4 ms·

It is not a problem. The solution to running high-trust elections is: * Use paper ballots with fill-in-the-oval results. This method has very little chance of

It is not a problem. The solution to running high-trust elections is: * Use paper ballots with fill-in-the-oval results. This method has very little chance of user error filling out the ballot (modulo concerns like two-sided sheets, etc.). * Chain-of-custody the ballot box the ballots get fed into at the polling place. Keep a roster of who voted, which lets you count how many ballots should be in that box. If that count is incorrect for the number of voters, you have issues. (This is rare.) * Count the ballots with a ballot-reading machine. Verify the machine's counts by doing hand checks of samples. (The US runs too many races not to use machine counts.) * For mail-in ballots, use envelope-inside-envelope to preserve secrecy. The inner envelope contains the ballot, and only the ballot, while the outer envelope contains the information needed to verify the voter. At that point, the only real question is determining who is eligible to vote, and it turns out that it's not really a question about the security of the voting process, but rather about how to prevent the undesirables from voting. Aspersions on the security of the voting process are really about trying to justify changes to laws to keep undesirables from being able to vote.

tptacek 4y ago
You can still safely do touchscreen voting in this system: just use ballot-marking devices that produce human-readable paper ballots. That's what happens in Cook County: you vote on a touchscreen (if you don't request a big cardboard paper ballot) and get a printed ballot that you cast as if you had marked paper yourself.
- quantified 4y ago
  Is it a print of the vote that was cast, or generated separately from the cast? How do you know?
  - tptacek 4y ago
    It prints the ballot you cast. Nothing in the BMD beams a vote to the secret vote-fixing center.
    - quantified 4y ago
      True. But some voting machines generate a print of the vote that was tabulated, and some generate a printout from a separate code path. The problem is that you don't know which it is.
      - akerl_ 4y ago
        Presumably you could ask any of the humans standing there staffing the election process and they'd tell you. Or you could assume Skynet's clever plan is mass election fraud and making sure nobody ever finds out or tells.
        quantified 4y ago
        They don't know. Not sure why you're dismissing the problems here by referring to fictional movie elements? Note the "secretly record" element in [https://www.schneier.com/blog/archives/2007/12/more_voting_mac_1.html https://www.schneier.com/blog/archives/2007/12/more_voting_m...] Bruce Schneier is not a crank, he's written extensively over the years on the issues and the one I'm pointing out is just one specific one of many. As a software developer yourself, you might be capable of taking these issues seriously.
        akerl_ 4y ago
        You don't think the staff at a polling place know whether the thing they're submitting to be counted is the printed ballots, or some other output of the ballot marking device? The article you linked doesn't seem to have any connection to the flow where a computerized machine helps mark a ballot, drops it into your hands, and you can see and review it before dropping it into a box to be counted.
        TechBro8615 4y ago
        Your link to Schneier got me browsing through his "voting" tag. I found it quite interesting to compare these two posts and comments, from November 25, 2016 [0] and November 27, 2020 [1]. The topic is nearly the same, - some people found some irregularities in some counties - but the tone and treatment of the claims is drastically different. It's worth considering how we discuss election security through a partisan lens. [0] https://www.schneier.com/blog/archives/2016/11/hacking_and_the.html https://www.schneier.com/blog/archives/2016/11/hacking_and_t... [1] https://www.schneier.com/blog/archives/2020/11/undermining-democracy.html https://www.schneier.com/blog/archives/2020/11/undermining-d...
quantified 4y ago
This is it.
tzs 4y ago
That's almost the solution. Just add this [1], which requires just minor changes to how the ballots are printed and the use of special pens to fill in the ovals, and you gain these properties: 1. The ballots can be published after the vote allowed anyone to verify the counts, 2. Individual voters can, if they want to, note some information when they vote that will allow them to verify when the ballots are published that their vote was counted and it was counted correctly, but will not allow them to prove to a third party that they voted a particular way, 3. Individual voters can check before they vote that the ballot they have been given has probably not been tampered with. [1] https://www.usenix.org/legacy/events/evt08/tech/full_papers/chaum/chaum.pdf https://www.usenix.org/legacy/events/evt08/tech/full_papers/...
TechBro8615 4y ago
> For mail-in ballots, use envelope-inside-envelope to preserve secrecy. This would work better if mail-in ballots were only printed on request, and had some kind of one way hashing so that someone who voted by mail could optionally verify their vote was counted correctly. Otherwise, isn't the count unauditable as soon as ballots are separated from their envelopes? You can only verify that the number of ballots matches the number of envelopes, and perhaps that there exists a bijection between them - but you cannot verify that the same set of ballots that was in the envelopes was the set of ballots which was counted. How can you verify that ballots were not replaced, after removing them from the envelopes but before counting them, with duplicate ballots that contained different votes? An attacker might not even need to duplicate a unique ID on each ballot, depending on how the "verify my vote" system is setup, because the verification is only that you removed a ballot from my envelope. As a voter, I can call my county and offer the ID number from my envelope, and the county can honestly tell me they "processed" it - but I cannot verify that my ballot itself was "processed," nor can I verify that it was counted toward the total votes with the weight I'd expect given the number of voters. Inversely, it's important that mail-in ballots only be printed on request, and that the (potential) voter receive a unique hash upon requesting the ballot (not just after voting with it). Because that way you can ensure that if someone receives a ballot but doesn't vote, they can call to verify that their vote was not processed. Whereas if they only receive a unique hash after voting, then only those who executed their ballot could verify it was counted, and any unexecuted mail-in ballots could be mixed into the tally with confidence that nobody would call to verify they were not counted. Surely there is some kind of "accumulator" system that can be used here, but I'm not familiar enough with the literature to identify it. However, I think it's clear that this is a deceptively hard problem, and worth the effort of our best minds publicly solving it, rather than deferring it to a private Canadian-owned, Serbian-operated corporation that produces proprietary systems and sues anyone who questions their trustworthiness.
- jcranmer 4y ago
  The idea is that the mail-in ballots go into the same kind of chain-of-custody ballot box that happens in a polling place once the identity is verified (same as what would happen at the in-processing table in a polling place). Once your ballot makes it in that box, it's counted. If you've got a competent election system (e.g., Oregon), it's easy to figure out if your ballot has made it into that box or not. You don't need anything fancier than that.

