13 ms·

To Protect Voting, Use Open-Source Software

281 points by evanb 9y ago

pedrocr 9y ago
Don't, use pen and paper instead. Previous HN discussion on it: https://news.ycombinator.com/item?id=14891266 https://news.ycombinator.com/item?id=14891266
- avelis 9y ago
  Came here to recommend that. Instead, use open source hardware. Use pen and paper! :-)
  - zanny 9y ago
    We could also use open source hardware that isn't pen and paper. We just need the open source part.
    - benchaney 9y ago
      Verifying hardware more complicated than a pen and paper is prohibitively difficult.
    - simias 9y ago
      And a way to simply audit them. It's a bit difficult to make a fake pen and paper that would trick me into voting for the wrong person (especially at scale).
    - rurban 9y ago
      Nope, that would not work. Paper and pen are the best secure methods. Everything digital is insecure.
    - Zash 9y ago
      What open source hardware would that be, and how can everyone eligible to vote be able to understand how it works and be able to observe that it really does work?
      - amenghra 9y ago
        Every single person doesn't understand all the security aspects of today's paper & pen ballots, how they are secured before and after the day of voting, how they are transported from one location to another, how mail-in ballots get handled, etc. There's no reason to require something that everyone can understand when talking about a different voting system. IMHO, we should aim to build something (whether using physical machines or using cryptography/mathematical properties) that the various parties in a government can audit and recognize as secure and that leads to a larger portion of the population voting or a cheaper election process.
        zAy0LfpBZLC8mAC 9y ago
        Whether people do understand something is very different from whether people can understand something. While many people maybe aren't aware of the security mechanisms of a pen and paper election, essentially everyone can actually understand them if they feel the need to, and that is extremely important. You cannot resolve widespread distrust by putting a bunch of mathematicians on TV who tell the population that everything is fine.
        jfnixon 9y ago
        We already have something that can be made secure, anonymous, and auditable, and yet is easy to understand and relatively inexpensive. It is pencil and paper ballots, with multiple interested parties observing the entire process.
    - thanhquanky 9y ago
      remember the butterfly ballot?
      - thrownblown 9y ago
        never forget the hanging chad!
    - jdavis703 9y ago
      Well then you have issues like "hanging chads," [0] that's why e-voting became big in the US. 0: https://cseweb.ucsd.edu/~goguen/courses/275f00/abc-chads.html https://cseweb.ucsd.edu/~goguen/courses/275f00/abc-chads.htm...
      - mnem 9y ago
        Pen and paper doesn't suffer from hanging chads, surely? That's only if you use paper + hole punch for primitive automated counting?
- SAI_Peregrinus 9y ago
  And if you want the benefits of computers (fast counting, ability to prove your vote was counted correctly) without sacrificing the secret ballot or the paper audit trail you can use something like punchscan or scantegrity.
- dgudkov 9y ago
  We can trust digital money, but we can't trust digital votes?
  - mrkrabo 9y ago
    Who trusts digital money?
    - CaptSpify 9y ago
      pretty much anyone that uses a bank
      - scierama 9y ago
        Digital records management is a technique; not digital currency.
  - komali2 9y ago
    Who's "we?" I don't trust digital money :P
    - amenghra 9y ago
      Does your bank account, credit card, etc. count as digital money? Your account balance is just bits somewhere.
      - scierama 9y ago
        You're conflating records management with actual currency.
      - komali2 9y ago
        Well, ok, but my account balance is guaranteed by a government (for well above my balance). I don't get that with digital currency.
  - mixmax 9y ago
    correct. The problem with digital voting is that it needs to be anonymous who votes for what. That makes the problem much much harder.
- peterwwillis 9y ago
  There are actually elaborate rules and measures on the handling of paper ballots to work around complicated schemes that have been devised to defraud the vote. It's certainly not foolproof. Problems with paper voting: - Fraud - Counting time - Margin of error Problems with electronic voting: - Hacking - Cost - Programming bugs - Machine error - Scalability Actual way voting is handled - Some states use mailed paper ballots - Some states use paper-free voting - Some states use a mixture of electronic and paper voting The biggest risk is not the mechanism, but the way it is implemented: 5,000 independent jurisdictions all have completely independent ways of choosing how to vote, and then completely independent methods of implementing it. [3] This[1] testimony from 2001 includes a good history of the voting process and the reasons why it is handled the way it is. The parent[2] directory contains 16 years of commentary articles. [1] http://homepage.divms.uiowa.edu/~jones/voting/congress.html http://homepage.divms.uiowa.edu/~jones/voting/congress.html [2] http://homepage.divms.uiowa.edu/~jones/voting/index.html http://homepage.divms.uiowa.edu/~jones/voting/index.html [3] http://homepage.divms.uiowa.edu/~jones/voting/PutinTrump.shtml http://homepage.divms.uiowa.edu/~jones/voting/PutinTrump.sht...
  - bluejekyll 9y ago
    Paper ballots can be destroyed easily too: I remember this in San Francisco in 2001, http://www.sfgate.com/politics/article/Scavenged-ballot-box-lids-haunt-S-F-elections-3302604.php#photo-2450496 http://www.sfgate.com/politics/article/Scavenged-ballot-box-...
    - peterwwillis 9y ago
      That's one of the methods of fraud. Many counties have had "lost" ballots. Many voters have not received their absentee ballots. Florida was actually not even close to finishing counting its ballots when Obama claimed victory in 2012. California had the same problem in June 2016. With regard to machines, many machines have recorded thousands of extra votes. Some machines run out of memory, and end up losing thousands of votes (those machines did not have paper trails). There's been plenty of problems with these machines - ones that can be fixed. But the fact that every precinct decides independently what to do and how to do it, there is absolutely no way (in the US) to provide a uniform solution to the problems of paperless voting.
- stephengillie 9y ago
  Then we can debate whether or not a bubble has been completely filled in. Or if a "hanging Chad" counts as a vote.
  - wang_li 9y ago
    It seems perfectly reasonable to not count votes that are unclear. It's not a complex procedure to fill in a circle on a scantron, if you can't follow the directions, then too bad for you and your vote and your preferred candidates.
  - pedrocr 9y ago
    Yes, the US has been able to screw up even paper elections in an attempt to make counting supposedly faster. Most other countries just use a paper ballot with some squares next to the candidates and you mark with an X. Any deviation from that is a null vote because the voter could try to identify himself otherwise. Our elections run smoothly every time and we have well counted results in a few hours at most, faster than the US is ever able to accomplish from what I've seen.
    - nickpeterson 9y ago
      Which country is this?
      - pedrocr 9y ago
        I'm in Portugal. Most of Europe is the same, Canada too.
        nickpeterson 9y ago
        Doesn't Portugal have widespread corruption, especially in regards to political parties and parliament?
        pedrocr 9y ago
        Perception of corruption is about on par with the US in the studies I've seen. That's mostly unrelated to quality of the election process though. There the US is quite a long way back. The Bush/Gore mess would never happen here.
- sapote 9y ago
  Agreed. And to add to it, we should switch to a system in which we have: * 100% mail-in paper ballots, like Oregon -- no long lines, no games about which districts get which machines, no polling place intimidation * Mandatory random-sample hand recounts (this has been shown to only need to be on the order of thousands of ballots out of millions for most races, given the statistical confidence you get with it)
  - dragonwriter 9y ago
    Mail-in ballots offer far more robust intimidation and coercion opportunities than are available in polling places.
    - sapote 9y ago
      I was expecting that response. The only solution, then, is to ban all mail in ballots. Right now California, for example, has optional mail-in voting. Wouldn't you expect that anyone who can be coerced to vote some way could be coerced whether the mail-in voting is optional or mandatory?
      - dragonwriter 9y ago
        I'm not arguing that mail in ballots don't have benefits that warranted the increase in coercion risk, I'm just arguing that mail in ballots cannot be viewed as a mitigation of coercion risk compared to the way US in-person polling stations are run since they exacerbate, rather than mitigate, that risk.
        deleted 9y ago
        [deleted]
    - nxsynonym 9y ago
      Care to expand? Don't see how that could be the case.
      - 9y ago
- hathawsh 9y ago
