16 ms·

What I dislike about a lot of these potential fraud analysis techniques is that if a group that was performing fraud was aware of them, then they would simply p

by ve55 6y ago

What I dislike about a lot of these potential fraud analysis techniques is that if a group that was performing fraud was aware of them, then they would simply perform the fraud 'properly' such that the given technique(s) don't show evidence (since they know what others are looking for and hoping to find, they simply ensure it isn't there). The same goes for similar techniques like Benford's law: once you know about them, you can improve your sophistication so that no conclusion can be made (There are some interesting exceptions here since most claims of fraud would have one believe that centralized or semi-centralized fraud is much harder to perform than decentralized/random fraud, in which case due to coordination issues, some of these techniques could still bear fruit). But, the obvious overlaying issue is that the system is broken from the bottom up: there is no authentication, authorization, or encryption. Rather than having random Internet bloggers attempt to detect fraud with the information and tools they have, the system should instead be made secure and robust from the bottom-up, starting with how votes are made, tallied, transported, and so on. Additionally the technologies used, voting machines used, counting methods used, and voting system itself (lacking any ranked-choice or similar options) are all severely lacking modern improvements. No single person should be counting votes and typing numbers into fields. We should at least try to use some of the multidisciplinary technology developed in the last five or so decades to try to patch this from the bottom-up so that the system is much more robust and auditable for the future, because things are only going to get weirder (honestly, the US election went very smoothly compared to how it gone have gone, imo - there is no better time to prevent future disasters than today).

