5 ms·

Ballots don't need to be secret, they just need to be anonymous. If you get rid of the secret constraint, it becomes fairly easy to produce a trustworthy votin

Ballots don't need to be secret, they just need to be anonymous. If you get rid of the secret constraint, it becomes fairly easy to produce a trustworthy voting system: 1. Immediately before identifying at the polling location, each voter takes a nondescript strip of paper out of a large container of numerous strips of paper, each with a unique identifier printed on it. (No one but the voter knows which identifier they took. No one can force a specific identifier.) 2. The voter fills in the identifier on a Scantron-style paper ballot. (Easily digitized, with a paper trail.) The ballot box scans the unique identifier and spits back out out any ballot with an identifier that wasn't generated for that polling location. (Ensuring no one can force a specific identifier.) 3. A list containing the entirety of every ballot is published publicly, including the unique identifier. (The voter can look up their ballot later. It becomes difficult to coerce a voter because they can say any one of the published ballots is theirs.) 4. A list of names of people who voted is published publicly. (Registered voters who didn't vote can check if a ballot was cast in their name. This is already done in many places.) You can also have mail-in ballots with user-generated statistically-unique identifiers (requiring only several rolls of a die, so anyone can do it at home), but you can't prevent voter coercion that way.

amalcon 6y ago
> The voter fills in the identifier on a Scantron-style paper ballot. The voter will mess this up a disturbing fraction of the time. It will be rejected. The voter will try again, possibly have it rejected again, give up, and go on Twitter to complain about the new system. Also, I can go to vote, surreptitiously take two strips of paper, use one, pocket the other. I coerce my spouse into using that one, and pocket the one they took. > It becomes difficult to coerce a voter because they can say any one of the published ballots is theirs. Maybe for simple ballots. A question including e.g. a ranking of ten candidates has about 3.6 million possible configurations -- more if undervotes or other ties are permitted. The voter can be coerced to fill this out in a specific way to self-identify, and then vote in a prescribed way on another question. edit: Of course, this vulnerability already exists: the voter could be given that same instruction. An observer of the ballot counting process can tell if the correct ballot was cast.
- Mindless2112 6y ago
  Good points, though they're rather at odds. If you assume voters will mess up their ballots that frequently then the voter being coerced can just find a ballot that's close to what they were coerced to do and say they messed up the rest. No way to prevent surreptitiously taking more than one strip of paper comes to mind. Someone should be observing the voters take the strips of paper to ensure only one is taken, but that doesn't prevent sleight of hand. But if there are mail-in ballots, you've already basically given up on voter coercion anyway.
jcrawfordor 6y ago
What you describe is the ballot-permit system currently in use in many jurisdictions (terminology varies, and the permit may be called an application to vote, voter authorization, or similar). The difference is that the ballot information is not published. There are two reasons for this: 1) Current election systems, with few exceptions, do not retain per-ballot voting information, only tallies. This is in large part a practical matter, ballots go through various channels of handling including exceptional cases (e.g. hand entry of damaged ballots) and many of these paths become much more complicated if you need to electronically record the individual selections on each ballot. 2) The risk of re-identification of voters to ballots is high and extremely difficult or impossible to satisfactorily resolve. There are many, many potential ways to establish which specific ballot was cast by a given voter. This is especially important considering that in many elections the number of voters per ballot style (which may be equivalent to a precinct in your area, the exact combination of questions which appears on the ballot based on voter location and potentially party affiliation) will often not be very large, even in densely populated areas, because of course as the area becomes more densely populated the electoral precincts become smaller. Finally, your step 2 is quite unnecessary for current purposes, the physical possession of both the ballot and permit are sufficient to prevent overvoting. One permit entitles an individual to cast one ballot. In the case of mail-in voting the ballot is sealed inside of the permit in a tamper-evident fashion (the outer envelope serves as permit). It also presents a more complicated and worse privacy proposition than the existing system, as the ballots can be post facto linked to the permits and someone could have (likely did) observe the voter take the permit. In current practice ballots cannot be linked to permits after they are physically separated when the voter casts their ballot. This protects the voter by reducing the time period during which their ballot can be identified.
- Mindless2112 6y ago
  For point 2, you could put the very local questions on a separate ballot with a separate unique identifier per voter. It would be mildly inconvenient though. Someone should be observing the voter taking the strip of paper, but it would be done in a way to prevent them from observing which one was taken by the voter.
jhanschoo 6y ago
Regarding (3). In addition to other comments, a vote buyer can demand that a voter affirm their ballot number before the results are published.
tzs 6y ago
If you want a system based on Scantron-style paper ballots that allows cast ballots to be published, allows anyone to verify that the count was correct, and allows voters to verify that their vote was counted correctly without being able to prove they voted for a particular candidate, see this [1]. It's been around for several years, and has been used successfully in a few elections. [1] https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity
- Mindless2112 6y ago
  Excellent! (And presumably more robust than the scheme I described.)
akvadrako 6y ago
Why do you think ballots don’t need to be secret? That’s often been feature of democracy since the beginning.
mFixman 6y ago
"Prove that you voted for Putin or you are fired".