  I agree, however, those of us who understand the importance of paper ballots are having a hard time selling it to the public. We're coming across as Luddites. I'm impressed that the New York Times is promoting open source software; it's a small step in the right direction. Perhaps the message we should be spreading is that paper ballots are even more "open source" than any computer software. With paper, poll workers can prevent hacking by simply observing, using physical locks, and communicating with other poll workers. Software (open source or not) only seems to complicate all of that.
  - pedrocr 9y ago
    That's why I find the HN discussions on this so important. If the actual technology people can't see it the rest of the population has no chance. The rule of thumb, that almost never fails, is that technology always brings advantages and quickly. Sometimes it even steals their jobs. If we can get a broad agreement on the message that "trust me, I implement new technology all day every day and electronic voting is a solution looking for a problem and if your local politician tries to sell you on it he's most likely trying to steal the vote" we can do quite a bit.
    - specialist 9y ago
      Voters know in their bones that the voting computers are bad. Voters are not the problem. Returning to paper ballots means less cheddar for cronies. Happily there's a workaround. Postal balloting (close the poll sites)! Ballots are digitally scanned as they're received at central count. So it has all the downsides of the touchscreens with all new vulnerabilities (undetectable alterations, signature mismatches, preview election counts, voter coercion...). But voters get the comfort of paper and it keeps the cheddar flowing for the cronies.
  - sapote 9y ago
    I remember someone saying here that a key shift in framing in Germany was to call them voting computers rather than voting machines (since the broader public understands that computers can be hacked). I think we might adopt that as well.
rectang 9y ago
Open source voting software will never replace proprietary voting software, because open discussion of voting software security will reveal that it's impossible to build hack-proof voting terminals. Paper ballots are a superior technology.
- partiallypro 9y ago
  You can stuff ballot boxes, that's where the term comes from. Nothing is "hack-proof." I think it's funny that people are freaking out on HN about this. The hacks at Defcon all took a long time to do, and I believe all required keys to the machines, and all were done on older voting machines. There has been no evidence of people hacking machines during the elections. Stuffing ballot boxes and other forms of voting fraud have been around for a long time, and nothing we do is going to stop it 100%. Also voting machines generally have paper copies that print off the back of the machine that are anonymized but can be matched if foul play is called into question, at least in my area. Couple that with monitors that stand near machines or walk around and I feel pretty comfortable with electronic voting. The only plausible hack would be an inside job, but I too find this difficult to believe. It would takes tons and tons of people to hack the machines if it required physical access. You'd have to hack ever machine, and even when you were done there are so many districts it would be nearly impossible to swing the election in any meaningful way.
  - deelowe 9y ago
    The point is that paper ballots are harder to tamper with. To the point that at scale it becomes impossible to rig an election in the vast majority of cases. Some things don't need a technological solution. Pen and paper and thumb dye generally work just fine.
    - improbable22 9y ago
      And what seems most important to me, the failure modes are obvious. Any school teacher who's collected tests from naughty 10 year olds can imagine all of them. These are the people who volunteer to show up and watch the process, in every district. It's not enough to have a very low rate of cheating. The legitimacy of the process depends on this fact being clear to everyone. The fewer over-educated specialists you have to trust to be sure of this, the better.
mipmap04 9y ago
Or use paper ballots. Additionally, if you really wanted to protect voting and still use computers, use an open ballot and also allow voters to audit their own vote.
- t_fatus 9y ago
  How do you ensure people able to hack your voting system won't be able to change what is displayed in the open ballot?
  - deelowe 9y ago
    You allow people to observe the counting of votes and do exit polls (which is currently the case).
  - zanny 9y ago
    You get a transaction id for your vote when you vote, and you can verify it against the open ballot. If they don't match, either the machine or the ballot was hacked. The public ballot is much easier to secure, since you can just use a trustless ledger. Spinning up a ton of processing power to protect the voting process day-of elections isn't infeasible.
ivanbakel 9y ago
A natural extension of the industry requirement for crypto implementations to be open-sourced. How can you rely on the security of a system you cannot inspect? The trouble is that security through obscurity is the physical standard - you can't keep a lock everyone knows the cut for - so the non-technical approach is sticking with what you know. It's disturbing that a major corporation has the lobbying power to back that kind of unsafe position for its own gain, though.
- wongarsu 9y ago
  Security through obscurity is a factor in physical security, but locks are really not an example of that. The construction of most locks is well documented, or easy to reverse engineer by buying an identical lock. The thing keeping a lock secure is the key, which is a regular secret just like any crypto key. Nobody would claim ssh does security by obscurity because anyone who knows my key can get into my server.
  - ivanbakel 9y ago
    Well, I meant more that, in contrast to an asymmetric keypair, you can't leave a criminal alone with a lock for as long as you please. With enough time to gather information about a specific lock, someone can eventually use it to get a key - no amount of time with your public key will, at present, give you its private counterpart. The lock itself is not inherently secure in a way that having it won't compromise the key, so its security comes somewhat from the obscurity of the internals of each lock. It's not an exact metaphor, I admit, but it's relevant to the fears of OSS - people think leaving all your public information on the table is enough to compromise the system, because in a physical model, it effectively is.
    - wongarsu 9y ago
      There are lock design where short of brute-forcing you can't gain any useful information. But in a way locks are hard to equate to digital concepts because typical locks are laughably insecure and can be bypassed with a $30 Amazon purchase and a few seconds of time on the lock.
SomeStupidPoint 9y ago
....Or just be reasonable and use paper ballots. They're not actually that hard to count, they leave a hard to alter record, they require more effort to fake, etc. The under investment in voting and the focus on mechanizing it has been a disaster in the US and is teetering on the edge of being incredibly dangerous to the well-being of the country. Electronic voting has none of the features we want and all the failure modes we don't. Return to entirely paper. (For what it's worth, my area seems to basically use those test scanning systems on paper mail-in ballots. That's still more electronics than I like involved in the process, but is much better than fully electronic and we might be stuck with that as long as we use mail-in ballots -- which is a separate debate.)
- wahern 9y ago
  California is almost entirely paper ballots across the state. Moreover, 1% of ballots are hand-audited to verify the integrity of the electronic tally. Years ago there was a push for online voting. The state commission came away from that study suggesting a return to paper ballots, recommending to ditch even the new electronic voting machines that were becoming popular, because of the lack of credible, verifiable security. I think paper ballots are effectively required by law, now, with exceptions for accommodating people with disabilities.
- 15155 9y ago
  > That's still more electronics than I like involved in the process, I think most places that use these will use an additional count-by-hand pass afterwards. If someone is tampering with these count-only machines it's likely that they will be discovered and prosecuted.
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
marcoperaza 9y ago
The most computerization I'm comfortable with for voting is having machines count paper ballots.
Kpourdeilami 9y ago
Even if they use open source software, what guarantee is there that version of the software deployed on the machines is the same as one people can inspect?
- mikegerwitz 9y ago
  You could have multiple independent inspectors do such certification provided state/federal laws are strong enough to discourage bad actors, but there's a bigger problem than that: how do you guarantee that the hardware is the same? You don't, especially if malicious State actors are involved. Even in the case of inspecting software, you'd have to guarantee that the systems are secured after inspection and not tampered with. That's an even more difficult problem. The systems are simply too complex.
  - zanny 9y ago
