6 ms·

This is missing two completely unnecessary failure modes that pen and paper don't have: 1. You cannot know whether the device leaks your vote, i.e., whether yo

This is missing two completely unnecessary failure modes that pen and paper don't have: 1. You cannot know whether the device leaks your vote, i.e., whether your vote is secret. Mind you that in addition to an attack inside the device, this can also happen via simple electromagnetic side channels inherent in the device--as has been demonstrated quite a while ago for Nedap voting computers by the dutch campaign against voting computers, where you could distinguish selected candicates by tuning an AM radio to the right frequency. 2. When the device malfunctions, whether due to a defect or sabotage, and only particular candidates can not be selected, that creates a side channel where the voter is effectively forced to unveil who they want to vote for. Neither of those failure modes exist with paper ballots.

dragontamer 8y ago
> Neither of those failure modes exist with paper ballots. Paper ballots stop secret cameras in the ballot room? I mean, they really don't. It depends on your threat-model. A lot of things will come down to trust. > 2. When the device malfunctions, whether due to a defect or sabotage, and only particular candidates can not be selected, that creates a side channel where the voter is effectively forced to unveil who they want to vote for. See Butterfly ballots. Paper ballots in USA (Florida specifically) which basically had this flaw. It was confusing to know which circles and lines were going to the correct candidate you wished to vote for. Asking for help on the ballot would leak information on who you wanted to vote for. A poorly done paper-ballot has its own set of issues.
- beat 8y ago
  And the solution to the flaws of butterfly ballots was the proliferation of insecure, dangerous touchscreen machines. Screw that. Give me a well-designed paper ballot.
- usrusr 8y ago
  > Paper ballots stop secret cameras in the ballot room? And neither do touchscreens. Paper is better if it's not done comically wrong. And even the worst paper ballots have a much smaller attack surface for plain old analog rumors than the best possible electronic system. The most powerful way to undermine a democracy is not flipping some votes to one candidate in perfect secrecy, it's making all candidates/camps believe that the other did. This could destroy a democracy even without a single vote having actually been tampered with. Electronic voting, only understood by experts, is perfect soil for such rumors and no amount of open sourcing can change that. The many human counters involved in a hierarchical paper vote counting scheme are not just an unfortunate inefficiency left over from a time when machines could not count yet, they also serve as witnesses, not only for keeping their peers in check but also for dampening any unfounded rumors that might come up. They increase trust even when they are not actively speaking up against rumors, just by being there, in numbers, as passive dampening elements like the moderator rods in a fission plant.
- logifail 8y ago
  > Paper ballots stop secret cameras in the ballot room? Ballot rooms are just about as decentralised and non-standard as it's possible to get your head around. Voting machines are the exact opposite. Are we actually discussing that someone could or would roll out a (nationwide?) network of hidden cameras across church halls, schools, and other places[0] where people go to cast paper ballots. Undetected? Distributing compromised software - or designing your attack into the hardware - for voting machines would be child's play by comparison. [0] https://www.theguardian.com/politics/gallery/2015/may/07/weird-wonderful-polling-stations-in-pictures https://www.theguardian.com/politics/gallery/2015/may/07/wei...
wyldfire 8y ago
> You cannot know whether the device leaks your vote, i.e., whether your vote is secret. The electronic voting machine never is granted your identity. But I'll grant it's possible that records of the voter identity with the ballot identity exist and could be used to map the voter's vote.
odyssey7 8y ago
These might be good arguments for letting people fill the ballot in manually, if they wish. Based on the design as I understand it, it seems like users aren't prohibited from printing a blank ballot and taking a pen to it themselves.
liquidify 8y ago
If these are open source hardware and software, then it is unlikely bugs like what you are talking about will slip through.
seanwilson 8y ago
Could any of these problems be at least partially fixed by randomising how the choices are displayed in the input UI and on the printouts?

dragontamer 8y ago

> Neither of those failure modes exist with paper ballots. Paper ballots stop secret cameras in the ballot room? I mean, they really don't. It depends on your threat-model. A lot of things will come down to trust. > 2. When the device malfunctions, whether due to a defect or sabotage, and only particular candidates can not be selected, that creates a side channel where the voter is effectively forced to unveil who they want to vote for. See Butterfly ballots. Paper ballots in USA (Florida specifically) which basically had this flaw. It was confusing to know which circles and lines were going to the correct candidate you wished to vote for. Asking for help on the ballot would leak information on who you wanted to vote for. A poorly done paper-ballot has its own set of issues.

beat 8y ago
And the solution to the flaws of butterfly ballots was the proliferation of insecure, dangerous touchscreen machines. Screw that. Give me a well-designed paper ballot.
usrusr 8y ago
> Paper ballots stop secret cameras in the ballot room? And neither do touchscreens. Paper is better if it's not done comically wrong. And even the worst paper ballots have a much smaller attack surface for plain old analog rumors than the best possible electronic system. The most powerful way to undermine a democracy is not flipping some votes to one candidate in perfect secrecy, it's making all candidates/camps believe that the other did. This could destroy a democracy even without a single vote having actually been tampered with. Electronic voting, only understood by experts, is perfect soil for such rumors and no amount of open sourcing can change that. The many human counters involved in a hierarchical paper vote counting scheme are not just an unfortunate inefficiency left over from a time when machines could not count yet, they also serve as witnesses, not only for keeping their peers in check but also for dampening any unfounded rumors that might come up. They increase trust even when they are not actively speaking up against rumors, just by being there, in numbers, as passive dampening elements like the moderator rods in a fission plant.
logifail 8y ago
> Paper ballots stop secret cameras in the ballot room? Ballot rooms are just about as decentralised and non-standard as it's possible to get your head around. Voting machines are the exact opposite. Are we actually discussing that someone could or would roll out a (nationwide?) network of hidden cameras across church halls, schools, and other places[0] where people go to cast paper ballots. Undetected? Distributing compromised software - or designing your attack into the hardware - for voting machines would be child's play by comparison. [0] https://www.theguardian.com/politics/gallery/2015/may/07/weird-wonderful-polling-stations-in-pictures https://www.theguardian.com/politics/gallery/2015/may/07/wei...

wyldfire 8y ago

> You cannot know whether the device leaks your vote, i.e., whether your vote is secret. The electronic voting machine never is granted your identity. But I'll grant it's possible that records of the voter identity with the ballot identity exist and could be used to map the voter's vote.

odyssey7 8y ago

These might be good arguments for letting people fill the ballot in manually, if they wish. Based on the design as I understand it, it seems like users aren't prohibited from printing a blank ballot and taking a pen to it themselves.

liquidify 8y ago

If these are open source hardware and software, then it is unlikely bugs like what you are talking about will slip through.

seanwilson 8y ago

Could any of these problems be at least partially fixed by randomising how the choices are displayed in the input UI and on the printouts?