4 ms·

The interesting thing is, I'm a huge fan of End-to-End auditable voting systems [1]. There's a ton of great work by very intelligent experts on a variety of opt

The interesting thing is, I'm a huge fan of End-to-End auditable voting systems [1]. There's a ton of great work by very intelligent experts on a variety of options with different tradeoffs. I find it speaks volumes about motivations that nobody seems to have any interest in the topic. But really both sides should want it, the left should want it so there's even less basis for doubt in the future, the right should want it if they honestly believe there was irregularity. 1. https://en.wikipedia.org/wiki/End-to-end_auditable_voting_systems https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy...

loopz 6y ago
It needs to allow secret votes though: Because of the importance of the right to a secret ballot, some E2E voting schemes also attempt to meet a third requirement, usually referred to as receipt freeness: No voter can demonstrate how he or she voted to any third party. Also, the more IT systems involved, the less people will be able to ascertain the process. Complex systems may have unknown and invisible weaknesses.
- zug_zug 6y ago
  So that's referring to the fact that because you have objective proof of who you voted for, maybe somebody could coerce (i.e. use violence) you to show them that proof. That's a tradeoff. I think the current election, or even just how screwed up elections are in other countries, show that it's probably an order of magnitude more important to have faith the process is objectively right, than to worry about the coercion scenario, which seems pretty contrived to me.
  - benmmurphy 6y ago
    Large scale use of absentee ballots or mail in ballots also allows coercion of voters. Most of the E2E systems are designed so it's not possible for a voter to prove to a third party who they voted for.
  - pmyteh 6y ago
    The concern isn't only coercion, it's also vote buying (which was very common at least in the UK before the secret ballot). If you can take the money and then vote for someone else, retail vote purchase falls apart. The existence of postal voting has already cracked this one open a bit, though.
- m0zg 6y ago
  You could still make the system more resilient to fraud, as well as easier to audit by introducing several levels of integrity protections. For example, it would cost next to nothing to capture pictures of all mail in ballot envelopes, and keep them for a few years. It would not cost much to release all voting data (both time series and totals) for free for statistical analysis in a uniform, machine readable format. Such data currently costs substantial amounts of money, and one of the most credible election integrity investigations (and the only one that yielded robust statistical evidence as far as I know) had to spend quarter of a million dollars to acquire it for several states. It would not cost much to capture the counting with a 4K webcam for future inspection and keep videos for a few years. It would not cost much to have uniform ballot mailing and arrival deadlines across states. It is also technically possible in 2020 to have voting systems that are not easily defeated after 1 minute intrusion by someone with the right tooling and a modicum of training. We have people on this site easily capable of designing such systems, as well as easily defeating the systems in use today. A lot of people (nearly all democrats) were interested in such things during Bush years, and demonstrated how easily hackable voting machines and systems are, only to promptly lose all interest and declare that everything is impenetrable the moment Obama was elected. Videos of their exposes are still on YouTube for everyone to see. For the record: I voted for Obama both times.
- tzs 6y ago
  You don't need complex systems for all E2E voting systems. Scantegrity II [1] uses pretty simple systems. A particularly nice thing is that casting your vote just involves filling in a bubble on a paper ballot--no electronics is involved at all in the voting booth. Machine counting just uses the simple optical scan counters that are an old and reliable technology. It also provides receipt freeness [2]. About half of all districts in the US already use the optical scan counters, which means if we switched to this half the districts would not need any expensive new equipment. All the mathematical/cryptographic magic is in how the ballots themselves are printed and in the pens used to fill the bubbles. [1] https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity [2] https://eprint.iacr.org/2010/502.pdf https://eprint.iacr.org/2010/502.pdf
- jjeaff 6y ago
  Couldn't one just record a video of themselves voting to prove who they voted for?
  - loopz 6y ago
    These are the things a proper election process need to hinder actually.
benmmurphy 6y ago
E2E is not a silver bullet. It doesn't solve the problem of ensuring only the people who are eligible to vote only vote once and people who are eligible to vote are not excluded. It also possible for an E2E system to have design flaws. For example Scytl created an E2E system for the Swiss that had a cryptographic flaw that would allow a mix operator to modify votes in an election undetected.
- zug_zug 6y ago
  Uh, it solves both of those. Let's take a trivial example from a non-expert (i.e. me) You could publish hash(salt + SSN) = Vote for all votes on a website, and therefore if somebody voted twice they'd hit the same hash twice. When you vote, you'd get a physical ballot, and a physical receipt, digitally signed by the booth. If what is published online Hash(salt + SSN) doesn't match your receipt, you'd have physical signed proof of tampering.
  - benmmurphy 6y ago
    This list of SSNs is not guarantee to correspond to people who have the right to vote. What I'm trying to claim is the math part of E2E doesn't prevent someone from stuffing the electoral rolls or the SSN database with fake people or preventing eligible voters from being correctly registered.
    - zug_zug 6y ago
      Well my only contention is that there are practical answers to all the what-ifs you can come up with. If you want to know more you should probably read the academic papers on the topic.
      - camgunz 6y ago
        I've read a few of these and, mostly OP is right. A lot of "we fixed voting" systems start with the premise that we know the information of everyone who's legally able to vote. We don't, and getting that information is very hard and at odds with making it easy to register, and subsequently vote. If you don't have that list, then there's nothing preventing you from padding the votes with fake people. You can try and implement some way of tracing the votes back to people but, first of all see point 1 up there (oh your phone number/email address/home address changed/was misspelled/you're homeless/you're a nomad) and second, you very likely break secret voting. FWIW there is no perfect voting system--that's the core problem w/ this discussion. We have to choose: - Do we have a citizen ID (there's a whole ball of wax here, primarily what happens if someone steals or you forget/lose your ID) - Do we think some people w/ a citizen ID still shouldn't vote (17 year olds, the incarcerated, etc.) - Do we create a potential link between people and their votes - Do we allow people to not vote - Do we require people to register before voting - Do we allow people to verify their vote was counted - Do we allow people to verify their vote was counted correctly (unclear how this would work) - Do we allow people to vote remotely - Do we create a paper trail - Do we allow people to fix problems with their ballots - Do we require people to sign their ballots, and do we require signature verification Many of these things are at odds with each other, and depending on how you flip the bits, different political interests will win out. That's the second reason this is such a nerd snipe. It really, really feels like this is a technical problem but it isn't. It's political, cultural, and societal. You're not gonna fix this with an app or an algorithm. If/When we do fix this I'm sure they'll be involved but, the reason will be multipartisan, multicultural consensus that we need to move forward.