    You need a system for point of use verification of system integrity by the voter as they are voting. It also doesn't need to be "simple enough" for anyone to do it. You just need a system in place to enable voters to verify the authenticity of the machine (a relatively easy way is a public voting ledger where the voter can match the id the machine shows with what shows up in the ledger a minute later) and those with the know-how will do so.
    - mikegerwitz 9y ago
      Software can be verified as such if backed by the proper hardware, but the hardware itself can't be verified in such a manner. You can't produce a signature of a hash of the atoms in a computer.
uncletaco 9y ago
Use paper voting, or if you want everyone to have easier access use mail-in paper voting.
- wongarsu 9y ago
  I don't think we should encourage mail-in voting. It opens the door to all kinds of voting fraud. A major point of the polling booth is that nobody can see what you put on you ballot, and you can lie to anyone about it. No family member can pressure you to vote in a certain way, and if somebody offers you money in exchange for your vote you take their money and vote for somebody else. And if your employer threatens to fire anyone who votes for the wrong person, you just tell them you voted for their favorite candidate, they can't tell the difference. Mail-in voting is nice for people who physically can't visit a voting booth, either due to disability, sickness, or scheduling problems. But it should never become the norm.
  - djrogers 9y ago
    At least in my district I can mail in a vote, then go on Election Day and fill out a provisional ballot that will override my mail in ballot.
Dowwie 9y ago
Paper and Rust.
denom 9y ago
Paper and pen is the way to go. It provides a verifiable record of votes cast and means you need physical/personal access to to tamper with the result. That also means people with no special skills can provide security for all segments the voting process.
dilap 9y ago
Give each vote a uuid. Give the voter a receipt with their uuid and results. Post the full results online by uuid; voters can verify the recorded online result is faithful. Label the online results by voting site. Keep a count at each site of the number of people that voted. Verify this count more or less matches the results posted online.
- denom 9y ago
  That would result in scenarios like this: "I'll pay you X amount for a 'Yes' UUID". It's far better to keep the result anonymous. As for the counts, where I vote my name is recorded in a book and then I cast my ballot. So it should be possible to verify that the book tally and vote tally match.
  - novalis78 9y ago
    I thought that's how democracy currently operates: you vote for me and I give you xyz. Now, combining this with a Blockchain and actually getting paid... hmmm...
    - deleted 9y ago
      [deleted]
  - agarden 9y ago
    Then I'll go pay someone who voted 'yes' 1/2X for their UUID receipt and everyone is happy.
  - improbable22 9y ago
    The last time I voted there was a campaign to remind you that taking a selfie with your ballot paper is illegal -- for exactly this reason.
  - zanny 9y ago
    One way to do it would be to present the user with the number but not give them a physical / digital certificate of the UUID. If they are all public, the conspirator trying to buy votes cannot trust that their client isn't just looking up UUIDs and giving them a different one. You can write your identifier down, but you could also go online and look up any other identifier you want and use that one instead. The public ledger results could be timestamped so you can correlate your vote with the on chain results, but given a large enough election thousands of votes should be coming in every <unit of time the ledger uses> and you could pick any one that voted the way your sponsor wanted to claim to be your own. It is only a problem if results don't come in in real time I think. Trying to photograph the display would be just as much of a problem as taking a picture of your ballot today. The broad point is to convey the UUID in the only untrustable memory store, the human brain.
GlitchMr 9y ago
There was once a GNU project for electronic voting (https://www.gnu.org/software/free/ https://www.gnu.org/software/free/), but it was stopped after realizing they were trying to do was almost impossible to do and changed the direction into recommending to not use electronic voting systems at all.
yosito 9y ago
The number of comments here that assume paper ballots are inherently unhackable is disturbing. Paper is a technology like any other and subject to being manipulated by clever folks. The only way to have secure, trustworthy voting systems is to have them constantly being designed, updated, understood and publicly auditable. The only downside inherent to digital vs paper systems is that they're more complex and harder for people to understand and therefore audit, but there are plenty of upsides and the downsides can be mitigated through education. Open source is absolutely important for the auditability of voting software, but the same openness and transparency is just as vital with paper. tl;dr, it's not hard to hack paper!
- rtkwe 9y ago
  You don't even have to modify the paper often. All that's really needed is for observers from any interested party to be allowed, which they are in the US. Then to affect anything above the city level an attacker has to bribe or coerce hundreds of people to turn a blind eye to things against their own political interests. They can watch polling places to spot ballot stuffing and counting places to spot count issues/fraud.
- eric_h 9y ago
  > tl;dr, it's not hard to hack paper! True, but it is significantly (as in several orders of magnitude) harder to hack paper at a national scale than it is to hack an electronic voting record at a national scale. Hacking paper requires people physically interacting with that paper to subvert it. That amounts to 1+ person per box of paper votes. Electronics just needs the one person who discovered and exploited the vulnerability.
  - jrimbault 9y ago
    I think we can assume quite a long chain of people per box. And it quickly becomes unmaintenable, "three can keep a secret, if two of them are dead".
    - eric_h 9y ago
      Indeed, my back of the napkin was ~1+ conspirator per ballot box, assuming many boxes per polling place. Making a conspiracy like that work at US scale would require a small country's worth of conspirators which really, really wouldn't be able to hide from the light of day for very long.
Budweiser 9y ago
I'm not sure why everyone is acting like paper ballots are fool-proof. Open source could be just as fool-proof if not even more so. With hundreds of thousands of people checking the software, and all updates there's not a lot of room to sneak malicious code in. With paper, you don't have many people overseeing the entire process, and there's a lot of room for interference.
jangerhofer 9y ago
I have two open-ended questions on the subject of technology in U.S. voting. (1) Why doesn't our electoral system require public disclosure of each voter's record? What would the ramifications of publishing each voter's identity & ballot online be? My thinking, like other comments here, is that a transparent voting system would make results more easily verifiable, if not easy to verify. (2) At what point could we transition toward more of a democracy (in contrast to the representative, republican system) through the use of digital voting, which has a lower "barrier to entry" than turning out to a polling center? Particularly on nationwide issues like healthcare, I presume there are relatively few technological barriers to letting every citizen vote individually on a bill and immense political and social consequences. I can't fathom the outcomes -- do you know of any discussion of such a system? Non sequitur: I've always wanted to see a "name brand" professional sports team run, down to the minutiae, by online fan voting. I know it's out there in small leagues already.
- banned1 9y ago
  (1) Things are crazy right now. As an example that is relevant for the HN audience, Republican voters would feel the wrath and hysteria of Liberals in San Francisco who would kick them out of companies or demand their dismissal. The same would happen to Democrat voters in some Republican stronghold in a Red state. (2) Probably not in a long time in the US. The system is built under the assumptions that you can't trust voters know what is good for them, let alone what is good for the country overall.
  - mentos 9y ago
    (1) What if we gave everyone a voter uuid that they could verify on a website where hundreds of millions of other voteruuids and votes are posted for verification
    - banned1 9y ago
      Yes, this is an excellent idea. I had read somewhere (other posters here make this point) that we could give this UUID to each voter. Then, we could give voters a way to verify their vote in the final tallies. This way, if enough voters see their vote has been changed, we could detect government interference, hacking, or other forms of fraud.
soufron 9y ago
To protect voting, keep up with transparent urns and paper ballots
digikata 9y ago
Open source voting software is not sufficient. Paper ballots are better, but I suspect that electronic + verified paper receipt + an audit process is a fuller solution. Paper alone can be more easily locally subverted, electronic alone can be more globally. But if you have to alter both an electronic record/reporting and the paper ballots in a way that correlates then you have a better resistance than either paper/electronic alone.
cwyers 9y ago
