33 ms·

CHVote: Open-source e-voting system from Switzerland

437 points by porker 10y ago

homarp 10y ago
java8 based. AGPL. currently used by 4 cantons in Switzerland: Basel-City, Bern, Geneva and Luzern, either for votations or elections.
splike 10y ago
But how does a voter verify that this is really the software running in the background?
- neikos 10y ago
  But how do you verify that the compiler produces the code you wanted it to create? But how do you verify that the Computer actually does what is in the Bytecode?
  - negus 10y ago
    "But how do you verify that the compiler produces the code you wanted it to create?" You open it in disassembler and look through. It's a white box. "But how do you verify that the Computer actually does what is in the Bytecode?" It is much closer to the original question. hardware backdoors is a difficult topic
- PaulRobinson 10y ago
  How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced? There is always going to be a weak point where you have to trust somebody - this is why party members should not be involved in every step from setting constituency borders, all the way to being in charge of any balloting and reporting results. It needs to be independent (e.g. in the UK it is fiercely independent of party members' involvement at any level). The interesting attack vector here is your ISP could trick you. That can be mitigated with certificates and some of the measures banks use to identify themselves to customers (strings that you added at registration being displayed at login that only you know, etc.) But yes, a hard problem to solve.
  - Klathmon 10y ago
    >How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced? You can watch it. With a "ballot box" system, you could get there, put your vote in the box, then sit there and watch it all day until it's counted. Hell if you want you could get there and inspect the box before they start voting. And it's not just you that can do that, everyone can do that regardless of profession, age, race, background, education, etc...
    - tribaal 10y ago
      To clarify on top of Klathmon's point: this actually happens in Switzerland, it's not just a theoretical argument. Actually, the government is required to have some people watching the counting (specific rules vary on a per-canton basis). Some states select random citizens for that (similar to jury duty in the US - you get fined if you don't show up, but get paid for your time). Other states have a pool of people they choose from randomly (you volunteer for the pool). EDIT: Furthermore, Swiss people vote in their community. It's not like you need to go out of your way to watch the counting - it happens in your town hall or (sometimes) the school. It always happens on Sundays (which is a required day off in Switzerland except in some rare cases).
      - Klathmon 10y ago
        That's nice to know! If you don't mind me asking, how does Switzerland handle those which are required to work on election days? That's one of the ugliest parts of the US election system to me, is the fact that many people need to fit the election around their work schedule, and I know of at least 3 people that couldn't get time to vote this year, and my state makes it so you basically need to be actively deployed in the military, or be hospitalized to get an absentee ballot.
        tribaal 10y ago
        Like I added in my edit, there is almost no such case: Sundays are a mandatory day off for most. That means you can't go shopping on a Sunday, except in very few shops (train station shops have exceptions). Doctors, pharmacies and most other emergency things operate on a reduced schedule. I'm not certain what would happen if say a nurse working a shift in an ICU was selected. I'm pretty sure it's either announced early enough that the hospital would have to switch shiftees or they would be given a pass for free. I suspect a person working in a train station shop on a Sunday would tell their boss, and would simply be shifted to another time (it's not like the boss or the employee can do anything about it - it's law). EDIT: to clarify once again - I'm pretty sure it does happen, but the case is probably rare enough for it not to matter too much. The rule works for a good 90% of cases, exceptions can certainly be done on a case-by-case basis at community level.
- Klathmon 10y ago
  Furthermore how does your average voter verify that the code itself is secure? How are your grandparents going to validate the crypto? How can your illiterate cousin ensure the hardware isn't backdoored? I just don't get the draw of an electronic voting system. Paper works, and it works well. Anyone that can count can validate a single precinct. You can have one person, or 100 people all standing there watching a ballot box all day for tampering. You can have a whole group of people count the results, or just a few. In a traditional paper system, swaying a single precinct with "blackhat" methods takes a lot of physical resources, a lot of time, and in most cases a lot of people. Then multiply that by every precinct in the country, and it quickly becomes pretty much impossible to do (and get away with). I've said it before, and i'll say it again. Electronic voting is dangerous and is a very bad idea. And it doesn't matter if it's FOSS, it doesn't matter if it's vetted, it doesn't matter what safeguards are put in place, all it takes is one mistake. One fuckup, and someone can now choose the leader of a nation. And replacing a system where literally everyone can validate a system on voting day if they want to with a system where only a fraction of a fraction of people can even read and understand the code, let alone validate the code (and can't actually validate the hardware, or make sure what is running on the hardware is actually that code), and it takes a magnitude more time to do so, just isn't a good idea.
  - Quarrelsome 10y ago
    > I just don't get the draw of an electronic voting system. Make elections cheap. For those that wish to experiment with majority rules a reliable system would allow the people to technically be able to vote in their government on a daily, weekly, monthly basis. So further to this if elections are easy to run and are cheap what does it matter if someone breaks one election? You can just run the next one fine. It changes the variables somewhat and requires a sustained and persistent threat to be engaged to subvert the democracy. Combined with a team that investigate irregularities you can create a vaguely stable system, especially if you consider ideas such as binding authentication to geography instead of identity making it more difficult to stuff ballot boxes as teams can easily verify how many votes should be possible from a specific gps co-ordinate. I'm not saying its a great idea, its probably awful but it opens up an option to society that previously hasn't been available and that's interesting.
- dola 10y ago
