9 ms·

An expert on voting machines explains how they work

36 points by zuhayeer 6y ago

adolph 6y ago
Interview with Douglas W. Jones, a computer scientist at the University of Iowa and co-author of the book Broken Ballots A fundamental flaw of direct-recording voting machines—that is, ones where you pull the lever on an old mechanical machine or you touch the touch screen on a modern one—all of those machines end up being completely impossible to audit. There’s no way to know whether the machine was honest or not, short of taking it apart and actually being able to inspect the mechanism. We have no good way of doing that with software. The complete lack of any auditable record of the count, so that you had to completely trust programmers, was a real problem. [But] the vast majority of votes in the U.S. today are being recorded on paper ballots that are filled in by hand. That makes me feel reasonably good. And furthermore, a growing number of states have some kind of an audit law.
- adolph 6y ago
  Interview with Douglas W. Jones, a computer scientist at the University of Iowa and co-author of the book Broken Ballots A fundamental flaw of direct-recording voting machines—that is, ones where you pull the lever on an old mechanical machine or you touch the touch screen on a modern one—all of those machines end up being completely impossible to audit. There’s no way to know whether the machine was honest or not, short of taking it apart and actually being able to inspect the mechanism. We have no good way of doing that with software. The complete lack of any auditable record of the count, so that you had to completely trust programmers, was a real problem. [But] the vast majority of votes in the U.S. today are being recorded on paper ballots that are filled in by hand. That makes me feel reasonably good. And furthermore, a growing number of states have some kind of an audit law. Broken Ballots book website: http://timbergroves.com/bb/ http://timbergroves.com/bb/ Douglas W. Jones: http://homepage.divms.uiowa.edu/~jones/ http://homepage.divms.uiowa.edu/~jones/
- Spivak 6y ago
  I don't get this one since digital voting machines right now today have auditing built-in that can be done by anyone. When you submit your vote it prints out a paper receipt you drop in a box that can be counted asynchronously and take as long as needed to verify the digital count. Best of both worlds.
  - sambe 6y ago
    "Can be" or "will be"?
    - Spivak 6y ago
      I mean voting is a very human affair. If you don't trust the humans to count the votes to verify the results then you couldn't trust them to count normal paper ballots either.
      - mshook 6y ago
        The way it's done here in France is it's just random voters who offer to do the recount (usually after being asked because it's pretty boring haha). And you don't count alone, there are people with you who count with you and who double check what you do. It works the following way. You legally must have: - one person who opens the envelope containing the ballot and unfolds it - one who reads out loud the ballot - at least two who write down what the person above said And all that is supervised by the same people who were manning the polling station (at least 4 them). So it becomes a lot harder not to trust humans when you have at least 4 persons who saw the ballot and a couple others observing if everything is being done as expected.
      - jcynix 6y ago
        In Germany you can watch the local committees while they are counting. it's an open affair. And you'll hear the numbers as the results are reported by phone to the next level. Which allows anyone who was present during the counting to audit the numbers when they are published afterwards. And yes, I did watch every now and then.
  - 6y ago
ryanobjc 6y ago
I've done election clerking, which I highly encourage everyone to do. Here in SF, it's an entirely paper election, and at every precinct there is a ballot scanner. As people fill out their ballots, it gets scanned, tabulated (aka "counted"), then deposited in a locked box that's part of the machine. Your ballot has no personally identifying markings, and is now lost in a pile of other ballots. That is how ballot secrecy works in practice. At the end of the night, the electronic tabulation is removed from the machine (CF cards), then given in a security sealed bag to a deputy officer who takes it to city hall to be summed up for the results. The paper results are organized, and put in security sealed bags, and given to a sheriff (person with gun), and locked into a van to be transported back to city hall. So now we have the best of both worlds: fast results, and paper audit trail. Any precinct can be retabulated - just run all the cards thru a machine again. The mail-in ballots are processed separately, and once the envelopes have been verified, the ballots are put thru a tabulation machine as well. My understanding is city hall has a ballot tabulator for every precinct mail-in, and as they process mail they drop them in the appropriate machine. If a mistake was made - it's easily correctable because each ballot has the precinct number printed on it. It's a very easy to understand system, that requires only basic elements of computer security. Cross checking a ballot tabulator for accuracy is easy. Recounting is easy. And finally, for accessible voting, people use a tablet to choose their selections, then their ballot is printed out, which contains the summary of the vote, and a QR code the ballot machine scans. Oh yes, and the ballot machine scans and keeps image files of every ballot. I'm not sure what they do with that, but there we go. It's fascinating, and my experiences in the SF elections department gives me high confidence that the SF election, and any run like it, are very secure, and accurate.
- adolph 6y ago
  From the interview a story about paper ballot tabulation problems: With fill-in-the-bubble ballots, a typical error would be printing the ballot with the candidates in one order but programming the scanner with the candidates in a different order. There was a famous incident of this happening [in] Pottawattamie County, [Iowa], in 2006 in its June primary. The net result was that the numbers that came up were pretty nonsensical and bore no relationship with anyone’s expectation of the outcome of the race. The election officials noticed. They did a hand count, and that completely resolved the problem. And they could because they had paper ballots. I think like most things there are tradeoffs and the qualities most needed in the system run counter to one another--speed can cause errors to be missed, security reduces access, etc.