Haven't we gotten past the "open source == secure" mindset yet? Yes, open source software can be audited. But secure software is also really really expensive. "With enough eyes, all bugs are shallow" has been pretty well repudiated. Finding security bugs and fixing them in open source products is exactly the sort of drudgery that people don't tend to do on their own; it's not fun like adding new features is. Open source is not a silver bullet to add security where other forces are pushing against it. Android is open source, iOS isn't. Which is more secure? I'm not saying that iOS is more secure because it's closed source, I'm just saying that "open source == secure" is overly simplistic.
- bluejekyll 9y ago
  To nitpic a little bit, much of iOS is in fact Open Source. Darwin and the XNU kernel public repos are updated by Apple after each release of their OSes. Definitely not as Open as Linux, but not closed source either.
- BoringCode 9y ago
  Many open-source projects simply don't have the resources to adequately test their products or provide support. Contrast this with a large company which has the resources and the willpower to provide support for their software. Often the best of both worlds is a large company/organization that dedicates its resources to an open-source product, but that's not always the case. But this issue is never as black and white as "open-source is more secure." There are many other factors that go into the security of a product beyond its source code being readable. Deciding which factors matter largely depends upon your unique threat model.
  - cwyers 9y ago
    I'm not sure about "a large company/organization that dedicates its resources to an open-source product" being the best of both worlds. I mean, maybe narrowly defined, sure. But take one of the better examples of the form, Chrome/Chromium. I'm not sure that a world where we get a free web browser that is used to funnel us all into an ad-driven model powered by an incredible surveillance apparatus is strictly better than a world where we all have to buy our web browsers. There's tradeoffs all the way down. Open source coexists well with some revenue models and doesn't with others, and the revenue models that best coexist with open source have some very significant downsides in terms of how they don't align the interests of the business with that of its users.
vmarshall23 9y ago
eVacs! https://lwn.net/Articles/44077/ https://lwn.net/Articles/44077/ http://www.softimp.com.au/evacs/products.html http://www.softimp.com.au/evacs/products.html
vmarshall23 9y ago
Open Source Voting Machines - with a take-away symmetric key paper receipts for auditing.
bearcobra 9y ago
This seems like a problem that requires multiple approaches to fix. Since the election, I've been thinking that a system with these features would be ideal 1. Electronic machines powered by OSS - Provides fast counting, and potentially better UX in scenarios with large number of items to vote on - Ability for the public to review the code 2. Machines print copy of ballot that voter can verify before being placed in a secure ballot box - Provides auditable backup record 3. Machines give the option to print a second copy of the ballot with a unique code. This code can be used to verify selections later via some kind of online interface. - Gives the user one more check on ballot integrity - Allows voter to keep voting record anonymous if they choose I think this would balance pros/cons of pure paper vs. electronic voting systems
khrm 9y ago
I find Rivest's video( https://www.youtube.com/watch?v=BYRTvoZ3Rho https://www.youtube.com/watch?v=BYRTvoZ3Rho ) on homomorphic encryption as voting mechanism quite interesting. It looks more secure than pen and paper. All user get a receipt which they can verify is same during vote counting. They themselves can vote count using all others receipt. At the same time, they can't sell their vote as it's encrypted.
jjawssd 9y ago
I think a lot of you guys mentioning paper ballots are also missing something very important: what is counting the paper ballots? Is a Scantron machine reading the ballots? If so, the firmware could be compromised to bias results in a particular direction in a stealthy manner. Please observe a real world example of this: https://www.youtube.com/watch?v=8mBMHPxdljE https://www.youtube.com/watch?v=8mBMHPxdljE
- maxerickson 9y ago
  Yes, paper ballots still need monitoring and audits, whether they use electronic tally machines or not. But those are both more straightforward with paper ballots than with other systems.
- jeltz 9y ago
  I have never assumed anything other than that it would be humans, presumably mostly volunteers from the various political parties, doing the counting. That is how it is done in Sweden, and I think also a bunch of other European countries. It worked fine for us before we have computers and it still works. We get a preliminary result within a few hours, and a final result in like 3 or 4 days. And the problem of manually counting votes scales linearly with the population so the size of the country should not matter much.
- boobsbr 9y ago
  You can solve this by using multiple scantron-like machines from any manufacturer. You could put them in sequence and compare the results. If results diverge, you investigate why.
Findeton 9y ago
Whether we like it or not, electronic voting has probably arrived to stay. So perhaps the best way of proceeding is trying to harden the electronic voting systems as best as we can instead of letting other less informed people try.
wolfgang42 9y ago
I see lots of debate on paper vs electronic voting, but I don't see anyone who's mentioned another option: mechanical voting machines. For those who haven't encountered one, here's how they work: 1. You go to your local polling place, show the volunteer your ID, and sign a book next to your name. They check your signature, then walk you to a voting machine and unlock it. 2. You go into the voting booth and pull the operating lever to the right. This closes the curtain, increments a counter, and unlocks the vote levers. 3. You make your vote selections on the voting levers. The machine prevents spoiled ballots with a mechanical interlocking: if the ballot says "pick any two", the other vote levers will be locked out once you've selected two of them. 4. Once finished, pull the operating lever to the left. This increments various counters for your votes, clears the voting levers, opens the curtain, and relocks the machine. At the end of the night, the election volunteers open the back of each machine and read off the values of each counter, then report the results to the election board. There, the numbers are subtracted from the original counter values (the counters are non-resettable) and cross-checked to ensure validity (casting a vote increments both a vote counter and various 'checksum' counters), then aggregated with the other machines to get the final result. This system has, in my view, most of the advantages of the other two systems: it is very difficult to tamper with (all the voting machines, once configured, are cross-checked and sealed; the seal is on the side of the machine and can be inspected by any voter to detect tampering), anonymous (all votes are aggregated in-machine), and provides fast counting (all of the counter values are entered into a digital system at the end of the night). Unfortunately, they were banned by the Help America Vote Act, and are sometimes panned as difficult to use. (I never got a chance to use them myself, as New York replaced them shortly before I became eligible to vote, but I got to go into the voting booth with my parents and even as a nine-year-old they didn't seem especially confusing to me.) Also, the machines are complex mechanical beasts, with some 28,000 moving parts, and they're probably becoming increasingly difficult to repair. Even if mechanical voting machines are a thing of the past, I think it's important to at least look at them to see how they provided for the important aspects of a voting system, and possibly take some of the ideas to be used in current and future systems.
zAy0LfpBZLC8mAC 9y ago
Just no. Very relevant to this topic: Ken Thompson's "Reflections on Trusting Trust": https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
- 43224gg252 9y ago
  Did Ken write anything on trusting the government?
fapjacks 9y ago
I would take it one step further: I should be able to build my own voting machine from the open source plans, and cast my vote with it this way, which prints out a receipt for me that I have verified matches the (paper) printout on the receiving end.
jgamman 9y ago
why don't you mix the two and have electronic as 'indicative' with paper being the ultimate decider. no way i want 100% e-voting but having a machine spit out a picture of the person i'm voting for that i deposit in a box seems fine - the instant-news cycle gets it's data realtime, the data is then fact checked over the next 24 hours. what's the downside? i like democracy, i think a bit of belt-and-braces to its mechanics is a Very Good Idea.
tzs 9y ago
If you need open source voting software in order to trust that your voting system is working reliably, you have already lost, because that implies your voting system is depending on software working correctly. Look at Scantegrity [1]. It provides end to end independent verifiability of elections and lets voters check to see if their vote was counted correctly, without depending on the voting software functioning correctly. [1] https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity

281 points by evanb 9y ago

Don't, use pen and paper instead. Previous HN discussion on it: https://news.ycombinator.com/item?id=14891266 https://news.ycombinator.com/item?id=14891266

avelis 9y ago
Came here to recommend that. Instead, use open source hardware. Use pen and paper! :-)
- zanny 9y ago
  We could also use open source hardware that isn't pen and paper. We just need the open source part.
  - benchaney 9y ago
    Verifying hardware more complicated than a pen and paper is prohibitively difficult.
  - simias 9y ago
    And a way to simply audit them. It's a bit difficult to make a fake pen and paper that would trick me into voting for the wrong person (especially at scale).
  - rurban 9y ago
    Nope, that would not work. Paper and pen are the best secure methods. Everything digital is insecure.
  - Zash 9y ago
    What open source hardware would that be, and how can everyone eligible to vote be able to understand how it works and be able to observe that it really does work?
    - amenghra 9y ago
      Every single person doesn't understand all the security aspects of today's paper & pen ballots, how they are secured before and after the day of voting, how they are transported from one location to another, how mail-in ballots get handled, etc. There's no reason to require something that everyone can understand when talking about a different voting system. IMHO, we should aim to build something (whether using physical machines or using cryptography/mathematical properties) that the various parties in a government can audit and recognize as secure and that leads to a larger portion of the population voting or a cheaper election process.
      - zAy0LfpBZLC8mAC 9y ago
        Whether people do understand something is very different from whether people can understand something. While many people maybe aren't aware of the security mechanisms of a pen and paper election, essentially everyone can actually understand them if they feel the need to, and that is extremely important. You cannot resolve widespread distrust by putting a bunch of mathematicians on TV who tell the population that everything is fine.
      - jfnixon 9y ago
        We already have something that can be made secure, anonymous, and auditable, and yet is easy to understand and relatively inexpensive. It is pencil and paper ballots, with multiple interested parties observing the entire process.
  - thanhquanky 9y ago
    remember the butterfly ballot?
    - thrownblown 9y ago
      never forget the hanging chad!
  - jdavis703 9y ago
    Well then you have issues like "hanging chads," [0] that's why e-voting became big in the US. 0: https://cseweb.ucsd.edu/~goguen/courses/275f00/abc-chads.html https://cseweb.ucsd.edu/~goguen/courses/275f00/abc-chads.htm...
    - mnem 9y ago
      Pen and paper doesn't suffer from hanging chads, surely? That's only if you use paper + hole punch for primitive automated counting?
SAI_Peregrinus 9y ago
And if you want the benefits of computers (fast counting, ability to prove your vote was counted correctly) without sacrificing the secret ballot or the paper audit trail you can use something like punchscan or scantegrity.
dgudkov 9y ago
We can trust digital money, but we can't trust digital votes?
- mrkrabo 9y ago
  Who trusts digital money?
  - CaptSpify 9y ago
    pretty much anyone that uses a bank
    - scierama 9y ago
      Digital records management is a technique; not digital currency.
- komali2 9y ago
  Who's "we?" I don't trust digital money :P
  - amenghra 9y ago
    Does your bank account, credit card, etc. count as digital money? Your account balance is just bits somewhere.
    - scierama 9y ago
      You're conflating records management with actual currency.
    - komali2 9y ago
      Well, ok, but my account balance is guaranteed by a government (for well above my balance). I don't get that with digital currency.
- mixmax 9y ago
  correct. The problem with digital voting is that it needs to be anonymous who votes for what. That makes the problem much much harder.
peterwwillis 9y ago
There are actually elaborate rules and measures on the handling of paper ballots to work around complicated schemes that have been devised to defraud the vote. It's certainly not foolproof. Problems with paper voting: - Fraud - Counting time - Margin of error Problems with electronic voting: - Hacking - Cost - Programming bugs - Machine error - Scalability Actual way voting is handled - Some states use mailed paper ballots - Some states use paper-free voting - Some states use a mixture of electronic and paper voting The biggest risk is not the mechanism, but the way it is implemented: 5,000 independent jurisdictions all have completely independent ways of choosing how to vote, and then completely independent methods of implementing it. [3] This[1] testimony from 2001 includes a good history of the voting process and the reasons why it is handled the way it is. The parent[2] directory contains 16 years of commentary articles. [1] http://homepage.divms.uiowa.edu/~jones/voting/congress.html http://homepage.divms.uiowa.edu/~jones/voting/congress.html [2] http://homepage.divms.uiowa.edu/~jones/voting/index.html http://homepage.divms.uiowa.edu/~jones/voting/index.html [3] http://homepage.divms.uiowa.edu/~jones/voting/PutinTrump.shtml http://homepage.divms.uiowa.edu/~jones/voting/PutinTrump.sht...
- bluejekyll 9y ago
  Paper ballots can be destroyed easily too: I remember this in San Francisco in 2001, http://www.sfgate.com/politics/article/Scavenged-ballot-box-lids-haunt-S-F-elections-3302604.php#photo-2450496 http://www.sfgate.com/politics/article/Scavenged-ballot-box-...
  - peterwwillis 9y ago
    That's one of the methods of fraud. Many counties have had "lost" ballots. Many voters have not received their absentee ballots. Florida was actually not even close to finishing counting its ballots when Obama claimed victory in 2012. California had the same problem in June 2016. With regard to machines, many machines have recorded thousands of extra votes. Some machines run out of memory, and end up losing thousands of votes (those machines did not have paper trails). There's been plenty of problems with these machines - ones that can be fixed. But the fact that every precinct decides independently what to do and how to do it, there is absolutely no way (in the US) to provide a uniform solution to the problems of paperless voting.
stephengillie 9y ago
Then we can debate whether or not a bubble has been completely filled in. Or if a "hanging Chad" counts as a vote.
- wang_li 9y ago
  It seems perfectly reasonable to not count votes that are unclear. It's not a complex procedure to fill in a circle on a scantron, if you can't follow the directions, then too bad for you and your vote and your preferred candidates.
- pedrocr 9y ago
  Yes, the US has been able to screw up even paper elections in an attempt to make counting supposedly faster. Most other countries just use a paper ballot with some squares next to the candidates and you mark with an X. Any deviation from that is a null vote because the voter could try to identify himself otherwise. Our elections run smoothly every time and we have well counted results in a few hours at most, faster than the US is ever able to accomplish from what I've seen.
  - nickpeterson 9y ago
    Which country is this?
    - pedrocr 9y ago
      I'm in Portugal. Most of Europe is the same, Canada too.
      - nickpeterson 9y ago
        Doesn't Portugal have widespread corruption, especially in regards to political parties and parliament?
        pedrocr 9y ago
        Perception of corruption is about on par with the US in the studies I've seen. That's mostly unrelated to quality of the election process though. There the US is quite a long way back. The Bush/Gore mess would never happen here.
sapote 9y ago
Agreed. And to add to it, we should switch to a system in which we have: * 100% mail-in paper ballots, like Oregon -- no long lines, no games about which districts get which machines, no polling place intimidation * Mandatory random-sample hand recounts (this has been shown to only need to be on the order of thousands of ballots out of millions for most races, given the statistical confidence you get with it)
- dragonwriter 9y ago
  Mail-in ballots offer far more robust intimidation and coercion opportunities than are available in polling places.
  - sapote 9y ago
    I was expecting that response. The only solution, then, is to ban all mail in ballots. Right now California, for example, has optional mail-in voting. Wouldn't you expect that anyone who can be coerced to vote some way could be coerced whether the mail-in voting is optional or mandatory?
    - dragonwriter 9y ago
      I'm not arguing that mail in ballots don't have benefits that warranted the increase in coercion risk, I'm just arguing that mail in ballots cannot be viewed as a mitigation of coercion risk compared to the way US in-person polling stations are run since they exacerbate, rather than mitigate, that risk.
      - deleted 9y ago
        [deleted]
  - nxsynonym 9y ago
    Care to expand? Don't see how that could be the case.
    - 9y ago
hathawsh 9y ago
I agree, however, those of us who understand the importance of paper ballots are having a hard time selling it to the public. We're coming across as Luddites. I'm impressed that the New York Times is promoting open source software; it's a small step in the right direction. Perhaps the message we should be spreading is that paper ballots are even more "open source" than any computer software. With paper, poll workers can prevent hacking by simply observing, using physical locks, and communicating with other poll workers. Software (open source or not) only seems to complicate all of that.
- pedrocr 9y ago
  That's why I find the HN discussions on this so important. If the actual technology people can't see it the rest of the population has no chance. The rule of thumb, that almost never fails, is that technology always brings advantages and quickly. Sometimes it even steals their jobs. If we can get a broad agreement on the message that "trust me, I implement new technology all day every day and electronic voting is a solution looking for a problem and if your local politician tries to sell you on it he's most likely trying to steal the vote" we can do quite a bit.
  - specialist 9y ago
    Voters know in their bones that the voting computers are bad. Voters are not the problem. Returning to paper ballots means less cheddar for cronies. Happily there's a workaround. Postal balloting (close the poll sites)! Ballots are digitally scanned as they're received at central count. So it has all the downsides of the touchscreens with all new vulnerabilities (undetectable alterations, signature mismatches, preview election counts, voter coercion...). But voters get the comfort of paper and it keeps the cheddar flowing for the cronies.
- sapote 9y ago
  I remember someone saying here that a key shift in framing in Germany was to call them voting computers rather than voting machines (since the broader public understands that computers can be hacked). I think we might adopt that as well.