  this is on a similar level of trust as the question about whether your paper vote is actually counted by some volunteer or just scraped. But I agree, that e-voting systems require a high level of trust by the users but I would argue that it is comparable to the trust you need in letter voting. The main difference in my view is the authority is typically split between fewer people with an e-voting system giving a single person more potential influence when they abuse their power. (e.g. a single server admin can deploy a malicious version of the system rather than a person only having access to maybe a few thousand ballots)
  - VLM 10y ago
    Speaking of trust, your comments are interesting and over the decades I've been struck by the symmetry and asymmetry between evoting systems and our heavily automated financial system. There is enormous financial reward to corrupt an e-voting system and enormous financial reward to provide a trustworthy secure financial system. No great surprise which system works and which system will never work. The solution seems simple at first glance; scrap the entire voting system, scrap the entire fundraising system, and whichever candidate receives more individual $1 donations via check or money order wins. You can vote a dollar to as many candidates as you want but your federal tax return for that year is only getting a single $1 election credit. You could require the candidates to declare to the IRS each $1 contributor which makes election fraud also a form of income tax fraud. Certainly, our financial marketplaces and clearinghouses at their absolute worst are more trustworthy and reliable than our evoting systems at their absolute best. And the additional infrastructure to transfer a hundred million bucks every four years is utterly trivial (well, more often due to primaries and midterm elections, but its still a drop in the bucket ...) The anonymity emperor has no clothes, anyway. Thanks to the miracle of modern technology everyone who matters already knows exactly who you voted for and your complete financial life, you're just plausibly deniable on an individual basis against some non-state opfor some of the time. May as well face reality and make all votes part of the public financial record. Sure, it sucks. But better to face a reality you don't like, than to live in a fantasy world of completely broken anonymity. Living a lie means you'll slip up and the consequences of the slip up are likely worse than the lack of anonymity itself.
  - tobltobs 10y ago
PaulRobinson 10y ago
The system overview is in the github repo here: https://github.com/republique-et-canton-de-geneve/chvote-1-0/blob/master/docs/system-overview.md https://github.com/republique-et-canton-de-geneve/chvote-1-0... For me, they haven't fixed the problem GUN.FREE highlighted when they decided to shut down (https://www.gnu.org/software/free/ https://www.gnu.org/software/free/), but they have highlighted the risks and made them harder to exploit. I need to sit down and think about attack vectors properly, as the process is quite convoluted, but it seems to me there are multiple opportunities for key personnel to change votes and to identify whom voted for each outcome - the scope is limited, and within a very small step due to ballot shuffling, but it definitely is there on a first read-through.
- sooheon 10y ago
  You would be doing a service to interested laypeople by writing down and sharing your thoughts on this. Experts often forget that things that are very obvious to them can be very enlightening to others.
deleted 10y ago
[deleted]
StreakyCobra 10y ago
While I appreciate the effort of putting it open-source, and even more to do it on GitHub, I hope they will hire someone who knows how to use Git/GitHub, like using tags for versioning instead of repository name [0], or using meaningful commit messages [1]. For the future let's see how they will manage external contributions. Opening the code for transparency is a good point (even if this still doesn't ensure you that the same version of the code is running in production on trusted hardware), but doing this on GitHub will certainly bring some contributions. Will they refuse everything? Or accept external contributions? Will they use GitHub as the central development process? If not how are they going to handle the development in intern in regards with external contributions? Also are they going to do all commits with this dedicated state-account? Who will be part and what would be the process for reviewing and accepting external contributions, to be sure they are not adding backdors purposely desguised as mistakes? Having a state starting to work on open-sourcing such a sensitive software in Switzerland opens a wide range of interesting questions. Maybe, and probably, this has already been discussed in other countries or even other part of Switzerland, but in the state of Valais (Switzerland) this is at least not the case. It's not the first project under state control in Switzerland that is on GitHub. I'm also aware of geo-admin [2] who have their sources there. As far as I saw, they are handling GitHub much more professionally. [0] https://github.com/republique-et-canton-de-geneve/chvote-1-0 https://github.com/republique-et-canton-de-geneve/chvote-1-0 [1] https://github.com/republique-et-canton-de-geneve/chvote-1-0/commits/master https://github.com/republique-et-canton-de-geneve/chvote-1-0... [2] https://github.com/geoadmin https://github.com/geoadmin
pedrocr 10y ago
Besides the usual comment that e-voting is a really bad idea[1] this sentence in their copy is delicious: "CHVote, entirely developed, hosted and exploited by the Geneva Canton" [1] https://news.ycombinator.com/item?id=13143302 https://news.ycombinator.com/item?id=13143302
- livatlantis 10y ago
  Almost certainly a mistranslation from French, where 'exploité' would be something like 'operated'. That whole paragraphe reads like French.
  - habi 10y ago
    Let's see what they make of this pull request: https://github.com/republique-et-canton-de-geneve/chvote-1-0/pull/2 https://github.com/republique-et-canton-de-geneve/chvote-1-0...
    - livatlantis 10y ago
      Merged! :)
  - scrollaway 10y ago
    > paragraphe :) It's paragraph in english, or section. I'm guilty of it as well. Despite English being my primary language for the last 10 years, whenever I read my previous comments I catch glaring mistakes.
    - livatlantis 10y ago
      Ha! Good catch :) English is my primary language as well but turns out living in a French-speaking country will do this to you.
brazzledazzle 10y ago
Off-topic: This one is kind of a curve ball for the temporary ban on political posts.
- Klathmon 10y ago
  that experiment has ended already.
  - brazzledazzle 10y ago
    My mistake. Sorry about that. Time really flies sometimes.
    - Klathmon 10y ago
      I don't think they announced it like they did the start of the experiment, it was at the top of a comment section one a bit ago. So there's no fault in not knowing!
- sgift 10y ago
  If you mean political detox week: That's over, the old rules are in effect again.
Synaesthesia 10y ago
I would like to say I think e-voting is a very good thing and could be transformative to society, given the political will. We have a very weak form of democracy in which we elect representatives and then entrust them to make decisions for us (yes I know we can lobby and petition govt). However this could allow a form of government where the population actually ratifies decisions made by government - a direct form of democracy.