pintxo 6y ago
What I don't get: vote counting is an easy to distribute problem, if done completely manually. Why take all this effort, cost and risk with the automation if it's awfully slow in the end? Germany uses (mostly) all paper ballots which are counted in each voting location by the local election committee, which is usually chaired by a government employee, and filled up with randomly chosen citizens. First results are often available 3-4h after closing of the voting location. With final results available during the next 1-2 days. All ballots will be collected on the next org level, to be available for audits/recounts.
- HideousKojima 6y ago
  Easier to commit fraud or, more likely, easier to get cushy government contracts for the companies making the machines and software.
- cafard 6y ago
  Does Germany have as many items on a typical ballot. In Washington, DC, we had city council (by ward), city council (at large), non-voting delegate to Congress, shadow representative, shadow senator, a couple of school board slots, advisory neighborhood commissioner, and of course president. In a state you might have two state legislative seats up, plus some county offices.
  - pintxo 6y ago
    This was the 2011 city council ballot for Frankfurt am Main: https://chalog.files.wordpress.com/2011/03/stimmzettel.jpg https://chalog.files.wordpress.com/2011/03/stimmzettel.jpg Every voter had 93 votes, one for each seat in the city council. It's a rather complicated system, where you can freely assign up to 3 votes of your 93 votes to each candidate, can strike candidates from the list or simply vote for party lists. Federal elections are way simpler, with just 2 votes. But often several elections are combined. But there are less elections overall in Germany, as we usually only vote for: city council, county council, state and federal parliaments, and finally EU parliament. 5 in total, most of them every 4 years, so on average 1.2 votings per year.
- 6y ago
mshook 6y ago
The issue I have with pure electronic voting machines are numerous: it's hard to audit them and it's been shown many times in the past how easy it is to compromise them. But if you put aside the security or the bug free status of the whole thing, a true democratic vote has at least 2 properties: 1. it's anonymous 2. it can be audited by a layman Because of the complexity or bugs or whatever, #1 cannot really be guaranteed. Voting machine vendors will say they have no way to track voters until someone finds a flow or figure it out. Or machines could be altered or hacked or... But really the biggest problem is #2: because if there's a problem, you need a paper trail. Because in the event of a recount, you want your average joe or jane to be able to recount ballots. You could bring all the blockchain stuff (because I often hear that) or what not into the argument, you still wouldn't be able to do both #1 and #2. So to me, voting must remain a paper thing.
- tcbawo 6y ago
  A voting machine can produce a printed ballot which is scanned by a separate counting machine. This can be checked for consistency by the voter. Also, you can have more than one scanning machine to verify the ballots are counted properly. And you have a paper trail if a recount is necessary.
  - mshook 6y ago
    So the voter would not only "print" his own ballot but check the consistency? That's not what I call audit. Audit is supposed to be multiple pair of eyes during counting. Plus you'd possibly lose the anonymity of the vote if the voter did both (timestamping transactions and so on). If all counting machines are the same, how do you know they're not all wrong? Or not all tampered with? And even if they all give you the same results, how do you know it's actually correct or how do you decide to recount? You have no real way to: you have to count. So at that point you might as well have counted in the first place. Ideally you should have multiple vendors and make sure they all give the same results. But who's going to do that?
- thaumasiotes 6y ago
  > You could bring all the blockchain stuff (because I often hear that) or what not into the argument, you still wouldn't be able to do both #1 and #2. You can't do both #1 and #2 now. An anonymous ballot can't be audited, because it has no provenance -- if somebody slips an extra ballot in, how would you tell?
throwaway2245 6y ago
> ...if we do it right, the Devil himself could build the voting machines, and we could hold an honest election,” Jones says. “And doing it right means having genuinely auditable technology... Volkswagen proves this to be an unsafe assumption - their technology intentionally behaved differently during an audit. I'm pretty sure it would be straightforward for the devil to know when they were being audited or not.
- Jtsummers 6y ago
  Volkswagen got around it via triggers to detect tests, not audits. It is a bit different. If you could detect that your system was being used in a test, you could yield correct results. Then otherwise yield biased results (perhaps the first so many votes of the day are always correct, and the biases are introduced later). Auditing means things like paper trails (get an automatic electronic tally, but produce a verifiable paper ballot that can be counted in the case of any apparent inconsistencies). This discourages cheating on the electronic tallies because you never know when an audit may take place.
jungletime 6y ago
Since election fraud is such a hot topic right now. There are statistical ways to test for Fraud. Here is a simple one, based on the distribution of integers. DIY Election Fraud Analysis Using Benford’s Law https://www.kdnuggets.com/2020/09/diy-election-fraud-analysis-benfords-law.html https://www.kdnuggets.com/2020/09/diy-election-fraud-analysi... python code https://pastebin.com/GFUeeigY https://pastebin.com/GFUeeigY Raw Data https://www.kaggle.com/unanimad/us-election-2020?select=president_county_candidate.csv https://www.kaggle.com/unanimad/us-election-2020?select=pres...

