14 ms·

Darpa wants help cracking the election security problem

96 points by ga-vu 7y ago

hedora 7y ago
Ballot security is a solved problem (but, sadly, I think DARPA knows this, which makes me wonder what’s really motivating this work): Use paper ballots. Scan them at the polling place for fast electronic tally. Audit a significantly significant random sample of the paper ballots after the election, and do a full recount if any discrepancy is found. Prosecute people that violate chain of custody for the ballot boxes. (Give this power to a non-partisan authority.) There are open problems around tampering with voter rolls; this is done both by state governments and foreign powers. We still need a scheme to make this more detectable (and to invalidate the election when it happens).
- thepangolino 7y ago
  As a European, it boggles my mind how there isn’t any for of proper verification on voters identity in many US states.
  - azinman2 7y ago
    This is a feature not a bug. Fraud is rare, but barriers to minorities and the poor having say are a real concern.
    - TylerE 7y ago
      I don’t really buy this. This is more an artifact of the US (insanely) not having any form of national ID.
      - hdfbdtbcdg 7y ago
        Plenty of countries have no national photo ID. UK, Norway and Denmark to name three in EU.
      - acollins1331 7y ago
        What's so great about a national ID except more government control?
      - azinman2 7y ago
        It’s not for you to buy. This is a well studied, well analyzed area because the GOP wants voter ID laws to reduce minorities and the poor at the polls. https://fivethirtyeight.com/features/what-we-know-about-voter-id-laws/ https://fivethirtyeight.com/features/what-we-know-about-vote...
        TylerE 7y ago
        Oh I know that. To be clear what I don’t buy is voter ID having a suppressive effect iff we had an actual national ID
    - colordrops 7y ago
      Why don't minorities and poor have IDs?
      - esyir 7y ago
        Cause there's sizable opposition to government issued IDs. IMO, it's bloody retarded that this feature is still non-present in the US, resulting in all the pseudo ids like driver's licenses and SSNs.
      - azinman2 7y ago
        Not everyone has a car, and if you don’t have a car, then you probably don’t have a passport, and if you don’t have a car or passport, then you likely don’t have a valid photo ID. https://fivethirtyeight.com/features/what-we-know-about-voter-id-laws/ https://fivethirtyeight.com/features/what-we-know-about-vote...
  - toomanybeersies 7y ago
    That's normal in New Zealand as well. I can vote with no form of ID. Requiring voter ID disenfranchises marginalised and poor voters, who may not be able to obtain ID easily. I know several people who have no form of government issued ID. It's different in countries like Germany and France, where compulsory national ID is a thing. Rates of fraud and abuse are low enough that this isn't an issue. Technically I could go and vote in somebody else's name, and hope they also didn't vote, and I most likely wouldn't get caught. But if they did vote as well, then the double-vote would be noticed (people have have been caught casting multiple votes in the past) and would be investigated.
    - thatoneuser 7y ago
      "Rates of fraud and abuse are low enough that this isn't an issue." How could one possibly defend this claim? If fraud and abuse were successfully committed, no one would be any the wiser. In the last two decades in the US, both parties have claimed to be the victims of voter fraud. Both have semi-legitimate claims. You cannot tell me an insecure network is intrinsically secure. That's a lie.
    - zfgnu 7y ago
      Marginalised and poor voters exist in Europe and they have an ID card like anybody else. Having yours done could be free, if you're so inclined.
      - danpalmer 7y ago
        Just because ID is free does not make it universally accessible. If the office that hands out ID cards is only open 9-5 Mon-Fri, for example, a voter who must work during this time and can't afford to miss work may not be able to get ID.
      - pjc50 7y ago
        The problem is that the system would be run by racist state governments who would construct the system in the worst possible way. (Not a conjecture, this was actually evidence in one of the various voter ID lawsuits; the state government had constructed a table with impact assessments of various approaches, then picked the one with the worst impact)
  - newaccoutnas 7y ago
    We don't need ID in the UK, just turn up.
    - danpalmer 7y ago
      While this is true, it's a little disingenuous with regards to safe elections. In the UK you must pre-register for a single voting location, and then when you turn up to vote they cross your name off so you can't come in again.
      - deleted 7y ago
        [deleted]
      - deleted 7y ago
        [deleted]
      - newaccoutnas 7y ago
        Sure but getting on the electoral register (to my knowledge) requires no ID either. I think this is a big part as to why postal voting fraud happens.
        danpalmer 7y ago
        It doesn't require ID but is verified against other records and against the electoral register in other regions, i.e. you can't register in two different places. When housemates have moved out I have received letters asking me to re-confirm who is living in the house for the electoral register. > I think this is a big part as to why postal voting fraud happens. It might happen, but it is exceptionally rare. The impact of introducing voter ID laws would cause a far larger decrease in election validity due to voter suppression than postal voting fraud causes.
- mc32 7y ago
  Occasionally we hear about “found” ballot boxes especially around recount time. How do they get lost. Or what does it mean when they say they lost them (and found them). I’d imagine it’s more prevalent than we hear as it seems rather odd if they only disappeared and reappeared in contested elections.
  - wil421 7y ago
    Each voting machine could tally the number of votes but not the vote itself. The count is encrypted and only the governor has the key.
  - throwawayjava 7y ago
    Imagine a very large mostly volunteer-run event that only runs once a year or so and where some fraction of the volunteers are running the event for the first time. At the end of the day all the important equipment gets packed up, shipped somewhere, and unpacked. But sometimes -- rarely, but sometimes -- some really important piece of equipment gets left behind at the event site or unpacked incorrectly at its new location. I just described marathons, carnivals, and... voting.
    - mschuster91 7y ago
