5 ms·

This, not in-person voter fraud, is the real threat to our democratic election process. Paper ballots have a couple of strong advantages: 1) The voter can confi

This, not in-person voter fraud, is the real threat to our democratic election process. Paper ballots have a couple of strong advantages: 1) The voter can confirm that their vote was recorded as they intended. 2) There is a paper trail that is difficult to falsify which can be used to confirm election counts. Sure, there are problems with a paper ballot system, such as the fact that ballots can be misplaced or destroyed, but we've given up a lot for "convenience," which shouldn't be the top priority when it comes to our voting process. If nothing else, our voting machines need to produce duplicate paper receipts, one for the voter and one retained within the voting machine so that electronic results can be verified. Edit: as has been pointed out in the replies there are good reasons not to give people a paper copy of their vote, so it would be preferable to only produce a single paper receipt that the voter can view but which is retained within the voting machine itself.

seanp2k2 10y ago
How would a county realistically go about verifying voter receipts? Have everyone bring theirs in to be counted by...someone? The entire system is based upon trust and not easily verifiable by a single voter working alone, so in any of the solutions I've seen, it's impossible to independently verify the results of any counts.
- deleted 10y ago
  [deleted]
- pyrophane 10y ago
  That's why I said that two copies of the receipt should be generated, both viewable by the voter, with one of them being retained within the machine. The one given to the voter allows them to verify that their vote was cast correctly and gives them a piece of paper with I "vote ID" on it to show an election official if they notice a problem. The one that is retained would be collected by election officials and stored. This would allow someone else to go back later using a separate counting device to verify that the automatic count from the voting machines.
refurb 10y ago
I was thinking the same thing. Combine electronic counting with paper records. Just throwing this out there, but why not have the voter vote via touch-screen, that data is counted electronically and the voter walks away with a paper receipt of their votes. They can then use the code on the paper receipt to check on a website that the electronic count matches their paper count. I have no doubt even a simple system like that would be difficult to implement.
- maxerickson 10y ago
  The optical scan system used in 18 states already gives the paper record with electronic counting, without any concerns about the printer working properly during the election. https://ballotpedia.org/Voting_methods_and_equipment_by_state https://ballotpedia.org/Voting_methods_and_equipment_by_stat... As I said in a sibling comment, it's problematic to give the voter the ability to later prove how they voted (because it enables a coercive agent to check).
  - refurb 10y ago
    Good comment on the printers. It needs to be fool-proof.
- angersock 10y ago
  There have been studies where people, presented with a falsified record of their actions, will vigorously defend what they believe to be their "true" history.
- mentos 10y ago
  What if in addition they posted all 100 million of these UUIDs/vote pairings to a public website where anyone could verify their vote?
- deleted 10y ago
  [deleted]
maxerickson 10y ago
It's problematic to give the voter an official record of their vote. And while a paper ballot gives the voter a clear picture of the record their vote will be tallied from, it's the rest of the process that ensures them that it will be accurately tallied, which is just as important as the vote being accurately recorded.
- huherto 10y ago
  > It's problematic to give the voter an official record of their vote. Correct. Because it will allow them to sell their vote.
  - grzm 10y ago
    There are ways around this. See Scantegrity[0] for one example. See End-to-End Autitable Voting Systems[1] for this whole topic in particular. [0]: https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity [1]: https://en.wikipedia.org/wiki/End-to-end_auditable_voting_systems https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy...
    - huherto 10y ago
      Awesome. Thanks for the links.
michaelbuckbee 10y ago
Receipts (that show who you voted for) are typically not given as they encourage vote buying and coercion.
- pyrophane 10y ago
  You are right, and that is something I hadn't considered. Perhaps it would be preferable then to simply allow them to view the receipt through a window but retain it within the machine.
SilasX 10y ago
>1) The voter can confirm that their vote was recorded as they intended. No, they can't. They can verify that: A) Poll location XYZ (claims to have) received your ballot, B) The government tabulator included the votes from XYZ in the final count. That's not the same thing as verifying C) that they actually recorded your vote as intended. If they can verify that this specific ballot, with this ID number, is yours, that would violate ballot secrecy and existing protocols avoid this. You would need something like homomorphic encryption to achieve C). Incidentally, I don't get why we're okay with (in California et al) the system of giving a ballot to anyone who claims to be the person on the list. Yes, there are legit arguments against going all the way to photo ID ... but "no authentication whatsoever"? Come now.
- jowiar 10y ago
  The basic reason we're okay with it is there is almost no compelling reason for an individual to falsely claim to be other people -- at least none where the risk/reward factor pays off. The reward for casting a false ballot is almost certainly zero, and the risk factor of, say, a friend in the polling place saying "Hi Steve!" when you tell the people you're John is enough to tip the scales. Almost any effort to rig an election involves falsifying hundreds or thousands of ballots (or, as we've started to see, depriving said number of their right to vote).
  - SilasX 10y ago
    In your model, is there "almost certainly zero reward" to the first (legit) vote?
    - jowiar 10y ago
      Yes, but you're not committing a felony, risking jail time and fines. Also, you've identified why GOTV is a big deal in campaigns. That said, rounding up a big group of people together to all vote is a whole lot easier than rounding up a big group of people to commit felonies.
      - 10y ago
azernik 10y ago
"Receipts" are a problem - a key security goal of voting systems is that it should be impossible for the voter to be able to prove who they voted for (to prevent both voter coercion and vote-selling). Paper trails that stay in the hands of the registrar of voters are a good idea, in that they can be used to cross-check the results of the counting. Sure, you now have to trust the people with custody of the physical ballots, but it expands the size of the required conspiracy to more than just a few people with access to the voting machine software.
- deleted 10y ago
  [deleted]
- mrfusion 10y ago
  What if machines randomly gave 50% of voters receipts? You could still use those for auditing with simple statistics. But any particular voter could simply say they didn't get one.
  - maxerickson 10y ago
    The current system allows people to inspect the equipment and observe the vote. The parties typically make an effort to train people that do this in districts with close votes. There's no need to make it 50% likely that you can get a reward for voting a certain way.
  - VLM 10y ago
    Issue any voter as many ballots linking candidate to random serial number as they want for either candidate. Publish the complete mapping of ballot-serial before the election. Make up like ten times as many as you want. Maybe a million times. Give up to ten ballots to each voter. They get to deposit exactly one. They legally have to shred at least one receipt no exceptions (could be the one they voted, could be one they didn't) Publish the full list of votes complete with receipt and name mapping. If I'm coerced I eat my receipt for the vote I actually submitted. If I kept my vote, it should show up in the list of Trump serial numbered voters or maybe I printed a fake receipt, they'll be handing out fake receipts because the mapping was published before the election. In fact I can falsely claim I voted for any one or take the identity of any voter. The receipts are not going to be elaborate, by intention, the secret is the number on it not the paper. I can prove I shredded 9 hillary votes so if they show up in the list of YES then shennanigans I can tell a corrupt mass media employer I voted for Hillary merely by turning in any published "Hillary-serial number" combination. All valid ballots were published after the election. You can make it more elaborate and maybe better or worse by assigning two serial numbers to each ballot, a public serial and a private serial and playing public key crypto style games with which is published.
huherto 10y ago
The big advantage of manual processes is that is very difficult to commit big scale fraud. It would involve thousands of people.