loopz 6y ago

It needs to allow secret votes though: Because of the importance of the right to a secret ballot, some E2E voting schemes also attempt to meet a third requirement, usually referred to as receipt freeness: No voter can demonstrate how he or she voted to any third party. Also, the more IT systems involved, the less people will be able to ascertain the process. Complex systems may have unknown and invisible weaknesses.

zug_zug 6y ago
So that's referring to the fact that because you have objective proof of who you voted for, maybe somebody could coerce (i.e. use violence) you to show them that proof. That's a tradeoff. I think the current election, or even just how screwed up elections are in other countries, show that it's probably an order of magnitude more important to have faith the process is objectively right, than to worry about the coercion scenario, which seems pretty contrived to me.
- benmmurphy 6y ago
  Large scale use of absentee ballots or mail in ballots also allows coercion of voters. Most of the E2E systems are designed so it's not possible for a voter to prove to a third party who they voted for.
- pmyteh 6y ago
  The concern isn't only coercion, it's also vote buying (which was very common at least in the UK before the secret ballot). If you can take the money and then vote for someone else, retail vote purchase falls apart. The existence of postal voting has already cracked this one open a bit, though.
m0zg 6y ago
You could still make the system more resilient to fraud, as well as easier to audit by introducing several levels of integrity protections. For example, it would cost next to nothing to capture pictures of all mail in ballot envelopes, and keep them for a few years. It would not cost much to release all voting data (both time series and totals) for free for statistical analysis in a uniform, machine readable format. Such data currently costs substantial amounts of money, and one of the most credible election integrity investigations (and the only one that yielded robust statistical evidence as far as I know) had to spend quarter of a million dollars to acquire it for several states. It would not cost much to capture the counting with a 4K webcam for future inspection and keep videos for a few years. It would not cost much to have uniform ballot mailing and arrival deadlines across states. It is also technically possible in 2020 to have voting systems that are not easily defeated after 1 minute intrusion by someone with the right tooling and a modicum of training. We have people on this site easily capable of designing such systems, as well as easily defeating the systems in use today. A lot of people (nearly all democrats) were interested in such things during Bush years, and demonstrated how easily hackable voting machines and systems are, only to promptly lose all interest and declare that everything is impenetrable the moment Obama was elected. Videos of their exposes are still on YouTube for everyone to see. For the record: I voted for Obama both times.
tzs 6y ago
You don't need complex systems for all E2E voting systems. Scantegrity II [1] uses pretty simple systems. A particularly nice thing is that casting your vote just involves filling in a bubble on a paper ballot--no electronics is involved at all in the voting booth. Machine counting just uses the simple optical scan counters that are an old and reliable technology. It also provides receipt freeness [2]. About half of all districts in the US already use the optical scan counters, which means if we switched to this half the districts would not need any expensive new equipment. All the mathematical/cryptographic magic is in how the ballots themselves are printed and in the pens used to fill the bubbles. [1] https://en.wikipedia.org/wiki/Scantegrity https://en.wikipedia.org/wiki/Scantegrity [2] https://eprint.iacr.org/2010/502.pdf https://eprint.iacr.org/2010/502.pdf
jjeaff 6y ago
Couldn't one just record a video of themselves voting to prove who they voted for?
- loopz 6y ago
  These are the things a proper election process need to hinder actually.

