17 ms·
Protecting democratic elections through secure, verifiable voting
- dang 7y agoAP article on this: https://www.apnews.com/7e78189c21ce4a7cb7cb73432705c3ca https://www.apnews.com/7e78189c21ce4a7cb7cb73432705c3ca (via https://news.ycombinator.com/item?id=19844173 https://news.ycombinator.com/item?id=19844173) And the Galois post here: https://galois.com/blog/2019/05/protecting-election-integrity-with-electionguard/ https://galois.com/blog/2019/05/protecting-election-integrit... (via https://news.ycombinator.com/item?id=19840683 https://news.ycombinator.com/item?id=19840683)
- gruez 7y ago>After the election is complete, the tracker codes can be used by voters to confirm that their votes were not altered or tampered with and that they were properly counted. So what's preventing vote-buying schemes?
- Kinnard 7y agoZero Knowledge Proofs: https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof
- c22 7y agoWhat you really want is some way for the voter to create plausible deniability. Like the voter should have multiple secret keys, one which allows them to confirm their vote was correctly tallied for themselves, and another one that allows them to trick an adversary into thinking they voted for an arbitrary candidate.
- codedokode 7y agoIn Estonian e-voting they allowed to change the vote later or re-vote offline. So that if someone sold their vote or was forced to vote, they can later change their mind. But such scheme is still vulnerable: for example, imagine if a large state-owned or having close ties with government company forces their employees to vote online under supervision. If the employees are not very good with computers or don't own one, they cannot change their vote online later, and employer can set their shifts to a voting day so that they cannot visit the polling station.
- mehrdadn 7y agoIsn't there a much more practical vulnerability? Just forcing people to vote in front of you in the last 15 minutes or something?
- ddebernardy 7y agoIt's not just that. Some UK researchers also demonstrated how it was possible to confuse voters whose devices were infected by malware. The trick basically was to display X to the voter and send Y instead.
- dwg 7y agoThat's a great point. If I understand correctly schemer could agree to pay for votes, but had no way to verify the ballot was indeed cast for that candidate. With this system they could first verify the vote before paying. It's made possible by the information which is used to verify the vote. It's supposed to be kept secret by the vote, but could be shared with the schemer in order to get paid. This would make vote-buying schemes much more manageable. However, there seems to be considerable risk to the voter. What's to prevent the schemer from not paying up? The vote is already cast, and what can the voter do? Sue the schemer? For not paying for a bought vote?
- YokoZar 7y agoWhether or not a person voted in a given election is already public knowledge. How does this scheme give an attacker any more information than that? If you're willing to assume the attacker is into the voting booth, you're no worse off with this.
- nostrebored 7y agoBecause they can ask to verify.
- YokoZar 7y agoImagine I ask the voting machine to give me 100 sealed envelopes with "Alice" written in them and 100 sealed envelopes with "Bob" written in them. I open and destroy 199 of them, verify that Alice votes are Alice votes and Bob votes are Bob votes. I then walk out of the voting booth with a sealed Alice envelope, then deposit it into the ballot box. That's the "verifiable" step in here. The only way for you to know who I voted for is if you were in that booth with me.
- dwg 7y agoThe post states: > The combination of the tracker – which allows individual voters to verify that their votes have been accurately recorded – and the verifier – which allows anyone to verify that the recorded votes have been accurately counted – enables full “end-to-end verification” of the correctness of election results. I understood this to mean that I am able to use the tracker to verify that my vote was cast for a particular candidate.
- jakeogh 7y agoElectronic voting isn't a solution, it's an attack. https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI
- YokoZar 7y agoThis isn't an electronic voting system. > ElectionGuard provides a complete implementation of end-to-end verifiable elections. It is designed to work with systems that use paper ballots, supplementing today’s tabulation process by providing a means of public verification of the accuracy of reported results.
- jakeogh 7y agoDigital tabulation is electronic voting. Incrementalism is a powerful technique.
