4 ms·

It likely speaks to my ignorance, but my gut reaction to using electronic voting machines has always been that they are inherently insecure and can't/shouldn't

It likely speaks to my ignorance, but my gut reaction to using electronic voting machines has always been that they are inherently insecure and can't/shouldn't be trusted to provide an accurate tally. There is so much money (available) and motive to cheat an election count that I have a hard time believing large and significant races haven't already been victims of tampering in the US (even if we haven't seen hard evidence of such). Is this cynicism misplaced?

speeder 11y ago
I am from Brazil, our machines are made by Diebold and a venezuelan company. I personally think that the 2014 elections were faked, also the machines had been proven to be easy to cheat with, and there are evidence that cheating did happen. (example: in one state election here, the number of votes was higher than the number of voters, one of the candidates complained, and got fined for complaining...) There is even a video on youtube showing how to cheat elections in a "impossible to trace" manner using diebold machines. Also the Dutch banned voting machines that don't print a paper copy of the vote (that you then use to put on a normal ballot).
- gilney 11y ago
  Could you please provide some links?
  - ehmuidifici 11y ago
    Sure http://programacaobr.com/elections2014/ http://programacaobr.com/elections2014/
  - slasaus 11y ago
    About the dutch campaign in 2006: http://wijvertrouwenstemcomputersniet.nl/English http://wijvertrouwenstemcomputersniet.nl/English And about a follow up campaign in India with some of the same people: https://indiaevm.org/ https://indiaevm.org/ Also see some recent research done with the Estonian e-voting system: https://www.youtube.com/watch?v=JY_pHvhE4os https://www.youtube.com/watch?v=JY_pHvhE4os
deleted 11y ago
[deleted]
flashman 11y ago
At the very minimum, I would expect a voting machine to create two paper receipts after each vote: one provided to the voter and another stored internally. These would hopefully be on something more durable than thermal paper, though that might suffice. The receipt would contain the machine ID, timestamp and vote recorded. Administrators could get a quick count from the machine memory, then perform a verification by pulling a sample of votes from the printed receipt and comparing them to the electronic values with the same timestamp. And any voter can compare their receipt with publicly-available voting records. Of course, then you have to worry about exploits that can cause the machine to print votes on demand, because those would appear legitimate, especially if the voter's receipt printout can be suppressed - there'd be no incriminating receipt trail hanging out of an unattended machine.
- hughw 11y ago
  You can't print out a person's vote on a receipt an admin could see; that's not a secret ballot. And, using that receipt, the voter can do little to verify his vote was counted. Edit: the timestamp gives the voter away
  - function_seven 11y ago
    No identifying info needs to be printed. Just a GUID. Use a dot matrix printer with triplicate ("biplicate"?), let the voter take their receipt, and keep the other one on the spool. Yeah, there's still might be some issue with external coercion on the voter to produce their receipt and prove they voted the way they were paid to. I suppose that could be solved by making the voter's copy an XOR of the audit tape, and by only having both copies together, can the vote be verified. Presumably the forces doing the coercion wouldn't have access to the audit tape. If they did, then we're already screwed no matter what system we implement. Just a thought. Not sure if there's some fundamental contradiction between secrecy in voting and voter-auditability.
    - spc476 11y ago
      Why not print out N copies of the receipt, where N = number of parties (usually 2 in the US, Republicans and Democrats). Then, each receipt is placed in a box dedicated to each party. Then, representatives from each party get a box, and count receipts. All count should match (or be within a certain margin), right?
x3n0ph3n3 11y ago
Your cynicism can be easily mistaken for just being a Luddite, but it doesn't seem too off the mark.
- germinalphrase 11y ago
  I'm not suggesting we go back to voting with shards in a pot; I am just skeptical that voting machine have been/are secure from tampering. Seems like the kind of question that matters a lot.
Strilanc 11y ago
It entirely depends if it's using cryptography or not [1]. For example, using zero knowledge proofs you can be given a receipt that lets you verify your vote was included in the total (without allowing you to prove to an attacker which party you voted for). Using the computers as glorified counters is a security nightmare. Using them for what they're good at (crypto) would be a security boon, with the main downside being how hard it would be for non-computer-scientists to understand the nature of the security. 1: https://www.youtube.com/watch?v=ZDnShu5V99s https://www.youtube.com/watch?v=ZDnShu5V99s
- gizmo686 11y ago
  I don't think the non expert voters not understanding the security is that big of a concern. Assuming that the security undisputed amongts experts, the media could convey this to the general population (absent some well supported opposition like climate science faces). At this point, the security points that need to be conveyed to the voters are relatively simple: 1) The receipt you are given may be used to confirm that your vote was correctly counted. Here is a list of websites/programs that you can use to verify your receipt. 2) It is impossible to use your receipt to prove to a third party how you voted. If we could get major news source (New York Times, CNN, Fox News, etc) to publish their own tools for (1), then I suspect that should give a fair amount of credibility for the general public. The problem I see is that any technical system of plausible deniability I can think of, would require that a voter is able to forge a receipt that would correctly validate as the incorrect vote. Otherwise, if an attacker wanted to verify that Alice voted Democrat, he could assume she voted Republican and attempt to verify the receipt.
- Lawtonfogle 11y ago
  How could it prove to you that your vote was included in the correct total without also being able to transfer that knowledge to a third party that is right there with you? Say A and B were the options. Anywhere you take the receipt to verify it has to then display if it counted towards A or towards B. Someone there with you could then see which it confirms.
  - Strilanc 11y ago
mcv 11y ago
> Is this cynicism misplaced? I'd call it caution rather than cynicism, and I'd say it's entirely justified.

speeder 11y ago

I am from Brazil, our machines are made by Diebold and a venezuelan company. I personally think that the 2014 elections were faked, also the machines had been proven to be easy to cheat with, and there are evidence that cheating did happen. (example: in one state election here, the number of votes was higher than the number of voters, one of the candidates complained, and got fined for complaining...) There is even a video on youtube showing how to cheat elections in a "impossible to trace" manner using diebold machines. Also the Dutch banned voting machines that don't print a paper copy of the vote (that you then use to put on a normal ballot).

gilney 11y ago
Could you please provide some links?
- ehmuidifici 11y ago
  Sure http://programacaobr.com/elections2014/ http://programacaobr.com/elections2014/
- slasaus 11y ago
  About the dutch campaign in 2006: http://wijvertrouwenstemcomputersniet.nl/English http://wijvertrouwenstemcomputersniet.nl/English And about a follow up campaign in India with some of the same people: https://indiaevm.org/ https://indiaevm.org/ Also see some recent research done with the Estonian e-voting system: https://www.youtube.com/watch?v=JY_pHvhE4os https://www.youtube.com/watch?v=JY_pHvhE4os

deleted 11y ago

[deleted]

flashman 11y ago

At the very minimum, I would expect a voting machine to create two paper receipts after each vote: one provided to the voter and another stored internally. These would hopefully be on something more durable than thermal paper, though that might suffice. The receipt would contain the machine ID, timestamp and vote recorded. Administrators could get a quick count from the machine memory, then perform a verification by pulling a sample of votes from the printed receipt and comparing them to the electronic values with the same timestamp. And any voter can compare their receipt with publicly-available voting records. Of course, then you have to worry about exploits that can cause the machine to print votes on demand, because those would appear legitimate, especially if the voter's receipt printout can be suppressed - there'd be no incriminating receipt trail hanging out of an unattended machine.

hughw 11y ago
You can't print out a person's vote on a receipt an admin could see; that's not a secret ballot. And, using that receipt, the voter can do little to verify his vote was counted. Edit: the timestamp gives the voter away
- function_seven 11y ago
  No identifying info needs to be printed. Just a GUID. Use a dot matrix printer with triplicate ("biplicate"?), let the voter take their receipt, and keep the other one on the spool. Yeah, there's still might be some issue with external coercion on the voter to produce their receipt and prove they voted the way they were paid to. I suppose that could be solved by making the voter's copy an XOR of the audit tape, and by only having both copies together, can the vote be verified. Presumably the forces doing the coercion wouldn't have access to the audit tape. If they did, then we're already screwed no matter what system we implement. Just a thought. Not sure if there's some fundamental contradiction between secrecy in voting and voter-auditability.
  - spc476 11y ago
    Why not print out N copies of the receipt, where N = number of parties (usually 2 in the US, Republicans and Democrats). Then, each receipt is placed in a box dedicated to each party. Then, representatives from each party get a box, and count receipts. All count should match (or be within a certain margin), right?

x3n0ph3n3 11y ago

Your cynicism can be easily mistaken for just being a Luddite, but it doesn't seem too off the mark.

germinalphrase 11y ago
I'm not suggesting we go back to voting with shards in a pot; I am just skeptical that voting machine have been/are secure from tampering. Seems like the kind of question that matters a lot.

Strilanc 11y ago

It entirely depends if it's using cryptography or not [1]. For example, using zero knowledge proofs you can be given a receipt that lets you verify your vote was included in the total (without allowing you to prove to an attacker which party you voted for). Using the computers as glorified counters is a security nightmare. Using them for what they're good at (crypto) would be a security boon, with the main downside being how hard it would be for non-computer-scientists to understand the nature of the security. 1: https://www.youtube.com/watch?v=ZDnShu5V99s https://www.youtube.com/watch?v=ZDnShu5V99s

gizmo686 11y ago
I don't think the non expert voters not understanding the security is that big of a concern. Assuming that the security undisputed amongts experts, the media could convey this to the general population (absent some well supported opposition like climate science faces). At this point, the security points that need to be conveyed to the voters are relatively simple: 1) The receipt you are given may be used to confirm that your vote was correctly counted. Here is a list of websites/programs that you can use to verify your receipt. 2) It is impossible to use your receipt to prove to a third party how you voted. If we could get major news source (New York Times, CNN, Fox News, etc) to publish their own tools for (1), then I suspect that should give a fair amount of credibility for the general public. The problem I see is that any technical system of plausible deniability I can think of, would require that a voter is able to forge a receipt that would correctly validate as the incorrect vote. Otherwise, if an attacker wanted to verify that Alice voted Democrat, he could assume she voted Republican and attempt to verify the receipt.
Lawtonfogle 11y ago
How could it prove to you that your vote was included in the correct total without also being able to transfer that knowledge to a third party that is right there with you? Say A and B were the options. Anywhere you take the receipt to verify it has to then display if it counted towards A or towards B. Someone there with you could then see which it confirms.
- Strilanc 11y ago

mcv 11y ago

> Is this cynicism misplaced? I'd call it caution rather than cynicism, and I'd say it's entirely justified.