7 ms·

Even if it were possible to design a provably correct, impossible to tamper with, anonymous electronic voting system (which seems unlikely to me) it still shoul

• pbz 8y ago
  How about this? 1) you go to vote with your voting card 2) you get a paper printout of your vote 3) the voting machine then broadcasts your vote (only IDs) to N independent checkers; this makes your vote public but anonymous 4) later you check the printout against your favorite online checker to make sure it registered properly To make all this work the paper and electronic trail is digitally signed with something that's only on your voting card.
  • rtpg 8y ago
    This leads to the problem of letting _other people_ force you to show them how you voted. This is a real problem! The secret vote isn't just about making sure that you can choose privately, but also about making sure that other people don't have ways of coercing you into certain choices.
    • keymone 8y ago
      There are ways to solve this issue with cryptography.
      • lolc 8y ago
        Such a solution is of the sort where you can't make up your own opinion if the two (hopefully) experts that looked at it disagree. And if they happen to agree you still have to trust them because you'd have to train for several years to be able to follow their argument.
      • tijl 8y ago
        No there aren't. If you can check your vote, then your abusive spouse, your boss or somebody else who has power over you, can force you to show them your vote.
        • rcxdude 8y ago
          Not neccessarily, you can have a system where you can retrieve 'proof' of having voted in any way you want, and you can verify via some secret information used when voting, but making the UX of such a feature good enough that it's actually usable by someone in those circumstances is not at all easy.
          • keymone 8y ago
            yes, this ^ never said it's easy, but it is possible.
          • therein 8y ago
            Voter goes in to vote. They are given two random words. One for candidate A, one for candidate B. They are told they should remember the code-word matching their choice if they later want to scan the printed out QR code (or enter their vote uuid) to one of the validator websites. Voter makes their choice, completes the process. A thermal printout is printed with their vote uuid and a QR code meant to make it easy to input it. Now anyone can get that printout with the uuid and scan it and see the code-word representing the voter's selection. However the association is only known to the voter and if asked, the voter can say that's what it was.
  • Rexxar 8y ago
    Doing this permit someone to force you to disclose your vote and force you to vote what they want. The strength of traditional vote is that nobody can know your vote and this is the more important feature of the voting system.
    • doubleunplussed 8y ago
      I was arguing about this with someone when they pointed out that in Australian Senate elections, it's trivially easy to make your vote unique. There are many candidates and you can order them however you like, so you can vote a particular way among the candidates that are actually competitive, and then order the rest of the candidates in some improbable way to make your vote unique. Then when the database gets published later someone can verify that you voted how you said you would. So the Australian Senate is currently vulnerable to vote buying, for what it's worth.
    • EGreg 8y ago
      Oh REALLY? Nobody can know? Then explain how this data exists: https://www.zdnet.com/google-amp/article/us-voter-records-from-19-states-sold-on-hacking-forum/ https://www.zdnet.com/google-amp/article/us-voter-records-fr... https://gizmodo.com/nearly-15-million-texas-voters-reportedly-exposed-by-da-1828579189/amp https://gizmodo.com/nearly-15-million-texas-voters-reportedl... https://thestack.com/security/2016/04/25/93-4-million-mexican-voter-records-leaked-online/ https://thestack.com/security/2016/04/25/93-4-million-mexica... So much for such an important feature.
    • 50korangutang 8y ago
      Postal votes in our current system mean people can know your vote and force you to vote in a certain way.
  • dnos 8y ago
    I like your thought, but if a voter can lookup their vote to confirm it got counted correctly with some form of receipt, then it opens the door for vote buying. I’m not sure if there’s a way around that, but it would be awesome to be able to absolutely prove all votes were correctly counted.
    • mgoetzke 8y ago
      that is why multiple people in the office of different political factions count the votes. And they are also present all the time. Otherwise you can simply do it the Russian way: https://www.youtube.com/watch?v=3oSeRyaFllY https://www.youtube.com/watch?v=3oSeRyaFllY
      • tijl 8y ago
        I think what dnos means by vote buying, is not that somebody bribes the people who count the votes, but that somebody bribes the voters. If a politician now approaches me and promises me to pay me if I vote for him, he can't really be sure I actually did vote for him. Nobody but me knows what happens in the voting booth. He could ask me to take a picture, but I could still change my vote after the picture was taken.
        • mgoetzke 8y ago
          sure .. that is possible. But all bribing is a matter of attenuation. One would want to spend as little money possible to change the outcome. Bribing voters is the most expensive version, one with the highest risk of being found out, and least verifiable. Paying off the people counting in each district is once removed in these risks. Attacking the people up the chain (that sum up many districts) is the next level etc. At every step of this way, if there is software involved it becomes instantly easier and less risky to influence. Whether it is online voting, voting machines, vote counting software, tabulation software, emailing results upwards etc.
  • j16sdiz 8y ago
    This does not stop adding extra ballot counts
  • archi42 8y ago
    That doesn't solve the > [...] my expert says your expert is wrong and so it is/isn't fraud.