alisonkisk 6y ago
Smart careful criminals are smart and careful. Most criminals are stupid or lazy.
- crobertsbmw 6y ago
  What a fun thing to say.
IfOnlyYouKnew 6y ago
The system is secure and robust, at least with regards to the mechanics of individual votings. Among the main factors is its distributed nature. You just can't run a scam with senior citizen volunteers in thousands of individual precincts. Then, there are observers. Famous case from this week's election was Republicans complaining that their two dozen(!) observers weren't allowed closer than 6 feet to the ballots. It would be impossible for fraud to happen on any regular basis and not coming to light. So the incidence of 0.00002% (https://www.vox.com/policy-and-politics/2017/4/26/15424270/voter-fraud-north-carolina https://www.vox.com/policy-and-politics/2017/4/26/15424270/v...) is somewhat informative. If it were possible to manipulate the vote tabulation in any meaningful way, the GOP wouldn't need to go to all the lengths it does w.r.t. gerrymandering, purging voter roles, coming up with new requirements for voting, or closing voting precincts.
- mistermann 6y ago
  > The system is secure and robust, at least with regards to the mechanics of individual votings. Not a single vulnerability or shortcoming? How would one know such a thing? > You just can't run a scam with senior citizen volunteers in thousands of individual precincts. Is this the only possible exploit? Is corruption of thousands of precincts even needed in a tight race? > It would be impossible for fraud to happen on any regular basis and not coming to light. How would one know such a thing? Is it possible on an irregular basis? Is it impossible that it does get noticed, but no serious followup? Have there been no examples of whistleblowers who were not listened to in the history of the USA, election related or not? > So the incidence of 0.00002% (https://www.vox.com/policy-and-politics/2017/4/26/15424270/v https://www.vox.com/policy-and-politics/2017/4/26/15424270/v...) is somewhat informative. How might we know that that impressive looking number is accurate? Does vox have an omniscient on staff? I wonder if when the discussion is about a non-politicized topic (like standard, run of the mill security), might there be a difference in mindset when people are formulating their opinions. If the system in question was for anything other than voting, I suspect IT folks would be a little less accepting of evidence-lite assurances that a distributed, largely manually implemented (by non-experts) system of this scale and frequency of usage is 100% up to snuff. It seems rather unlikely that an inconsistent, somewhat cobbled together and non-expertly manned system of this scope is absolutely perfect. And yet, this seems to be not only the overwhelming narrative, but the fact passed down from the media - the same one that spent the last 4 years assuring us that Russia had hacked the prior election.
jonhohle 6y ago
I’m not a statistician or political scientist, but my intuition would say that it is probably easy to defeat any given statistical analysis of voting data, but would be difficult to defeat two or more simultaneously. In cryptographic terms, it might be possible to find a collision in MD5 or SHA1, but finding a collision in both for the same target payload would be significantly more difficult. This is actually a very valid use of blockchain, imho, that would go very far in securing elections, make remote online voting more secure, and provide a public, auditable, immutable log.
- michaelmrose 6y ago
  - How does this work and simultaneously protect the secret ballot. For example how do I as an outside audit it if I can't check the a vote for foo wasn't counted as a vote for bar. I know in theory you could provide a means for THEM to verify it and again you have broken the secret ballot and they can prove to others how they voted. - With one technology used to secure the entire election on which hinges trillions of dollars and control of the most powerful military in the world how do you know that a singular exploit wouldn't allow you to forge the election. - Given that the functioning or non functioning would rely on crypto instead of things people understand like counting marks on paper how would you ever expect regular people to trust it?
  - tcgv 6y ago
    For one, a blockchain based voting system would allow individual voters to ensure that their votes haven't been tampered with, without breaking anonymity. If one or more voters fail to check their vote registered in the blockchain, they could submit a complain providing their voting key and voting receipt (this receipt could be any proof of vote, like a public verifiable signature provided by the blockchain at the time of voting)
    - rjmunro 6y ago
      The main reason you can't force people to vote for you is that once they get in the polling booth, no one knows how they specifically voted. If you allow people to "check their vote" later, an attacker could verify that they voted in the way the attacker wanted.
save_ferris 6y ago
One very important point to consider in all of this is that the states administer their own elections and election processes directly. While this makes unifying the voting system practically impossible, it prevents a singular federal authority from directly interfering in the electoral process. I don't think we can safely assume that a president or any other federal authority should have the power to oversee any aspect of the voting process, regardless of party affiliation. We discovered the value of that power check during this election cycle.
- TechBro8615 6y ago
  Sure, but 25+ states are using the same hardware/software from a single vendor (Dominion).
- zo1 6y ago
  Just because it's distributed or handled individually by each state doesn't necessarily mean it can't be compromised or interfered with. If anything, I would argue that because it's distributed and handled by individual smaller units, each individual one is susceptible to interference within its own area. On a side note: There is a reason why people recommend "don't roll your own encryption". Some things such as security are hard problems, and just because you want to be "independent" doesn't mean you should come up with your own half-baked solution to the problem instead of using a secure and standardized one.
  - save_ferris 6y ago
    I'm not saying that state-run election systems can't be interfered with, there's just no way for a single actor to compromise all systems simultaneously from a single point, legislatively or otherwise. Of course those systems can and should be hardened, but arguing that it should be done in a standard way completely ignores the reality of the political system that we're in. That's like going to your boss and suggesting to completely rewrite your company codebase in X language because it's more secure. Theoretically, it's not a bad idea, but the reality is that it doesn't work that way.
maxerickson 6y ago
What 'modern improvements' can be made over paper ballots?
- ed25519FUUU 6y ago
  I think most of the improvements can be made in relation to voter registrations and rolls. How a state can keep people who have obviously died on voter rolls should be a red flag.
  - guram11 6y ago
    I agree and like to point out the downvotes to your comment raise a "red" flag itself
    - EricDeb 6y ago
      I think most democrats would agree purging dead people from the voters roles is something that could be improved. However, dead people voting is not a significant problem. Trump is using it as a reason to cast doubt on the election outcome. https://www.politifact.com/factchecks/2020/nov/07/tweets/list-does-not-show-over-14000-dead-people-cast-bal/ https://www.politifact.com/factchecks/2020/nov/07/tweets/lis... https://www.politifact.com/factchecks/2017/may/18/chain-email/no-thousands-dead-people-are-not-registered-vote-n/ https://www.politifact.com/factchecks/2017/may/18/chain-emai...
  - gwd 6y ago
    I'm pretty sure if I looked I could find you: 1. A voter registration of a T R D* in the Detroit area in the 1970s 2. A death certificate for T R D from the 1980s 3. A record of a T R D voting in the Detroit area in the 2020 election. That's because T R D from #1 and #2 was my uncle, who grew up in the Detroit area, and died in the 1980s; and the T R D from #3 is my brother, who also grew up in the Detroit area, and is still alive and well. It turns out that 1) a lot of people are named after their relatives. And also, 2) a lot of people still live where those relatives lived. And, 3) a lot of those relatives, being from the previous generation, have died. Any intersection of #2 and #3 will give you the "evidence of dead people on the voter rolls" (or "evidence of dead people voting") that we've been hearing so much about. How big is that intersection in a state with 10 million people? (* Full name redacted, but I have a very specific T R D in mind)
ffdjjjffjj 6y ago
Another thing worth mentioning is it’s a lot easier to spread a faulty statistics analysis than it is to spread an explanation. I’ve seen a lot of viral posts about Benford’s law and the 2020 election. I finally dig up the data and the explanation - which is mundane - and yet I’m not seeing a bunch of viral “this is why those posts were wrong” responses.
7952 6y ago
A feature of simple paper based systems is that normal people can understand the system and can even help to validate the process. It may have flaws, but they are pretty apparent to everyone. Technology and encryption seems far less easy to understand and more open to malicious complaints. A voter who doesn't trust the current system is not going to trust block chains or hashing algorithms.
- rhinoceraptor 6y ago
  The other feature of paper systems is that they're physical. Casting 10,000 fraudulent votes is 10,000 times harder than one fraudulent vote, unlike an attack on a digital system where if you have an attack, there is likely no significant difference.
defertoreptar 6y ago
> then they would simply perform the fraud 'properly' such that the given technique(s) don't show evidence Unless the fraud is decentralized, for example when some scattered districts fudge their numbers but can't necessarily coordinate with one another (and especially not with those districts that aren't fraudulent). In that case, the anomalies would still show up.

