3 ms·

I don't know how the implementation of mail-in voting is in the States. Here's how I would implement it: 1. Ballots contain: a ballot, a serial number, a small

I don't know how the implementation of mail-in voting is in the States. Here's how I would implement it: 1. Ballots contain: a ballot, a serial number, a small envelope and a large envelope. 2. The voter fills in the ballot and stuffs in the small envelope and closes it. 3. Voter now needs to get a code from a webpage and add to the serial number card. Here's the part where infrastructure in Iceland is excellent. Nigh everyone has personal electronic certificates on their phones so authentication is easy. I must admit I have no idea how easy or hard this would be in the States. 4. Puts the small envelope and the serial number card in the large envelope and closes it. 5. Mails in the large envelope. 6. Precinct opens the large envelope and validates the serial number. If it is valid, puts the small envelope in box headed for counting. 7. Count the votes. Declare results. 8. Investigate the "bad serials and validation number". There are fun things to think about doing to increase confidence in the voting process. In this scheme I describe the validation code could be a hash of the serial and a salt. Then you could actually release all the validation cards so voters can actually verify that their ballots were counted.

pacala 6y ago
There several problems with mail-in voting systems, including your proposal. On top of my head: * The tampering envelope is extended to weeks instead of hours. * There is a non-zero risk of vote secrecy violation. * There is a non-zero risk of voter pressuring. Coming from a country that earned the right to vote through violent revolt, it is strange how established democracies, especially the US, are cavalier with weakening the voting process: vote on a Tuesday [???], no paper trail voting machines [???], mail-in voting [???].
- Beltiras 6y ago
  I'm in a country where the right to vote is not under attack (yet at least). The Republicans have been doing their level best to reduce the number of voters and slicing the electorate into favorable lots (gerrymandering). Now it would be nice if the US could just hold elections in a similar manner to (most) European nations and just allow all citizens to vote (no registration needed) and some states are moving that way [0]. This effort is one of the fronts of that war where people want to preserve their right to vote. It's especially relevant now in this strange year of social distancing. The concerns you cite are all valid and some have mitigations. VBM is usually not mail-in but mail-out ballots. You get your ballot by mail, fill it in then go to the post-office or some designated location to hand in the ballot. It has round about the same chances for corruption as a regular paper election. If you could at that location invalidate your ballot and get a new one then voter pressuring goes away too. That leaves secrecy violation. If there's nothing that links serial numbers with voters (it's just the signature that validates the ballot), then there's no chance of secrecy violation. In a perfect world I would execute elections in the same manner we do in Iceland. Voting booth, paper ballots, pencils for marks. We have a presidential election this summer and everyone was worried if COVID would suppress the vote. Looks like it won't since we only have 2 active cases and new cases are almost none (can't find the numbers atm but iirc we had 7 new cases in the month of May). [0]: https://www.brennancenter.org/our-work/research-reports/automatic-voter-registration-summary https://www.brennancenter.org/our-work/research-reports/auto...
  - pacala 6y ago
    I believe we are mostly on the same page. Voting should be in person, on paper, on a weekend day. It can be done, even in covid times. One more thought: Simple >>> Complex. Small variations in a technically correct process may break some of its properties. The more complex the process, the easier is to inject variations, some of them adversarial. If gerrymandering is to be taken as an example, this can be taken to quite some extremes by two sides driven to win the zero-sum game at all costs. But even in absence of that, bugs happen. To nitpick one detail, I'm not persuaded by the secrecy violation prevention argument. You either prevent secrecy violation by anonymization, or you prevent vote fraud by keeping a link between the voter and the ballot. You can't have both at the same time. In person voting minimizes the bounding box of anonymization: in space, at the ballot box, and in time, the election day. Hopefully both parties afford to have observers during this space-time interval. As you spread out the voting process, both spatially and temporally, it becomes increasingly impractical / too expensive to maintain observers of the entire process.
    - Beltiras 6y ago
      The serial number in my scheme would not be linked to voter. It's not registered, only signed for the validation code.
      - pacala 6y ago
        Fair enough. If I understand correctly, the server only uses the user's identity to generate a random serial number, then only remembers the serial number and the fact that user X has generated a serial number. With that, we are left with the following attack vectors: the server and its software, either via hacking or via subtle rule tweaks, targeted ballot invalidation, voter pressure. As a technopesimist, I'm especially uncomfortable that a key piece of the process is an opaque blob of silicon that can't meaningfully be inspected by a human observer. Echoes of Diebold voting machines, plus billions of dollars poured into elections. But I can see why HN audience is prone to be persuaded this is a good idea.
        6y ago
zaroth 6y ago
I found a very detailed description of how absentee ballots are handled in Orange County (CA) here [1] It’s a complex and laborious process, including multiple partially automated steps both in sending, receiving, and processing an application for an absentee ballot, as well sending, receiving, and processing the absentee ballot itself (in one of several possible languages, as requested by the voter). This includes a manual step of comparing the voters signature on an outer envelope, which is scanned by machine and presented to remote data entry techs for side-by-side comparison with the signature on the scanned application for the absentee ballot. If the signatures aren’t a good enough match as decided by the human, the ballot is rejected (and the voter eventually notified). So if you’re not sending applications for an absentee ballot out to voters, where is this signature coming from that you are comparing against? It can’t possibly be the electronically captured signature on the drivers license, because that one is chicken scratch... [1] - https://www.ocvote.com/election-library/docs/2007%20Grand%20Jury%20Absentee%20Ballot%20Process%20Report.pdf https://www.ocvote.com/election-library/docs/2007%20Grand%20...