- electic 10y ago
  This seems like a bad idea. You are assuming you have an informed electorate and that is rarely the case. Not saying what is in place is the best right now, but what you are suggesting seems far worse.
  - Synaesthesia 10y ago
    In other words people are too ignorant to know what's good for them and we must trust our smart government officials to make decisions for us. A typical line of anti-democratic ideology.
    - electic 10y ago
      No. It is not likely the average person will have time to go through all the nuances of a bill to properly evaluate it and make an informed decision. You are obviously passionate about the big name issues but there are hundreds, if not thousands, of boring bills and policy adjustments that the common person is not going to research to make an informed decision. Direct democracy has been tried and it largely failed.
      - Synaesthesia 10y ago
        It hasn't been tried! Not to my knowledge. And the closest approximations have been quite good successes too. For example the Swiss system, in Liby under Gadaffi there was a system where every law had to be ratified by the population. Apparently it was very successful. Lastly the system of workers councils and anarchist rule in revolutionary Spain was very successful.
bikamonki 10y ago
A successful challenge to the results of an election will most likely end up in a civil war. In other words, whoever is officially announced as winner will remain so, even if proof of fraud is found; accepting fraud would question the capabilities/transparency/independene of the electoral authorities. This situation is aggravated by electronic voting, not because of the possibilities of hacking the system, but because the results come to damn fast: victims of fraud do not have a chance to react. While they are barely starting the legal paper work to ask for a recount, the winner is already giving his/her triumphant speech!
- flexie 10y ago
  Civil war? Last time America had a civil war was 150 years ago, and not due to election fraud. Who exactly in today's America do you see potentially engaging themselves in civil war? Most young people - those that would usually be recruited as soldiers - are busy studying, working (debt off). There is no generation of idle, dead poor or undereducated youngsters to pick soldiers from. Many of the young people are really out of shape and have lived comfortable indoor lives. Most importantly they have better options than to fight a war. In what scenario would more than a few thousand crazy people take to arms because, for example Trump was caught in election fraud and impeached? I just cannot imagine that happening.
  - jylam 10y ago
    why are you talking about America ? Parent did not. You also seem to confuse America with USA.
    - briandear 10y ago
      America is the USA. Mexico is Mexico, the United States of Mexico to be exact. If you're thinking of the continent North America and South America, that's a different thing. Besides, America is a common name for the USA. You don't call Peruvians "Americans." But you do call the United States nationality "American." North America isn't "the north part of America" -- the continent is named "North America." So the nationality is American but citizens of the continent are North American or South American respectively. The people's of North and South Americans aren't collectively known as "Americans." In French americain refers to "one who is from the United States." It's the same in multiple languages. Even Spanish refers to people from the US as americanos. This is a subtle thing and in the grand scheme really makes no difference unless someone feels so strongly about it that they want to change multiple languages. The American Embassy is not referred to anywhere (in English) as The United States Embassy -- edit: actually "US Embassy" is common, sorry for the misstatement. However American Embassy is very commonly used by diplomatic personnel and in general conversation. -- I don't understand why a certain subset of people, generally from South and Central America have such an obsession with this. Canadians never refer to themselves as Americans. In fact, many would resent such a thing.
pksadiq 10y ago
I don't know how are they going to make a Java based application to be AGPLv3 compliant. And I don't know if the source code be provided to every voter on request, as voting is the service provided by the machine. Edit: Yeah, there are exemptions for voting machines in [A]GPLv3.
lo-enterprise 10y ago
Most interesting document of CHVote documentation is this one https://github.com/republique-et-canton-de-geneve/chvote-1-0/blob/master/docs/system-overview.md https://github.com/republique-et-canton-de-geneve/chvote-1-0... At the moment, the open sourced part is the "offline administration application" in the green box at the top right. https://github.com/republique-et-canton-de-geneve/chvote-1-0/blob/master/docs/system-overview.md#architecture-overview https://github.com/republique-et-canton-de-geneve/chvote-1-0...
yason 10y ago
For giving a guiding vote from the citizens to assist in parliamentary or local decisions, yes. For electing state officials, no. A voting scheme needs to be designed for the worst possible circumstances which practically means a bordering civil war, and where trust between voters is zero at best. Voting allows revolution to take place peacefully. Therefore the method of voting needs to be understood, carried over, and be verifiable by the common (wo)man. No electronic scheme can do that: anything that runs in software means that the correctness of the system depends on the experts' word only, and that word is likely to mean nothing when half the population is already collecting arms.
- devoply 10y ago
  You could do it this way: Two or more block chains. Each run by different parties. And a need for the same vote to show up on multiple blockchains to count. The voters would visit multiple websites to cast their votes which would then be verified between the various block chains, potentially by software that anyone can run on their own computer or vps. Every single person does not have to vote on multiple platform. Just enough that you can validate the voting.
  - endisukaj 10y ago
    Or you can just use a piece of paper, pencil and a plastic box to collect the votes.
    - devoply 10y ago
      Yes and how do you, as a citizen, verify that it's not been tampered with. In the US in the past few elections at least there has been accusations of fraud. And also having this sort of thing makes it possible to do research on the data afterwards... for anyone to do research on the data as it's public. No so with any other system.
      - slasaus 10y ago
        If you take the time to enter the voting booth when it opens and verify that the ballot boxes are empty at the start, and stay in the voting booth until it closes, you can verify yourself if everyone put at most one ballot in the ballot box. Later on you can double check if indeed every ballot is counted correctly and can thus conclude that at least your own ballot is counted correctly and exactly once without having to let anyone know what you voted.
xiphias 10y ago
