [2].

[1] https://news.ycombinator.com/item?id=32436338

[2] https://en.wikipedia.org/wiki/Booth_capturing

I really would like to hear the opinion of HN people about the Brazilian system.

As far as I can tell, largely they are trusted when they result is the desired one and distrusted when the result is not the desired one, since people mostly care about making sure that they get the result they want, not with making sure that the process is "fair".

Do you realize you are preaching to the choir?