amalcon 6y ago

> The voter fills in the identifier on a Scantron-style paper ballot. The voter will mess this up a disturbing fraction of the time. It will be rejected. The voter will try again, possibly have it rejected again, give up, and go on Twitter to complain about the new system. Also, I can go to vote, surreptitiously take two strips of paper, use one, pocket the other. I coerce my spouse into using that one, and pocket the one they took. > It becomes difficult to coerce a voter because they can say any one of the published ballots is theirs. Maybe for simple ballots. A question including e.g. a ranking of ten candidates has about 3.6 million possible configurations -- more if undervotes or other ties are permitted. The voter can be coerced to fill this out in a specific way to self-identify, and then vote in a prescribed way on another question. edit: Of course, this vulnerability already exists: the voter could be given that same instruction. An observer of the ballot counting process can tell if the correct ballot was cast.

Mindless2112 6y ago
Good points, though they're rather at odds. If you assume voters will mess up their ballots that frequently then the voter being coerced can just find a ballot that's close to what they were coerced to do and say they messed up the rest. No way to prevent surreptitiously taking more than one strip of paper comes to mind. Someone should be observing the voters take the strips of paper to ensure only one is taken, but that doesn't prevent sleight of hand. But if there are mail-in ballots, you've already basically given up on voter coercion anyway.

jcrawfordor 6y ago

What you describe is the ballot-permit system currently in use in many jurisdictions (terminology varies, and the permit may be called an application to vote, voter authorization, or similar). The difference is that the ballot information is not published. There are two reasons for this: 1) Current election systems, with few exceptions, do not retain per-ballot voting information, only tallies. This is in large part a practical matter, ballots go through various channels of handling including exceptional cases (e.g. hand entry of damaged ballots) and many of these paths become much more complicated if you need to electronically record the individual selections on each ballot. 2) The risk of re-identification of voters to ballots is high and extremely difficult or impossible to satisfactorily resolve. There are many, many potential ways to establish which specific ballot was cast by a given voter. This is especially important considering that in many elections the number of voters per ballot style (which may be equivalent to a precinct in your area, the exact combination of questions which appears on the ballot based on voter location and potentially party affiliation) will often not be very large, even in densely populated areas, because of course as the area becomes more densely populated the electoral precincts become smaller. Finally, your step 2 is quite unnecessary for current purposes, the physical possession of both the ballot and permit are sufficient to prevent overvoting. One permit entitles an individual to cast one ballot. In the case of mail-in voting the ballot is sealed inside of the permit in a tamper-evident fashion (the outer envelope serves as permit). It also presents a more complicated and worse privacy proposition than the existing system, as the ballots can be post facto linked to the permits and someone could have (likely did) observe the voter take the permit. In current practice ballots cannot be linked to permits after they are physically separated when the voter casts their ballot. This protects the voter by reducing the time period during which their ballot can be identified.

Mindless2112 6y ago
For point 2, you could put the very local questions on a separate ballot with a separate unique identifier per voter. It would be mildly inconvenient though. Someone should be observing the voter taking the strip of paper, but it would be done in a way to prevent them from observing which one was taken by the voter.

jhanschoo 6y ago

Regarding (3). In addition to other comments, a vote buyer can demand that a voter affirm their ballot number before the results are published.

tzs 6y ago

If you want a system based on Scantron-style paper ballots that allows cast ballots to be published, allows anyone to verify that the count was correct, and allows voters to verify that their vote was counted correctly without being able to prove they voted for a particular candidate, see this [1]. It's been around for several years, and has been used successfully in a few elections. [1] https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity

Mindless2112 6y ago
Excellent! (And presumably more robust than the scheme I described.)

akvadrako 6y ago

Why do you think ballots don’t need to be secret? That’s often been feature of democracy since the beginning.

mFixman 6y ago

"Prove that you voted for Putin or you are fired".