5 ms·

The central issue with electronic voting is that it's opaque to observers. You can't guarantee vote privacy and monitor the counting process at the same time in

by lolc 8y ago

The central issue with electronic voting is that it's opaque to observers. You can't guarantee vote privacy and monitor the counting process at the same time in electronics. I find that problem alone should mean no electronic voting should be used at scale. Further, vote privacy is threatened at the client side. The fact that they specifically exclude client vulnerabilities is telling: "... known and accepted characteristics of the system will however not be accepted. Such “issues” include: Any operation compromising the vote privacy on the client-side (e.g. browser extension);" They even met "issues" in quotes, even tough these are a common attack vector. They are real and dangerous. It's common in Switzerland to vote by mail, so there's the possibility that people get pressured into voting in a certain way by their relatives. But the scale is very different when people must expose their voting preferences to a machine they already know watches them.

Mirioron 8y ago
I agree about the risk of client-side vulnerabilities. Another state-level actor could easily abuse this to influence an election. On the counting side though, I don't fully agree. Paper voting sees some enormous mistakes. Whether they are intentional or not, but it has happened before where an entire town's votes for a candidate missed a zero. No election observers or people sent from either party noticed it until a volunteer pointed it out. Electronic voting isn't going to make such mistakes and I believe that if the process is handled well, then the secrecy of the vote shouldn't be an issue from the server side. But again, there's nothing you can do about the client side attack vector.
- sametmax 8y ago
  In your example it worked: a volunteer pointed it out. The volunteer probably would not have been able to with e-vote. Who has the skill to be able to assess such a system ? And among those, who has the time ? I've been a programmer for 15 years and I'm pretty sure I would not be able to look at such a system and feel confident there is no error. And definitly not in the reasonable time period required for voting.
  - paulhilbert 8y ago
    This exactly - complete recountability and the fact that there actually are independent volunteers recounting are the only assurances of a transparent, legitimate voting system. Black boxes (and computer systems by their nature are black boxes) introduced into this system will always void its transparency.
  - godelski 8y ago
    > In your example it worked: a volunteer pointed it out. The volunteer probably would not have been able to with e-vote. I believe the parent's example was to show that it was missed by the system that was intended to catch it. That the catch in itself was a fluke, lucky. It should bring into question "How many times have we missed and not caught it?" not "Well it worked this time, it must always work." In fact, we can only recognize cases if we catch them. Therefore it is confirmation bias to use this example as a "proof of it working". It can only serve as an example of "We have caught failures in the system" and suggest that we should be wary of others existing (neither proving nor disproving fault in the system).
    - sametmax 8y ago
      We can't know how many, but we know it's possible. For e-vote, i'm not sure it's possible. Hell, i can't tell with certainty my own laptop is clean.
- lolc 8y ago
  While I agree that voting with paper ballots is prone to errors, I argue the errors are of the type that can be detected by observation. Manipulation at scale takes many conspirators and can be detected just by watching the process. You know you can't trust a vote when the watchers complain they couldn't monitor the ballot boxes at all time. In electronic voting, you just have to trust the machine to do it right. There are multiple layers of manipulation available that are hard to detect. Sure, the bar is higher, but so are the opportunities for doctoring by the involved actors. What are the watchers to do? They simply can't watch the ballot box when it's inside a machine where no single human can fully understand its machinations.