Shouldn't it be using cryptographic proofs for voting? Ring signatures are good for it for example: https://en.wikipedia.org/wiki/Ring_signature#cite_note-FS07-5 https://en.wikipedia.org/wiki/Ring_signature#cite_note-FS07-...
tauntz 10y ago
Estonia's E-Voting systems backend code is also on GitHub (for already quite some years): https://github.com/vvk-ehk/evalimine https://github.com/vvk-ehk/evalimine
- toppy 10y ago
  Without a single unit test how can this piece of software be called "system"?
  - VMG 10y ago
    Simple, just add a singleton: https://github.com/vvk-ehk/evalimine/blob/master/ivote-server/common/singleton.py https://github.com/vvk-ehk/evalimine/blob/master/ivote-serve...
    - jessaustin 10y ago
      Haha; this seems pretty dumb: if __name__ == '__main__': pass
    - SanFranManDan 10y ago
      How they use the singleton is strange also. https://github.com/vvk-ehk/evalimine/blob/master/ivote-server/evui/evui.py https://github.com/vvk-ehk/evalimine/blob/master/ivote-serve... > Election().count_questions() > Election().is_hes() > for el in Election().get_questions() > Election().is_voters_list_disabled() Election is a singleton so they keep reinstantiating it every time they want to use it instead of just doing > election = Election() at the module level and having a more idiomatic singleton (module variable are singletons). But a singleton design probably isn't the best approach. The singleton example isn't that bad of code since it assumes that one server will run one election which is a valid assumption, but reading through this code makes me weary about e-voting. I think this proves that OpenSource doesn't always mean good code. There is little incentive for people outside of Estonia to contribute to the project.
  - trymas 10y ago
    Estonians use a 'black box principle'. They have some voting system - a black box - and they believe it works and no one has hacked it.
coldcode 10y ago
Why build an open source voting system, why not go all the way and build an open source election system? That way no one can complain about voting or not voting. Assuming you could find a bunch of people eligible who are willing to do the work, building some kind of AI system would at least eliminate the hassle, though I imagine not the complaining.
ljk 10y ago
relevant Tom Scott video on E-voting https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI
specialist 10y ago
These fix all, cure all novel voting systems are like recurring announcements of perpetual motion. Catnip for nerds. Please, study how election administration (in the USA) works to better assess these new technologies, techniques, systems. TLDR: Electronic (mediated) voting schemes cannot guarantee both the secret ballot and public count. Tech which may do one, or perhaps even both, hasn't even been conceived, must less invented.
dttrgrr 10y ago
There are necessary requirements in a voting system: 1. Authenticity - One vote per citizen. 2. Secrecy - no one, not even the government, should know who voted for who. 3. Verifiability - I know my vote counts. So if you have a login/password, #2 (logs are too easy) and #3 are out. With a Blockchain, #1 is out (how do you verify that a private key is owned by a citizen)?
- unethical_ban 10y ago
  I would question the requirement that government not have a record of who voted for who. Furthermore, I believe there are mathematical methods for being able to validate that someone voted, but not for whom they voted.
  - deleted 10y ago
    [deleted]
- Cshelton 10y ago
  You have a seperate blockchain that is used to verify a citizen. You can put many things there (marriage status, SSN..not needed anymore with this, any other info), which would include a voting key. The voting blockchain would check the citizen ID blockchain, to verify that citizen and all ensure the same voting key would not be used twice and that the citizen has proper status (like...is the person alive...legal...not a current felon, etc.) Theoretically, we have figured out the entire thing pretty damn well, we just need someone to try it ;) Also, explaining blockchain to the general population and "assuring" them will be the hardest part. People will revolt and think it's rigged and have no understanding of how it works. Even politicians are clueless...so, yeah, not sure how far off we are on this hah.
  - dispose13432 10y ago
    >You have a seperate blockchain that is used to verify a citizen. You can put many things there (marriage status, SSN..not needed anymore with this, any other info), which would include a voting key. The voting blockchain would check the citizen ID blockchain, to verify that citizen and all ensure the same voting key would not be used twice and that the citizen has proper status (like...is the person alive...legal...not a current felon, etc.) So how is the citizen ID blockchain linked with the voting blockchain?
sandGorgon 10y ago
The world's largest elections in india are all electronic.. including voting boxes shipped on elephant, camel, horses and canoe. is there a comparison of this voting system versus the others that exist?
- nickik 10y ago
  The voting system of India has been heavily criticized by Hackers. People from the German CCC have gone there showed how easy these systems are to exploit. Indian authorities have reacted pretty hostile of course. Nobody says you can not run electronic voting, its just hard to do it securely. India does not do it securely. See here for lots of information (India should be mentioned somewhere: https://media.ccc.de/search/?q=voting https://media.ccc.de/search/?q=voting)
  - sandGorgon 10y ago
    i know that - but it is guarded by actual physical security. The election commission of india is unanswerable to anyone - including the judiciary or the legislature.. and does its job brilliantly. Which is why I was asking the question on comparison. Because I'm not able to figure out if it is yet-another-voting-system... or something this is peer reviewed and secure.
triangleman 10y ago
The electronic voting system in Brazil is pretty well thought-out, IMO: https://en.wikipedia.org/wiki/Electronic_voting_in_Brazil https://en.wikipedia.org/wiki/Electronic_voting_in_Brazil Still, I would not trust an electronic system unless it printed a paper receipt behind a glass window, and dropped it into a box when I hit the submit button.
rvdm 10y ago
I've always been intrigued by Swiss software. I'd love to know what the Swiss themselves think about this system. To any Swiss people on HN : — Do you feel this had a positive impact on society? — Maybe more important, would you recommend this to other governments?
ElijahLynn 10y ago
I have been very interested in Open Voting Systems for quite some time now and have been following Open Voting Consortium, Alan Dechert and more for many years now. It is a problem that I think could have better solutions. There are many good ideas out there for this, and many include paper and open source software. I have compiled a list of reading materials here for those who are interested. https://github.com/ElijahLynn/open-source-voting-systems https://github.com/ElijahLynn/open-source-voting-systems
grondilu 10y ago
What proves that the published code is the one that is actually running?

