6 ms·

I believe the generally accepted way of solving this problem is to do Risk Limiting Audits of the system; randomly sample districts, and then manually recount u

I believe the generally accepted way of solving this problem is to do Risk Limiting Audits of the system; randomly sample districts, and then manually recount until you're confident to X sigma that the results are correct (or, if the audit diverges, you trigger a full manual recount). Citation: https://verifiedvoting.org/audits/whatisrla/ https://verifiedvoting.org/audits/whatisrla/ There's a recent report that goes into a lot of details on the various improvements that should be prioritized in the current system: https://nap.nationalacademies.org/catalog/25120/securing-the-vote-protecting-american-democracy https://nap.nationalacademies.org/catalog/25120/securing-the....

WalterBright 4y ago
Banks don't randomly apply banking controls to check for fraud, they do it for all the money flows. The original idea of double entry bookkeeping was to: 1. catch errors 2. make fraud much more difficult It's been in continuous use since the 13th century. It works. The reason it works is because an error, to remain undetected, requires a matching error somewhere else. That's what "balancing the books" means.
- teeray 4y ago
  Right, we’re not dealing with banks here. Ultimately we’re picking between N alternatives. The size of the gap between them doesn’t really matter, as long as it preserves the correct ordering of winners. Given that, using statistics to reduce your work is a completely reasonable efficiency here.
  - WalterBright 4y ago
    Ballots can be kept track of, just like dollar bills can be. It's not rocket science.
- specialist 4y ago
  This is a terrific idea. For voting in the USA to be like banking, with matching credits and debits, some changes must first be made. Every eligible voter must be issued a ballot. Prerequisite is automatic universal voter registration. Every ballot must be fully marked. No under votes. Every issued ballot must be cast. aka Compulsory voting. You have my full support for your "voting like banking" reform.
- theptip 4y ago
  I like double-entry bookkeeping as much as the next guy. But your proposal isn't double-entry (which requires every ledger entry to net out to zero), it's more akin to aerospace/NASA style reduntant control systems where you have independent implementations that must agree with each other for their output to be propagated. Redundant control is a great system if you need to provide realtime output with high correctness requirements (though for this of course three implementations is better than two as you can discard one faulty output and continue with the quorum output). In elections, we don't need to provide real-time control; in the happy path the random audits don't add an unreasonable delay, and when they do find a discrepancy we're fine to wait a week or two if needed for a full hand count. Another reason why banking/accounting is a poor analogy: in banking, you don't have anonymity requirements. Each transaction is tied out to a known individual (even more granular than that really); you can do double-entry bookkeeping because you know which accounts to debit and credit for each transaction, and maintain the accounting invariant that all accounts sum to zero. In voting, we have strict anonymity requirements, so there's no equivalent "debit Alice's account of a vote, and credit Candidate Bob's account" operation, and there is no equivalent to "netting the voting accounts to zero" that I can see. Another way of thinking about this is the RLA is simply a different approach to provide your second implementation of a vote tallying machine. It's an implementation that uses manual (human) counting, and for pragmatic cost/time reasons doesn't count every vote, just enough votes to get statistical confidence that the result is correct. And, if you have two machine