      In Germany, we also have paper based voting and yet, we do not have the issue that ballot boxes disappear. Everything and I mean literally everything is accounted for and if the numbers do not match up (e.g. less boxes of ballot boxes than before, or n(valid votes)+n(invalid votes)!=n(total votes) there is an immediate recount. No one leaves until shit is done, and if it gets too late everything is packed up, sealed and boxes counted. The horror stories of the US are a failure of their system, not of paper voting.
  - jakeogh 7y ago
    Exactly. If chain of custody is broken, it's not in the pile. People from all sides of the electorate should be able to observe every box at all times if they wish to follow it. Mail in voting is similarly exceptionally easy to game. Oops, lost 1% of that zip code... bummer...
- JoeOfTexas 7y ago
  Blockchain all the votes with layered encryption... Top Level) General population can only verify their own votes Mid Level) Counties can tally their county only Low Level) States can tally up their states only Ground Level) Federal government can tally up all votes. The blockchain ledger will allow everyone to see votes without knowing individuals. To get name and location and other data, you need to be at a lower level.
  - Jarwain 7y ago
    Individuals can see their own vote, and who they voted for, right? If that's the case, it would be evidence that an individual voted for a specific candidate. This is, essentially, proof for anyone who'd want to purchase votes. If they can't see who they voted for, they'd need some alternative way to verify that their vote counted for the candidate they wanted to vote for, without actually disclosing who that candidate is. Which would add some complexity to the solution.
    - dpiers 7y ago
      If the chain were public, individuals could look up their vote by the hash but would have no way of proving the hash was their vote.
      - rjf72 7y ago
        You could also add a second layer of security here pretty easily. People would probably need to be given a printout with their hash on it. To avoid this receipt being proof, that receipt would include a large number of hashes with various voting combinations also shown. The voter knows which hash is his, but nobody else does. And he's free to claim whichever one he likes for himself. To solve the issue of first voters (when there would be no other valid hashes for their printout) simply seed all candidates with a billion votes to start. Which hash is real and which is 'fake' is irrelevant since all that matters is the sum total of which we know 1 billion are to be removed.
      - miskin 7y ago
        How would that work? If they would get any hash that is not bound to them in any verifiable way, how does that prove to THEM that they are verifying their own vote?
- EGreg 7y ago
  Stop it. Obviously DARPA is looking for security AND electronic voting. Why bring up paper? Hey a word processor is secure if it’s paper based!
  - antoinevg 7y ago
    The reason to bring up paper is that the cost of election fraud is much higher than any "efficiency" gains to be had by digitising the process. This is (often) not true for word processors.
    - darawk 7y ago
      You don't digitize elections for efficiency. You do it for security. The idea that paper ballots are a secure form of voting is ridiculous. The only reason people think that they're secure is that they're so profoundly insecure that we have no way of auditing them effectively and so never uncover anything that may be happening to them. Not to mention the fact that access and efficiency are in fact forms of election manipulation. The inefficiency of the process keeps people from voting who otherwise would. That has political consequences and is absolutely used as a means to cause outcomes that otherwise wouldn't happen.
      - duffmancd 7y ago
        Affecting a(n electorally) significant number of paper votes requires the compromise of more people and leaves more evidence than for electronic votes. (In general, for the quality of voting generally seen in first world countries) Can you do better in theory, yes. Have we seen any evidence that various US election bodies can do better through using electronic voting, no. The exact opposite in fact. It's similar to passwords: writing down all your passwords in a notebook and keeping it in your desk draw is a bad idea. But it's usually significantly harder to break into millions of desk draws than to break any given site's security.
        darawk 7y ago
        > Affecting a(n electorally) significant number of paper votes requires the compromise of more people and leaves more evidence than for electronic votes. (In general, for the quality of voting generally seen in first world countries) If we didn't have an electoral college, that might be true. But the reality is that you don't need to compromise that many people in that many places to have a decent probability of tipping a close election one way or the other. > Can you do better in theory, yes. Have we seen any evidence that various US election bodies can do better through using electronic voting, no. The exact opposite in fact. Which is exactly why DARPA is researching the problem.
- gonzo41 7y ago
  You're really close. Don't audit a sample. Audit all of the votes.
- acollins1331 7y ago
  Sounds good, just get rid of the ballot box problems by scanning the paper ballot right after it's cast. Voting would go like this: wait in line, confirm your address, vote on paper, watch the person upload your vote, take your printed receipt confirmed the upload was received, leave. Security problem solved.
  - ufo 7y ago
    Uploading vote counts after each individual vote removes the secrecy of the vote.
lidHanteyk 7y ago
Use the post office. Use paper ballots in the mail. Many security issues vanish if polling places are no longer rich targets. In my state of residence, my ballot is sent in the mail, and I get SMS notifications when it is sent to me and when it is counted.
- airstrike 7y ago
  You never know if it's counted correctly, though, so it sounds like the auditing challenge remains
  - hedora 7y ago
    They could ensure correct delivery (but not necessarily counting) by MMSing a picture of the ballot, but then you can sell your vote.
  - debatem1 7y ago
    We have a system where you can go and see a webpage say your vote was counted after you mail in your ballot. What you can't do is tell if that webpage is accurate. This still feels like a tractable problem in the domain of pure crypto if you divide it into a commitment scheme and a tabulation step.
- conductr 7y ago
  I like the idea of snail mailing a PIN number for an online system. But I’m a layman on the security issues that complicate what seems easy, is it the MITM risk of anything over a wire?
  - ISL 7y ago
    Or compromising the central server. Some things are worth extra effort to do in a ponderous, slow, and fault-tolerant way.
- ufo 7y ago