- codedokode 7y agoI don't understand how counting verification is achieved. Let's say that election officials release a list of hashed votes, so that you can verify that your vote has been counted and included into results. But how can you check that all other votes in the list are the votes from real people and not arbitrarily added by sysadmin to get the expected result? Does anyone know how such things are implemented? I have read about e-voting in Estonia, but there one has to trust the authorities and cannot independently verify the results.
- Mindless2112 7y agoWho voted is public record (depending on your state [1]), so the numbers should add up. [1] https://www.nytimes.com/2018/11/04/us/politics/apps-public-voting-record.html https://www.nytimes.com/2018/11/04/us/politics/apps-public-v...
- codedokode 7y agoWhat if it is not a public record? Also, even if it is a public record, how can you be sure that people in the voters list are real, they are eligible to vote in this region and not made up by authorities? Also, even if the list of people who voted is public, and if results were falsified, with electronic voting you cannot estimate the scale of falsification. Did they alter just a hundred of votes or hundred thousands.
- C1sc0cat 7y agoIs the electoral roll not publicly available information where you are.
- codedokode 7y agoAlso, there is another scenario. Let's say the rules allow to change the vote later. A voter votes for candidate X and gets a link that allows to verify that the vote is recorded. But several hours later the server software re-votes for candidate Y. If the voter bothers to check results after election, they will find that their vote was altered. But the voter has no proof that they didn't vote for candidate Y, and election officials have server logs that prove that the voter has voted two times. So probably the voter is just lying because they don't want to accept the fact that candidate Y is supported by 99% of population. And one more scenario: before closing the elections, officials can make a list of people who didn't vote and vote for them. If they didn't vote they probably don't care about elections and won't find out that someone voted for them.
- YokoZar 7y agoThe mechanism for voter verification is based on homomorphic encryption. Numberphile made a video on this topic recently, with a few basic explainers: https://www.youtube.com/watch?v=BYRTvoZ3Rho https://www.youtube.com/watch?v=BYRTvoZ3Rho
- rahuldottech 7y agoNumberphile is amazing. Definitely some of my favorite content.
- teddyh 7y agoVery related: Why Electronic Voting is a BAD Idea - Computerphile: https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI
- MrStonedOne 7y agono its not.
- ycombonator 7y agoSo we are supposed to trust all the digital pixie dust voting and no paper trail ?
- shard972 7y agoDo you still use and balance a cheque book?
- YokoZar 7y agoThis isn't an electronic voting system. > ElectionGuard provides a complete implementation of end-to-end verifiable elections. It is designed to work with systems that use paper ballots, supplementing today’s tabulation process by providing a means of public verification of the accuracy of reported results.
- jakeogh 7y agoDigital tabulation is electronic voting. The paper becomes the recount, which gets challenged in court and might not even happen.
- alexandercrohde 7y agoSo, it sounds like you're entirely in support of this article, the only tiny change you want to make is for the paper to be counted FIRST, and then the eletronic tabulation to be used as a validator. And any discrepancy results in an investigation, no?
- jakeogh 7y agoI'm opposed to any form of electronic counting. If the first hand count of paper ballots has a problem, then they can be re-counted. By humans.
- TheTrueTDF 7y agoIntroducing the new "a box and pieces of papers" system which is sustainable, secure and low tech. Microsoft shall I send you my resume ?
- freshm087 7y agoIt certainly has nothing to do with democracy, and intended to solve exactly one problem: Microsoft's need to increase revenue through sweet gov't funded contracts. Let's not be fooled by opensourced code, once the idea is sold to politicians, and media, someone should be contracted to implement this useless staff. And who's this going to be? Not hard to guess.
- YokoZar 7y agoWhile I appreciate the cynicism, I'm not seeing how an open schema for tamper-evident verifiable voting machines could be anything other than positive. It's worth noting that Microsoft has discouraged the use of embedded Windows on voting machines in the past: https://www.infoworld.com/article/2680658/gates-undaunted-by-linux.html https://www.infoworld.com/article/2680658/gates-undaunted-by... > “We ourselves are not going after the e-voting market or the nuclear reactor control market,” Gates said.