  - Klathmon 8y ago
    To expand on this, "verification" or "observation" of paper voting can be done by just about anyone. Young or old, natives or transplants, left or right, comp sci majors or the high school dropout, just about anyone can count along and watch a box to make sure nobody is stuffing tons of ballots in there. That's what makes it so powerful. If you think some conspiracy is happening by "the other side", you can go down and watch for yourself, or you can gather a hundred other people to watch with you.
    - iguy 8y ago
      Exactly. The goal isn't just to minimise the number of errors, it's to minimise the estimated number of errors among the most conspiracy-prone 10% of your fellow citizens. The validity of the vote is something which resides in their heads.
  - visarga 8y ago
    It is possible to create an encrypted log of all votes, each vote encrypted with a different key. Voters would receive a decryption key printed on a slip of paper at the voting booth. Later on they could check to see if their vote was correctly counted.
    - howard941 8y ago
      Can this procedure confirm that the machine properly recorded my preferences, reported them to the central tabulator, and that the tabulator included my ballot choices in the final counts?
- frosted-flakes 8y ago
  That's why you have paper ballots with dumb electronic counters, as Ontario (Canada) did in its last provincial election. The ballot is a full letter size piece of paper that is fed through the counting machine while the voter watches, into a standard ballot box that can easily be recounted.
Taylor_OD 8y ago
Maybe I'm incredibly naive but if we can build safe financial trading platforms then why cant we build safe electronic voting platforms? It seems like someone would have as much motivation to steal money as they would to change votes if it was possible.
- jfk13 8y ago
  I'd guess that a lot of that "safety" depends on the audibility of what happens on financial trading platforms. If someone manipulates them, this can be discovered (and the manipulator punished) precisely because there's a trail recording exactly who did what. If a voting platform has such a trail, what becomes of ballot secrecy? And if it doesn't, how will the process be reliably audited? I'm sure a simple, transparent, and bullet-proof blockchain solution is just around the corner. /s
- shaki-dora 8y ago
  Voting needs not only to be safe. It needs to be safe in a way that even old people, or those with zero knowledge of technology, do not belief conspiracy theories about how their vote is being stolen.
bubblethink 8y ago
>The central issue with electronic voting is that it's opaque to observers. There was this interesting talk years ago. https://www.youtube.com/watch?v=ZDnShu5V99s https://www.youtube.com/watch?v=ZDnShu5V99s Does anyone in the space have a more up to date reference on where things are at ?
vowelless 8y ago
> The central issue with electronic voting is that it's opaque to observers. The central issue with electronic voting is that it is centralized.
imw 8y ago
While I agree with your point about client-side vulnerability, I think the central issue you highlight has reached a tipping point. The use of zero-knowledge arguments of knowledge, such as the zk-snark, allows for anonymous, but still verifiable voting systems. These could be decentralized (via blockchain or similar), or built according to a more traditional architecture, but I do think that such a tool would represent a genuine advancement in voting systems.
- lolc 8y ago
  The problem is that very few people can follow how a zero-knowledge protocol works. We'd all have to trust a small set of people to do it right. And then we'd have to trust the people implementing it to do it right. Then we'd have to trust the people who provision the devices it runs on to do it right. But then we'd have to trust the devices themselves too. All the people who worked on the devices must be trusted. In the end it means we can't know there was no manipulation. Contrast this with a box where you can watch the pieces of paper as they are put inside. And as they are taken out again. As long as you can watch the box, you can can verify the process.