  Voting by mail introduces many extra problems. 1) Now the post office is a rich target 2) The voter doesn't see with their own eyes that their ballot has been deposited. They have to trust the SMS message. 3) It is more vulnerable to vote coercion. Family members, employers or organized crime might force you to show them your ballot before its submitted.
daenz 7y ago
Both are important, but WRT elections, faith in security is as important as actual physical security. I don't see how a black box of tech can convince a layperson that voting is secure. We need more in the way of audit trails and accountability.
- m-p-3 7y ago
  The toughest part is ensuring anonymity and privacy while ensuring someone can only vote once, ensure the vote is legitimate, and accounted for. The only way I can see that is using a PKI-based ID to validate the ID of someone, but then how do you ensure that person can vote anonymously and only once?
sambroner 7y ago
I had thought that this was a great opportunity for blockchain, if identity could be solved reliably. That being said, identity is already being solved through IDs, voting stations, home-delivered ballots, etc. The audit-ability and reproduce-ability would be great features, while cost and latency wouldn't be huge problems for voting. There were even a few start ups in the space (e.g. Votem), but none seem to have made the jump to doing real elections. Votem did a few smaller voting experiments like a vote for the Rock & Roll hall of fame, but never made its way to state elections. I hope that DARPA can not only inspire innovation, but also help startups break into the difficult game of government contracting.
- sly010 7y ago
  > I had thought that this was a great opportunity for blockchain, if identity could be solved reliably. If identity could be solved reliably, you wouldn't need a blockchain.
  - ypcx 7y ago
    You would, because without blockchain, you can still lie about what was done by (or with) that identity, and when.
- ypcx 7y ago
  I wonder if biometry (e.g. a fingerprint) could be reliably used as the private key (and thus the identity on the blockchain). That is, without a 3rd party / external system. For trust, the network (as any blockchain network) would have to be properly decentralized, and (good or at least benevolent) people would have to be incentivized to run the network. I.e. there would be a monetary value (a coin, or a token), which would have its own pros and cons as seen by various parties. (Mentioning fingerprints, I cannot but reference the movie Southland Tales, which in my view was the most prophetic movie ever made.)
- hedora 7y ago
  There used to be a problem with vote buying / coercion. If you can prove you voted one way or another, you can sell your vote, or your employer can fire you for voting the wrong way (for example).
ModernMech 7y ago
Step 1) Make sure the guy in charge of bringing election security bills to vote on the Senate floor can't accept campaign donations from voting machine companies [1]. Step 2) Bring election security bills to vote on Senate floor. [1] https://www.newsweek.com/mitch-mcconnell-robert-mueller-election-security-russia-1451361 https://www.newsweek.com/mitch-mcconnell-robert-mueller-elec...
- hedora 7y ago
  I didn’t realize Moscow Mitch was also bought off by the voting machine companies. Makes sense.
m463 7y ago
I think paper ballots should be collected at each polling location. I also think paper ballot totals from each polling location should be published publicly in a variety of forms, so that the totals can be added independently.
- tamrix 7y ago
  Paper ballots get counted publicly. Anyone that would like to witness it can attend for any amount of time and call out miss counts. Totals are read out on live TV.
  - Supermancho 7y ago
    Multiple counts that are corroborated is a common validation, iirc. That would be tedious, to listen to or correlate. 24-13 .... 25-13 25-13 .... 25-14 26-13 .... 26-14
ElijahLynn 7y ago
* Open Voting Specification (includes paper trail) * Ranked Choice Voting (or better) * Individual Vote Verification API
bumblebritches5 7y ago
DON'T RELY ON FUCKING SOFTWARE.
shanxS 7y ago
Has it been proved that elections have been tampered with in past?
- rectang 7y ago
  Yes — for instance last year in North Carolina's 9th congressional district. https://en.wikipedia.org/wiki/2018_North_Carolina%27s_9th_congressional_district_election https://en.wikipedia.org/wiki/2018_North_Carolina%27s_9th_co... > On February 21, the board unanimously voted to call a new election because of fraud by Republican operatives.
rectang 7y ago
The article goes awry from the first sentence: > If election security is an engineering problem, It's not an engineering problem, it's a political problem. To the extent that it's engineering, it's solved if we would only adopt the known good approaches. But we won't because there is political utility in having elections remain murky and messy for parties who may benefit from manipulation of the vote through disenfranchisement or other shenanigans.
hardwaresofton 7y ago
IMO it shouldn't be all or nothing, here's a system I think would be the best of both worlds: - Allow people to express voting intent & go through the candidates on the ticket with a website/app (as strong as it can be), which spits out some random ID/QR code - Widen voting time period to months - Support mail-in-ballots in more states - Add a mandatory # of holidays per year (with proof of vote, notification of which local/national election the person is voting in) - Require people to confirm their vote in person, with the option to vote with the QR their phone generated (and a confirmation screen afterwards for them to review), with every vote required to take a certain amount of time in the booth (to prevent timing people to figure out if they used their cell phone or not). This setup allows for a few things: - Early consideration of candidates and their positions and the ability to save how you were going to vote once you're in the booth - More signals of voting intent that could be used to detect fraud (in addition to random sampling) This scheme probably needs more thought to prevent election tampering, but I think adding a digital element as additive would be a benefit. If the digital element detects voting intent that sharply diverges from voter rolls, then a recount in whatever county is triggered.
yardstick 7y ago
Given postal votes are a thing, and have been for many years (at least for UK/AU/NZ), is there still such stringent requirements on making it difficult/impossible to buy/coerce votes? Since both can be done using postal votes already. Does this then open up more digital options? Eg app based voting where your vote is published along with everyone elses but in anonymised form, so everyone can independently verify the totals. By anonymised I mean the app displays a random “vote reference ID” that you could check in the final published ledger to see your vote was included, and was recorded correctly.
