5 ms·

With paper ballots it's easy for anyone to get involved in verifying the trustworthiness of part of an election. You can watch the box that the votes are put i

With paper ballots it's easy for anyone to get involved in verifying the trustworthiness of part of an election. You can watch the box that the votes are put into, you can be present at the opening of the box, you can participate in the count. All the key parts of the process can (and in most countries do) happen in public view, and even someone with a low level of education can gain high confidence that the election is fair, trusting only other people like themselves - no need to trust the corporation that built the machine, or the politicians currently in power - you can watch it from empty box to published voting district results, and as long as you think there are people like you in each district doing similar checks, you can be confident the entire vote was done correctly.

owenmarshall 7y ago
I’ve yet to see a technological solution that doesn’t fall victim to this. I’m a reasonably intelligent software engineer and I would not trust myself to audit the described solution to know it does what it claims. I can, however, * review the receipt produced by the voting machine and ensure it matches * observe the random audits of submitted receipts to tabulated votes to be sure they match I can also trust that a wide section of the public can do those things as well.
crazygringo 7y ago
Sorry, but that's just not true. If you look up how elections get rigged, there are all sorts of opportunities for corrupting the election, which actually happen all over the world -- ballot boxes getting swapped out, literally stuffed with extra votes, being hidden and forgotten completely, getting "lost" or "accidentally destroyed" to prevent a recount along with forged results, the list goes on and on. Yes the UN can send unbiased people to observe elections, but there just aren't enough to be present at every polling station and verify every step of the way. And the police tend to be happy to deny "unauthorized" people from observing... in the name of "security" to promote election integrity. So considering that even official UN observers historically have been unable to verify the trustworthiness of many elections, I don't understand how you think "anyone who can count" could possibly do so. You are right that ultimately it's based on trust, currently. But with technology we can have far greater certainty, and follow the phrase Reagan popularized: "trust, but verify". Elections deserve nothing less.
- kybernetikos 7y ago
  My contention is that when there are things like you describe going on, it's usually fairly obvious to people (even those who can't count) because they weren't able to do the all points observation that the process allows. I'm describing elections where you can literally watch the box before it is sealed, to being opened, to having the votes counted and the count being published. If you're in a place where you are not able to do that, then yes, of course, you're running a high risk that the election is not fair. You don't even need people to be unbiased, you just need a selection of people with different allegiances who will be able to cry foul if they see something happening that is not right because they think it will damage their side. > But with technology we can have far greater certainty I have yet to see any technological solution that gives greater certainty than the ballot box system. Most of them allow the voter to prove their vote or involve many more actors that must be trusted. They also provide new central points of attack, where a well run paper vote is very distributed. I like Schneiers analysis of the papal election protocol: https://www.schneier.com/blog/archives/2005/04/hacking_the_pap_1.html https://www.schneier.com/blog/archives/2005/04/hacking_the_p...
  - crazygringo 7y ago
    > it's usually fairly obvious to people Except it's not, which is the whole point. Half the country cries foul based on observational samples but without systemic proof, and the other half of the country says they're inventing stories and cherry-picking irregularities, and that there are just as many irregularities in the other direction to cancel them out. And the average citizen, of course, has absolutely no idea what to think. Both sides sound entirely plausible. And even if there was manipulation, nobody has any idea if it changed the outcome by 0.1% (a few bad actors) or by 10% (the president directed it), if it was enough to tip an election or not. By introducing foolproof technological verification, all this goes away. And I don't understand how you think this doesn't exist -- isn't this HN post just one example of multiple proposals?
    - kybernetikos 7y ago
