4 ms·

It is one of the curious facts of modern culture that the people who love technology the most also seem to be the most opposed to electronic voting. I think it

by seldo 16y ago

It is one of the curious facts of modern culture that the people who love technology the most also seem to be the most opposed to electronic voting. I think it's because the people who most understand how computers work also understand that no data can be considered trustworthy if somebody else has been in possession of the hardware. Yet governments continue to trust the impossible promises of the people who make voting machines that their machines are secure, despite a continuous stream of demonstrations to the contrary, both intentional and accidental.

dandelany 16y ago
I don't know that we're opposed to it in theory, it's just that every single implementation thus far has been terrifically bad. Making the code open source would go a long way, I think, as would establishing open working groups to establish security standards. I may be an optimist, but I do believe that theoretically (at least information-theoretically[1]), it can be done well. [1] http://scholar.google.com/scholar?q=Information-theoretically+secure+voting&hl=en&as_sdt=0&as_vis=1&oi=scholart http://scholar.google.com/scholar?q=Information-theoreticall...
- yummyfajitas 16y ago
  It's also fairly easy for us techies to grasp the hacking of computer systems. But we often forget how insecure and error prone paper systems can also be: http://www.youtube.com/watch?v=sJfj9ySYg0Q http://www.youtube.com/watch?v=sJfj9ySYg0Q Massive voter fraud could be happening every election - it's pretty easy to vote fraudulently and there is almost no way to find out after the fact (I've done it unintentionally). For whatever reason, we are insanely afraid of hackers pushing an election over the edge, and yet we don't even ask for photo ID at the voting booth.
  - aristus 16y ago
    We're more concerned about electronic voting because it lowers the effort and manpower needed to defraud immensely.
    - jacquesm 16y ago
      And more likely, in a close election the election can be stolen by a minimal change, which will probably go undetected.
  - cubicle67 16y ago
    I voted on Saturday (Australian election). No id required, 100% paper votes, all counted by hand (as far as I'm aware) and we normally have a result within a few hours of polls in the West closing. Seems to work very well, but I guess one advantage we have is that none of the parties here are worth cheating for.
    - shrikant 16y ago
      Might also help that Australia's population is about 22M. The USA are at 308M and India is 1180M - hand-counting ballots might just be a bigger problem with those kinds of numbers involved.
      - sesqu 16y ago
        Can't see why it would be. That kind of thing parallelizes really well. Granted, oversight would likely thin a bit.
      - dhs 16y ago
        Germany has 80 m, and hand-counting works well. It does seem to be easy to parallelize.
- seldo 16y ago
  I do not. As long as the hardware has been in possession of untrusted parties (and polling place workers do not count as trusted) any software solution can be compromised.
  - dandelany 16y ago
    I'm not convinced that any method will ever be 100% foolproof, but I think it can be improved immensely, and if we could limit the inaccuracies/fraud to always be less than those incurred by a traditional paper ballot[1], I think I'd approve. In regards to your comment regarding untrusted parties handling the hardware, here are a few counterpoints: - We already trust polling place workers with paper ballots, the possibility for fraud already exists. - The potential for fraud from any one polling place can be limited by implementing a system which makes it impossible (or very very difficult) to spoof the location from which a vote was cast, and ensuring that the number of votes cast per polling place is within an expected range. - Such a system could also include a paper receipt with an ID number on it. A voter could plug this "tracking number" in on a trusted website (ie. vote.gov) and confirm that their name is associated with their preferred candidates, but not allow them to change these choices. This would go a long way towards identifying fraudulent activity when/if it occurs. [1] Though figuring out how to quantify this is anybody's guess.
    - biafra 16y ago
      "We already trust polling place workers with paper ballots, the possibility for fraud already exists." I don't know about the US, but here in Germany _anyone_ can watch the whole process including the counting of the votes. So it is possible for me to check up on my polling place. With the current paper ballot system you need a lot of people to cheat significantly. With voting computers you need only a really tiny number of people to steal an election.
      - ams6110 16y ago
        Is it not the case in the US that representatives of each party supervise the counting of the ballots? Pretty sure that's how it works locally; though elections are state-governed so I guess there could be some variation. Having representatives of each party overseeing the process should serve to keep any monkey business in check. Though when people are involved, there's always a chance for corruption.
gxti 16y ago
I've often considered open source voting software and hardware as a possible startup idea, but frankly I don't have the balls to go through with it. I'm not an entrepreneur, and it is a legal minefield besides, so I stay away. Still, I have some neat (IMHO) ideas, so maybe I should find a venue in which to express them.
jasonjei 16y ago