- freshm087 7y agoFor starters, the whole voting machines concept is a essentially a ploy to exploit wide-spread respect for computer technologies in society to sell hardware, and software. It reduces observability compared to pieces of paper, and doesn't solve any real problems. I don't think Gates words from 2004 can be seen as policy statement for today's Msft. Apparently, a lot has changed.
- YokoZar 7y ago> Microsoft will not charge for using ElectionGuard and will not profit from partnering with election technology suppliers that incorporate it into their products. I'm not sure how much stronger of a statement they can make than that. There's no money in voting machines for Microsoft.
- jankotek 7y agoMaybe they are solving multiple problems at the same time :-)
- 7y ago
- codedokode 7y agoI thought about some advantages of paper voting compared to electronic: you can spoil the ballot, for example, if you don't like any of candidates and there is no option titled "Against all". In electronic elections, you cannot do that.
- dao- 7y agoYou can just not vote. It has the same impact on the results of the election.
- TheTrueTDF 7y agoIt's a lot less fun though
- crispinb 7y agoNot legally here (Aus) - we have compulsory voting.
- NeedMoreTea 7y agoNot always - spoiled ballots can sometimes count, or indicate growing dissent in society. Not voting can achieve neither. Here's a case from last week of a spoiled ballot giving someone a majority of one: https://www.theguardian.com/politics/2019/may/03/ballot-paper-marked-brexit-win-tory-councillor https://www.theguardian.com/politics/2019/may/03/ballot-pape... Was that the result the voter intended? Probably not, but who knows? :)
- dao- 7y agoI don't understand your example. That ballot paper was counted as a Tory vote, i.e. not as spoiled.
- ddebernardy 7y agoAs I understood the story (the photo of the ballot that is sometimes circulated is just one taken from Twitter), the ballot had Brexit written all over it, and an arrow pointing at the Tory candidate's name, so ended up counting it as a Tory vote because of that.
- Tsubasachan 7y agoWith an American company? Really Microsoft?
- vinay427 7y agoIt's apparently free and open-source. What exactly is your concern?
- deleted 7y ago[deleted]
- atoav 7y agoI shall repeat it like a mantra: voting beeing slow inefficient is a side effect of it’s transparency. You want a voting system were a average voting helper can look at it and say: “There was nothing fishy there, I saw it”. This is because it is about trust and not only about secrecy and security. Your electronic voting system can be mathematically perfect, but if nobody average can say from the outside that everything is going by the rules and it makes sense, then it is worthless. This is why paper works so well: it takes not much skill to count it, it has to have a physical place (harder to make it vanish) and everybody can have their eyeballs glued to it, and if something fishy is going on, it is harder to hide from the average voting helper. Even I as a programmer with some crypto knowledge would never be able to fully gurantee for the integrity of a voting system, because who knows what software version is running out there in the wild, and whom I have to trust on that one. Paper has no software version and errors in the process can (and are) catched more easily. Electronic voting is good for decision were power is not involved, or where the outcome doesn’t really matter. I’d rather improve what we have instead of replacing it with a mathematical sound blackbox that everybody can with perfectly rational reasons distrust when the vote went into the wrong direction.
- sideshowb 7y agoEven a mathematically perfect voting system could be substituted in entirety. Replace the whole damn thing with your own one in an identical case running system.out.println("my favourite candidate wins! ");
- Strilanc 7y agoThe correctness of cryptographic voting systems is determined by their publicly observable behavior, not by their internal implementation. It's the protocol that's secure, not the specific hardware or software implementation. So the attack you're describing doesn't really apply.
- pauljurczak 7y ago"publicly observable behavior" is a bit of a misnomer - general public can indeed observe ElectionGuard in action, but it will not know what it sees. Fortunately, Microsoft advocates using paper ballots as a backup.