seanp2k2 10y ago

How would a county realistically go about verifying voter receipts? Have everyone bring theirs in to be counted by...someone? The entire system is based upon trust and not easily verifiable by a single voter working alone, so in any of the solutions I've seen, it's impossible to independently verify the results of any counts.

deleted 10y ago
[deleted]
pyrophane 10y ago
That's why I said that two copies of the receipt should be generated, both viewable by the voter, with one of them being retained within the machine. The one given to the voter allows them to verify that their vote was cast correctly and gives them a piece of paper with I "vote ID" on it to show an election official if they notice a problem. The one that is retained would be collected by election officials and stored. This would allow someone else to go back later using a separate counting device to verify that the automatic count from the voting machines.

refurb 10y ago

I was thinking the same thing. Combine electronic counting with paper records. Just throwing this out there, but why not have the voter vote via touch-screen, that data is counted electronically and the voter walks away with a paper receipt of their votes. They can then use the code on the paper receipt to check on a website that the electronic count matches their paper count. I have no doubt even a simple system like that would be difficult to implement.

maxerickson 10y ago
The optical scan system used in 18 states already gives the paper record with electronic counting, without any concerns about the printer working properly during the election. https://ballotpedia.org/Voting_methods_and_equipment_by_state https://ballotpedia.org/Voting_methods_and_equipment_by_stat... As I said in a sibling comment, it's problematic to give the voter the ability to later prove how they voted (because it enables a coercive agent to check).
- refurb 10y ago
  Good comment on the printers. It needs to be fool-proof.
angersock 10y ago
There have been studies where people, presented with a falsified record of their actions, will vigorously defend what they believe to be their "true" history.
mentos 10y ago
What if in addition they posted all 100 million of these UUIDs/vote pairings to a public website where anyone could verify their vote?
deleted 10y ago
[deleted]

maxerickson 10y ago

It's problematic to give the voter an official record of their vote. And while a paper ballot gives the voter a clear picture of the record their vote will be tallied from, it's the rest of the process that ensures them that it will be accurately tallied, which is just as important as the vote being accurately recorded.