• celticninja 8y ago
  Some systems are simple enough and important enough that speeding them up with computers just ain't necessary. I can see how in a direct democracy, where many issues are voted on, it may seem reasonable to do it. However if an issue is important enough ought for it to be out directly to the people then it is important enough that we can wait for 24-48 hours for a result.
• vlovich123 8y ago
  That's a surprisingly luddite response on a technology forum. Paper ballots have all their own set of security challenges. The North Carolina event that literally happened this year being a great such example. The Battle of Athens is another - a literal gunfight over who would hold possession over the ballot box. Or how about all the issues over running out of paper ballots, long lines, etc. With electronic voting you could have everyone pre-enter their vote electronically & just "drop" it off by scanning their phone & getting a printed receipt they can use to confirm their vote was recorded correctly cryptographically. It is possible to actually design secure electoral systems that actually protect the integrity of the election better (better anonymity, better traceability, better auditing, less error, more accessibility, etc, etc, etc). Convenience is also important; there are even ways you can potentially design the system to run on semi-trusted hardware which means lower cost & more polling stations, easier access etc. This rhetorical argument of making fun of the idea as "we can wait a couple of days for the results" completely ignores the actual advantages of such a system. It also completely ignores that a paper trail isn't mutually exclusive from electronic voting. The challenge is in making sure the process for creating these systems isn't corrupted, especially by technologically illiterate legislative leaders who don't seem to place any of the most basic protections that experts recommend. They also don't have the balls to hold the voting companies to task for designing secure systems; somehow it's a non-issue for the same companies to do the obviously right things when it comes to their other customers (banks).
  • bloomer 8y ago
    You might be surprised that that "Luddite" response is actually the consensus opinion among experts familiar with electronic voting technology. See https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html https://www.schneier.com/blog/archives/2018/04/securing_elec... and the links there in.
    • vlovich123 8y ago
      I think it was just a misunderstanding on my part. It sounded like OP was advocating for a purely paper-driven system. That's why I said it's a Luddite position. I think the misunderstanding on your part may have been similar meaning I'm advocating for entirely electronic. To me electronic voting means a machine generating your ballot which avoids spoilage like hanging chads, incorrectly filled out ballots, etc (paper ballots should also be an option). Electronic voting means using counting machines to tabulate everything quickly while creating & retaining a paper trail for auditing. This is literally what Schneier is talking about: merging the advantages of both to mitigate the disadvantages of either.
• kr4 8y ago
  VVPAT is a nice feature for EVM verification. India has gone full electronic for the national election happening this year with VVPAT for all EVMs. https://en.wikipedia.org/wiki/Electronic_voting_in_India https://en.wikipedia.org/wiki/Electronic_voting_in_India
• jaabe 8y ago
  I work in public digitisation in Denmark where we do digital elections. We’ve digitised voter registration, not the actual voting part. That bit is still done with paper, and will continue to be that way for a long time. Basically every adult Dane is mailed a vote-card that you can trade in for a ballot at your local voting place each election. Traditionally you took this paper and got crossed off in a big book, something which created hour long queues at prime times. So we added a bar code to your vote-card, and now we scan it when you arrive. The interesting bit about this though, is that it’s way more expensive to do things this way because public IT-systems are just damn expensive. Which leads me to your point on “why would you do it”, and I agree, it just doesn’t make sense to digitise elections. It doesn’t really make them easier to handle. We have to train people on how to setup and use the system, each time. We also have to set up the equipment and the backup equipment. Basically we spend a few thousand hours extra in preparation for each election, so not only is the software/hardware expensive, we actually use more man hours. You could reduce some of that by digitising the vote counting of course, but when we did the math it wouldn’t save us more than we spend. So there is no financial reason to digitise elections. We knew this when we decided to digitise part of our election btw, but because we’re the public sector and not a business, well, financial reasons aren’t the only reason we operate. Citizen satisfaction is a major one, and that’s exactly what we get by lowering the queues from a few hours to 10 minutes max. But what is there to gain by digitising the counting? Getting results at 8pm instead of later during the night? Maybe if it was risk free, but since digital elections are the opposite, there is just no reason. I guess if you let people vote online like Estonia, but we wouldn’t consider that to be a democratic process.
  • kome 8y ago
    I had a similar experience. My first job was to study the deployment of electronic ballot box in a region in northern Italy. It's such a problematic process on many levels, and it's incredible how many things can go wrong. Things you cannot even imagine: like finger traces on the touch screen. We just observed an increase of risks, without an increase in benefits. For extra safety, our machine produced a paper trace to every vote as well, but it's just not worth it... Paper and pencils are still the best technology for elections. And ofc voting at home, by mail or electronically, like in Switzerland or Estonia, is not democratic enough for me. To make it democratic, you have to be alone in a safe space with maximum privacy: a ballot box. You should not be pressured by family or anyone. I know for sure that in Switzerland (I lived there), in many households, ballot box of the wife are often ticked by the man, and that's nonsense.
• kakarot 8y ago
  This attitude doesn't scale to a space-faring society.