by ve55 6y ago

alisonkisk 6y ago

Smart careful criminals are smart and careful. Most criminals are stupid or lazy.

crobertsbmw 6y ago
What a fun thing to say.

IfOnlyYouKnew 6y ago

The system is secure and robust, at least with regards to the mechanics of individual votings. Among the main factors is its distributed nature. You just can't run a scam with senior citizen volunteers in thousands of individual precincts. Then, there are observers. Famous case from this week's election was Republicans complaining that their two dozen(!) observers weren't allowed closer than 6 feet to the ballots. It would be impossible for fraud to happen on any regular basis and not coming to light. So the incidence of 0.00002% (https://www.vox.com/policy-and-politics/2017/4/26/15424270/voter-fraud-north-carolina https://www.vox.com/policy-and-politics/2017/4/26/15424270/v...) is somewhat informative. If it were possible to manipulate the vote tabulation in any meaningful way, the GOP wouldn't need to go to all the lengths it does w.r.t. gerrymandering, purging voter roles, coming up with new requirements for voting, or closing voting precincts.

mistermann 6y ago
> The system is secure and robust, at least with regards to the mechanics of individual votings. Not a single vulnerability or shortcoming? How would one know such a thing? > You just can't run a scam with senior citizen volunteers in thousands of individual precincts. Is this the only possible exploit? Is corruption of thousands of precincts even needed in a tight race? > It would be impossible for fraud to happen on any regular basis and not coming to light. How would one know such a thing? Is it possible on an irregular basis? Is it impossible that it does get noticed, but no serious followup? Have there been no examples of whistleblowers who were not listened to in the history of the USA, election related or not? > So the incidence of 0.00002% (https://www.vox.com/policy-and-politics/2017/4/26/15424270/v https://www.vox.com/policy-and-politics/2017/4/26/15424270/v...) is somewhat informative. How might we know that that impressive looking number is accurate? Does vox have an omniscient on staff? I wonder if when the discussion is about a non-politicized topic (like standard, run of the mill security), might there be a difference in mindset when people are formulating their opinions. If the system in question was for anything other than voting, I suspect IT folks would be a little less accepting of evidence-lite assurances that a distributed, largely manually implemented (by non-experts) system of this scale and frequency of usage is 100% up to snuff. It seems rather unlikely that an inconsistent, somewhat cobbled together and non-expertly manned system of this scope is absolutely perfect. And yet, this seems to be not only the overwhelming narrative, but the fact passed down from the media - the same one that spent the last 4 years assuring us that Russia had hacked the prior election.

jonhohle 6y ago

I’m not a statistician or political scientist, but my intuition would say that it is probably easy to defeat any given statistical analysis of voting data, but would be difficult to defeat two or more simultaneously. In cryptographic terms, it might be possible to find a collision in MD5 or SHA1, but finding a collision in both for the same target payload would be significantly more difficult. This is actually a very valid use of blockchain, imho, that would go very far in securing elections, make remote online voting more secure, and provide a public, auditable, immutable log.

michaelmrose 6y ago
- How does this work and simultaneously protect the secret ballot. For example how do I as an outside audit it if I can't check the a vote for foo wasn't counted as a vote for bar. I know in theory you could provide a means for THEM to verify it and again you have broken the secret ballot and they can prove to others how they voted. - With one technology used to secure the entire election on which hinges trillions of dollars and control of the most powerful military in the world how do you know that a singular exploit wouldn't allow you to forge the election. - Given that the functioning or non functioning would rely on crypto instead of things people understand like counting marks on paper how would you ever expect regular people to trust it?
- tcgv 6y ago
  For one, a blockchain based voting system would allow individual voters to ensure that their votes haven't been tampered with, without breaking anonymity. If one or more voters fail to check their vote registered in the blockchain, they could submit a complain providing their voting key and voting receipt (this receipt could be any proof of vote, like a public verifiable signature provided by the blockchain at the time of voting)
  - rjmunro 6y ago
    The main reason you can't force people to vote for you is that once they get in the polling booth, no one knows how they specifically voted. If you allow people to "check their vote" later, an attacker could verify that they voted in the way the attacker wanted.

save_ferris 6y ago

One very important point to consider in all of this is that the states administer their own elections and election processes directly. While this makes unifying the voting system practically impossible, it prevents a singular federal authority from directly interfering in the electoral process. I don't think we can safely assume that a president or any other federal authority should have the power to oversee any aspect of the voting process, regardless of party affiliation. We discovered the value of that power check during this election cycle.