I think the issue is the difficulty of auditing electronic votes. Computers and databases have made it so easy to forge data--just look at Bernie Madoff. The best way to ameliorate these discomforts is to ensure that a list of eligible voters is made available every year (already available under the current system), as well as a list and sum total of those eligible that voted. We would need to assign every voter a UUID every time he votes, and provide the voter a printed receipt of the UUID and selected choices (if desired) on security paper (controlled stock of security paper with its own unique identifier to be accounted for), and publish all election results with the selected choices matched to a UUID on a website every year in CSV and HTML formats. I'm sure there will always be ways to tamper the system. The key is that if every one is able to watch the system (like open source code auditing), the risk of discrepancies or error is minimized. The UUID will allow the voter to confirm that his choices match the recorded results. If this system were implemented, it would be better than the status quo. The current system may seem better, but it's prone to human error (Scantrons not being scanned by an optical reader; hanging chads; etc).
- yummyfajitas 16y ago
  At least two obvious ways to hack your proposed system. Hackers could just add phony UUID/vote pairs to the totals. Activists could claim their vote was stolen if their preferred candidate loses. (We already saw a variant of the latter in 2000. Remember "I couldn't follow the arrow and accidentally voted buchanan"?). Further, if a person's vote is verifiable, it also opens the door to paying people for their votes.
  - jasonjei 16y ago
    I can't think of a fix for paying people for their votes since that problem still exists today (albeit to a lesser extent than if a voter's vote were verifiable), but I imagine they wouldn't be able to keep it under wraps for very long. Anyone offering to pay money will definitely risk drawing attention to themselves, and I believe ethical people will report suspicious people to voting investigators. As far as the UUID/pair frauds, we could mail a confirmation letter to the voters stating that they voted. Since I don't think we could tie the UUID to the actual voter, we could tell them they participated in this year's election and to verify the results to the receipt. This part is compounded in difficulty partly due to federal voting regulations that don't allow us to tie a voter to his votes, so I think the only real way is to verify videotapes verifying that said voters appeared in person to vote. Again there are flaws and it will take more people to resolve the issues with electronic voting.
electromagnetic 16y ago
Well firstly these machines should have been riveted shut, leaving the only way to access the machine is by breaking the tamper-seals. (This at least eliminates everyone in the country without corresponding replacement tamper-seals from screwing around inside the machines) Secondly, the OS on these devices should have been stored into ROM; not only is this a bastard way of ensuring people have to use the manufacturer to upgrade the systems, but it also makes tampering that much more of a pain in the ass. Thirdly a proprietary data storage should have been used. Preferably one designed so that the voting machines only ever contain a write-only drive, in that it either cannot edit the data, or preferably doesn't even have the necessary hardware to read the data it writes (this would be complicated to get working right, but would be well worth it). This means only the manufacturer would have access to the edit/read connections. I mean come on, compact flash, seriously. My phone can read flash drives, what were the designers thinking!
- billybob 16y ago
  Proprietary storage? I'm skeptical. This is contrary to the open-source mentality: let the details of how the system works be known to everyone. Like PGP encryption: nobody's hiding how it works - in fact, more scrutiny helps prove it's safe. You don't hide the mechanism, you just hide your personal key. Otherewise, you start feeling secure based on your assumptions, like "only we can read these drives" - when maybe your assumption is wrong. Maybe somebody has hacked one machine somewhere and reverse-engineered the connector. Now you've got an unknown danger out there. Whereas if you're constantly submitting your system to public scrutiny, you'll probably only have known dangers. Which you can fix.
JoachimSchipper 16y ago
As a counterpoint, cryptographers (including Rivest of _R_SA fame) are quite interested in voting. Of course, they generally don't trust the machines at all...
michaelneale 16y ago
So here in Australia we use plain old paper and pencil ballots (it is the same in every state - it's Federal). How does electronic security compare to pencil on (anonymous) paper ? I am sure paper fraud happens - as would manual counting (it is manual but overseen of course). Is it perhaps that with electronic both the scale can be increased and the chance of detection decreased?
endtime 16y ago
>no data can be considered trustworthy if somebody else has been in possession of the hardware Actually, this isn't true, given properly-implemented crypto. Or, I suppose I should say, it's true only with very low probability.
jackfoxy 16y ago
How much of the drive for electronic voting is driven by big media? The MSM really covers elections like horse races, and at the finish they want to be able to wrap it before people drift off to sleep for another workday. I wouldn't mind if election results weren't available for a day or two. The ancient Greeks had a completely tamper-proof voting method (and voting was theoretically obligatory). We should likewise be seeking a tamper-proof voting method, whatever that may be. I would also support obligatory voting (with "abstain" as a choice), and media outlets that cover elections like entertainment should be ridiculed.

