4 ms·

> Hackable machines are a problem, but they are not the only problem. They might not be the biggest problem, but they're definitely an _extra_ problem. I don't

> Hackable machines are a problem, but they are not the only problem. They might not be the biggest problem, but they're definitely an _extra_ problem. I don't see what problems they take away, in exchange for bringing this extra problem. With a paper ballot, I can go to the polling booth, see my vote being counted, and see whether any other funky stuff happens, right there. It's all in the open. This in turn gives you extra trust in the system. With an electronic system, how do I know what happens behind those layers of abstraction between the user interface and the hardware? How can I in any way verify that my vote has been counted?

wuliwong 7y ago
>With a paper ballot, I can go to the polling booth, see my vote being counted, and see whether any other funky stuff happens, right there. It's all in the open. This in turn gives you extra trust in the system. What do you mean you see it counted? I don't think I've ever voted with a paper ballot.
ascagnel_ 7y ago
> With a paper ballot, I can go to the polling booth, see my vote being counted, and see whether any other funky stuff happens, right there. It's all in the open. This in turn gives you extra trust in the system. > With an electronic system, how do I know what happens behind those layers of abstraction between the user interface and the hardware? How can I in any way verify that my vote has been counted? The best I've seen is a verifiable electronic system with a paper trail. After a voter records their vote electronically, they're shown a "receipt" of their vote to verify it, and the "receipt" is stored securely and anonymously after the user verifies the vote. If the receipt doesn't match their inputs, a red flag can be raised immediately. After the election, the paper records can be used to run a stop-loss audit to verify the electronic vote count. The redundancy has an added benefit -- you're increasing the surface area of the attack itself, and by adding a physical element, you can capture bad actors on camera.
- zanny 7y ago
  > the paper records can be used to run a stop-loss audit to verify the electronic vote count You can't do this. Probably the most fundamental problem with electronic vote verification is that you cannot give someone physical evidence of how their vote was cast, because it makes voter coercion feasible. Its why almost all absentee / write in ballots are set up so that if you send multiple ballots only the last one is counted (or an in person vote if you give one). If someone tries to coerce your vote and use the absentee ballot as proof unless they keep you imprisoned until the election is over they can't prove you didn't resubmit / go in person to change your vote. With receipts for in person ballots the only way to defeat coercion is to make it so you can, at the point of receipt, get issued an intentionally flawed receipt. But if you are verifying votes this way, it would have to be for another legitimate voter voting the exact way your coercer wanted. That sounds like a hugely limiting technical flaw.
  - ascagnel_ 7y ago
    > You can't do this. Probably the most fundamental problem with electronic vote verification is that you cannot give someone physical evidence of how their vote was cast, because it makes voter coercion feasible. There are machines that print paper receipts to voters (presented under glass so voters can verify), and then drop the receipts into a traditional lockable ballot box. The voter cannot access the paper ballot without evidently tampering with the machine; the only issue is that you'd need a way to get poll workers the ballot at issue without identifying the voter.
  - brownbat 7y ago
    > you cannot give someone physical evidence of how their vote was cast, because it makes voter coercion feasible Some countries try to solve this with an extended voting period and by making votes repudiable / changeable up until the end of the election. Another solution is generous whistleblower rewards and significant criminal penalties. There are tools outside the ballot box to prevent crime, and extortion is a crime regardless of whether there's an election going on or not. (If you bake deniability into your system, you lose the ability to let voters prove to others that their vote was miscounted, so receipts lose a key feature at that point.)
seppin 7y ago
They are the biggest problem in terms of foreign interference. I don't think a Russian national can hang out in rural Organ and mess with paper ballots without being noticed.
alistairSH 7y ago
In VA (or, at least in Fairfax County), we fill in a paper ballot which is scanned by a machine. The vote counting is done by the scanners/electronically, but there is a paper trail for audits. Seems like the best of both worlds (when implemented properly). Like you, I would have zero faith in an electronic voting booth that simply said "Yup, you pushed a button." I have no idea what actually gets "written to disk".
- codedokode 7y ago
  With scanning machines there still is a problem that they can be tampered with and even if you see that the outcome doesn't match exit polls, you don't have any solid proofs to require the manual re-counting of paper ballots.
  - beat 7y ago
    In most states, if the election is within a certain degree of closeness (like half a percent), it triggers an automatic recount. And that will catch mismatches between the machine counts and the contents of their ballot boxes, unless you also carefully rig the manual recount - at scale. And altering the count more than a percent or so is a LOT of alteration.
  - alistairSH 7y ago
    Sibling comment is correct - most states will auto-recount within a certain margin. If somebody hacks a difference larger than that, we have a larger problem (ie, not just a machine or two hacked, but the entire system has fallen apart). And that also brings us back to an earlier comment about driving turnout (or lack thereof) is possibly a larger problem than tampering at the polls. If a party (or somebody acting on behalf of a party) can convince a significant block of voters to stay home, that's more likely to have an impact.
- ghaff 7y ago
  Ditto. Fill out a standardized test-like multiple choice form and it gets fed into a reader.
- 7y ago