rectang 9y ago

Open source voting software will never replace proprietary voting software, because open discussion of voting software security will reveal that it's impossible to build hack-proof voting terminals. Paper ballots are a superior technology.

partiallypro 9y ago
You can stuff ballot boxes, that's where the term comes from. Nothing is "hack-proof." I think it's funny that people are freaking out on HN about this. The hacks at Defcon all took a long time to do, and I believe all required keys to the machines, and all were done on older voting machines. There has been no evidence of people hacking machines during the elections. Stuffing ballot boxes and other forms of voting fraud have been around for a long time, and nothing we do is going to stop it 100%. Also voting machines generally have paper copies that print off the back of the machine that are anonymized but can be matched if foul play is called into question, at least in my area. Couple that with monitors that stand near machines or walk around and I feel pretty comfortable with electronic voting. The only plausible hack would be an inside job, but I too find this difficult to believe. It would takes tons and tons of people to hack the machines if it required physical access. You'd have to hack ever machine, and even when you were done there are so many districts it would be nearly impossible to swing the election in any meaningful way.
- deelowe 9y ago
  The point is that paper ballots are harder to tamper with. To the point that at scale it becomes impossible to rig an election in the vast majority of cases. Some things don't need a technological solution. Pen and paper and thumb dye generally work just fine.
  - improbable22 9y ago
    And what seems most important to me, the failure modes are obvious. Any school teacher who's collected tests from naughty 10 year olds can imagine all of them. These are the people who volunteer to show up and watch the process, in every district. It's not enough to have a very low rate of cheating. The legitimacy of the process depends on this fact being clear to everyone. The fewer over-educated specialists you have to trust to be sure of this, the better.

mipmap04 9y ago

Or use paper ballots. Additionally, if you really wanted to protect voting and still use computers, use an open ballot and also allow voters to audit their own vote.

t_fatus 9y ago
How do you ensure people able to hack your voting system won't be able to change what is displayed in the open ballot?
- deelowe 9y ago
  You allow people to observe the counting of votes and do exit polls (which is currently the case).
- zanny 9y ago
  You get a transaction id for your vote when you vote, and you can verify it against the open ballot. If they don't match, either the machine or the ballot was hacked. The public ballot is much easier to secure, since you can just use a trustless ledger. Spinning up a ton of processing power to protect the voting process day-of elections isn't infeasible.

ivanbakel 9y ago

A natural extension of the industry requirement for crypto implementations to be open-sourced. How can you rely on the security of a system you cannot inspect? The trouble is that security through obscurity is the physical standard - you can't keep a lock everyone knows the cut for - so the non-technical approach is sticking with what you know. It's disturbing that a major corporation has the lobbying power to back that kind of unsafe position for its own gain, though.

wongarsu 9y ago
Security through obscurity is a factor in physical security, but locks are really not an example of that. The construction of most locks is well documented, or easy to reverse engineer by buying an identical lock. The thing keeping a lock secure is the key, which is a regular secret just like any crypto key. Nobody would claim ssh does security by obscurity because anyone who knows my key can get into my server.
- ivanbakel 9y ago
  Well, I meant more that, in contrast to an asymmetric keypair, you can't leave a criminal alone with a lock for as long as you please. With enough time to gather information about a specific lock, someone can eventually use it to get a key - no amount of time with your public key will, at present, give you its private counterpart. The lock itself is not inherently secure in a way that having it won't compromise the key, so its security comes somewhat from the obscurity of the internals of each lock. It's not an exact metaphor, I admit, but it's relevant to the fears of OSS - people think leaving all your public information on the table is enough to compromise the system, because in a physical model, it effectively is.
  - wongarsu 9y ago
    There are lock design where short of brute-forcing you can't gain any useful information. But in a way locks are hard to equate to digital concepts because typical locks are laughably insecure and can be bypassed with a $30 Amazon purchase and a few seconds of time on the lock.

SomeStupidPoint 9y ago

....Or just be reasonable and use paper ballots. They're not actually that hard to count, they leave a hard to alter record, they require more effort to fake, etc. The under investment in voting and the focus on mechanizing it has been a disaster in the US and is teetering on the edge of being incredibly dangerous to the well-being of the country. Electronic voting has none of the features we want and all the failure modes we don't. Return to entirely paper. (For what it's worth, my area seems to basically use those test scanning systems on paper mail-in ballots. That's still more electronics than I like involved in the process, but is much better than fully electronic and we might be stuck with that as long as we use mail-in ballots -- which is a separate debate.)

wahern 9y ago
California is almost entirely paper ballots across the state. Moreover, 1% of ballots are hand-audited to verify the integrity of the electronic tally. Years ago there was a push for online voting. The state commission came away from that study suggesting a return to paper ballots, recommending to ditch even the new electronic voting machines that were becoming popular, because of the lack of credible, verifiable security. I think paper ballots are effectively required by law, now, with exceptions for accommodating people with disabilities.
15155 9y ago
> That's still more electronics than I like involved in the process, I think most places that use these will use an additional count-by-hand pass afterwards. If someone is tampering with these count-only machines it's likely that they will be discovered and prosecuted.

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

marcoperaza 9y ago

The most computerization I'm comfortable with for voting is having machines count paper ballots.

