4 ms·

Sorry - so how do I ensure that the code running is the code I expect it to at the moment I vote? I "can simply hire a computer expert to examine it and see, in

Sorry - so how do I ensure that the code running is the code I expect it to at the moment I vote? I "can simply hire a computer expert to examine it and see, in real time"? That doesn't seem feasible while I'm sitting in the voting booth. I see they are using manual vote counting this time around to check, but how is that any guarantee the software will be the same in 2 years time when it happens all over again? Knowing there is software in some git repo somewhere that I can audit doesn't make me trust the machine in front of me any more.

starkd 4y ago
True, the average voter is not inclined to hire a computer expert to do an analysis, but if there is widespread suspicion, they will at least have the ability to vent their collective outrage into an actual audit of the code. This transparency can provide some assurance.
- mFixman 4y ago
  Volkswagen cheated on emissions tests by creating software that did the expected results only during an audit. Doing the same for voting software would be much easier. There's no way for a computer to completely prove it has the right software for a job.
- SketchySeaBeast 4y ago
  Can it though? If the audit is called for after the election how do we determine the code that the auditor is inspecting is what was run on election day? It's still a black box on election day - it's just got detailed instructions written on it claiming that's what is inside.
- nyokodo 4y ago
  > audit of the code The OP is talking about the inability to audit the code actually running at the time of voting. You can audit the code in the repo all you like but if the hardware of the voting machine is compromised, or the code you audit is modified or replaced sometime before execution, or there is other malicious code running on the machine interfering with the voting then your audit is useless.
  - capableweb 4y ago
    Require (by law) that the actual machines be available for potential inspection for X weeks/months after each election. If there is suspicion of fraud/issues, inspection happens on the machines that have been stored since the election. Since the machines are offline the entire time (by design it seems), manipulation doesn't seem that easy, granted the machines are stored in a secure location in the meantime.
    - nyokodo 4y ago
      > manipulation doesn't seem that easy I wasn’t suggesting manipulation was easy. But for a sufficiently motivated and resourced actor with direct or indirect physical access to the machine all bets are off.
    - r00fus 4y ago
      The problem is that "audits" of those machines is itself a threat model. The auditing needs to be controlled such that a malicious auditor doesn't compromise the machine. State couldn't prove that the machines audited by a private group in Arizona weren't compromised so they had to replace them [0] to a tune of $2.8M. [0] https://www.businessinsider.com/arizona-audit-maricopa-county-seeks-28-million-to-replace-machines-2021-8 https://www.businessinsider.com/arizona-audit-maricopa-count...
mavhc 4y ago
1. Send the results to multiple independent organisations 2. Print out for each voter a list of codes they can use to show that they voted for each candidate, show on screen the code they need to memorise/highlight for their actual vote 3. Later they voters can put that code into any of the organisations' websites to check their result was recorded correctly, which also means each org can check that they have the same results the voters think they made
- SketchySeaBeast 4y ago
  Isn't this de-anonymizing the process a bit - I know your name won't be printed directly on it, but now the organization you went to can determine who you are and who you voted for.
  - mavhc 4y ago
    They don't need to know who you are, just that random number 44925923 voted for X
luxuryballs 4y ago
yeah open source software isn’t a fix for this it’s a ruse, the last built and deployed binary can in theory contain anything, why are we using computers for this??
jcrawfordor 4y ago
The audit strategy for precinct tabulators such as these is not to audit the machines but the actual ballots, which are retained. Upon suspicion (usually this requires a court order, details vary a lot by state) the original ballots, which are retained after the machines tabulate them, can be hand-counted or more practically recounted by independent machines. Every conceivable election method is vulnerable to some type of fraud, and hand-counting leads to relatively very high unintentional error rates. Post-election audit sampling is a typical practice in many states and should be in all.
- puffoflogic 4y ago

starkd 4y ago

True, the average voter is not inclined to hire a computer expert to do an analysis, but if there is widespread suspicion, they will at least have the ability to vent their collective outrage into an actual audit of the code. This transparency can provide some assurance.

mFixman 4y ago
Volkswagen cheated on emissions tests by creating software that did the expected results only during an audit. Doing the same for voting software would be much easier. There's no way for a computer to completely prove it has the right software for a job.
SketchySeaBeast 4y ago
Can it though? If the audit is called for after the election how do we determine the code that the auditor is inspecting is what was run on election day? It's still a black box on election day - it's just got detailed instructions written on it claiming that's what is inside.
nyokodo 4y ago
> audit of the code The OP is talking about the inability to audit the code actually running at the time of voting. You can audit the code in the repo all you like but if the hardware of the voting machine is compromised, or the code you audit is modified or replaced sometime before execution, or there is other malicious code running on the machine interfering with the voting then your audit is useless.
- capableweb 4y ago
  Require (by law) that the actual machines be available for potential inspection for X weeks/months after each election. If there is suspicion of fraud/issues, inspection happens on the machines that have been stored since the election. Since the machines are offline the entire time (by design it seems), manipulation doesn't seem that easy, granted the machines are stored in a secure location in the meantime.
  - nyokodo 4y ago
    > manipulation doesn't seem that easy I wasn’t suggesting manipulation was easy. But for a sufficiently motivated and resourced actor with direct or indirect physical access to the machine all bets are off.
  - r00fus 4y ago
    The problem is that "audits" of those machines is itself a threat model. The auditing needs to be controlled such that a malicious auditor doesn't compromise the machine. State couldn't prove that the machines audited by a private group in Arizona weren't compromised so they had to replace them [0] to a tune of $2.8M. [0] https://www.businessinsider.com/arizona-audit-maricopa-county-seeks-28-million-to-replace-machines-2021-8 https://www.businessinsider.com/arizona-audit-maricopa-count...

mavhc 4y ago

1. Send the results to multiple independent organisations 2. Print out for each voter a list of codes they can use to show that they voted for each candidate, show on screen the code they need to memorise/highlight for their actual vote 3. Later they voters can put that code into any of the organisations' websites to check their result was recorded correctly, which also means each org can check that they have the same results the voters think they made

SketchySeaBeast 4y ago
Isn't this de-anonymizing the process a bit - I know your name won't be printed directly on it, but now the organization you went to can determine who you are and who you voted for.
- mavhc 4y ago
  They don't need to know who you are, just that random number 44925923 voted for X

luxuryballs 4y ago

yeah open source software isn’t a fix for this it’s a ruse, the last built and deployed binary can in theory contain anything, why are we using computers for this??

jcrawfordor 4y ago

The audit strategy for precinct tabulators such as these is not to audit the machines but the actual ballots, which are retained. Upon suspicion (usually this requires a court order, details vary a lot by state) the original ballots, which are retained after the machines tabulate them, can be hand-counted or more practically recounted by independent machines. Every conceivable election method is vulnerable to some type of fraud, and hand-counting leads to relatively very high unintentional error rates. Post-election audit sampling is a typical practice in many states and should be in all.

puffoflogic 4y ago