- devsec0 7y agothat's all good in theory, but italian 5 star movement showed how bad actually the reality can hit you
- lamchob 7y agoRelevant xkcd: https://xkcd.com/2030/ https://xkcd.com/2030/
- YokoZar 7y agoHow is this relevant? This isn't an electronic voting system. It's a system for verifiable receipts that attach to paper systems. > ElectionGuard provides a complete implementation of end-to-end verifiable elections. It is designed to work with systems that use paper ballots, supplementing today’s tabulation process by providing a means of public verification of the accuracy of reported results.
- jakeogh 7y agoDigital tabulation is electronic voting.
- johnisgood 7y agoLoosely related as it is about democracy: https://www.anthonyflood.com/rothbarddemocracy.htm https://www.anthonyflood.com/rothbarddemocracy.htm
- raister 7y agoThis is a nice effort, however, don't politicians actually want voting systems to be really messy? If so, they could shift the balance towards what they want at will. USA has one of the worst voting systems in the world, however, it keeps the balance of power, equilibrating elections, i.e., alternating Democrats and Republicans every eight years or so. If the voting system was spotless and verifiable and accountable, they couldn't mess with it!
- nkkollaw 7y agoI don't get what's wrong with paper voting. If it takes 3 days instead of 1h to get the votes, I think it's worth the wait since elections are pretty important and with paper you can do a recount, find physical paper that's been thrown in the trash (happens every time in Italy), etc. Also, these corporations seem to have a strong political bias, and how do we know they're not injecting their software with backdoors that would allow to manipulate results..?
- nmai10 7y agoIf you want to protect elections, USE PEN AND PAPER: https://www.bundesverfassungsgericht.de/SharedDocs/Pressemitteilungen/EN/2009/bvg09-019.html https://www.bundesverfassungsgericht.de/SharedDocs/Pressemit...
- zorked 7y agoI don't think it's desirable to let individual voters verify that their votes were counted. That means that the privacy of your vote can be compromised under duress a long time after the election. Paper and pen, such a beautiful straightforward system, sacrificed in the altar of unnecessary use of technology.
- stardek 7y agoI was surprised when I read that as well but reading further my impression was that you can confirm the contents of the ballot only while voting and then afterwards you only get access to a message along the lines of "Yes, vote a678b234 was correctly counted" or a message saying otherwise but not the contents of the ballot. (which, while more secure, is also slightly less useful)
- bumby 7y agoCan someone smarter than me explain if this system maintains anonymity? To a layperson, statements like the one below raise a flag. If I can track it electronically, is it also possible for someone else to see who voted for whom? "After the election is complete, the tracker codes can be used by voters to confirm that their votes were not altered or tampered with and that they were properly counted" Again, to a layperson the above statement seems potentially at odds with the one below at first blush (because I don't understand the technology): "With homomorphic encryption, individually encrypted votes can be combined to form an encrypted tabulation of all votes which can then be decrypted to produce an election tally that protects voter privacy." So we have privacy but electronic traceability to the individual voter? To the uninitiated like myself, it seems like we'd have to choose between electronic traceability and anonymity.
- useerup 7y agoThe system does not ensure anonymity as to who has voted, but it does maintain secrecy as to how you voted. The idea is that you can have a public, verifiable "ledger" of voters. You can verify that you are on the list with your encrypted vote. I.e. you verify that your vote counts. You can match it to the receipt you received when voting. You do not, however possess the key to decrypt your vote or the vote of anyone else. The public list can also be used (more work) to verify that only real people voted: They could presumably be contacted. Homomorphic encryption allows the votes to be tallied while still encrypted. The result is an encrypted tally. At this point someone with the decryption key can decrypt the final tally and reveal the result. Presumably this can happen per polling place.
- bumby 7y agoThank you for taking the time to clarify. So if I understand this correctly, the system can allow an individual to verify that their vote was counted but not validate that the vote was counted correctly? From that perspective, it seems analogous to the system in use but perhaps more efficient. In other words, does this actually introduce any new features or just translate the existing features of the current system to a new medium?