437 points by porker 10y ago

java8 based. AGPL. currently used by 4 cantons in Switzerland: Basel-City, Bern, Geneva and Luzern, either for votations or elections.

splike 10y ago

But how does a voter verify that this is really the software running in the background?

neikos 10y ago
But how do you verify that the compiler produces the code you wanted it to create? But how do you verify that the Computer actually does what is in the Bytecode?
- negus 10y ago
  "But how do you verify that the compiler produces the code you wanted it to create?" You open it in disassembler and look through. It's a white box. "But how do you verify that the Computer actually does what is in the Bytecode?" It is much closer to the original question. hardware backdoors is a difficult topic
PaulRobinson 10y ago
How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced? There is always going to be a weak point where you have to trust somebody - this is why party members should not be involved in every step from setting constituency borders, all the way to being in charge of any balloting and reporting results. It needs to be independent (e.g. in the UK it is fiercely independent of party members' involvement at any level). The interesting attack vector here is your ISP could trick you. That can be mitigated with certificates and some of the measures banks use to identify themselves to customers (strings that you added at registration being displayed at login that only you know, etc.) But yes, a hard problem to solve.
- Klathmon 10y ago
  >How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced? You can watch it. With a "ballot box" system, you could get there, put your vote in the box, then sit there and watch it all day until it's counted. Hell if you want you could get there and inspect the box before they start voting. And it's not just you that can do that, everyone can do that regardless of profession, age, race, background, education, etc...
  - tribaal 10y ago
    To clarify on top of Klathmon's point: this actually happens in Switzerland, it's not just a theoretical argument. Actually, the government is required to have some people watching the counting (specific rules vary on a per-canton basis). Some states select random citizens for that (similar to jury duty in the US - you get fined if you don't show up, but get paid for your time). Other states have a pool of people they choose from randomly (you volunteer for the pool). EDIT: Furthermore, Swiss people vote in their community. It's not like you need to go out of your way to watch the counting - it happens in your town hall or (sometimes) the school. It always happens on Sundays (which is a required day off in Switzerland except in some rare cases).
    - Klathmon 10y ago
      That's nice to know! If you don't mind me asking, how does Switzerland handle those which are required to work on election days? That's one of the ugliest parts of the US election system to me, is the fact that many people need to fit the election around their work schedule, and I know of at least 3 people that couldn't get time to vote this year, and my state makes it so you basically need to be actively deployed in the military, or be hospitalized to get an absentee ballot.
      - tribaal 10y ago
        Like I added in my edit, there is almost no such case: Sundays are a mandatory day off for most. That means you can't go shopping on a Sunday, except in very few shops (train station shops have exceptions). Doctors, pharmacies and most other emergency things operate on a reduced schedule. I'm not certain what would happen if say a nurse working a shift in an ICU was selected. I'm pretty sure it's either announced early enough that the hospital would have to switch shiftees or they would be given a pass for free. I suspect a person working in a train station shop on a Sunday would tell their boss, and would simply be shifted to another time (it's not like the boss or the employee can do anything about it - it's law). EDIT: to clarify once again - I'm pretty sure it does happen, but the case is probably rare enough for it not to matter too much. The rule works for a good 90% of cases, exceptions can certainly be done on a case-by-case basis at community level.
Klathmon 10y ago
Furthermore how does your average voter verify that the code itself is secure? How are your grandparents going to validate the crypto? How can your illiterate cousin ensure the hardware isn't backdoored? I just don't get the draw of an electronic voting system. Paper works, and it works well. Anyone that can count can validate a single precinct. You can have one person, or 100 people all standing there watching a ballot box all day for tampering. You can have a whole group of people count the results, or just a few. In a traditional paper system, swaying a single precinct with "blackhat" methods takes a lot of physical resources, a lot of time, and in most cases a lot of people. Then multiply that by every precinct in the country, and it quickly becomes pretty much impossible to do (and get away with). I've said it before, and i'll say it again. Electronic voting is dangerous and is a very bad idea. And it doesn't matter if it's FOSS, it doesn't matter if it's vetted, it doesn't matter what safeguards are put in place, all it takes is one mistake. One fuckup, and someone can now choose the leader of a nation. And replacing a system where literally everyone can validate a system on voting day if they want to with a system where only a fraction of a fraction of people can even read and understand the code, let alone validate the code (and can't actually validate the hardware, or make sure what is running on the hardware is actually that code), and it takes a magnitude more time to do so, just isn't a good idea.
- Quarrelsome 10y ago
  > I just don't get the draw of an electronic voting system. Make elections cheap. For those that wish to experiment with majority rules a reliable system would allow the people to technically be able to vote in their government on a daily, weekly, monthly basis. So further to this if elections are easy to run and are cheap what does it matter if someone breaks one election? You can just run the next one fine. It changes the variables somewhat and requires a sustained and persistent threat to be engaged to subvert the democracy. Combined with a team that investigate irregularities you can create a vaguely stable system, especially if you consider ideas such as binding authentication to geography instead of identity making it more difficult to stuff ballot boxes as teams can easily verify how many votes should be possible from a specific gps co-ordinate. I'm not saying its a great idea, its probably awful but it opens up an option to society that previously hasn't been available and that's interesting.
dola 10y ago
this is on a similar level of trust as the question about whether your paper vote is actually counted by some volunteer or just scraped. But I agree, that e-voting systems require a high level of trust by the users but I would argue that it is comparable to the trust you need in letter voting. The main difference in my view is the authority is typically split between fewer people with an e-voting system giving a single person more potential influence when they abuse their power. (e.g. a single server admin can deploy a malicious version of the system rather than a person only having access to maybe a few thousand ballots)
- VLM 10y ago
  Speaking of trust, your comments are interesting and over the decades I've been struck by the symmetry and asymmetry between evoting systems and our heavily automated financial system. There is enormous financial reward to corrupt an e-voting system and enormous financial reward to provide a trustworthy secure financial system. No great surprise which system works and which system will never work. The solution seems simple at first glance; scrap the entire voting system, scrap the entire fundraising system, and whichever candidate receives more individual $1 donations via check or money order wins. You can vote a dollar to as many candidates as you want but your federal tax return for that year is only getting a single $1 election credit. You could require the candidates to declare to the IRS each $1 contributor which makes election fraud also a form of income tax fraud. Certainly, our financial marketplaces and clearinghouses at their absolute worst are more trustworthy and reliable than our evoting systems at their absolute best. And the additional infrastructure to transfer a hundred million bucks every four years is utterly trivial (well, more often due to primaries and midterm elections, but its still a drop in the bucket ...) The anonymity emperor has no clothes, anyway. Thanks to the miracle of modern technology everyone who matters already knows exactly who you voted for and your complete financial life, you're just plausibly deniable on an individual basis against some non-state opfor some of the time. May as well face reality and make all votes part of the public financial record. Sure, it sucks. But better to face a reality you don't like, than to live in a fantasy world of completely broken anonymity. Living a lie means you'll slip up and the consequences of the slip up are likely worse than the lack of anonymity itself.
- tobltobs 10y ago

