The presence of the barcodes doesn't do anything to reduce the trustworthiness of the system
Tell me this: what is the advantage of a barcode, over a scantron-esque system where I can see which item I chose because a dot is filled in?
The scantron-esque system is still efficiently machine readable; we've had scantron since I was a kid. The difference is, I can verify with my own two eyes that the information is encoded correctly on the ballot I submitted if it's done scantron-style.
I cannot do that with barcodes.
It adds another layer of safety. Do we still have to be able to trust the rest of the system? Yup. But I cannot trust anything at all if I cannot even verify that my vote was submitted correctly in the first place.
JMHO.
It's about the ability for the voter to determine that their own part of the process -- the recording of their own vote -- is done correctly in every respect.
Each step of the system has to be verifiable as correct for the system to be trustworthy. As it stands right now, I cannot visually verify that my own vote produced a correct printed ballot. I have no way of doing that.
This removes one of the most critical safeguards. If something in the software (malicious or otherwise) records an incorrect barcode, I have absolutely no way of knowing.
That's a problem.
Garbage in, garbage out.
To me, this seems like the only part worth worrying about, and any solution to it should satisfy your concerns as well.
Every ballot should have a UUID that the voter takes with them (or make it a hash of their voter registration number or something). As soon as the ballot is processed, the results are posted to a public place. Voters can then confirm their ballot was recorded accurately.
This still doesn't tell you that all the internal variables were incremented correctly, but you can separately aggregate the publicly posted results and compare with the aggregate reported by the machine.
The problem this still doesn't solve is electronically stuffing in fake ballots.
Opening the door for vote bribery or voter intimidation.
$1,000 for every tag proving you voted for my candidate.
If you don't prove you voted for my candidate, expect some retaliation!
This doesn't happen today because it isn't scalable and is easy to get caught and prosecuted. Electronic manipulation is more appealing because it does not require interacting with people.
Most people aren't going to try too hard to undermine or outsmart the gangster. Which is why, again, the perpetrator doesn't even need validation of how people actually voted. Vague threats will work just fine. In fact the gangster will still beat up a random sampling of the voters anyway.
If the gangster is just going to hurt a random sampling of people anyways, you might as well just vote however you want to vote. They may or may not commit violence against you regardless of how you vote, its completely disconnected. If you know they can validate it, you're probably going to be less brave.
Just put yourself in those two situations. One where the ballot is absolutely secret, and one where it can be trivially looked up. Someone says you better vote for X or I'll hurt you. You really don't want to vote for X. In the first instance, do you vote for X? In the second, do you still vote for X knowing the thug will be able to know for sure how you voted?
I'm not suggesting nobody would do an illegal thing, obviously I acknowledge people would do illegal things. I'm just pointing to that as why taking a photo of a ballot is illegal in many areas.
I don't disagree that it's strictly better, but the improvements in security are marginal. Any audits/recounts would be done by looking at the human readable part of the ballot, and would therefore be unaffected. Moreover, regardless of whether there's barcodes or not, you'd want to conduct proactive recounts to mitigate any risk for tampered/broken machines. In that case, getting rid of barcodes wouldn't add any security in practice.
Seems a pretty substantial difference to me.
When was the last time you had a printer print the wrong thing? Moreover, if an election is close enough that a few votes matter, there's definitely going to be a manual recount, so any advantage is purely academic (eg. knowing that candidate A won by 51.704% rather than 51.703%). Point is, either the error is big enough that it's trivially detected with spot checks, or the margins are so close that a manual recount is performed automatically.
A collection of dots and a collection of bars are the same to me in terms of trusting the computer actually read it right.
I'm fine with it so long as the choices are also printed in a human readable way at the bottom. If it was just a giant bar code or whatever I wouldn't like it.