by lolc 8y ago

Mirioron 8y ago

I agree about the risk of client-side vulnerabilities. Another state-level actor could easily abuse this to influence an election. On the counting side though, I don't fully agree. Paper voting sees some enormous mistakes. Whether they are intentional or not, but it has happened before where an entire town's votes for a candidate missed a zero. No election observers or people sent from either party noticed it until a volunteer pointed it out. Electronic voting isn't going to make such mistakes and I believe that if the process is handled well, then the secrecy of the vote shouldn't be an issue from the server side. But again, there's nothing you can do about the client side attack vector.

sametmax 8y ago
In your example it worked: a volunteer pointed it out. The volunteer probably would not have been able to with e-vote. Who has the skill to be able to assess such a system ? And among those, who has the time ? I've been a programmer for 15 years and I'm pretty sure I would not be able to look at such a system and feel confident there is no error. And definitly not in the reasonable time period required for voting.
- paulhilbert 8y ago
  This exactly - complete recountability and the fact that there actually are independent volunteers recounting are the only assurances of a transparent, legitimate voting system. Black boxes (and computer systems by their nature are black boxes) introduced into this system will always void its transparency.
- godelski 8y ago
  > In your example it worked: a volunteer pointed it out. The volunteer probably would not have been able to with e-vote. I believe the parent's example was to show that it was missed by the system that was intended to catch it. That the catch in itself was a fluke, lucky. It should bring into question "How many times have we missed and not caught it?" not "Well it worked this time, it must always work." In fact, we can only recognize cases if we catch them. Therefore it is confirmation bias to use this example as a "proof of it working". It can only serve as an example of "We have caught failures in the system" and suggest that we should be wary of others existing (neither proving nor disproving fault in the system).
  - sametmax 8y ago
    We can't know how many, but we know it's possible. For e-vote, i'm not sure it's possible. Hell, i can't tell with certainty my own laptop is clean.
lolc 8y ago
While I agree that voting with paper ballots is prone to errors, I argue the errors are of the type that can be detected by observation. Manipulation at scale takes many conspirators and can be detected just by watching the process. You know you can't trust a vote when the watchers complain they couldn't monitor the ballot boxes at all time. In electronic voting, you just have to trust the machine to do it right. There are multiple layers of manipulation available that are hard to detect. Sure, the bar is higher, but so are the opportunities for doctoring by the involved actors. What are the watchers to do? They simply can't watch the ballot box when it's inside a machine where no single human can fully understand its machinations.
- Klathmon 8y ago
  To expand on this, "verification" or "observation" of paper voting can be done by just about anyone. Young or old, natives or transplants, left or right, comp sci majors or the high school dropout, just about anyone can count along and watch a box to make sure nobody is stuffing tons of ballots in there. That's what makes it so powerful. If you think some conspiracy is happening by "the other side", you can go down and watch for yourself, or you can gather a hundred other people to watch with you.
  - iguy 8y ago
    Exactly. The goal isn't just to minimise the number of errors, it's to minimise the estimated number of errors among the most conspiracy-prone 10% of your fellow citizens. The validity of the vote is something which resides in their heads.
- visarga 8y ago
  It is possible to create an encrypted log of all votes, each vote encrypted with a different key. Voters would receive a decryption key printed on a slip of paper at the voting booth. Later on they could check to see if their vote was correctly counted.
  - howard941 8y ago
    Can this procedure confirm that the machine properly recorded my preferences, reported them to the central tabulator, and that the tabulator included my ballot choices in the final counts?
frosted-flakes 8y ago
That's why you have paper ballots with dumb electronic counters, as Ontario (Canada) did in its last provincial election. The ballot is a full letter size piece of paper that is fed through the counting machine while the voter watches, into a standard ballot box that can easily be recounted.

Taylor_OD 8y ago

Maybe I'm incredibly naive but if we can build safe financial trading platforms then why cant we build safe electronic voting platforms? It seems like someone would have as much motivation to steal money as they would to change votes if it was possible.

jfk13 8y ago
I'd guess that a lot of that "safety" depends on the audibility of what happens on financial trading platforms. If someone manipulates them, this can be discovered (and the manipulator punished) precisely because there's a trail recording exactly who did what. If a voting platform has such a trail, what becomes of ballot secrecy? And if it doesn't, how will the process be reliably audited? I'm sure a simple, transparent, and bullet-proof blockchain solution is just around the corner. /s
shaki-dora 8y ago
Voting needs not only to be safe. It needs to be safe in a way that even old people, or those with zero knowledge of technology, do not belief conspiracy theories about how their vote is being stolen.

bubblethink 8y ago

>The central issue with electronic voting is that it's opaque to observers. There was this interesting talk years ago. https://www.youtube.com/watch?v=ZDnShu5V99s https://www.youtube.com/watch?v=ZDnShu5V99s Does anyone in the space have a more up to date reference on where things are at ?

vowelless 8y ago

> The central issue with electronic voting is that it's opaque to observers. The central issue with electronic voting is that it is centralized.

imw 8y ago

While I agree with your point about client-side vulnerability, I think the central issue you highlight has reached a tipping point. The use of zero-knowledge arguments of knowledge, such as the zk-snark, allows for anonymous, but still verifiable voting systems. These could be decentralized (via blockchain or similar), or built according to a more traditional architecture, but I do think that such a tool would represent a genuine advancement in voting systems.

lolc 8y ago
The problem is that very few people can follow how a zero-knowledge protocol works. We'd all have to trust a small set of people to do it right. And then we'd have to trust the people implementing it to do it right. Then we'd have to trust the people who provision the devices it runs on to do it right. But then we'd have to trust the devices themselves too. All the people who worked on the devices must be trusted. In the end it means we can't know there was no manipulation. Contrast this with a box where you can watch the pieces of paper as they are put inside. And as they are taken out again. As long as you can watch the box, you can can verify the process.