TechBro8615 6y ago
Sure, but 25+ states are using the same hardware/software from a single vendor (Dominion).
zo1 6y ago
Just because it's distributed or handled individually by each state doesn't necessarily mean it can't be compromised or interfered with. If anything, I would argue that because it's distributed and handled by individual smaller units, each individual one is susceptible to interference within its own area. On a side note: There is a reason why people recommend "don't roll your own encryption". Some things such as security are hard problems, and just because you want to be "independent" doesn't mean you should come up with your own half-baked solution to the problem instead of using a secure and standardized one.
- save_ferris 6y ago
  I'm not saying that state-run election systems can't be interfered with, there's just no way for a single actor to compromise all systems simultaneously from a single point, legislatively or otherwise. Of course those systems can and should be hardened, but arguing that it should be done in a standard way completely ignores the reality of the political system that we're in. That's like going to your boss and suggesting to completely rewrite your company codebase in X language because it's more secure. Theoretically, it's not a bad idea, but the reality is that it doesn't work that way.

maxerickson 6y ago

What 'modern improvements' can be made over paper ballots?

ed25519FUUU 6y ago
I think most of the improvements can be made in relation to voter registrations and rolls. How a state can keep people who have obviously died on voter rolls should be a red flag.
- guram11 6y ago
  I agree and like to point out the downvotes to your comment raise a "red" flag itself
  - EricDeb 6y ago
    I think most democrats would agree purging dead people from the voters roles is something that could be improved. However, dead people voting is not a significant problem. Trump is using it as a reason to cast doubt on the election outcome. https://www.politifact.com/factchecks/2020/nov/07/tweets/list-does-not-show-over-14000-dead-people-cast-bal/ https://www.politifact.com/factchecks/2020/nov/07/tweets/lis... https://www.politifact.com/factchecks/2017/may/18/chain-email/no-thousands-dead-people-are-not-registered-vote-n/ https://www.politifact.com/factchecks/2017/may/18/chain-emai...
- gwd 6y ago
  I'm pretty sure if I looked I could find you: 1. A voter registration of a T R D* in the Detroit area in the 1970s 2. A death certificate for T R D from the 1980s 3. A record of a T R D voting in the Detroit area in the 2020 election. That's because T R D from #1 and #2 was my uncle, who grew up in the Detroit area, and died in the 1980s; and the T R D from #3 is my brother, who also grew up in the Detroit area, and is still alive and well. It turns out that 1) a lot of people are named after their relatives. And also, 2) a lot of people still live where those relatives lived. And, 3) a lot of those relatives, being from the previous generation, have died. Any intersection of #2 and #3 will give you the "evidence of dead people on the voter rolls" (or "evidence of dead people voting") that we've been hearing so much about. How big is that intersection in a state with 10 million people? (* Full name redacted, but I have a very specific T R D in mind)

ffdjjjffjj 6y ago

Another thing worth mentioning is it’s a lot easier to spread a faulty statistics analysis than it is to spread an explanation. I’ve seen a lot of viral posts about Benford’s law and the 2020 election. I finally dig up the data and the explanation - which is mundane - and yet I’m not seeing a bunch of viral “this is why those posts were wrong” responses.

7952 6y ago

A feature of simple paper based systems is that normal people can understand the system and can even help to validate the process. It may have flaws, but they are pretty apparent to everyone. Technology and encryption seems far less easy to understand and more open to malicious complaints. A voter who doesn't trust the current system is not going to trust block chains or hashing algorithms.

rhinoceraptor 6y ago
The other feature of paper systems is that they're physical. Casting 10,000 fraudulent votes is 10,000 times harder than one fraudulent vote, unlike an attack on a digital system where if you have an attack, there is likely no significant difference.

defertoreptar 6y ago

> then they would simply perform the fraud 'properly' such that the given technique(s) don't show evidence Unless the fraud is decentralized, for example when some scattered districts fudge their numbers but can't necessarily coordinate with one another (and especially not with those districts that aren't fraudulent). In that case, the anomalies would still show up.