4 ms·

The good news is election security researchers mostly agree with you. The prevailing opinion of election security professionals is that State election systems

The good news is election security researchers mostly agree with you. The prevailing opinion of election security professionals is that State election systems should be designed assuming the machines are insecure and the process should be tolerant to that fault. That's why many states that use electronic voting or tabulation produce a voter verifiable paper trail. That means, when you're done voting the machine gives the voter a piece of paper that has their votes on it. The voter can check the paper to ensure it matches their votes, then deposits the paper record like a ballot. State's can then use Risk Limiting Audits to verify a necessary amount of randomly sampled ballots to ensure that the electronic count matches the voter verifiable paper ballots. So, if your concern is that the GA election was overturned by electronic tampering you would need to explain why the voter verifiable paper trail extremely closely matched the electronic tabulation. This is a long-winded way of saying I agree with you. There are some states that use electronic voting or tabulation without a voter-verifiable paper trail and risk limiting audits. Fortunately, none of those states were "disputed" in this election. But those states should absolutely switch to these kinds of systems.

nostromo 6y ago
The attack vector isn’t the tabulation, it’s the mail-in ballot sleeves. The identity of the voter is on the outer envelope which is separated from the ballot and destroyed after their signature is checked. An attacker could insert manufactured ballots to be tabulated after this process and there would be no way to know if they are legitimate or not - they’re anonymous now too so you can’t check with the voter and the voter can’t verify their vote. You can recount the ballots all you want if this attack occurred, because the fake and real ballots would be indistinguishable and unauditable.
- ncallaway 6y ago
  The exact same criticism can be applied to regular in-person voting. It's a criticism of the concept of anonymous ballots, not actually a criticism of mail in voting.
  - nostromo 6y ago
    There are proposals on how to make the system more secure to this attack without eliminating anonymity. However I believe they would all eliminate same day registration.
supergirl 6y ago
checking a random sample is not enough for the US election system. in a few states it's decided by a few thousand votes
- ncallaway 6y ago
  > checking a random sample is not enough You can't say that without saying how large the sample is. Certainly, if the random sample size is "100% of all ballots" it would be enough. Risk Limiting Audits take that into account. There's a rigorously backed formula for determining how big the sample size needs to be based on the margin of victory. The closer the election, the more ballots are included in the sample. In fact, you're right that a _very_ narrow margin requires a random sample that ends up being very nearly or actually all votes. Georgia is a perfect example of this. Georgia applied a Risk Limiting Audit to the Presidential Election. Because the margin was so close, the RLA required them to sample every single ballot cast. The first "complete hand recount" of Georgia was actually a Risk Limiting Audit. Here is the GA SOS reporting out the results of that first statewide hand recount: https://sos.ga.gov/index.php/elections/historic_first_statewide_audit_of_paper_ballots_upholds_result_of_presidential_race https://sos.ga.gov/index.php/elections/historic_first_statew...
  - unanswered 6y ago
    Something that struck me about the Arizona hand recount numbers: most of the reporting precincts(? - I use this term in a general sense, I don't remember how the numbers were grouped) reported that hand counts in batches of about 1000 votes showed an accuracy of about 99%, i.e., on the order of 5-10 ballots incorrectly counted (again, rough numbers from memory). But then some of the precincts reported "nope, we found 100% accuracy; no discrepancies", for the same batch sizes. That struck me as odd. There wasn't a spectrum where 0-10 or even 0-20 were the outliers; it was bimodal around 5-10 and 0. Or whatever the actual numbers were, my point is bimodality with a mode at 0. That was odd.
    - kube-system 6y ago
      I think it's relatively common for errors caused by engineering processes to exhibit a pattern that isn't evenly distributed. As a made up example: maybe some precincts had scanners that worked 100% perfectly, and some had units that occasionally mis-scanned with a rhythm.

nostromo 6y ago

The attack vector isn’t the tabulation, it’s the mail-in ballot sleeves. The identity of the voter is on the outer envelope which is separated from the ballot and destroyed after their signature is checked. An attacker could insert manufactured ballots to be tabulated after this process and there would be no way to know if they are legitimate or not - they’re anonymous now too so you can’t check with the voter and the voter can’t verify their vote. You can recount the ballots all you want if this attack occurred, because the fake and real ballots would be indistinguishable and unauditable.

ncallaway 6y ago
The exact same criticism can be applied to regular in-person voting. It's a criticism of the concept of anonymous ballots, not actually a criticism of mail in voting.
- nostromo 6y ago
  There are proposals on how to make the system more secure to this attack without eliminating anonymity. However I believe they would all eliminate same day registration.

supergirl 6y ago

checking a random sample is not enough for the US election system. in a few states it's decided by a few thousand votes

ncallaway 6y ago
> checking a random sample is not enough You can't say that without saying how large the sample is. Certainly, if the random sample size is "100% of all ballots" it would be enough. Risk Limiting Audits take that into account. There's a rigorously backed formula for determining how big the sample size needs to be based on the margin of victory. The closer the election, the more ballots are included in the sample. In fact, you're right that a _very_ narrow margin requires a random sample that ends up being very nearly or actually all votes. Georgia is a perfect example of this. Georgia applied a Risk Limiting Audit to the Presidential Election. Because the margin was so close, the RLA required them to sample every single ballot cast. The first "complete hand recount" of Georgia was actually a Risk Limiting Audit. Here is the GA SOS reporting out the results of that first statewide hand recount: https://sos.ga.gov/index.php/elections/historic_first_statewide_audit_of_paper_ballots_upholds_result_of_presidential_race https://sos.ga.gov/index.php/elections/historic_first_statew...
- unanswered 6y ago
  Something that struck me about the Arizona hand recount numbers: most of the reporting precincts(? - I use this term in a general sense, I don't remember how the numbers were grouped) reported that hand counts in batches of about 1000 votes showed an accuracy of about 99%, i.e., on the order of 5-10 ballots incorrectly counted (again, rough numbers from memory). But then some of the precincts reported "nope, we found 100% accuracy; no discrepancies", for the same batch sizes. That struck me as odd. There wasn't a spectrum where 0-10 or even 0-20 were the outliers; it was bimodal around 5-10 and 0. Or whatever the actual numbers were, my point is bimodality with a mode at 0. That was odd.
  - kube-system 6y ago
    I think it's relatively common for errors caused by engineering processes to exhibit a pattern that isn't evenly distributed. As a made up example: maybe some precincts had scanners that worked 100% perfectly, and some had units that occasionally mis-scanned with a rhythm.