PaulRobinson 10y ago

The system overview is in the github repo here: https://github.com/republique-et-canton-de-geneve/chvote-1-0/blob/master/docs/system-overview.md https://github.com/republique-et-canton-de-geneve/chvote-1-0... For me, they haven't fixed the problem GUN.FREE highlighted when they decided to shut down (https://www.gnu.org/software/free/ https://www.gnu.org/software/free/), but they have highlighted the risks and made them harder to exploit. I need to sit down and think about attack vectors properly, as the process is quite convoluted, but it seems to me there are multiple opportunities for key personnel to change votes and to identify whom voted for each outcome - the scope is limited, and within a very small step due to ballot shuffling, but it definitely is there on a first read-through.

sooheon 10y ago
You would be doing a service to interested laypeople by writing down and sharing your thoughts on this. Experts often forget that things that are very obvious to them can be very enlightening to others.

deleted 10y ago

[deleted]

StreakyCobra 10y ago

While I appreciate the effort of putting it open-source, and even more to do it on GitHub, I hope they will hire someone who knows how to use Git/GitHub, like using tags for versioning instead of repository name [0], or using meaningful commit messages [1]. For the future let's see how they will manage external contributions. Opening the code for transparency is a good point (even if this still doesn't ensure you that the same version of the code is running in production on trusted hardware), but doing this on GitHub will certainly bring some contributions. Will they refuse everything? Or accept external contributions? Will they use GitHub as the central development process? If not how are they going to handle the development in intern in regards with external contributions? Also are they going to do all commits with this dedicated state-account? Who will be part and what would be the process for reviewing and accepting external contributions, to be sure they are not adding backdors purposely desguised as mistakes? Having a state starting to work on open-sourcing such a sensitive software in Switzerland opens a wide range of interesting questions. Maybe, and probably, this has already been discussed in other countries or even other part of Switzerland, but in the state of Valais (Switzerland) this is at least not the case. It's not the first project under state control in Switzerland that is on GitHub. I'm also aware of geo-admin [2] who have their sources there. As far as I saw, they are handling GitHub much more professionally. [0] https://github.com/republique-et-canton-de-geneve/chvote-1-0 https://github.com/republique-et-canton-de-geneve/chvote-1-0 [1] https://github.com/republique-et-canton-de-geneve/chvote-1-0/commits/master https://github.com/republique-et-canton-de-geneve/chvote-1-0... [2] https://github.com/geoadmin https://github.com/geoadmin

pedrocr 10y ago

Besides the usual comment that e-voting is a really bad idea[1] this sentence in their copy is delicious: "CHVote, entirely developed, hosted and exploited by the Geneva Canton" [1] https://news.ycombinator.com/item?id=13143302 https://news.ycombinator.com/item?id=13143302

livatlantis 10y ago
Almost certainly a mistranslation from French, where 'exploité' would be something like 'operated'. That whole paragraphe reads like French.
- habi 10y ago
  Let's see what they make of this pull request: https://github.com/republique-et-canton-de-geneve/chvote-1-0/pull/2 https://github.com/republique-et-canton-de-geneve/chvote-1-0...
  - livatlantis 10y ago
    Merged! :)
- scrollaway 10y ago
  > paragraphe :) It's paragraph in english, or section. I'm guilty of it as well. Despite English being my primary language for the last 10 years, whenever I read my previous comments I catch glaring mistakes.
  - livatlantis 10y ago
    Ha! Good catch :) English is my primary language as well but turns out living in a French-speaking country will do this to you.

brazzledazzle 10y ago

Off-topic: This one is kind of a curve ball for the temporary ban on political posts.

Klathmon 10y ago
that experiment has ended already.
- brazzledazzle 10y ago
  My mistake. Sorry about that. Time really flies sometimes.
  - Klathmon 10y ago
    I don't think they announced it like they did the start of the experiment, it was at the top of a comment section one a bit ago. So there's no fault in not knowing!
sgift 10y ago
If you mean political detox week: That's over, the old rules are in effect again.