      > foolproof technological verification, all this goes away. And I don't understand how you think this doesn't exist Well, firstly, having some familiarity with software, it's rare to come across 'foolproof' used as an adjective, even with formally proved correct pieces of code. But, I accept that it's possible that if implemented correctly, something like the most modern forms of things like Pret a Voter might be pretty secure. However, it's going to be harder for a normal human to check that Pret a Voter is implemented correctly than to check that a paper ballot system is implemented correctly. For example, in Pret a Voter, the group of tellers and only the group of tellers have the ability to recover the original order. This would allow them to decrypt any of the posted receipts, if they shared that knowledge with someone nefarious, it provides perfect means for vote coercion. If the process is not run correctly and they are colluding, they could have the chance to choose a decryption that provides the right result. If you implement Pret a Voter correctly, with a group of ideologically distinct tellers, and you involve them at the right points in the process, and not at other points, and you have a non-colluding auditor check they are doing their job correctly, then everything is fine, but in practice, how is a voter going to get that confidence? This is ignoring very real usability concerns (that in some cases can be politically weaponized to disenfrancise particular segments of the population). https://www.usenix.org/system/files/conference/jets15/jets_0302-acemyan.pdf https://www.usenix.org/system/files/conference/jets15/jets_0... Ultimately, I find myself agreeing with Bruce Schneier. "The problem isn't the math, it's the human procedures around the math. I don't think a cryptographic voting system would be an improvement, because that's not the weakest link." https://www.schneier.com/blog/archives/2006/11/voting_technolo.html#c125450 https://www.schneier.com/blog/archives/2006/11/voting_techno...
godelski 7y ago
> With paper ballots That's good and all, but in the 4 states I've voted in, only one had a paper ballot. 3 were me showing up to the polling place and pressing buttons on a monitor. The 4th mails me a ballot, I fill things in, and send it back (so no receipt either). Given my experience, and that several others tell me they do similar things, I don't understand your counter argument. We already do not have paper ballots to check. There is ZERO verification currently. If those ballots are printed out from the electronic machine that I voted on, well you still have to trust that a corporation did not mess with anything and printed out the wrong ballot, or just didn't print yours out. The way we are doing things and the way we used to do things don't enable the trust that you are suggesting. But let's assume that the year is 2000 and we're voting on a paper ballot. We don't get to take a copy home. Once we leave we don't know what happens to that ballot in the box. Has our vote been counter? Did we fully punch out the paper chad? Did our ballot get lost when a country wide controversy started and my ballot got mailed around the state several times? Can I verify that the government's decision of how to count my vote reflected my actual intention? The answer to these is that you can't do any verification of this. So I rather kinda like the idea of a website that I can go to and check that my vote was counted correctly and matches. The triviality of it from the voter side makes this process easy. Does it solve all verifiablity problems within the pipeline? No. Does it solve some? Yeah. Personally I'd rather take a step forward, even if that step is small.
- kybernetikos 7y ago
  Where I vote, we use paper ballots. They're still widely used, even in the 21st century. The state of election security in the USA is appalling. https://www.schneier.com/blog/archives/2018/11/buying_used_vot.html https://www.schneier.com/blog/archives/2018/11/buying_used_v... https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html https://www.schneier.com/blog/archives/2018/04/securing_elec... You are also able to volunteer to take part in the counting, or to observe the whole process. Sure, when you leave, you don't know that nothing bad happened, but you don't have to leave until the end of the process. In my jurisdiction, you can be part of the process that determines whether a vote is distinct (and should be voted) or not. It sounds like you've already taken many steps backwards in your voting system, so this further step doesn't seem so bad, but it's still worse than a properly run paper system.
mlyle 7y ago
OK, use this scheme where the receipt you take is a carbon copy, and then you can maintain the votes in a ballot box, too.
masonic 7y ago
You can watch the box that the votes are put into, you can be present at the opening of the box... But you can't monitor the boxes in transit or be sure that any given box, or vote, was tallied properly. It's happened numerous times in the Bay Area that boxes of ballots have been "found" days after an election, with votes curiously inconsistent with others from nearby precincts.
- fsh 7y ago
  In many countries with paper ballots, the box never leaves the room until the count is complete. You can watch it from the moment it arrives empty until the results are submitted to the election committee.