huherto 10y ago
> It's problematic to give the voter an official record of their vote. Correct. Because it will allow them to sell their vote.
- grzm 10y ago
  There are ways around this. See Scantegrity[0] for one example. See End-to-End Autitable Voting Systems[1] for this whole topic in particular. [0]: https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity [1]: https://en.wikipedia.org/wiki/End-to-end_auditable_voting_systems https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy...
  - huherto 10y ago
    Awesome. Thanks for the links.

michaelbuckbee 10y ago

Receipts (that show who you voted for) are typically not given as they encourage vote buying and coercion.

pyrophane 10y ago
You are right, and that is something I hadn't considered. Perhaps it would be preferable then to simply allow them to view the receipt through a window but retain it within the machine.

SilasX 10y ago

>1) The voter can confirm that their vote was recorded as they intended. No, they can't. They can verify that: A) Poll location XYZ (claims to have) received your ballot, B) The government tabulator included the votes from XYZ in the final count. That's not the same thing as verifying C) that they actually recorded your vote as intended. If they can verify that this specific ballot, with this ID number, is yours, that would violate ballot secrecy and existing protocols avoid this. You would need something like homomorphic encryption to achieve C). Incidentally, I don't get why we're okay with (in California et al) the system of giving a ballot to anyone who claims to be the person on the list. Yes, there are legit arguments against going all the way to photo ID ... but "no authentication whatsoever"? Come now.

jowiar 10y ago
The basic reason we're okay with it is there is almost no compelling reason for an individual to falsely claim to be other people -- at least none where the risk/reward factor pays off. The reward for casting a false ballot is almost certainly zero, and the risk factor of, say, a friend in the polling place saying "Hi Steve!" when you tell the people you're John is enough to tip the scales. Almost any effort to rig an election involves falsifying hundreds or thousands of ballots (or, as we've started to see, depriving said number of their right to vote).
- SilasX 10y ago
  In your model, is there "almost certainly zero reward" to the first (legit) vote?
  - jowiar 10y ago
    Yes, but you're not committing a felony, risking jail time and fines. Also, you've identified why GOTV is a big deal in campaigns. That said, rounding up a big group of people together to all vote is a whole lot easier than rounding up a big group of people to commit felonies.
    - 10y ago

azernik 10y ago

"Receipts" are a problem - a key security goal of voting systems is that it should be impossible for the voter to be able to prove who they voted for (to prevent both voter coercion and vote-selling). Paper trails that stay in the hands of the registrar of voters are a good idea, in that they can be used to cross-check the results of the counting. Sure, you now have to trust the people with custody of the physical ballots, but it expands the size of the required conspiracy to more than just a few people with access to the voting machine software.

deleted 10y ago
[deleted]
mrfusion 10y ago
What if machines randomly gave 50% of voters receipts? You could still use those for auditing with simple statistics. But any particular voter could simply say they didn't get one.
- maxerickson 10y ago
  The current system allows people to inspect the equipment and observe the vote. The parties typically make an effort to train people that do this in districts with close votes. There's no need to make it 50% likely that you can get a reward for voting a certain way.
- VLM 10y ago
  Issue any voter as many ballots linking candidate to random serial number as they want for either candidate. Publish the complete mapping of ballot-serial before the election. Make up like ten times as many as you want. Maybe a million times. Give up to ten ballots to each voter. They get to deposit exactly one. They legally have to shred at least one receipt no exceptions (could be the one they voted, could be one they didn't) Publish the full list of votes complete with receipt and name mapping. If I'm coerced I eat my receipt for the vote I actually submitted. If I kept my vote, it should show up in the list of Trump serial numbered voters or maybe I printed a fake receipt, they'll be handing out fake receipts because the mapping was published before the election. In fact I can falsely claim I voted for any one or take the identity of any voter. The receipts are not going to be elaborate, by intention, the secret is the number on it not the paper. I can prove I shredded 9 hillary votes so if they show up in the list of YES then shennanigans I can tell a corrupt mass media employer I voted for Hillary merely by turning in any published "Hillary-serial number" combination. All valid ballots were published after the election. You can make it more elaborate and maybe better or worse by assigning two serial numbers to each ballot, a public serial and a private serial and playing public key crypto style games with which is published.

huherto 10y ago

The big advantage of manual processes is that is very difficult to commit big scale fraud. It would involve thousands of people.