Kpourdeilami 9y ago

Even if they use open source software, what guarantee is there that version of the software deployed on the machines is the same as one people can inspect?

mikegerwitz 9y ago
You could have multiple independent inspectors do such certification provided state/federal laws are strong enough to discourage bad actors, but there's a bigger problem than that: how do you guarantee that the hardware is the same? You don't, especially if malicious State actors are involved. Even in the case of inspecting software, you'd have to guarantee that the systems are secured after inspection and not tampered with. That's an even more difficult problem. The systems are simply too complex.
- zanny 9y ago
  You need a system for point of use verification of system integrity by the voter as they are voting. It also doesn't need to be "simple enough" for anyone to do it. You just need a system in place to enable voters to verify the authenticity of the machine (a relatively easy way is a public voting ledger where the voter can match the id the machine shows with what shows up in the ledger a minute later) and those with the know-how will do so.
  - mikegerwitz 9y ago
    Software can be verified as such if backed by the proper hardware, but the hardware itself can't be verified in such a manner. You can't produce a signature of a hash of the atoms in a computer.

uncletaco 9y ago

Use paper voting, or if you want everyone to have easier access use mail-in paper voting.

wongarsu 9y ago
I don't think we should encourage mail-in voting. It opens the door to all kinds of voting fraud. A major point of the polling booth is that nobody can see what you put on you ballot, and you can lie to anyone about it. No family member can pressure you to vote in a certain way, and if somebody offers you money in exchange for your vote you take their money and vote for somebody else. And if your employer threatens to fire anyone who votes for the wrong person, you just tell them you voted for their favorite candidate, they can't tell the difference. Mail-in voting is nice for people who physically can't visit a voting booth, either due to disability, sickness, or scheduling problems. But it should never become the norm.
- djrogers 9y ago
  At least in my district I can mail in a vote, then go on Election Day and fill out a provisional ballot that will override my mail in ballot.

Dowwie 9y ago

Paper and Rust.

denom 9y ago

Paper and pen is the way to go. It provides a verifiable record of votes cast and means you need physical/personal access to to tamper with the result. That also means people with no special skills can provide security for all segments the voting process.

dilap 9y ago

Give each vote a uuid. Give the voter a receipt with their uuid and results. Post the full results online by uuid; voters can verify the recorded online result is faithful. Label the online results by voting site. Keep a count at each site of the number of people that voted. Verify this count more or less matches the results posted online.

denom 9y ago
That would result in scenarios like this: "I'll pay you X amount for a 'Yes' UUID". It's far better to keep the result anonymous. As for the counts, where I vote my name is recorded in a book and then I cast my ballot. So it should be possible to verify that the book tally and vote tally match.
- novalis78 9y ago
  I thought that's how democracy currently operates: you vote for me and I give you xyz. Now, combining this with a Blockchain and actually getting paid... hmmm...
  - deleted 9y ago
    [deleted]
- agarden 9y ago
  Then I'll go pay someone who voted 'yes' 1/2X for their UUID receipt and everyone is happy.
- improbable22 9y ago
  The last time I voted there was a campaign to remind you that taking a selfie with your ballot paper is illegal -- for exactly this reason.
- zanny 9y ago
  One way to do it would be to present the user with the number but not give them a physical / digital certificate of the UUID. If they are all public, the conspirator trying to buy votes cannot trust that their client isn't just looking up UUIDs and giving them a different one. You can write your identifier down, but you could also go online and look up any other identifier you want and use that one instead. The public ledger results could be timestamped so you can correlate your vote with the on chain results, but given a large enough election thousands of votes should be coming in every <unit of time the ledger uses> and you could pick any one that voted the way your sponsor wanted to claim to be your own. It is only a problem if results don't come in in real time I think. Trying to photograph the display would be just as much of a problem as taking a picture of your ballot today. The broad point is to convey the UUID in the only untrustable memory store, the human brain.

GlitchMr 9y ago

There was once a GNU project for electronic voting (https://www.gnu.org/software/free/ https://www.gnu.org/software/free/), but it was stopped after realizing they were trying to do was almost impossible to do and changed the direction into recommending to not use electronic voting systems at all.

yosito 9y ago

The number of comments here that assume paper ballots are inherently unhackable is disturbing. Paper is a technology like any other and subject to being manipulated by clever folks. The only way to have secure, trustworthy voting systems is to have them constantly being designed, updated, understood and publicly auditable. The only downside inherent to digital vs paper systems is that they're more complex and harder for people to understand and therefore audit, but there are plenty of upsides and the downsides can be mitigated through education. Open source is absolutely important for the auditability of voting software, but the same openness and transparency is just as vital with paper. tl;dr, it's not hard to hack paper!

rtkwe 9y ago
You don't even have to modify the paper often. All that's really needed is for observers from any interested party to be allowed, which they are in the US. Then to affect anything above the city level an attacker has to bribe or coerce hundreds of people to turn a blind eye to things against their own political interests. They can watch polling places to spot ballot stuffing and counting places to spot count issues/fraud.
eric_h 9y ago
> tl;dr, it's not hard to hack paper! True, but it is significantly (as in several orders of magnitude) harder to hack paper at a national scale than it is to hack an electronic voting record at a national scale. Hacking paper requires people physically interacting with that paper to subvert it. That amounts to 1+ person per box of paper votes. Electronics just needs the one person who discovered and exploited the vulnerability.
- jrimbault 9y ago
  I think we can assume quite a long chain of people per box. And it quickly becomes unmaintenable, "three can keep a secret, if two of them are dead".
  - eric_h 9y ago
    Indeed, my back of the napkin was ~1+ conspirator per ballot box, assuming many boxes per polling place. Making a conspiracy like that work at US scale would require a small country's worth of conspirators which really, really wouldn't be able to hide from the light of day for very long.

Budweiser 9y ago

I'm not sure why everyone is acting like paper ballots are fool-proof. Open source could be just as fool-proof if not even more so. With hundreds of thousands of people checking the software, and all updates there's not a lot of room to sneak malicious code in. With paper, you don't have many people overseeing the entire process, and there's a lot of room for interference.

jangerhofer 9y ago

I have two open-ended questions on the subject of technology in U.S. voting. (1) Why doesn't our electoral system require public disclosure of each voter's record? What would the ramifications of publishing each voter's identity & ballot online be? My thinking, like other comments here, is that a transparent voting system would make results more easily verifiable, if not easy to verify. (2) At what point could we transition toward more of a democracy (in contrast to the representative, republican system) through the use of digital voting, which has a lower "barrier to entry" than turning out to a polling center? Particularly on nationwide issues like healthcare, I presume there are relatively few technological barriers to letting every citizen vote individually on a bill and immense political and social consequences. I can't fathom the outcomes -- do you know of any discussion of such a system? Non sequitur: I've always wanted to see a "name brand" professional sports team run, down to the minutiae, by online fan voting. I know it's out there in small leagues already.

banned1 9y ago
(1) Things are crazy right now. As an example that is relevant for the HN audience, Republican voters would feel the wrath and hysteria of Liberals in San Francisco who would kick them out of companies or demand their dismissal. The same would happen to Democrat voters in some Republican stronghold in a Red state. (2) Probably not in a long time in the US. The system is built under the assumptions that you can't trust voters know what is good for them, let alone what is good for the country overall.
- mentos 9y ago
  (1) What if we gave everyone a voter uuid that they could verify on a website where hundreds of millions of other voteruuids and votes are posted for verification
  - banned1 9y ago
    Yes, this is an excellent idea. I had read somewhere (other posters here make this point) that we could give this UUID to each voter. Then, we could give voters a way to verify their vote in the final tallies. This way, if enough voters see their vote has been changed, we could detect government interference, hacking, or other forms of fraud.

soufron 9y ago

To protect voting, keep up with transparent urns and paper ballots

digikata 9y ago

Open source voting software is not sufficient. Paper ballots are better, but I suspect that electronic + verified paper receipt + an audit process is a fuller solution. Paper alone can be more easily locally subverted, electronic alone can be more globally. But if you have to alter both an electronic record/reporting and the paper ballots in a way that correlates then you have a better resistance than either paper/electronic alone.