36 points by zuhayeer 6y ago

Interview with Douglas W. Jones, a computer scientist at the University of Iowa and co-author of the book Broken Ballots A fundamental flaw of direct-recording voting machines—that is, ones where you pull the lever on an old mechanical machine or you touch the touch screen on a modern one—all of those machines end up being completely impossible to audit. There’s no way to know whether the machine was honest or not, short of taking it apart and actually being able to inspect the mechanism. We have no good way of doing that with software. The complete lack of any auditable record of the count, so that you had to completely trust programmers, was a real problem. [But] the vast majority of votes in the U.S. today are being recorded on paper ballots that are filled in by hand. That makes me feel reasonably good. And furthermore, a growing number of states have some kind of an audit law.

adolph 6y ago
Interview with Douglas W. Jones, a computer scientist at the University of Iowa and co-author of the book Broken Ballots A fundamental flaw of direct-recording voting machines—that is, ones where you pull the lever on an old mechanical machine or you touch the touch screen on a modern one—all of those machines end up being completely impossible to audit. There’s no way to know whether the machine was honest or not, short of taking it apart and actually being able to inspect the mechanism. We have no good way of doing that with software. The complete lack of any auditable record of the count, so that you had to completely trust programmers, was a real problem. [But] the vast majority of votes in the U.S. today are being recorded on paper ballots that are filled in by hand. That makes me feel reasonably good. And furthermore, a growing number of states have some kind of an audit law. Broken Ballots book website: http://timbergroves.com/bb/ http://timbergroves.com/bb/ Douglas W. Jones: http://homepage.divms.uiowa.edu/~jones/ http://homepage.divms.uiowa.edu/~jones/
Spivak 6y ago
I don't get this one since digital voting machines right now today have auditing built-in that can be done by anyone. When you submit your vote it prints out a paper receipt you drop in a box that can be counted asynchronously and take as long as needed to verify the digital count. Best of both worlds.
- sambe 6y ago
  "Can be" or "will be"?
  - Spivak 6y ago
    I mean voting is a very human affair. If you don't trust the humans to count the votes to verify the results then you couldn't trust them to count normal paper ballots either.
    - mshook 6y ago
      The way it's done here in France is it's just random voters who offer to do the recount (usually after being asked because it's pretty boring haha). And you don't count alone, there are people with you who count with you and who double check what you do. It works the following way. You legally must have: - one person who opens the envelope containing the ballot and unfolds it - one who reads out loud the ballot - at least two who write down what the person above said And all that is supervised by the same people who were manning the polling station (at least 4 them). So it becomes a lot harder not to trust humans when you have at least 4 persons who saw the ballot and a couple others observing if everything is being done as expected.
    - jcynix 6y ago
      In Germany you can watch the local committees while they are counting. it's an open affair. And you'll hear the numbers as the results are reported by phone to the next level. Which allows anyone who was present during the counting to audit the numbers when they are published afterwards. And yes, I did watch every now and then.
- 6y ago