- shirajec 7y agohttps://screenshot-magazine.com/politics/pete-buttigiegs-technology-driven-policies-are-here-to-revive-america/ https://screenshot-magazine.com/politics/pete-buttigiegs-tec...
- couchand 7y agoFor the most part, this seems like a pretty reasonable application of homomorphic cryptography to act as an extra voting record. Like others here I think it would need to be secondary to the paper voting record, and I worry that would be hard to enforce forever. But one line stands out as particularly troubling: Our sample reference will showcase how people can make their selections at home, where they can easily research their choices, then bring a QR code to the polling place to scan and pre-populate their ballot. On the one hand, I support the goal of making it easier for people to research and select their choices. But the risk of enabling a "scan-to-vote" operation is pretty clear: voters will be given their QR codes pre-populated by some interested third party.
- abathur 7y agoThis is a good point. I don't mean this as a what-about, but it's worth noting: any ballots that list the party of the candidates or offer single-action straight-party votes are effectively a subtle form of a ballot pre-populated by an interested party.
- asdfman123 7y agoI have at times followed an election guide verbatim. It's far more rational than voting straight ticket. If it means it's easier to vote for those overwhelmed by all the various choices out there, then that's a win. If it means you can get your average millennial or Generation-Z friend to vote, someone who cares about social issues but can't be bothered to learn about local judges -- then that's a good thing. It could mean more accurate representation. It's better than letting the richest and most idle determine everything.
- rando444 7y agoYes, but there is no proof that the user actually used that QR to make their vote. This diminishes the incentive to buy votes because there is no verifiable proof of how someone voted. I'm not saying it's a perfect solution, but it's more secure than mail-in ballots, which are currently in use and popular in many locations.
- 7y ago
- abathur 7y agoI've been accumulating a mental list of properties that would support less-exploitable, more-auditable paper balloting. This has a surprising number of the properties. The main items I don't see represented are all roughly related to auditability for ballot chain of custody. I think issues/irregularities with the ballot chain of custody are probably good proxies for triaging hand-audit efforts. The goal is knowing when ballots go missing, or turn up in unexpected places (but I'm not sure where the sweet spot is for securing that chain without making individual votes unmaskable). I think it's a similar process, with lots of identifiers, and lots of scanning. It would live or die by rapid, simple, reliable scanning. This means scanning identified ballots into shipping boxes, and generating an identifier for the box based on which ballots were scanned in. A pallet gets an identifier based on the boxes that went in. Shipments get identifiers based on whatever combination of boxes/pallets they contain. Scan in boxes at the polling station and accumulate identifiers for the polling place. Perhaps per poll worker. Scan ballots out of the boxes, back into the completed-ballot boxes and/or trash. Cumulative identifiers for completed-ballot boxes, trashed ballots, and unused ballots are scanned back out of the poling place and at each step back up the chain again.
- laughinghan 7y agoI think the whole point of this fancy homomorphic encryption-based system is that only the endpoints need to be verifiable, you no longer have to worry about chain of custody anymore. Kinda like how end-to-end encryption means you no longer have to trust every link in the network that connects you to the other party. As long as you can verify that the final tally is correctly calculated from all the public encrypted votes, that those encrypted votes include yours, and none are by fake voters, who cares how the encrypted votes are transmitted to the body that officially calculates the final tally?
- abathur 7y agoMaybe? I won't assert it doesn't, since I don't know. It certainly seems to be a tolerable solution to the questions of whether votes were changed, or whether ballots were disappeared without counting. But I don't see how the ability of individuals to verify that their own vote was counted can sum, at scale, to verifying that real-but-fraudulent ballots aren't also in the total. It seems like you could verify this if everyone who voted proved that their vote was included in the count and the full count was explained by everyone who proved they voted. In practice, that seems unlikely?
- tamaharbor 7y agoThe bigger problem is WHO is allowed to vote, not HOW they do it.