owenmarshall 7y ago

I’ve yet to see a technological solution that doesn’t fall victim to this. I’m a reasonably intelligent software engineer and I would not trust myself to audit the described solution to know it does what it claims. I can, however, * review the receipt produced by the voting machine and ensure it matches * observe the random audits of submitted receipts to tabulated votes to be sure they match I can also trust that a wide section of the public can do those things as well.

crazygringo 7y ago

Sorry, but that's just not true. If you look up how elections get rigged, there are all sorts of opportunities for corrupting the election, which actually happen all over the world -- ballot boxes getting swapped out, literally stuffed with extra votes, being hidden and forgotten completely, getting "lost" or "accidentally destroyed" to prevent a recount along with forged results, the list goes on and on. Yes the UN can send unbiased people to observe elections, but there just aren't enough to be present at every polling station and verify every step of the way. And the police tend to be happy to deny "unauthorized" people from observing... in the name of "security" to promote election integrity. So considering that even official UN observers historically have been unable to verify the trustworthiness of many elections, I don't understand how you think "anyone who can count" could possibly do so. You are right that ultimately it's based on trust, currently. But with technology we can have far greater certainty, and follow the phrase Reagan popularized: "trust, but verify". Elections deserve nothing less.

kybernetikos 7y ago
My contention is that when there are things like you describe going on, it's usually fairly obvious to people (even those who can't count) because they weren't able to do the all points observation that the process allows. I'm describing elections where you can literally watch the box before it is sealed, to being opened, to having the votes counted and the count being published. If you're in a place where you are not able to do that, then yes, of course, you're running a high risk that the election is not fair. You don't even need people to be unbiased, you just need a selection of people with different allegiances who will be able to cry foul if they see something happening that is not right because they think it will damage their side. > But with technology we can have far greater certainty I have yet to see any technological solution that gives greater certainty than the ballot box system. Most of them allow the voter to prove their vote or involve many more actors that must be trusted. They also provide new central points of attack, where a well run paper vote is very distributed. I like Schneiers analysis of the papal election protocol: https://www.schneier.com/blog/archives/2005/04/hacking_the_pap_1.html https://www.schneier.com/blog/archives/2005/04/hacking_the_p...
- crazygringo 7y ago
  > it's usually fairly obvious to people Except it's not, which is the whole point. Half the country cries foul based on observational samples but without systemic proof, and the other half of the country says they're inventing stories and cherry-picking irregularities, and that there are just as many irregularities in the other direction to cancel them out. And the average citizen, of course, has absolutely no idea what to think. Both sides sound entirely plausible. And even if there was manipulation, nobody has any idea if it changed the outcome by 0.1% (a few bad actors) or by 10% (the president directed it), if it was enough to tip an election or not. By introducing foolproof technological verification, all this goes away. And I don't understand how you think this doesn't exist -- isn't this HN post just one example of multiple proposals?
  - kybernetikos 7y ago
    > foolproof technological verification, all this goes away. And I don't understand how you think this doesn't exist Well, firstly, having some familiarity with software, it's rare to come across 'foolproof' used as an adjective, even with formally proved correct pieces of code. But, I accept that it's possible that if implemented correctly, something like the most modern forms of things like Pret a Voter might be pretty secure. However, it's going to be harder for a normal human to check that Pret a Voter is implemented correctly than to check that a paper ballot system is implemented correctly. For example, in Pret a Voter, the group of tellers and only the group of tellers have the ability to recover the original order. This would allow them to decrypt any of the posted receipts, if they shared that knowledge with someone nefarious, it provides perfect means for vote coercion. If the process is not run correctly and they are colluding, they could have the chance to choose a decryption that provides the right result. If you implement Pret a Voter correctly, with a group of ideologically distinct tellers, and you involve them at the right points in the process, and not at other points, and you have a non-colluding auditor check they are doing their job correctly, then everything is fine, but in practice, how is a voter going to get that confidence? This is ignoring very real usability concerns (that in some cases can be politically weaponized to disenfrancise particular segments of the population). https://www.usenix.org/system/files/conference/jets15/jets_0302-acemyan.pdf https://www.usenix.org/system/files/conference/jets15/jets_0... Ultimately, I find myself agreeing with Bruce Schneier. "The problem isn't the math, it's the human procedures around the math. I don't think a cryptographic voting system would be an improvement, because that's not the weakest link." https://www.schneier.com/blog/archives/2006/11/voting_technolo.html#c125450 https://www.schneier.com/blog/archives/2006/11/voting_techno...

godelski 7y ago

> With paper ballots That's good and all, but in the 4 states I've voted in, only one had a paper ballot. 3 were me showing up to the polling place and pressing buttons on a monitor. The 4th mails me a ballot, I fill things in, and send it back (so no receipt either). Given my experience, and that several others tell me they do similar things, I don't understand your counter argument. We already do not have paper ballots to check. There is ZERO verification currently. If those ballots are printed out from the electronic machine that I voted on, well you still have to trust that a corporation did not mess with anything and printed out the wrong ballot, or just didn't print yours out. The way we are doing things and the way we used to do things don't enable the trust that you are suggesting. But let's assume that the year is 2000 and we're voting on a paper ballot. We don't get to take a copy home. Once we leave we don't know what happens to that ballot in the box. Has our vote been counter? Did we fully punch out the paper chad? Did our ballot get lost when a country wide controversy started and my ballot got mailed around the state several times? Can I verify that the government's decision of how to count my vote reflected my actual intention? The answer to these is that you can't do any verification of this. So I rather kinda like the idea of a website that I can go to and check that my vote was counted correctly and matches. The triviality of it from the voter side makes this process easy. Does it solve all verifiablity problems within the pipeline? No. Does it solve some? Yeah. Personally I'd rather take a step forward, even if that step is small.

kybernetikos 7y ago
Where I vote, we use paper ballots. They're still widely used, even in the 21st century. The state of election security in the USA is appalling. https://www.schneier.com/blog/archives/2018/11/buying_used_vot.html https://www.schneier.com/blog/archives/2018/11/buying_used_v... https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html https://www.schneier.com/blog/archives/2018/04/securing_elec... You are also able to volunteer to take part in the counting, or to observe the whole process. Sure, when you leave, you don't know that nothing bad happened, but you don't have to leave until the end of the process. In my jurisdiction, you can be part of the process that determines whether a vote is distinct (and should be voted) or not. It sounds like you've already taken many steps backwards in your voting system, so this further step doesn't seem so bad, but it's still worse than a properly run paper system.

mlyle 7y ago

OK, use this scheme where the receipt you take is a carbon copy, and then you can maintain the votes in a ballot box, too.

masonic 7y ago

You can watch the box that the votes are put into, you can be present at the opening of the box... But you can't monitor the boxes in transit or be sure that any given box, or vote, was tallied properly. It's happened numerous times in the Bay Area that boxes of ballots have been "found" days after an election, with votes curiously inconsistent with others from nearby precincts.

fsh 7y ago
In many countries with paper ballots, the box never leaves the room until the count is complete. You can watch it from the moment it arrives empty until the results are submitted to the election committee.