ryanobjc 6y ago

I've done election clerking, which I highly encourage everyone to do. Here in SF, it's an entirely paper election, and at every precinct there is a ballot scanner. As people fill out their ballots, it gets scanned, tabulated (aka "counted"), then deposited in a locked box that's part of the machine. Your ballot has no personally identifying markings, and is now lost in a pile of other ballots. That is how ballot secrecy works in practice. At the end of the night, the electronic tabulation is removed from the machine (CF cards), then given in a security sealed bag to a deputy officer who takes it to city hall to be summed up for the results. The paper results are organized, and put in security sealed bags, and given to a sheriff (person with gun), and locked into a van to be transported back to city hall. So now we have the best of both worlds: fast results, and paper audit trail. Any precinct can be retabulated - just run all the cards thru a machine again. The mail-in ballots are processed separately, and once the envelopes have been verified, the ballots are put thru a tabulation machine as well. My understanding is city hall has a ballot tabulator for every precinct mail-in, and as they process mail they drop them in the appropriate machine. If a mistake was made - it's easily correctable because each ballot has the precinct number printed on it. It's a very easy to understand system, that requires only basic elements of computer security. Cross checking a ballot tabulator for accuracy is easy. Recounting is easy. And finally, for accessible voting, people use a tablet to choose their selections, then their ballot is printed out, which contains the summary of the vote, and a QR code the ballot machine scans. Oh yes, and the ballot machine scans and keeps image files of every ballot. I'm not sure what they do with that, but there we go. It's fascinating, and my experiences in the SF elections department gives me high confidence that the SF election, and any run like it, are very secure, and accurate.

adolph 6y ago
From the interview a story about paper ballot tabulation problems: With fill-in-the-bubble ballots, a typical error would be printing the ballot with the candidates in one order but programming the scanner with the candidates in a different order. There was a famous incident of this happening [in] Pottawattamie County, [Iowa], in 2006 in its June primary. The net result was that the numbers that came up were pretty nonsensical and bore no relationship with anyone’s expectation of the outcome of the race. The election officials noticed. They did a hand count, and that completely resolved the problem. And they could because they had paper ballots. I think like most things there are tradeoffs and the qualities most needed in the system run counter to one another--speed can cause errors to be missed, security reduces access, etc.

pintxo 6y ago

What I don't get: vote counting is an easy to distribute problem, if done completely manually. Why take all this effort, cost and risk with the automation if it's awfully slow in the end? Germany uses (mostly) all paper ballots which are counted in each voting location by the local election committee, which is usually chaired by a government employee, and filled up with randomly chosen citizens. First results are often available 3-4h after closing of the voting location. With final results available during the next 1-2 days. All ballots will be collected on the next org level, to be available for audits/recounts.