by seldo 16y ago

dandelany 16y ago

I don't know that we're opposed to it in theory, it's just that every single implementation thus far has been terrifically bad. Making the code open source would go a long way, I think, as would establishing open working groups to establish security standards. I may be an optimist, but I do believe that theoretically (at least information-theoretically[1]), it can be done well. [1] http://scholar.google.com/scholar?q=Information-theoretically+secure+voting&hl=en&as_sdt=0&as_vis=1&oi=scholart http://scholar.google.com/scholar?q=Information-theoreticall...

yummyfajitas 16y ago
It's also fairly easy for us techies to grasp the hacking of computer systems. But we often forget how insecure and error prone paper systems can also be: http://www.youtube.com/watch?v=sJfj9ySYg0Q http://www.youtube.com/watch?v=sJfj9ySYg0Q Massive voter fraud could be happening every election - it's pretty easy to vote fraudulently and there is almost no way to find out after the fact (I've done it unintentionally). For whatever reason, we are insanely afraid of hackers pushing an election over the edge, and yet we don't even ask for photo ID at the voting booth.
- aristus 16y ago
  We're more concerned about electronic voting because it lowers the effort and manpower needed to defraud immensely.
  - jacquesm 16y ago
    And more likely, in a close election the election can be stolen by a minimal change, which will probably go undetected.
- cubicle67 16y ago
  I voted on Saturday (Australian election). No id required, 100% paper votes, all counted by hand (as far as I'm aware) and we normally have a result within a few hours of polls in the West closing. Seems to work very well, but I guess one advantage we have is that none of the parties here are worth cheating for.
  - shrikant 16y ago
    Might also help that Australia's population is about 22M. The USA are at 308M and India is 1180M - hand-counting ballots might just be a bigger problem with those kinds of numbers involved.
    - sesqu 16y ago
      Can't see why it would be. That kind of thing parallelizes really well. Granted, oversight would likely thin a bit.
    - dhs 16y ago
      Germany has 80 m, and hand-counting works well. It does seem to be easy to parallelize.
seldo 16y ago
I do not. As long as the hardware has been in possession of untrusted parties (and polling place workers do not count as trusted) any software solution can be compromised.
- dandelany 16y ago
  I'm not convinced that any method will ever be 100% foolproof, but I think it can be improved immensely, and if we could limit the inaccuracies/fraud to always be less than those incurred by a traditional paper ballot[1], I think I'd approve. In regards to your comment regarding untrusted parties handling the hardware, here are a few counterpoints: - We already trust polling place workers with paper ballots, the possibility for fraud already exists. - The potential for fraud from any one polling place can be limited by implementing a system which makes it impossible (or very very difficult) to spoof the location from which a vote was cast, and ensuring that the number of votes cast per polling place is within an expected range. - Such a system could also include a paper receipt with an ID number on it. A voter could plug this "tracking number" in on a trusted website (ie. vote.gov) and confirm that their name is associated with their preferred candidates, but not allow them to change these choices. This would go a long way towards identifying fraudulent activity when/if it occurs. [1] Though figuring out how to quantify this is anybody's guess.
  - biafra 16y ago
    "We already trust polling place workers with paper ballots, the possibility for fraud already exists." I don't know about the US, but here in Germany _anyone_ can watch the whole process including the counting of the votes. So it is possible for me to check up on my polling place. With the current paper ballot system you need a lot of people to cheat significantly. With voting computers you need only a really tiny number of people to steal an election.
    - ams6110 16y ago
      Is it not the case in the US that representatives of each party supervise the counting of the ballots? Pretty sure that's how it works locally; though elections are state-governed so I guess there could be some variation. Having representatives of each party overseeing the process should serve to keep any monkey business in check. Though when people are involved, there's always a chance for corruption.

gxti 16y ago

I've often considered open source voting software and hardware as a possible startup idea, but frankly I don't have the balls to go through with it. I'm not an entrepreneur, and it is a legal minefield besides, so I stay away. Still, I have some neat (IMHO) ideas, so maybe I should find a venue in which to express them.

