Not even formally verified open-source compilers can be trusted (and for the record, in practice, voting machine software does not reach anywhere near such leve

Not even formally verified open-source compilers can be trusted (and for the record, in practice, voting machine software does not reach anywhere near such level of security): https://cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Reflect... Then you also have to trust the entire supply chain (software AND hardware): https://www.schneier.com/blog/archives/2018/03/adding_backdoor.html https://www.schneier.com/blog/archives/2018/03/adding_backdo... Because the prize is so great, the system has to withstand decades-long attacks by global superpower-level actors. And unlike a bank account, you don't know when you've been hacked. Once compromised, a smart attacker will stay within the public poll's margin of error - which is much greater for small, local elections through which most politicians have to pass. Think 30% or more, in countries where people have little to fear from answering such polls truthfully. Or venture outside of it, deliberately making the election look stolen to throw a country into chaos. No system that relies on an un-auditable black box for security can be trusted with elections. This is so blindingly obvious, anyone that says otherwise, no matter how credentialed, is either deluded, corrupt, or malicious. All this risk, and the benefit is.. what? Countries all over the world manage to vote and tally the results quickly using nothing but paper. > I'm only referring to electronic machines used to vote, without any internet connection. If you don't trust the chip fab, how do you check there is no connection? I suspect antennas can be hidden incredibly well, and there are countless side-channels that can be used for communication. And even without antennas, machines are not safe: It is typically introduced to the target environment via an infected USB flash drive, thus crossing any air gap. - https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet Do you trust every PC and every USB drive that comes into contact with the voting machine? And every PC that PC came into contact with, and so on? Edit: To clarify, paper isn't immune to tampering. But crucially, tampering with it is much harder to hide, and it doesn't scale. Not unless you already have loyal agents controlling most polling stations in a country - at which point, no voting system can save you. But even then, hiding your activity will be hard, unlike if you only have to flip a few bits.