phs318u 7y ago
An excellent essay on Voting Security by Bruce Schneier, showing how hard this problem is: https://www.schneier.com/essays/archives/2004/07/voting_security.html https://www.schneier.com/essays/archives/2004/07/voting_secu... And more on the same topic: https://www.schneier.com/essays/elections/ https://www.schneier.com/essays/elections/
dwobry 7y ago
I know Ron Rivest has a lot of interest and work invested into securing voting system. I can't point you to a direct paper, but if you Google it I'm sure you'll find more then enough.
karterk 7y ago
India has been conducting elections via electronic voting machines for a while now: https://en.wikipedia.org/wiki/Electronic_voting_in_India https://en.wikipedia.org/wiki/Electronic_voting_in_India In India's case, the paper ballots actually caused a lot of rigging as booth capturing was ramptant. EVMs greatly helped tackle that. A small sample of the votes are also verified using voter-verified paper audit trail (VVPAT).
- iyw 7y ago
  And there are rampant reports of election fraud. so your point?
toomanybeersies 7y ago
Disenfranchisement (e.g. requiring voter ID) and gerrymandering are far more significant issues for the democratic process in the USA than ballot security, which is a relatively solved problem.
- lucifirius 7y ago
  Most countries require a form of voter ID.
  - NikkiA 7y ago
    Most countries automatically and freely issue said ID, the voter ID attempts in the US disenfranchise poor people and people who, for whatever reason, cannot attain the ID required.
    - code_chimp 7y ago
      Source? In the US I need a valid ID to cash a check, pick up a benefit check, apply for government benefits, buy cold medication, board an airplane, open a bank account, etc. This is a short list off of the top of my head. Are all of these activities disenfranchising me?
      - rexpop 7y ago
        Yes, when ID is hard to get. https://www.theatlantic.com/politics/archive/2012/03/how-voter-id-laws-are-being-used-to-disenfranchise-minorities-and-the-poor/254572/ https://www.theatlantic.com/politics/archive/2012/03/how-vot...
      - Faark 7y ago
        IDs are not a problem in principle. But there is barely any voter fraud at all (see Trumps commission), thus no real reason to enact law. Why do politicians non the less spend their political capital doing so? Often their new rules just so happen to help the people voting for them and hinder their opponents. North Carolina [0] was one of the more egregious cases. [0] https://www.nytimes.com/2017/05/15/us/politics/voter-id-laws-supreme-court-north-carolina.html https://www.nytimes.com/2017/05/15/us/politics/voter-id-laws...
josh_fyi 7y ago
Israel has an old-school paper-based procedure, with cross-party observers present at every step. This wastes a lot of paper, but is very hard to hack. https://www.timesofisrael.com/can-israels-election-count-be-tampered-with-an-official-explains-the-process/ https://www.timesofisrael.com/can-israels-election-count-be-...
Quequau 7y ago
Back when we were all agonising over "Hanging Chads" in Bush v. Gore, Bruce Schneier published a series of collaborative works featuring the back & forth design of secure paper ballots + digital voting. So that was what? 2000? Surely the problem then isn't technical, it's cultural and political.
Dowwie 7y ago
Those who are involved in the American election industry, from government to vendors or consultants, have committed to a platform based on verified C. The industry continues to refuse to adopt a memory safe language such as Rust. Granted, the investment in a new toolset is costly. However, the benefits are very compelling. In the meanwhile, industry will crutch its toolset decisions with white hat hacking events, bug bounties, millions of dollars in contracts supporting audits and testing, etc. Path dependence is costly. In the case of elections, more than money is at stake. Industry must move beyond verified C to Rust.
peg_leg 7y ago
Paper ballots?
Beltiras 7y ago
The most successful attacks on democracy are gerrymandering (US especially) and misinformation (global problem, see Brexit thou specifically). Don't get me wrong, this sort of security is necessary but there's nothing wrong with tossing out the machines and using real paper ballots with a pencil (thus sidestepping the problem). You can even machine-read those for a machine count (which can be verified since the paper ballots are still around to rescan with different hardware/software for validation). How do you engineer around the misinformation vector thou? That's the hard problem.
- jethro_tell 7y ago
  Not only are paper ballots simple and effective, they can be mailed out 2 weeks ahead of time and people can vote with a laptop, at their leisure. Also, you don't have to store them for three months at a time with proof of custody, you can just scan them, or dump them once the election has been certified. Voting machines sound great but that it's solving a problem by doing things the same with tech.
  - habnds 7y ago
    I think the laptops would defeat the purpose of the paper ballots?
    - abathur 7y ago
      I think GP just means with a laptop available (i.e., the ability to research a bond initiative they weren't already aware of).
      - habnds 7y ago
        yeah nice
  - jfengel 7y ago
    Voting by mail has an even more massive security hole, in that ballots can be stolen, or people coerced (or paid). To my knowledge that hasn't happened yet, either in Oregon or in absentee voting, but with the level of discourse being what it is, I suspect it could easily become a problem.
deleted 7y ago
[deleted]
g00s3_caLL_x2 7y ago
There are still too many cracks in the process with the human element. We've seen pollsters that have hoarded and thrown away ballots. Persuasion and intimidation outside the polling buildings. Now we have hoards of people that are not even American citizens that are be used a pawns for a vote. GREED. GREED is the problem.
thepaperone 7y ago
DARPA, fund me. 1. go vote 2. check to see who hasn't left their house today via open source GPS indicators 3. vote as them too because its illegal for those at a voting station to ask to verify your identification 4. ??? 5. undetectable voter fraud
- bb611 7y ago
  There's a high chance you'll go try to vote as someone who simply didn't register. In California you could then register as that person and vote provisionally, but polling officials will check your identification. Alternatively you may attempt to impersonate someone using vote by mail. In that case, there won't be a ballot to vote at the polling station, and even if you are able to successfully register provisionally or convince polling workers to give you a blank to fill out, election officials are already looking for these kinds of duplicates.

96 points by ga-vu 7y ago

Ballot security is a solved problem (but, sadly, I think DARPA knows this, which makes me wonder what’s really motivating this work): Use paper ballots. Scan them at the polling place for fast electronic tally. Audit a significantly significant random sample of the paper ballots after the election, and do a full recount if any discrepancy is found. Prosecute people that violate chain of custody for the ballot boxes. (Give this power to a non-partisan authority.) There are open problems around tampering with voter rolls; this is done both by state governments and foreign powers. We still need a scheme to make this more detectable (and to invalidate the election when it happens).

thepangolino 7y ago
As a European, it boggles my mind how there isn’t any for of proper verification on voters identity in many US states.
- azinman2 7y ago
  This is a feature not a bug. Fraud is rare, but barriers to minorities and the poor having say are a real concern.
  - TylerE 7y ago
    I don’t really buy this. This is more an artifact of the US (insanely) not having any form of national ID.
    - hdfbdtbcdg 7y ago
      Plenty of countries have no national photo ID. UK, Norway and Denmark to name three in EU.
    - acollins1331 7y ago
      What's so great about a national ID except more government control?
    - azinman2 7y ago
      It’s not for you to buy. This is a well studied, well analyzed area because the GOP wants voter ID laws to reduce minorities and the poor at the polls. https://fivethirtyeight.com/features/what-we-know-about-voter-id-laws/ https://fivethirtyeight.com/features/what-we-know-about-vote...
      - TylerE 7y ago
        Oh I know that. To be clear what I don’t buy is voter ID having a suppressive effect iff we had an actual national ID
  - colordrops 7y ago
    Why don't minorities and poor have IDs?
    - esyir 7y ago
      Cause there's sizable opposition to government issued IDs. IMO, it's bloody retarded that this feature is still non-present in the US, resulting in all the pseudo ids like driver's licenses and SSNs.
    - azinman2 7y ago
      Not everyone has a car, and if you don’t have a car, then you probably don’t have a passport, and if you don’t have a car or passport, then you likely don’t have a valid photo ID. https://fivethirtyeight.com/features/what-we-know-about-voter-id-laws/ https://fivethirtyeight.com/features/what-we-know-about-vote...
- toomanybeersies 7y ago
  That's normal in New Zealand as well. I can vote with no form of ID. Requiring voter ID disenfranchises marginalised and poor voters, who may not be able to obtain ID easily. I know several people who have no form of government issued ID. It's different in countries like Germany and France, where compulsory national ID is a thing. Rates of fraud and abuse are low enough that this isn't an issue. Technically I could go and vote in somebody else's name, and hope they also didn't vote, and I most likely wouldn't get caught. But if they did vote as well, then the double-vote would be noticed (people have have been caught casting multiple votes in the past) and would be investigated.
  - thatoneuser 7y ago
    "Rates of fraud and abuse are low enough that this isn't an issue." How could one possibly defend this claim? If fraud and abuse were successfully committed, no one would be any the wiser. In the last two decades in the US, both parties have claimed to be the victims of voter fraud. Both have semi-legitimate claims. You cannot tell me an insecure network is intrinsically secure. That's a lie.
  - zfgnu 7y ago
    Marginalised and poor voters exist in Europe and they have an ID card like anybody else. Having yours done could be free, if you're so inclined.
    - danpalmer 7y ago
      Just because ID is free does not make it universally accessible. If the office that hands out ID cards is only open 9-5 Mon-Fri, for example, a voter who must work during this time and can't afford to miss work may not be able to get ID.
    - pjc50 7y ago
      The problem is that the system would be run by racist state governments who would construct the system in the worst possible way. (Not a conjecture, this was actually evidence in one of the various voter ID lawsuits; the state government had constructed a table with impact assessments of various approaches, then picked the one with the worst impact)
- newaccoutnas 7y ago
  We don't need ID in the UK, just turn up.
  - danpalmer 7y ago
    While this is true, it's a little disingenuous with regards to safe elections. In the UK you must pre-register for a single voting location, and then when you turn up to vote they cross your name off so you can't come in again.
    - deleted 7y ago
      [deleted]
    - deleted 7y ago
      [deleted]
    - newaccoutnas 7y ago
      Sure but getting on the electoral register (to my knowledge) requires no ID either. I think this is a big part as to why postal voting fraud happens.
      - danpalmer 7y ago
        It doesn't require ID but is verified against other records and against the electoral register in other regions, i.e. you can't register in two different places. When housemates have moved out I have received letters asking me to re-confirm who is living in the house for the electoral register. > I think this is a big part as to why postal voting fraud happens. It might happen, but it is exceptionally rare. The impact of introducing voter ID laws would cause a far larger decrease in election validity due to voter suppression than postal voting fraud causes.
mc32 7y ago
Occasionally we hear about “found” ballot boxes especially around recount time. How do they get lost. Or what does it mean when they say they lost them (and found them). I’d imagine it’s more prevalent than we hear as it seems rather odd if they only disappeared and reappeared in contested elections.
- wil421 7y ago
  Each voting machine could tally the number of votes but not the vote itself. The count is encrypted and only the governor has the key.
- throwawayjava 7y ago
  Imagine a very large mostly volunteer-run event that only runs once a year or so and where some fraction of the volunteers are running the event for the first time. At the end of the day all the important equipment gets packed up, shipped somewhere, and unpacked. But sometimes -- rarely, but sometimes -- some really important piece of equipment gets left behind at the event site or unpacked incorrectly at its new location. I just described marathons, carnivals, and... voting.
  - mschuster91 7y ago
    In Germany, we also have paper based voting and yet, we do not have the issue that ballot boxes disappear. Everything and I mean literally everything is accounted for and if the numbers do not match up (e.g. less boxes of ballot boxes than before, or n(valid votes)+n(invalid votes)!=n(total votes) there is an immediate recount. No one leaves until shit is done, and if it gets too late everything is packed up, sealed and boxes counted. The horror stories of the US are a failure of their system, not of paper voting.
- jakeogh 7y ago
  Exactly. If chain of custody is broken, it's not in the pile. People from all sides of the electorate should be able to observe every box at all times if they wish to follow it. Mail in voting is similarly exceptionally easy to game. Oops, lost 1% of that zip code... bummer...
JoeOfTexas 7y ago
Blockchain all the votes with layered encryption... Top Level) General population can only verify their own votes Mid Level) Counties can tally their county only Low Level) States can tally up their states only Ground Level) Federal government can tally up all votes. The blockchain ledger will allow everyone to see votes without knowing individuals. To get name and location and other data, you need to be at a lower level.
- Jarwain 7y ago
  Individuals can see their own vote, and who they voted for, right? If that's the case, it would be evidence that an individual voted for a specific candidate. This is, essentially, proof for anyone who'd want to purchase votes. If they can't see who they voted for, they'd need some alternative way to verify that their vote counted for the candidate they wanted to vote for, without actually disclosing who that candidate is. Which would add some complexity to the solution.
  - dpiers 7y ago
    If the chain were public, individuals could look up their vote by the hash but would have no way of proving the hash was their vote.
    - rjf72 7y ago
      You could also add a second layer of security here pretty easily. People would probably need to be given a printout with their hash on it. To avoid this receipt being proof, that receipt would include a large number of hashes with various voting combinations also shown. The voter knows which hash is his, but nobody else does. And he's free to claim whichever one he likes for himself. To solve the issue of first voters (when there would be no other valid hashes for their printout) simply seed all candidates with a billion votes to start. Which hash is real and which is 'fake' is irrelevant since all that matters is the sum total of which we know 1 billion are to be removed.
    - miskin 7y ago
      How would that work? If they would get any hash that is not bound to them in any verifiable way, how does that prove to THEM that they are verifying their own vote?
EGreg 7y ago
Stop it. Obviously DARPA is looking for security AND electronic voting. Why bring up paper? Hey a word processor is secure if it’s paper based!
- antoinevg 7y ago
  The reason to bring up paper is that the cost of election fraud is much higher than any "efficiency" gains to be had by digitising the process. This is (often) not true for word processors.
  - darawk 7y ago
    You don't digitize elections for efficiency. You do it for security. The idea that paper ballots are a secure form of voting is ridiculous. The only reason people think that they're secure is that they're so profoundly insecure that we have no way of auditing them effectively and so never uncover anything that may be happening to them. Not to mention the fact that access and efficiency are in fact forms of election manipulation. The inefficiency of the process keeps people from voting who otherwise would. That has political consequences and is absolutely used as a means to cause outcomes that otherwise wouldn't happen.
    - duffmancd 7y ago
      Affecting a(n electorally) significant number of paper votes requires the compromise of more people and leaves more evidence than for electronic votes. (In general, for the quality of voting generally seen in first world countries) Can you do better in theory, yes. Have we seen any evidence that various US election bodies can do better through using electronic voting, no. The exact opposite in fact. It's similar to passwords: writing down all your passwords in a notebook and keeping it in your desk draw is a bad idea. But it's usually significantly harder to break into millions of desk draws than to break any given site's security.
      - darawk 7y ago
        > Affecting a(n electorally) significant number of paper votes requires the compromise of more people and leaves more evidence than for electronic votes. (In general, for the quality of voting generally seen in first world countries) If we didn't have an electoral college, that might be true. But the reality is that you don't need to compromise that many people in that many places to have a decent probability of tipping a close election one way or the other. > Can you do better in theory, yes. Have we seen any evidence that various US election bodies can do better through using electronic voting, no. The exact opposite in fact. Which is exactly why DARPA is researching the problem.
gonzo41 7y ago
You're really close. Don't audit a sample. Audit all of the votes.
acollins1331 7y ago
Sounds good, just get rid of the ballot box problems by scanning the paper ballot right after it's cast. Voting would go like this: wait in line, confirm your address, vote on paper, watch the person upload your vote, take your printed receipt confirmed the upload was received, leave. Security problem solved.
- ufo 7y ago
  Uploading vote counts after each individual vote removes the secrecy of the vote.

lidHanteyk 7y ago

Use the post office. Use paper ballots in the mail. Many security issues vanish if polling places are no longer rich targets. In my state of residence, my ballot is sent in the mail, and I get SMS notifications when it is sent to me and when it is counted.

airstrike 7y ago
You never know if it's counted correctly, though, so it sounds like the auditing challenge remains
- hedora 7y ago
  They could ensure correct delivery (but not necessarily counting) by MMSing a picture of the ballot, but then you can sell your vote.
- debatem1 7y ago
  We have a system where you can go and see a webpage say your vote was counted after you mail in your ballot. What you can't do is tell if that webpage is accurate. This still feels like a tractable problem in the domain of pure crypto if you divide it into a commitment scheme and a tabulation step.
conductr 7y ago
I like the idea of snail mailing a PIN number for an online system. But I’m a layman on the security issues that complicate what seems easy, is it the MITM risk of anything over a wire?
- ISL 7y ago
  Or compromising the central server. Some things are worth extra effort to do in a ponderous, slow, and fault-tolerant way.
ufo 7y ago
Voting by mail introduces many extra problems. 1) Now the post office is a rich target 2) The voter doesn't see with their own eyes that their ballot has been deposited. They have to trust the SMS message. 3) It is more vulnerable to vote coercion. Family members, employers or organized crime might force you to show them your ballot before its submitted.

daenz 7y ago

Both are important, but WRT elections, faith in security is as important as actual physical security. I don't see how a black box of tech can convince a layperson that voting is secure. We need more in the way of audit trails and accountability.

m-p-3 7y ago
The toughest part is ensuring anonymity and privacy while ensuring someone can only vote once, ensure the vote is legitimate, and accounted for. The only way I can see that is using a PKI-based ID to validate the ID of someone, but then how do you ensure that person can vote anonymously and only once?

sambroner 7y ago

I had thought that this was a great opportunity for blockchain, if identity could be solved reliably. That being said, identity is already being solved through IDs, voting stations, home-delivered ballots, etc. The audit-ability and reproduce-ability would be great features, while cost and latency wouldn't be huge problems for voting. There were even a few start ups in the space (e.g. Votem), but none seem to have made the jump to doing real elections. Votem did a few smaller voting experiments like a vote for the Rock & Roll hall of fame, but never made its way to state elections. I hope that DARPA can not only inspire innovation, but also help startups break into the difficult game of government contracting.

sly010 7y ago
> I had thought that this was a great opportunity for blockchain, if identity could be solved reliably. If identity could be solved reliably, you wouldn't need a blockchain.
- ypcx 7y ago
  You would, because without blockchain, you can still lie about what was done by (or with) that identity, and when.
ypcx 7y ago
I wonder if biometry (e.g. a fingerprint) could be reliably used as the private key (and thus the identity on the blockchain). That is, without a 3rd party / external system. For trust, the network (as any blockchain network) would have to be properly decentralized, and (good or at least benevolent) people would have to be incentivized to run the network. I.e. there would be a monetary value (a coin, or a token), which would have its own pros and cons as seen by various parties. (Mentioning fingerprints, I cannot but reference the movie Southland Tales, which in my view was the most prophetic movie ever made.)
hedora 7y ago
There used to be a problem with vote buying / coercion. If you can prove you voted one way or another, you can sell your vote, or your employer can fire you for voting the wrong way (for example).

ModernMech 7y ago

Step 1) Make sure the guy in charge of bringing election security bills to vote on the Senate floor can't accept campaign donations from voting machine companies [1]. Step 2) Bring election security bills to vote on Senate floor. [1] https://www.newsweek.com/mitch-mcconnell-robert-mueller-election-security-russia-1451361 https://www.newsweek.com/mitch-mcconnell-robert-mueller-elec...

hedora 7y ago
I didn’t realize Moscow Mitch was also bought off by the voting machine companies. Makes sense.

m463 7y ago

I think paper ballots should be collected at each polling location. I also think paper ballot totals from each polling location should be published publicly in a variety of forms, so that the totals can be added independently.

tamrix 7y ago
Paper ballots get counted publicly. Anyone that would like to witness it can attend for any amount of time and call out miss counts. Totals are read out on live TV.
- Supermancho 7y ago
  Multiple counts that are corroborated is a common validation, iirc. That would be tedious, to listen to or correlate. 24-13 .... 25-13 25-13 .... 25-14 26-13 .... 26-14

ElijahLynn 7y ago

* Open Voting Specification (includes paper trail) * Ranked Choice Voting (or better) * Individual Vote Verification API

bumblebritches5 7y ago

DON'T RELY ON FUCKING SOFTWARE.

shanxS 7y ago

Has it been proved that elections have been tampered with in past?

rectang 7y ago
Yes — for instance last year in North Carolina's 9th congressional district. https://en.wikipedia.org/wiki/2018_North_Carolina%27s_9th_congressional_district_election https://en.wikipedia.org/wiki/2018_North_Carolina%27s_9th_co... > On February 21, the board unanimously voted to call a new election because of fraud by Republican operatives.

rectang 7y ago

The article goes awry from the first sentence: > If election security is an engineering problem, It's not an engineering problem, it's a political problem. To the extent that it's engineering, it's solved if we would only adopt the known good approaches. But we won't because there is political utility in having elections remain murky and messy for parties who may benefit from manipulation of the vote through disenfranchisement or other shenanigans.

hardwaresofton 7y ago

IMO it shouldn't be all or nothing, here's a system I think would be the best of both worlds: - Allow people to express voting intent & go through the candidates on the ticket with a website/app (as strong as it can be), which spits out some random ID/QR code - Widen voting time period to months - Support mail-in-ballots in more states - Add a mandatory # of holidays per year (with proof of vote, notification of which local/national election the person is voting in) - Require people to confirm their vote in person, with the option to vote with the QR their phone generated (and a confirmation screen afterwards for them to review), with every vote required to take a certain amount of time in the booth (to prevent timing people to figure out if they used their cell phone or not). This setup allows for a few things: - Early consideration of candidates and their positions and the ability to save how you were going to vote once you're in the booth - More signals of voting intent that could be used to detect fraud (in addition to random sampling) This scheme probably needs more thought to prevent election tampering, but I think adding a digital element as additive would be a benefit. If the digital element detects voting intent that sharply diverges from voter rolls, then a recount in whatever county is triggered.

yardstick 7y ago

Given postal votes are a thing, and have been for many years (at least for UK/AU/NZ), is there still such stringent requirements on making it difficult/impossible to buy/coerce votes? Since both can be done using postal votes already. Does this then open up more digital options? Eg app based voting where your vote is published along with everyone elses but in anonymised form, so everyone can independently verify the totals. By anonymised I mean the app displays a random “vote reference ID” that you could check in the final published ledger to see your vote was included, and was recorded correctly.

phs318u 7y ago

An excellent essay on Voting Security by Bruce Schneier, showing how hard this problem is: https://www.schneier.com/essays/archives/2004/07/voting_security.html https://www.schneier.com/essays/archives/2004/07/voting_secu... And more on the same topic: https://www.schneier.com/essays/elections/ https://www.schneier.com/essays/elections/

dwobry 7y ago

I know Ron Rivest has a lot of interest and work invested into securing voting system. I can't point you to a direct paper, but if you Google it I'm sure you'll find more then enough.

karterk 7y ago

India has been conducting elections via electronic voting machines for a while now: https://en.wikipedia.org/wiki/Electronic_voting_in_India https://en.wikipedia.org/wiki/Electronic_voting_in_India In India's case, the paper ballots actually caused a lot of rigging as booth capturing was ramptant. EVMs greatly helped tackle that. A small sample of the votes are also verified using voter-verified paper audit trail (VVPAT).

iyw 7y ago
And there are rampant reports of election fraud. so your point?

toomanybeersies 7y ago

Disenfranchisement (e.g. requiring voter ID) and gerrymandering are far more significant issues for the democratic process in the USA than ballot security, which is a relatively solved problem.

lucifirius 7y ago
Most countries require a form of voter ID.
- NikkiA 7y ago
  Most countries automatically and freely issue said ID, the voter ID attempts in the US disenfranchise poor people and people who, for whatever reason, cannot attain the ID required.
  - code_chimp 7y ago
    Source? In the US I need a valid ID to cash a check, pick up a benefit check, apply for government benefits, buy cold medication, board an airplane, open a bank account, etc. This is a short list off of the top of my head. Are all of these activities disenfranchising me?
    - rexpop 7y ago
      Yes, when ID is hard to get. https://www.theatlantic.com/politics/archive/2012/03/how-voter-id-laws-are-being-used-to-disenfranchise-minorities-and-the-poor/254572/ https://www.theatlantic.com/politics/archive/2012/03/how-vot...
    - Faark 7y ago
      IDs are not a problem in principle. But there is barely any voter fraud at all (see Trumps commission), thus no real reason to enact law. Why do politicians non the less spend their political capital doing so? Often their new rules just so happen to help the people voting for them and hinder their opponents. North Carolina [0] was one of the more egregious cases. [0] https://www.nytimes.com/2017/05/15/us/politics/voter-id-laws-supreme-court-north-carolina.html https://www.nytimes.com/2017/05/15/us/politics/voter-id-laws...

josh_fyi 7y ago

Israel has an old-school paper-based procedure, with cross-party observers present at every step. This wastes a lot of paper, but is very hard to hack. https://www.timesofisrael.com/can-israels-election-count-be-tampered-with-an-official-explains-the-process/ https://www.timesofisrael.com/can-israels-election-count-be-...

Quequau 7y ago

Back when we were all agonising over "Hanging Chads" in Bush v. Gore, Bruce Schneier published a series of collaborative works featuring the back & forth design of secure paper ballots + digital voting. So that was what? 2000? Surely the problem then isn't technical, it's cultural and political.

Dowwie 7y ago

Those who are involved in the American election industry, from government to vendors or consultants, have committed to a platform based on verified C. The industry continues to refuse to adopt a memory safe language such as Rust. Granted, the investment in a new toolset is costly. However, the benefits are very compelling. In the meanwhile, industry will crutch its toolset decisions with white hat hacking events, bug bounties, millions of dollars in contracts supporting audits and testing, etc. Path dependence is costly. In the case of elections, more than money is at stake. Industry must move beyond verified C to Rust.

peg_leg 7y ago

Paper ballots?

Beltiras 7y ago

The most successful attacks on democracy are gerrymandering (US especially) and misinformation (global problem, see Brexit thou specifically). Don't get me wrong, this sort of security is necessary but there's nothing wrong with tossing out the machines and using real paper ballots with a pencil (thus sidestepping the problem). You can even machine-read those for a machine count (which can be verified since the paper ballots are still around to rescan with different hardware/software for validation). How do you engineer around the misinformation vector thou? That's the hard problem.

jethro_tell 7y ago
Not only are paper ballots simple and effective, they can be mailed out 2 weeks ahead of time and people can vote with a laptop, at their leisure. Also, you don't have to store them for three months at a time with proof of custody, you can just scan them, or dump them once the election has been certified. Voting machines sound great but that it's solving a problem by doing things the same with tech.
- habnds 7y ago
  I think the laptops would defeat the purpose of the paper ballots?
  - abathur 7y ago
    I think GP just means with a laptop available (i.e., the ability to research a bond initiative they weren't already aware of).
    - habnds 7y ago
      yeah nice
- jfengel 7y ago
  Voting by mail has an even more massive security hole, in that ballots can be stolen, or people coerced (or paid). To my knowledge that hasn't happened yet, either in Oregon or in absentee voting, but with the level of discourse being what it is, I suspect it could easily become a problem.

deleted 7y ago

[deleted]

g00s3_caLL_x2 7y ago

There are still too many cracks in the process with the human element. We've seen pollsters that have hoarded and thrown away ballots. Persuasion and intimidation outside the polling buildings. Now we have hoards of people that are not even American citizens that are be used a pawns for a vote. GREED. GREED is the problem.

thepaperone 7y ago

DARPA, fund me. 1. go vote 2. check to see who hasn't left their house today via open source GPS indicators 3. vote as them too because its illegal for those at a voting station to ask to verify your identification 4. ??? 5. undetectable voter fraud

bb611 7y ago
There's a high chance you'll go try to vote as someone who simply didn't register. In California you could then register as that person and vote provisionally, but polling officials will check your identification. Alternatively you may attempt to impersonate someone using vote by mail. In that case, there won't be a ballot to vote at the polling station, and even if you are able to successfully register provisionally or convince polling workers to give you a blank to fill out, election officials are already looking for these kinds of duplicates.