HideousKojima 6y ago
Easier to commit fraud or, more likely, easier to get cushy government contracts for the companies making the machines and software.
cafard 6y ago
Does Germany have as many items on a typical ballot. In Washington, DC, we had city council (by ward), city council (at large), non-voting delegate to Congress, shadow representative, shadow senator, a couple of school board slots, advisory neighborhood commissioner, and of course president. In a state you might have two state legislative seats up, plus some county offices.
- pintxo 6y ago
  This was the 2011 city council ballot for Frankfurt am Main: https://chalog.files.wordpress.com/2011/03/stimmzettel.jpg https://chalog.files.wordpress.com/2011/03/stimmzettel.jpg Every voter had 93 votes, one for each seat in the city council. It's a rather complicated system, where you can freely assign up to 3 votes of your 93 votes to each candidate, can strike candidates from the list or simply vote for party lists. Federal elections are way simpler, with just 2 votes. But often several elections are combined. But there are less elections overall in Germany, as we usually only vote for: city council, county council, state and federal parliaments, and finally EU parliament. 5 in total, most of them every 4 years, so on average 1.2 votings per year.
6y ago

mshook 6y ago

The issue I have with pure electronic voting machines are numerous: it's hard to audit them and it's been shown many times in the past how easy it is to compromise them. But if you put aside the security or the bug free status of the whole thing, a true democratic vote has at least 2 properties: 1. it's anonymous 2. it can be audited by a layman Because of the complexity or bugs or whatever, #1 cannot really be guaranteed. Voting machine vendors will say they have no way to track voters until someone finds a flow or figure it out. Or machines could be altered or hacked or... But really the biggest problem is #2: because if there's a problem, you need a paper trail. Because in the event of a recount, you want your average joe or jane to be able to recount ballots. You could bring all the blockchain stuff (because I often hear that) or what not into the argument, you still wouldn't be able to do both #1 and #2. So to me, voting must remain a paper thing.

tcbawo 6y ago
A voting machine can produce a printed ballot which is scanned by a separate counting machine. This can be checked for consistency by the voter. Also, you can have more than one scanning machine to verify the ballots are counted properly. And you have a paper trail if a recount is necessary.
- mshook 6y ago
  So the voter would not only "print" his own ballot but check the consistency? That's not what I call audit. Audit is supposed to be multiple pair of eyes during counting. Plus you'd possibly lose the anonymity of the vote if the voter did both (timestamping transactions and so on). If all counting machines are the same, how do you know they're not all wrong? Or not all tampered with? And even if they all give you the same results, how do you know it's actually correct or how do you decide to recount? You have no real way to: you have to count. So at that point you might as well have counted in the first place. Ideally you should have multiple vendors and make sure they all give the same results. But who's going to do that?
thaumasiotes 6y ago
> You could bring all the blockchain stuff (because I often hear that) or what not into the argument, you still wouldn't be able to do both #1 and #2. You can't do both #1 and #2 now. An anonymous ballot can't be audited, because it has no provenance -- if somebody slips an extra ballot in, how would you tell?

throwaway2245 6y ago

> ...if we do it right, the Devil himself could build the voting machines, and we could hold an honest election,” Jones says. “And doing it right means having genuinely auditable technology... Volkswagen proves this to be an unsafe assumption - their technology intentionally behaved differently during an audit. I'm pretty sure it would be straightforward for the devil to know when they were being audited or not.

Jtsummers 6y ago
Volkswagen got around it via triggers to detect tests, not audits. It is a bit different. If you could detect that your system was being used in a test, you could yield correct results. Then otherwise yield biased results (perhaps the first so many votes of the day are always correct, and the biases are introduced later). Auditing means things like paper trails (get an automatic electronic tally, but produce a verifiable paper ballot that can be counted in the case of any apparent inconsistencies). This discourages cheating on the electronic tallies because you never know when an audit may take place.

jungletime 6y ago

Since election fraud is such a hot topic right now. There are statistical ways to test for Fraud. Here is a simple one, based on the distribution of integers. DIY Election Fraud Analysis Using Benford’s Law https://www.kdnuggets.com/2020/09/diy-election-fraud-analysis-benfords-law.html https://www.kdnuggets.com/2020/09/diy-election-fraud-analysi... python code https://pastebin.com/GFUeeigY https://pastebin.com/GFUeeigY Raw Data https://www.kaggle.com/unanimad/us-election-2020?select=president_county_candidate.csv https://www.kaggle.com/unanimad/us-election-2020?select=pres...