implementations, who's to say that everyone will trust one of them? You still need to solve "trusting trust" for each one, and while it's harder to subvert two systems, there's no reason it's impossible. Whereas I think it's a lot easier to produce a human-powered vote counting system that is transparent and trustable by virtue of its simplicity. Down the road I'd be happy to put a second vote tallying machine in place to provide better assurance of the initial counts (and I'd love to stop using closed-source private implementations), but I think it's important to be pragmatic here and focus on the best ROI steps, and I think implementing RLAs and abolishing DREs are two of the very-high ROI items we should be focusing on first. Adding RLAs to all states would be a much better improvement than adding a second open-source machine tabulator to all states.
somenameforme 4y ago
I don't really understand why we are always stuck in the past on things like this. 155 million votes, spread out over thousands of polling stations is a minuscule number. Why not have each voting station digitally scan/print every ballot cast, and then once the stations close - upload everything to a centralized and publicly accessible server organized by station and their reported polling result. If anybody wants to do a recount, they can - to whatever degree of confidence, and using whatever method they prefer. One might still make claims of ballot stuffing or exclusion, but there would be literally zero doubt that the count itself was accurate.
- theptip 4y ago
  Have a look at the links I shared above, particularly https://verifiedvoting.org/votingequipment/ https://verifiedvoting.org/votingequipment/ for a quick summary; it gives some analysis of different voting equipment and concerns thereof. In particular, purely-digital systems are widely regarded to be too vulnerable to hacking to be safe. What you're describing sounds like DRE with VVPAT, which isn't considered to be a secure option, though it's better than DRE without VPAT since as you note you can in principle audit it. (However, note that most jurisdictions don't yet do RLAs to randomly audit, so right now digitizing, even with VPAT, could weaken the system.) I think the basic idea here is -- if paper is secure and will be your fallback, and digital is insecure, you should just build your process to be optimized for paper-first, rather than digital-first. Digitizing as you suggest doesn't really gain anything over paper (except perhaps reporting provisional results faster, but you'd still need to do a risk-limiting audit to verify that your digital votes didn't get hacked so this might be a wash), but it does add more attack surfaces along the chain of custody. Ultimately, paper is a very robust solution to the problem of making the system hard to subvert at scale; you can think of it as a sort of "proof of work", where it would be extremely difficult for, say, Russia, or the DNC / RNC to tamper with large quantities of ballots across the nation. Compare that robustness with a digital system, where IF it works you have the same properties... but around here we all know that almost all digital systems can be owned by a persistent enough adversary. If you're willing to relax some of the requirements around refutability, there are some interesting e-voting schemes, for example you can do some cool stuff with homomorphic encryption like https://github.com/microsoft/electionguard/ https://github.com/microsoft/electionguard/. But there is something to be said for having a tallying algorithm like "count the pieces of paper" that doesn't require a PhD to understand.
ravel-bar-foo 4y ago
A fundamental limitation of RLAs is that they don't follow the ballot chain of custody, only the counting procedure. So if you have an old-fashioned political machine with dead people voting or people in nursing homes being scammed out of their votes it will not appear in RLAs.