benmmurphy 6y ago

E2E is not a silver bullet. It doesn't solve the problem of ensuring only the people who are eligible to vote only vote once and people who are eligible to vote are not excluded. It also possible for an E2E system to have design flaws. For example Scytl created an E2E system for the Swiss that had a cryptographic flaw that would allow a mix operator to modify votes in an election undetected.

zug_zug 6y ago
Uh, it solves both of those. Let's take a trivial example from a non-expert (i.e. me) You could publish hash(salt + SSN) = Vote for all votes on a website, and therefore if somebody voted twice they'd hit the same hash twice. When you vote, you'd get a physical ballot, and a physical receipt, digitally signed by the booth. If what is published online Hash(salt + SSN) doesn't match your receipt, you'd have physical signed proof of tampering.
- benmmurphy 6y ago
  This list of SSNs is not guarantee to correspond to people who have the right to vote. What I'm trying to claim is the math part of E2E doesn't prevent someone from stuffing the electoral rolls or the SSN database with fake people or preventing eligible voters from being correctly registered.
  - zug_zug 6y ago
    Well my only contention is that there are practical answers to all the what-ifs you can come up with. If you want to know more you should probably read the academic papers on the topic.
    - camgunz 6y ago
      I've read a few of these and, mostly OP is right. A lot of "we fixed voting" systems start with the premise that we know the information of everyone who's legally able to vote. We don't, and getting that information is very hard and at odds with making it easy to register, and subsequently vote. If you don't have that list, then there's nothing preventing you from padding the votes with fake people. You can try and implement some way of tracing the votes back to people but, first of all see point 1 up there (oh your phone number/email address/home address changed/was misspelled/you're homeless/you're a nomad) and second, you very likely break secret voting. FWIW there is no perfect voting system--that's the core problem w/ this discussion. We have to choose: - Do we have a citizen ID (there's a whole ball of wax here, primarily what happens if someone steals or you forget/lose your ID) - Do we think some people w/ a citizen ID still shouldn't vote (17 year olds, the incarcerated, etc.) - Do we create a potential link between people and their votes - Do we allow people to not vote - Do we require people to register before voting - Do we allow people to verify their vote was counted - Do we allow people to verify their vote was counted correctly (unclear how this would work) - Do we allow people to vote remotely - Do we create a paper trail - Do we allow people to fix problems with their ballots - Do we require people to sign their ballots, and do we require signature verification Many of these things are at odds with each other, and depending on how you flip the bits, different political interests will win out. That's the second reason this is such a nerd snipe. It really, really feels like this is a technical problem but it isn't. It's political, cultural, and societal. You're not gonna fix this with an app or an algorithm. If/When we do fix this I'm sure they'll be involved but, the reason will be multipartisan, multicultural consensus that we need to move forward.