Synaesthesia 10y ago

I would like to say I think e-voting is a very good thing and could be transformative to society, given the political will. We have a very weak form of democracy in which we elect representatives and then entrust them to make decisions for us (yes I know we can lobby and petition govt). However this could allow a form of government where the population actually ratifies decisions made by government - a direct form of democracy.

electic 10y ago
This seems like a bad idea. You are assuming you have an informed electorate and that is rarely the case. Not saying what is in place is the best right now, but what you are suggesting seems far worse.
- Synaesthesia 10y ago
  In other words people are too ignorant to know what's good for them and we must trust our smart government officials to make decisions for us. A typical line of anti-democratic ideology.
  - electic 10y ago
    No. It is not likely the average person will have time to go through all the nuances of a bill to properly evaluate it and make an informed decision. You are obviously passionate about the big name issues but there are hundreds, if not thousands, of boring bills and policy adjustments that the common person is not going to research to make an informed decision. Direct democracy has been tried and it largely failed.
    - Synaesthesia 10y ago
      It hasn't been tried! Not to my knowledge. And the closest approximations have been quite good successes too. For example the Swiss system, in Liby under Gadaffi there was a system where every law had to be ratified by the population. Apparently it was very successful. Lastly the system of workers councils and anarchist rule in revolutionary Spain was very successful.

bikamonki 10y ago

A successful challenge to the results of an election will most likely end up in a civil war. In other words, whoever is officially announced as winner will remain so, even if proof of fraud is found; accepting fraud would question the capabilities/transparency/independene of the electoral authorities. This situation is aggravated by electronic voting, not because of the possibilities of hacking the system, but because the results come to damn fast: victims of fraud do not have a chance to react. While they are barely starting the legal paper work to ask for a recount, the winner is already giving his/her triumphant speech!

flexie 10y ago
Civil war? Last time America had a civil war was 150 years ago, and not due to election fraud. Who exactly in today's America do you see potentially engaging themselves in civil war? Most young people - those that would usually be recruited as soldiers - are busy studying, working (debt off). There is no generation of idle, dead poor or undereducated youngsters to pick soldiers from. Many of the young people are really out of shape and have lived comfortable indoor lives. Most importantly they have better options than to fight a war. In what scenario would more than a few thousand crazy people take to arms because, for example Trump was caught in election fraud and impeached? I just cannot imagine that happening.
- jylam 10y ago
  why are you talking about America ? Parent did not. You also seem to confuse America with USA.
  - briandear 10y ago
    America is the USA. Mexico is Mexico, the United States of Mexico to be exact. If you're thinking of the continent North America and South America, that's a different thing. Besides, America is a common name for the USA. You don't call Peruvians "Americans." But you do call the United States nationality "American." North America isn't "the north part of America" -- the continent is named "North America." So the nationality is American but citizens of the continent are North American or South American respectively. The people's of North and South Americans aren't collectively known as "Americans." In French americain refers to "one who is from the United States." It's the same in multiple languages. Even Spanish refers to people from the US as americanos. This is a subtle thing and in the grand scheme really makes no difference unless someone feels so strongly about it that they want to change multiple languages. The American Embassy is not referred to anywhere (in English) as The United States Embassy -- edit: actually "US Embassy" is common, sorry for the misstatement. However American Embassy is very commonly used by diplomatic personnel and in general conversation. -- I don't understand why a certain subset of people, generally from South and Central America have such an obsession with this. Canadians never refer to themselves as Americans. In fact, many would resent such a thing.

pksadiq 10y ago

I don't know how are they going to make a Java based application to be AGPLv3 compliant. And I don't know if the source code be provided to every voter on request, as voting is the service provided by the machine. Edit: Yeah, there are exemptions for voting machines in [A]GPLv3.

lo-enterprise 10y ago

Most interesting document of CHVote documentation is this one https://github.com/republique-et-canton-de-geneve/chvote-1-0/blob/master/docs/system-overview.md https://github.com/republique-et-canton-de-geneve/chvote-1-0... At the moment, the open sourced part is the "offline administration application" in the green box at the top right. https://github.com/republique-et-canton-de-geneve/chvote-1-0/blob/master/docs/system-overview.md#architecture-overview https://github.com/republique-et-canton-de-geneve/chvote-1-0...

yason 10y ago

For giving a guiding vote from the citizens to assist in parliamentary or local decisions, yes. For electing state officials, no. A voting scheme needs to be designed for the worst possible circumstances which practically means a bordering civil war, and where trust between voters is zero at best. Voting allows revolution to take place peacefully. Therefore the method of voting needs to be understood, carried over, and be verifiable by the common (wo)man. No electronic scheme can do that: anything that runs in software means that the correctness of the system depends on the experts' word only, and that word is likely to mean nothing when half the population is already collecting arms.

devoply 10y ago
You could do it this way: Two or more block chains. Each run by different parties. And a need for the same vote to show up on multiple blockchains to count. The voters would visit multiple websites to cast their votes which would then be verified between the various block chains, potentially by software that anyone can run on their own computer or vps. Every single person does not have to vote on multiple platform. Just enough that you can validate the voting.
- endisukaj 10y ago
  Or you can just use a piece of paper, pencil and a plastic box to collect the votes.
  - devoply 10y ago
    Yes and how do you, as a citizen, verify that it's not been tampered with. In the US in the past few elections at least there has been accusations of fraud. And also having this sort of thing makes it possible to do research on the data afterwards... for anyone to do research on the data as it's public. No so with any other system.
    - slasaus 10y ago
      If you take the time to enter the voting booth when it opens and verify that the ballot boxes are empty at the start, and stay in the voting booth until it closes, you can verify yourself if everyone put at most one ballot in the ballot box. Later on you can double check if indeed every ballot is counted correctly and can thus conclude that at least your own ballot is counted correctly and exactly once without having to let anyone know what you voted.

xiphias 10y ago

Shouldn't it be using cryptographic proofs for voting? Ring signatures are good for it for example: https://en.wikipedia.org/wiki/Ring_signature#cite_note-FS07-5 https://en.wikipedia.org/wiki/Ring_signature#cite_note-FS07-...