pacala 6y ago

There several problems with mail-in voting systems, including your proposal. On top of my head: * The tampering envelope is extended to weeks instead of hours. * There is a non-zero risk of vote secrecy violation. * There is a non-zero risk of voter pressuring. Coming from a country that earned the right to vote through violent revolt, it is strange how established democracies, especially the US, are cavalier with weakening the voting process: vote on a Tuesday [???], no paper trail voting machines [???], mail-in voting [???].

Beltiras 6y ago
I'm in a country where the right to vote is not under attack (yet at least). The Republicans have been doing their level best to reduce the number of voters and slicing the electorate into favorable lots (gerrymandering). Now it would be nice if the US could just hold elections in a similar manner to (most) European nations and just allow all citizens to vote (no registration needed) and some states are moving that way [0]. This effort is one of the fronts of that war where people want to preserve their right to vote. It's especially relevant now in this strange year of social distancing. The concerns you cite are all valid and some have mitigations. VBM is usually not mail-in but mail-out ballots. You get your ballot by mail, fill it in then go to the post-office or some designated location to hand in the ballot. It has round about the same chances for corruption as a regular paper election. If you could at that location invalidate your ballot and get a new one then voter pressuring goes away too. That leaves secrecy violation. If there's nothing that links serial numbers with voters (it's just the signature that validates the ballot), then there's no chance of secrecy violation. In a perfect world I would execute elections in the same manner we do in Iceland. Voting booth, paper ballots, pencils for marks. We have a presidential election this summer and everyone was worried if COVID would suppress the vote. Looks like it won't since we only have 2 active cases and new cases are almost none (can't find the numbers atm but iirc we had 7 new cases in the month of May). [0]: https://www.brennancenter.org/our-work/research-reports/automatic-voter-registration-summary https://www.brennancenter.org/our-work/research-reports/auto...
- pacala 6y ago
  I believe we are mostly on the same page. Voting should be in person, on paper, on a weekend day. It can be done, even in covid times. One more thought: Simple >>> Complex. Small variations in a technically correct process may break some of its properties. The more complex the process, the easier is to inject variations, some of them adversarial. If gerrymandering is to be taken as an example, this can be taken to quite some extremes by two sides driven to win the zero-sum game at all costs. But even in absence of that, bugs happen. To nitpick one detail, I'm not persuaded by the secrecy violation prevention argument. You either prevent secrecy violation by anonymization, or you prevent vote fraud by keeping a link between the voter and the ballot. You can't have both at the same time. In person voting minimizes the bounding box of anonymization: in space, at the ballot box, and in time, the election day. Hopefully both parties afford to have observers during this space-time interval. As you spread out the voting process, both spatially and temporally, it becomes increasingly impractical / too expensive to maintain observers of the entire process.
  - Beltiras 6y ago
    The serial number in my scheme would not be linked to voter. It's not registered, only signed for the validation code.
    - pacala 6y ago
      Fair enough. If I understand correctly, the server only uses the user's identity to generate a random serial number, then only remembers the serial number and the fact that user X has generated a serial number. With that, we are left with the following attack vectors: the server and its software, either via hacking or via subtle rule tweaks, targeted ballot invalidation, voter pressure. As a technopesimist, I'm especially uncomfortable that a key piece of the process is an opaque blob of silicon that can't meaningfully be inspected by a human observer. Echoes of Diebold voting machines, plus billions of dollars poured into elections. But I can see why HN audience is prone to be persuaded this is a good idea.
      - 6y ago

zaroth 6y ago

I found a very detailed description of how absentee ballots are handled in Orange County (CA) here [1] It’s a complex and laborious process, including multiple partially automated steps both in sending, receiving, and processing an application for an absentee ballot, as well sending, receiving, and processing the absentee ballot itself (in one of several possible languages, as requested by the voter). This includes a manual step of comparing the voters signature on an outer envelope, which is scanned by machine and presented to remote data entry techs for side-by-side comparison with the signature on the scanned application for the absentee ballot. If the signatures aren’t a good enough match as decided by the human, the ballot is rejected (and the voter eventually notified). So if you’re not sending applications for an absentee ballot out to voters, where is this signature coming from that you are comparing against? It can’t possibly be the electronically captured signature on the drivers license, because that one is chicken scratch... [1] - https://www.ocvote.com/election-library/docs/2007%20Grand%20Jury%20Absentee%20Ballot%20Process%20Report.pdf https://www.ocvote.com/election-library/docs/2007%20Grand%20...