WalterBright 4y ago

Banks don't randomly apply banking controls to check for fraud, they do it for all the money flows. The original idea of double entry bookkeeping was to: 1. catch errors 2. make fraud much more difficult It's been in continuous use since the 13th century. It works. The reason it works is because an error, to remain undetected, requires a matching error somewhere else. That's what "balancing the books" means.

teeray 4y ago
Right, we’re not dealing with banks here. Ultimately we’re picking between N alternatives. The size of the gap between them doesn’t really matter, as long as it preserves the correct ordering of winners. Given that, using statistics to reduce your work is a completely reasonable efficiency here.
- WalterBright 4y ago
  Ballots can be kept track of, just like dollar bills can be. It's not rocket science.
specialist 4y ago
This is a terrific idea. For voting in the USA to be like banking, with matching credits and debits, some changes must first be made. Every eligible voter must be issued a ballot. Prerequisite is automatic universal voter registration. Every ballot must be fully marked. No under votes. Every issued ballot must be cast. aka Compulsory voting. You have my full support for your "voting like banking" reform.
theptip 4y ago
I like double-entry bookkeeping as much as the next guy. But your proposal isn't double-entry (which requires every ledger entry to net out to zero), it's more akin to aerospace/NASA style reduntant control systems where you have independent implementations that must agree with each other for their output to be propagated. Redundant control is a great system if you need to provide realtime output with high correctness requirements (though for this of course three implementations is better than two as you can discard one faulty output and continue with the quorum output). In elections, we don't need to provide real-time control; in the happy path the random audits don't add an unreasonable delay, and when they do find a discrepancy we're fine to wait a week or two if needed for a full hand count. Another reason why banking/accounting is a poor analogy: in banking, you don't have anonymity requirements. Each transaction is tied out to a known individual (even more granular than that really); you can do double-entry bookkeeping because you know which accounts to debit and credit for each transaction, and maintain the accounting invariant that all accounts sum to zero. In voting, we have strict anonymity requirements, so there's no equivalent "debit Alice's account of a vote, and credit Candidate Bob's account" operation, and there is no equivalent to "netting the voting accounts to zero" that I can see. Another way of thinking about this is the RLA is simply a different approach to provide your second implementation of a vote tallying machine. It's an implementation that uses manual (human) counting, and for pragmatic cost/time reasons doesn't count every vote, just enough votes to get statistical confidence that the result is correct. And, if you have two machine implementations, who's to say that everyone will trust one of them? You still need to solve "trusting trust" for each one, and while it's harder to subvert two systems, there's no reason it's impossible. Whereas I think it's a lot easier to produce a human-powered vote counting system that is transparent and trustable by virtue of its simplicity. Down the road I'd be happy to put a second vote tallying machine in place to provide better assurance of the initial counts (and I'd love to stop using closed-source private implementations), but I think it's important to be pragmatic here and focus on the best ROI steps, and I think implementing RLAs and abolishing DREs are two of the very-high ROI items we should be focusing on first. Adding RLAs to all states would be a much better improvement than adding a second open-source machine tabulator to all states.

somenameforme 4y ago

I don't really understand why we are always stuck in the past on things like this. 155 million votes, spread out over thousands of polling stations is a minuscule number. Why not have each voting station digitally scan/print every ballot cast, and then once the stations close - upload everything to a centralized and publicly accessible server organized by station and their reported polling result. If anybody wants to do a recount, they can - to whatever degree of confidence, and using whatever method they prefer. One might still make claims of ballot stuffing or exclusion, but there would be literally zero doubt that the count itself was accurate.

theptip 4y ago
Have a look at the links I shared above, particularly https://verifiedvoting.org/votingequipment/ https://verifiedvoting.org/votingequipment/ for a quick summary; it gives some analysis of different voting equipment and concerns thereof. In particular, purely-digital systems are widely regarded to be too vulnerable to hacking to be safe. What you're describing sounds like DRE with VVPAT, which isn't considered to be a secure option, though it's better than DRE without VPAT since as you note you can in principle audit it. (However, note that most jurisdictions don't yet do RLAs to randomly audit, so right now digitizing, even with VPAT, could weaken the system.) I think the basic idea here is -- if paper is secure and will be your fallback, and digital is insecure, you should just build your process to be optimized for paper-first, rather than digital-first. Digitizing as you suggest doesn't really gain anything over paper (except perhaps reporting provisional results faster, but you'd still need to do a risk-limiting audit to verify that your digital votes didn't get hacked so this might be a wash), but it does add more attack surfaces along the chain of custody. Ultimately, paper is a very robust solution to the problem of making the system hard to subvert at scale; you can think of it as a sort of "proof of work", where it would be extremely difficult for, say, Russia, or the DNC / RNC to tamper with large quantities of ballots across the nation. Compare that robustness with a digital system, where IF it works you have the same properties... but around here we all know that almost all digital systems can be owned by a persistent enough adversary. If you're willing to relax some of the requirements around refutability, there are some interesting e-voting schemes, for example you can do some cool stuff with homomorphic encryption like https://github.com/microsoft/electionguard/ https://github.com/microsoft/electionguard/. But there is something to be said for having a tallying algorithm like "count the pieces of paper" that doesn't require a PhD to understand.

ravel-bar-foo 4y ago

A fundamental limitation of RLAs is that they don't follow the ballot chain of custody, only the counting procedure. So if you have an old-fashioned political machine with dead people voting or people in nursing homes being scammed out of their votes it will not appear in RLAs.