jasonjei 16y ago

I think the issue is the difficulty of auditing electronic votes. Computers and databases have made it so easy to forge data--just look at Bernie Madoff. The best way to ameliorate these discomforts is to ensure that a list of eligible voters is made available every year (already available under the current system), as well as a list and sum total of those eligible that voted. We would need to assign every voter a UUID every time he votes, and provide the voter a printed receipt of the UUID and selected choices (if desired) on security paper (controlled stock of security paper with its own unique identifier to be accounted for), and publish all election results with the selected choices matched to a UUID on a website every year in CSV and HTML formats. I'm sure there will always be ways to tamper the system. The key is that if every one is able to watch the system (like open source code auditing), the risk of discrepancies or error is minimized. The UUID will allow the voter to confirm that his choices match the recorded results. If this system were implemented, it would be better than the status quo. The current system may seem better, but it's prone to human error (Scantrons not being scanned by an optical reader; hanging chads; etc).

yummyfajitas 16y ago
At least two obvious ways to hack your proposed system. Hackers could just add phony UUID/vote pairs to the totals. Activists could claim their vote was stolen if their preferred candidate loses. (We already saw a variant of the latter in 2000. Remember "I couldn't follow the arrow and accidentally voted buchanan"?). Further, if a person's vote is verifiable, it also opens the door to paying people for their votes.
- jasonjei 16y ago
  I can't think of a fix for paying people for their votes since that problem still exists today (albeit to a lesser extent than if a voter's vote were verifiable), but I imagine they wouldn't be able to keep it under wraps for very long. Anyone offering to pay money will definitely risk drawing attention to themselves, and I believe ethical people will report suspicious people to voting investigators. As far as the UUID/pair frauds, we could mail a confirmation letter to the voters stating that they voted. Since I don't think we could tie the UUID to the actual voter, we could tell them they participated in this year's election and to verify the results to the receipt. This part is compounded in difficulty partly due to federal voting regulations that don't allow us to tie a voter to his votes, so I think the only real way is to verify videotapes verifying that said voters appeared in person to vote. Again there are flaws and it will take more people to resolve the issues with electronic voting.

electromagnetic 16y ago

Well firstly these machines should have been riveted shut, leaving the only way to access the machine is by breaking the tamper-seals. (This at least eliminates everyone in the country without corresponding replacement tamper-seals from screwing around inside the machines) Secondly, the OS on these devices should have been stored into ROM; not only is this a bastard way of ensuring people have to use the manufacturer to upgrade the systems, but it also makes tampering that much more of a pain in the ass. Thirdly a proprietary data storage should have been used. Preferably one designed so that the voting machines only ever contain a write-only drive, in that it either cannot edit the data, or preferably doesn't even have the necessary hardware to read the data it writes (this would be complicated to get working right, but would be well worth it). This means only the manufacturer would have access to the edit/read connections. I mean come on, compact flash, seriously. My phone can read flash drives, what were the designers thinking!

billybob 16y ago
Proprietary storage? I'm skeptical. This is contrary to the open-source mentality: let the details of how the system works be known to everyone. Like PGP encryption: nobody's hiding how it works - in fact, more scrutiny helps prove it's safe. You don't hide the mechanism, you just hide your personal key. Otherewise, you start feeling secure based on your assumptions, like "only we can read these drives" - when maybe your assumption is wrong. Maybe somebody has hacked one machine somewhere and reverse-engineered the connector. Now you've got an unknown danger out there. Whereas if you're constantly submitting your system to public scrutiny, you'll probably only have known dangers. Which you can fix.

JoachimSchipper 16y ago

As a counterpoint, cryptographers (including Rivest of _R_SA fame) are quite interested in voting. Of course, they generally don't trust the machines at all...

michaelneale 16y ago

So here in Australia we use plain old paper and pencil ballots (it is the same in every state - it's Federal). How does electronic security compare to pencil on (anonymous) paper ? I am sure paper fraud happens - as would manual counting (it is manual but overseen of course). Is it perhaps that with electronic both the scale can be increased and the chance of detection decreased?

endtime 16y ago

>no data can be considered trustworthy if somebody else has been in possession of the hardware Actually, this isn't true, given properly-implemented crypto. Or, I suppose I should say, it's true only with very low probability.

jackfoxy 16y ago

How much of the drive for electronic voting is driven by big media? The MSM really covers elections like horse races, and at the finish they want to be able to wrap it before people drift off to sleep for another workday. I wouldn't mind if election results weren't available for a day or two. The ancient Greeks had a completely tamper-proof voting method (and voting was theoretically obligatory). We should likewise be seeking a tamper-proof voting method, whatever that may be. I would also support obligatory voting (with "abstain" as a choice), and media outlets that cover elections like entertainment should be ridiculed.