wuliwong 7y ago

ascagnel_ 7y ago

> With a paper ballot, I can go to the polling booth, see my vote being counted, and see whether any other funky stuff happens, right there. It's all in the open. This in turn gives you extra trust in the system. > With an electronic system, how do I know what happens behind those layers of abstraction between the user interface and the hardware? How can I in any way verify that my vote has been counted? The best I've seen is a verifiable electronic system with a paper trail. After a voter records their vote electronically, they're shown a "receipt" of their vote to verify it, and the "receipt" is stored securely and anonymously after the user verifies the vote. If the receipt doesn't match their inputs, a red flag can be raised immediately. After the election, the paper records can be used to run a stop-loss audit to verify the electronic vote count. The redundancy has an added benefit -- you're increasing the surface area of the attack itself, and by adding a physical element, you can capture bad actors on camera.

zanny 7y ago
> the paper records can be used to run a stop-loss audit to verify the electronic vote count You can't do this. Probably the most fundamental problem with electronic vote verification is that you cannot give someone physical evidence of how their vote was cast, because it makes voter coercion feasible. Its why almost all absentee / write in ballots are set up so that if you send multiple ballots only the last one is counted (or an in person vote if you give one). If someone tries to coerce your vote and use the absentee ballot as proof unless they keep you imprisoned until the election is over they can't prove you didn't resubmit / go in person to change your vote. With receipts for in person ballots the only way to defeat coercion is to make it so you can, at the point of receipt, get issued an intentionally flawed receipt. But if you are verifying votes this way, it would have to be for another legitimate voter voting the exact way your coercer wanted. That sounds like a hugely limiting technical flaw.
- ascagnel_ 7y ago
  > You can't do this. Probably the most fundamental problem with electronic vote verification is that you cannot give someone physical evidence of how their vote was cast, because it makes voter coercion feasible. There are machines that print paper receipts to voters (presented under glass so voters can verify), and then drop the receipts into a traditional lockable ballot box. The voter cannot access the paper ballot without evidently tampering with the machine; the only issue is that you'd need a way to get poll workers the ballot at issue without identifying the voter.
- brownbat 7y ago
  > you cannot give someone physical evidence of how their vote was cast, because it makes voter coercion feasible Some countries try to solve this with an extended voting period and by making votes repudiable / changeable up until the end of the election. Another solution is generous whistleblower rewards and significant criminal penalties. There are tools outside the ballot box to prevent crime, and extortion is a crime regardless of whether there's an election going on or not. (If you bake deniability into your system, you lose the ability to let voters prove to others that their vote was miscounted, so receipts lose a key feature at that point.)

seppin 7y ago

They are the biggest problem in terms of foreign interference. I don't think a Russian national can hang out in rural Organ and mess with paper ballots without being noticed.

alistairSH 7y ago

In VA (or, at least in Fairfax County), we fill in a paper ballot which is scanned by a machine. The vote counting is done by the scanners/electronically, but there is a paper trail for audits. Seems like the best of both worlds (when implemented properly). Like you, I would have zero faith in an electronic voting booth that simply said "Yup, you pushed a button." I have no idea what actually gets "written to disk".

codedokode 7y ago
With scanning machines there still is a problem that they can be tampered with and even if you see that the outcome doesn't match exit polls, you don't have any solid proofs to require the manual re-counting of paper ballots.
- beat 7y ago
  In most states, if the election is within a certain degree of closeness (like half a percent), it triggers an automatic recount. And that will catch mismatches between the machine counts and the contents of their ballot boxes, unless you also carefully rig the manual recount - at scale. And altering the count more than a percent or so is a LOT of alteration.
- alistairSH 7y ago
  Sibling comment is correct - most states will auto-recount within a certain margin. If somebody hacks a difference larger than that, we have a larger problem (ie, not just a machine or two hacked, but the entire system has fallen apart). And that also brings us back to an earlier comment about driving turnout (or lack thereof) is possibly a larger problem than tampering at the polls. If a party (or somebody acting on behalf of a party) can convince a significant block of voters to stay home, that's more likely to have an impact.
ghaff 7y ago
Ditto. Fill out a standardized test-like multiple choice form and it gets fed into a reader.
7y ago