tauntz 10y ago

Estonia's E-Voting systems backend code is also on GitHub (for already quite some years): https://github.com/vvk-ehk/evalimine https://github.com/vvk-ehk/evalimine

toppy 10y ago
Without a single unit test how can this piece of software be called "system"?
- VMG 10y ago
  Simple, just add a singleton: https://github.com/vvk-ehk/evalimine/blob/master/ivote-server/common/singleton.py https://github.com/vvk-ehk/evalimine/blob/master/ivote-serve...
  - jessaustin 10y ago
    Haha; this seems pretty dumb: if __name__ == '__main__': pass
  - SanFranManDan 10y ago
    How they use the singleton is strange also. https://github.com/vvk-ehk/evalimine/blob/master/ivote-server/evui/evui.py https://github.com/vvk-ehk/evalimine/blob/master/ivote-serve... > Election().count_questions() > Election().is_hes() > for el in Election().get_questions() > Election().is_voters_list_disabled() Election is a singleton so they keep reinstantiating it every time they want to use it instead of just doing > election = Election() at the module level and having a more idiomatic singleton (module variable are singletons). But a singleton design probably isn't the best approach. The singleton example isn't that bad of code since it assumes that one server will run one election which is a valid assumption, but reading through this code makes me weary about e-voting. I think this proves that OpenSource doesn't always mean good code. There is little incentive for people outside of Estonia to contribute to the project.
- trymas 10y ago
  Estonians use a 'black box principle'. They have some voting system - a black box - and they believe it works and no one has hacked it.

coldcode 10y ago

Why build an open source voting system, why not go all the way and build an open source election system? That way no one can complain about voting or not voting. Assuming you could find a bunch of people eligible who are willing to do the work, building some kind of AI system would at least eliminate the hassle, though I imagine not the complaining.

ljk 10y ago

relevant Tom Scott video on E-voting https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI

specialist 10y ago

These fix all, cure all novel voting systems are like recurring announcements of perpetual motion. Catnip for nerds. Please, study how election administration (in the USA) works to better assess these new technologies, techniques, systems. TLDR: Electronic (mediated) voting schemes cannot guarantee both the secret ballot and public count. Tech which may do one, or perhaps even both, hasn't even been conceived, must less invented.

dttrgrr 10y ago

There are necessary requirements in a voting system: 1. Authenticity - One vote per citizen. 2. Secrecy - no one, not even the government, should know who voted for who. 3. Verifiability - I know my vote counts. So if you have a login/password, #2 (logs are too easy) and #3 are out. With a Blockchain, #1 is out (how do you verify that a private key is owned by a citizen)?

unethical_ban 10y ago
I would question the requirement that government not have a record of who voted for who. Furthermore, I believe there are mathematical methods for being able to validate that someone voted, but not for whom they voted.
- deleted 10y ago
  [deleted]
Cshelton 10y ago
You have a seperate blockchain that is used to verify a citizen. You can put many things there (marriage status, SSN..not needed anymore with this, any other info), which would include a voting key. The voting blockchain would check the citizen ID blockchain, to verify that citizen and all ensure the same voting key would not be used twice and that the citizen has proper status (like...is the person alive...legal...not a current felon, etc.) Theoretically, we have figured out the entire thing pretty damn well, we just need someone to try it ;) Also, explaining blockchain to the general population and "assuring" them will be the hardest part. People will revolt and think it's rigged and have no understanding of how it works. Even politicians are clueless...so, yeah, not sure how far off we are on this hah.
- dispose13432 10y ago
  >You have a seperate blockchain that is used to verify a citizen. You can put many things there (marriage status, SSN..not needed anymore with this, any other info), which would include a voting key. The voting blockchain would check the citizen ID blockchain, to verify that citizen and all ensure the same voting key would not be used twice and that the citizen has proper status (like...is the person alive...legal...not a current felon, etc.) So how is the citizen ID blockchain linked with the voting blockchain?

sandGorgon 10y ago

The world's largest elections in india are all electronic.. including voting boxes shipped on elephant, camel, horses and canoe. is there a comparison of this voting system versus the others that exist?

nickik 10y ago
The voting system of India has been heavily criticized by Hackers. People from the German CCC have gone there showed how easy these systems are to exploit. Indian authorities have reacted pretty hostile of course. Nobody says you can not run electronic voting, its just hard to do it securely. India does not do it securely. See here for lots of information (India should be mentioned somewhere: https://media.ccc.de/search/?q=voting https://media.ccc.de/search/?q=voting)
- sandGorgon 10y ago
  i know that - but it is guarded by actual physical security. The election commission of india is unanswerable to anyone - including the judiciary or the legislature.. and does its job brilliantly. Which is why I was asking the question on comparison. Because I'm not able to figure out if it is yet-another-voting-system... or something this is peer reviewed and secure.

triangleman 10y ago

The electronic voting system in Brazil is pretty well thought-out, IMO: https://en.wikipedia.org/wiki/Electronic_voting_in_Brazil https://en.wikipedia.org/wiki/Electronic_voting_in_Brazil Still, I would not trust an electronic system unless it printed a paper receipt behind a glass window, and dropped it into a box when I hit the submit button.

rvdm 10y ago

I've always been intrigued by Swiss software. I'd love to know what the Swiss themselves think about this system. To any Swiss people on HN : — Do you feel this had a positive impact on society? — Maybe more important, would you recommend this to other governments?

ElijahLynn 10y ago

I have been very interested in Open Voting Systems for quite some time now and have been following Open Voting Consortium, Alan Dechert and more for many years now. It is a problem that I think could have better solutions. There are many good ideas out there for this, and many include paper and open source software. I have compiled a list of reading materials here for those who are interested. https://github.com/ElijahLynn/open-source-voting-systems https://github.com/ElijahLynn/open-source-voting-systems

grondilu 10y ago

What proves that the published code is the one that is actually running?