11 ms·
> I'm so sick and tired of stories like this framing the issue of election security as a software issue or hardware issue. Election security is certainly more
by dwheeler 7y ago
> I'm so sick and tired of stories like this framing the issue of election security as a software issue or hardware issue.
Election security is certainly more than software or hardware. But I'm sick and tired of jurisdictions that permit paperless votes, because by definition they are insecure.
> You can mitigate software flaws with chains of custody, tamper proof seals, bipartisan poll watchers, bipartisan election judges, and enough transparency.
Not true; none of these mitigations work. If the software is malicious, it can receive one input and produce a different result. Reviews of source code and even machine code are not enough, because you don't get adequate confidence that what was reviewed is what was run. "Tamper proof" seals don't help, because the malicious code could have been what's installed in the first place, and hardware can easily report "what you expect to see" while running something else in practice on election day. In most cases the source code isn't even available for public review & scrutiny, so there's no possibility of enough transparency even if you could somehow be assured of what code was run.
When I was a kid I liked to do magic tricks. I bought cheap plastic devices that looked like they did one thing, but in actuality did something else. Modern DRE systems are just a magic trick device - they'll do something, but not necessarily what you think they do.
> Most election systems in the United States employ all of these controls, which is why you have few stories of legitimate votes being discarded due to software failure or tampering.
You hear few stories because there is no effective logging, and therefore no way to report failure or tampering.
> If your argument is that paper ballots are more auditable or harder to hack, they are not. The same access controls above can be applied to paper, and paper is always susceptible to being destroyed, lost, or conveniently found in a clutch race.
Paper ballots are subvertible, but because they are physical items someone has to physically be there to do the manipulation. There's also a long history with paper ballots, so the ways they can be subverted are known - as are their countermeasures.
> Hackable machines are a problem, but they are not the only problem. ...
It's true that these machines are not the only problem, but voting systems are systems. For voting systems to be legitimate we must address all parts. Direct Recording Equipment (DREs) subvert the entire voting system, and thus should never be allowed to be part of one.
- brownbat 7y ago> By definition insecure... I take "secure voting" to mean a process where every participant can later individually audit that their vote was counted without betraying the confidentiality of any other voter. For that, what would you think about a system where the election board published all the votes after the fact without any names, but placing each vote alongside a secret, a key, shared with that voter? So, as a voter, I could perform a few operations on this published list of results. (1) I could search for my row indicated by my shared secret key to confirm my vote was recorded correctly. (2) I could add all the votes to confirm election officials added all recorded votes. (3) I could confirm that the number of rows is equal to the turnout reported on the day, possibly by district, so no ballot boxes could suddenly be lost or added after the fact. > If the software is malicious, it can receive one input and produce a different result. Sure, but all of cryptography is about solving for bad middlemen. The trick to secure multiparty computation is forcing the system to show enough of its work to verify, like above. Just publish the votes with the individual voters strongly masked. Part of me worries that any voting system without public key cryptography is insecure, but our standards are so low we're just settling for paper, assuming that's the best we can do. But I'm not sure what attacks paper advocates are trying to prevent, so I'm probably missing something. If I think my local election officials threw out my vote, how do I use my receipt to detect that from home? But I agree with you if your main points are: 1) Current electronic implementations are terrible. 2) Paper never hurts. N.b. - Vote selling could be an issue with either paper receipts or my protocol above. The best solution for either is probably outside the system (criminal penalties and significant whistle-blower rewards). You might be able to add deniability to the toy protocol above, but things would get complicated.
- deleted 7y ago[deleted]
- dwheeler 7y agoMy point is not that paper never hurts. My point is that paper is the absolute minimum. The security requirements of a voting system are radically different than most systems. A good summary of the problems and how to solve them is here: https://www.verifiedvoting.org/ https://www.verifiedvoting.org/