cwyers 9y ago

Haven't we gotten past the "open source == secure" mindset yet? Yes, open source software can be audited. But secure software is also really really expensive. "With enough eyes, all bugs are shallow" has been pretty well repudiated. Finding security bugs and fixing them in open source products is exactly the sort of drudgery that people don't tend to do on their own; it's not fun like adding new features is. Open source is not a silver bullet to add security where other forces are pushing against it. Android is open source, iOS isn't. Which is more secure? I'm not saying that iOS is more secure because it's closed source, I'm just saying that "open source == secure" is overly simplistic.

bluejekyll 9y ago
To nitpic a little bit, much of iOS is in fact Open Source. Darwin and the XNU kernel public repos are updated by Apple after each release of their OSes. Definitely not as Open as Linux, but not closed source either.
BoringCode 9y ago
Many open-source projects simply don't have the resources to adequately test their products or provide support. Contrast this with a large company which has the resources and the willpower to provide support for their software. Often the best of both worlds is a large company/organization that dedicates its resources to an open-source product, but that's not always the case. But this issue is never as black and white as "open-source is more secure." There are many other factors that go into the security of a product beyond its source code being readable. Deciding which factors matter largely depends upon your unique threat model.
- cwyers 9y ago
  I'm not sure about "a large company/organization that dedicates its resources to an open-source product" being the best of both worlds. I mean, maybe narrowly defined, sure. But take one of the better examples of the form, Chrome/Chromium. I'm not sure that a world where we get a free web browser that is used to funnel us all into an ad-driven model powered by an incredible surveillance apparatus is strictly better than a world where we all have to buy our web browsers. There's tradeoffs all the way down. Open source coexists well with some revenue models and doesn't with others, and the revenue models that best coexist with open source have some very significant downsides in terms of how they don't align the interests of the business with that of its users.

vmarshall23 9y ago

eVacs! https://lwn.net/Articles/44077/ https://lwn.net/Articles/44077/ http://www.softimp.com.au/evacs/products.html http://www.softimp.com.au/evacs/products.html

vmarshall23 9y ago

Open Source Voting Machines - with a take-away symmetric key paper receipts for auditing.

bearcobra 9y ago

This seems like a problem that requires multiple approaches to fix. Since the election, I've been thinking that a system with these features would be ideal 1. Electronic machines powered by OSS - Provides fast counting, and potentially better UX in scenarios with large number of items to vote on - Ability for the public to review the code 2. Machines print copy of ballot that voter can verify before being placed in a secure ballot box - Provides auditable backup record 3. Machines give the option to print a second copy of the ballot with a unique code. This code can be used to verify selections later via some kind of online interface. - Gives the user one more check on ballot integrity - Allows voter to keep voting record anonymous if they choose I think this would balance pros/cons of pure paper vs. electronic voting systems

khrm 9y ago

I find Rivest's video( https://www.youtube.com/watch?v=BYRTvoZ3Rho https://www.youtube.com/watch?v=BYRTvoZ3Rho ) on homomorphic encryption as voting mechanism quite interesting. It looks more secure than pen and paper. All user get a receipt which they can verify is same during vote counting. They themselves can vote count using all others receipt. At the same time, they can't sell their vote as it's encrypted.

jjawssd 9y ago

I think a lot of you guys mentioning paper ballots are also missing something very important: what is counting the paper ballots? Is a Scantron machine reading the ballots? If so, the firmware could be compromised to bias results in a particular direction in a stealthy manner. Please observe a real world example of this: https://www.youtube.com/watch?v=8mBMHPxdljE https://www.youtube.com/watch?v=8mBMHPxdljE

maxerickson 9y ago
Yes, paper ballots still need monitoring and audits, whether they use electronic tally machines or not. But those are both more straightforward with paper ballots than with other systems.
jeltz 9y ago
I have never assumed anything other than that it would be humans, presumably mostly volunteers from the various political parties, doing the counting. That is how it is done in Sweden, and I think also a bunch of other European countries. It worked fine for us before we have computers and it still works. We get a preliminary result within a few hours, and a final result in like 3 or 4 days. And the problem of manually counting votes scales linearly with the population so the size of the country should not matter much.
boobsbr 9y ago
You can solve this by using multiple scantron-like machines from any manufacturer. You could put them in sequence and compare the results. If results diverge, you investigate why.

Findeton 9y ago

Whether we like it or not, electronic voting has probably arrived to stay. So perhaps the best way of proceeding is trying to harden the electronic voting systems as best as we can instead of letting other less informed people try.

wolfgang42 9y ago

I see lots of debate on paper vs electronic voting, but I don't see anyone who's mentioned another option: mechanical voting machines. For those who haven't encountered one, here's how they work: 1. You go to your local polling place, show the volunteer your ID, and sign a book next to your name. They check your signature, then walk you to a voting machine and unlock it. 2. You go into the voting booth and pull the operating lever to the right. This closes the curtain, increments a counter, and unlocks the vote levers. 3. You make your vote selections on the voting levers. The machine prevents spoiled ballots with a mechanical interlocking: if the ballot says "pick any two", the other vote levers will be locked out once you've selected two of them. 4. Once finished, pull the operating lever to the left. This increments various counters for your votes, clears the voting levers, opens the curtain, and relocks the machine. At the end of the night, the election volunteers open the back of each machine and read off the values of each counter, then report the results to the election board. There, the numbers are subtracted from the original counter values (the counters are non-resettable) and cross-checked to ensure validity (casting a vote increments both a vote counter and various 'checksum' counters), then aggregated with the other machines to get the final result. This system has, in my view, most of the advantages of the other two systems: it is very difficult to tamper with (all the voting machines, once configured, are cross-checked and sealed; the seal is on the side of the machine and can be inspected by any voter to detect tampering), anonymous (all votes are aggregated in-machine), and provides fast counting (all of the counter values are entered into a digital system at the end of the night). Unfortunately, they were banned by the Help America Vote Act, and are sometimes panned as difficult to use. (I never got a chance to use them myself, as New York replaced them shortly before I became eligible to vote, but I got to go into the voting booth with my parents and even as a nine-year-old they didn't seem especially confusing to me.) Also, the machines are complex mechanical beasts, with some 28,000 moving parts, and they're probably becoming increasingly difficult to repair. Even if mechanical voting machines are a thing of the past, I think it's important to at least look at them to see how they provided for the important aspects of a voting system, and possibly take some of the ideas to be used in current and future systems.

zAy0LfpBZLC8mAC 9y ago

Just no. Very relevant to this topic: Ken Thompson's "Reflections on Trusting Trust": https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...

43224gg252 9y ago
Did Ken write anything on trusting the government?

fapjacks 9y ago

I would take it one step further: I should be able to build my own voting machine from the open source plans, and cast my vote with it this way, which prints out a receipt for me that I have verified matches the (paper) printout on the receiving end.

jgamman 9y ago

why don't you mix the two and have electronic as 'indicative' with paper being the ultimate decider. no way i want 100% e-voting but having a machine spit out a picture of the person i'm voting for that i deposit in a box seems fine - the instant-news cycle gets it's data realtime, the data is then fact checked over the next 24 hours. what's the downside? i like democracy, i think a bit of belt-and-braces to its mechanics is a Very Good Idea.

tzs 9y ago

If you need open source voting software in order to trust that your voting system is working reliably, you have already lost, because that implies your voting system is depending on software working correctly. Look at Scantegrity [1]. It provides end to end independent verifiability of elections and lets voters check to see if their vote was counted correctly, without depending on the voting software functioning correctly. [1] https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity