5 ms·

I hope this includes voting software.

chaostheory 11y ago
I could be wrong, but in most cases the US government buys appliances from companies like Diebold and they don't develop or contract software for voting. The best that can be done is regulation to force audits of the appliances like what Nevada does with casino slots. Even that would be a huge step up.
- nxzero 11y ago
  Might be a reason to long-term require all software used be open source and for that matter make it easy for a user to confirm that the system in use real-time is the system that's open-sourced too.
  - tajen 11y ago
    How do you allow a user to confirm this in real time? Hash displayed on th screen?
    - nxzero 11y ago
      Yes, that's correct, being able to download the code, hash it, and then compare it to the hash displayed real-time would be a first step towards enabling this.
      - stepanhruda 11y ago
        the software can easily be modified to display the hash you are expecting
        nxzero 11y ago
        To start, something is better than nothing. Long-term remote inbound two part authitacation combine with like measures for hardware via meta-programming would make bypassing this very, very hard for the average hacker.
    - Spivak 11y ago
      Users wouldn't confirm this in in real time just like users have no way of verifying in real time that their paper ballot was actually counted. A better outcome for this type of system would be a pre-election and post-election verification of each machine (which isn't unreasonable since the number of machines is far less than the number of ballots) in which interested agents from each party/group could be present during the verification process (and use their own machine if they desire) to ensure that all the digital signatures match and there's no foul play.
    - HappyTypist 11y ago
      perhaps use a Merkle hash to verify your vote was counted?
grondilu 11y ago
Unless you have a way to ensure the code actually running on voting machines is the code that was published, there is no point.
- gpm 11y ago
  Yes there is, it significantly raises the bar for maintaining plausible deniability while enabling voting fraud. Right now if there is a bug that creates incorrect vote totals it would be very hard to prove it was done intentionally. If the software was required to be open source, then just the fact that they were running different software than was published would be strong evidence that it was intentional.
  - knight17 11y ago
    The low tech solution tried in India is to have a paper trail on the electronic voting machines itself. >> ... will be fitted with a printer that will have a drop box to store the paper trail of the votes cast. This is expected to alleviate concerns — expressed earlier by the opposition led by BJP — over possible tampering of EVMs to favour a certain candidate.<< http://www.business-standard.com/article/pti-stories/2019-general-elections-to-have-paper-trail-evms-cec-116022300504_1.html http://www.business-standard.com/article/pti-stories/2019-ge... http://timesofindia.indiatimes.com/india/EC-ready-with-new-age-electronic-voting-machines-with-printing-unit/articleshow/18299965.cms http://timesofindia.indiatimes.com/india/EC-ready-with-new-a...
brudgers 11y ago
In general the US Federal government does not operate polls. The various local governments operate elections while abiding Federal and State laws and regulations. In practice, the highest level where software standards are promulgated is state governments and there only some states and with variation among them.
macktheknife 11y ago
There are actually foundations out there that do exactly that. If you're interested, OSET Foundation (http://www.osetfoundation.org/#welcome http://www.osetfoundation.org/#welcome) has developed everything from ballot scanners to entry systems. It's all open source and they've been at it for about 10 years. They patented some of their systems and made the Secretary of commerce the owner of these patents, as far as I'm aware. Legislation is slowly moving towards adoption, given the potential reduction in cost.
stonesixone 11y ago
There is an effort happening in San Francisco right now to do just this. See here, for example, for a recent March 24, 2016 hearing on the topic: https://sfgov.legistar.com/LegislationDetail.aspx?ID=2567089&GUID=84A8E0AB-00CD-4FD3-B609-043F930B7A52 https://sfgov.legistar.com/LegislationDetail.aspx?ID=2567089... "Hearing on San Francisco's efforts to fund, design, and implement an open source voting system, including budget costs and projected roll-out schedule; and requesting the Department of Elections and the Elections Commission to report." It's currently up for consideration in the budget. SF resident Brian Behlendorf recently endorsed (along with EFF, Code for San Francisco, California Common Cause, local GitHub CEO Chris Wanstrath, etc), and we're looking for more high-profile supporters to help influence the Mayor's budget decision: https://twitter.com/cjerdonek/status/716448812181512192 https://twitter.com/cjerdonek/status/716448812181512192

I could be wrong, but in most cases the US government buys appliances from companies like Diebold and they don't develop or contract software for voting. The best that can be done is regulation to force audits of the appliances like what Nevada does with casino slots. Even that would be a huge step up.

nxzero 11y ago
Might be a reason to long-term require all software used be open source and for that matter make it easy for a user to confirm that the system in use real-time is the system that's open-sourced too.
- tajen 11y ago
  How do you allow a user to confirm this in real time? Hash displayed on th screen?
  - nxzero 11y ago
    Yes, that's correct, being able to download the code, hash it, and then compare it to the hash displayed real-time would be a first step towards enabling this.
    - stepanhruda 11y ago
      the software can easily be modified to display the hash you are expecting
      - nxzero 11y ago
        To start, something is better than nothing. Long-term remote inbound two part authitacation combine with like measures for hardware via meta-programming would make bypassing this very, very hard for the average hacker.
  - Spivak 11y ago
    Users wouldn't confirm this in in real time just like users have no way of verifying in real time that their paper ballot was actually counted. A better outcome for this type of system would be a pre-election and post-election verification of each machine (which isn't unreasonable since the number of machines is far less than the number of ballots) in which interested agents from each party/group could be present during the verification process (and use their own machine if they desire) to ensure that all the digital signatures match and there's no foul play.
  - HappyTypist 11y ago
    perhaps use a Merkle hash to verify your vote was counted?

grondilu 11y ago

Unless you have a way to ensure the code actually running on voting machines is the code that was published, there is no point.

gpm 11y ago
Yes there is, it significantly raises the bar for maintaining plausible deniability while enabling voting fraud. Right now if there is a bug that creates incorrect vote totals it would be very hard to prove it was done intentionally. If the software was required to be open source, then just the fact that they were running different software than was published would be strong evidence that it was intentional.
- knight17 11y ago
  The low tech solution tried in India is to have a paper trail on the electronic voting machines itself. >> ... will be fitted with a printer that will have a drop box to store the paper trail of the votes cast. This is expected to alleviate concerns — expressed earlier by the opposition led by BJP — over possible tampering of EVMs to favour a certain candidate.<< http://www.business-standard.com/article/pti-stories/2019-general-elections-to-have-paper-trail-evms-cec-116022300504_1.html http://www.business-standard.com/article/pti-stories/2019-ge... http://timesofindia.indiatimes.com/india/EC-ready-with-new-age-electronic-voting-machines-with-printing-unit/articleshow/18299965.cms http://timesofindia.indiatimes.com/india/EC-ready-with-new-a...

brudgers 11y ago

In general the US Federal government does not operate polls. The various local governments operate elections while abiding Federal and State laws and regulations. In practice, the highest level where software standards are promulgated is state governments and there only some states and with variation among them.

macktheknife 11y ago

There are actually foundations out there that do exactly that. If you're interested, OSET Foundation (http://www.osetfoundation.org/#welcome http://www.osetfoundation.org/#welcome) has developed everything from ballot scanners to entry systems. It's all open source and they've been at it for about 10 years. They patented some of their systems and made the Secretary of commerce the owner of these patents, as far as I'm aware. Legislation is slowly moving towards adoption, given the potential reduction in cost.

stonesixone 11y ago

There is an effort happening in San Francisco right now to do just this. See here, for example, for a recent March 24, 2016 hearing on the topic: https://sfgov.legistar.com/LegislationDetail.aspx?ID=2567089&GUID=84A8E0AB-00CD-4FD3-B609-043F930B7A52 https://sfgov.legistar.com/LegislationDetail.aspx?ID=2567089... "Hearing on San Francisco's efforts to fund, design, and implement an open source voting system, including budget costs and projected roll-out schedule; and requesting the Department of Elections and the Elections Commission to report." It's currently up for consideration in the budget. SF resident Brian Behlendorf recently endorsed (along with EFF, Code for San Francisco, California Common Cause, local GitHub CEO Chris Wanstrath, etc), and we're looking for more high-profile supporters to help influence the Mayor's budget decision: https://twitter.com/cjerdonek/status/716448812181512192 https://twitter.com/cjerdonek/status/716448812181512192