tptacek 4y ago

You can still safely do touchscreen voting in this system: just use ballot-marking devices that produce human-readable paper ballots. That's what happens in Cook County: you vote on a touchscreen (if you don't request a big cardboard paper ballot) and get a printed ballot that you cast as if you had marked paper yourself.

quantified 4y ago
Is it a print of the vote that was cast, or generated separately from the cast? How do you know?
- tptacek 4y ago
  It prints the ballot you cast. Nothing in the BMD beams a vote to the secret vote-fixing center.
  - quantified 4y ago
    True. But some voting machines generate a print of the vote that was tabulated, and some generate a printout from a separate code path. The problem is that you don't know which it is.
    - akerl_ 4y ago
      Presumably you could ask any of the humans standing there staffing the election process and they'd tell you. Or you could assume Skynet's clever plan is mass election fraud and making sure nobody ever finds out or tells.
      - quantified 4y ago
        They don't know. Not sure why you're dismissing the problems here by referring to fictional movie elements? Note the "secretly record" element in [https://www.schneier.com/blog/archives/2007/12/more_voting_mac_1.html https://www.schneier.com/blog/archives/2007/12/more_voting_m...] Bruce Schneier is not a crank, he's written extensively over the years on the issues and the one I'm pointing out is just one specific one of many. As a software developer yourself, you might be capable of taking these issues seriously.
        akerl_ 4y ago
        You don't think the staff at a polling place know whether the thing they're submitting to be counted is the printed ballots, or some other output of the ballot marking device? The article you linked doesn't seem to have any connection to the flow where a computerized machine helps mark a ballot, drops it into your hands, and you can see and review it before dropping it into a box to be counted.
        TechBro8615 4y ago
        Your link to Schneier got me browsing through his "voting" tag. I found it quite interesting to compare these two posts and comments, from November 25, 2016 [0] and November 27, 2020 [1]. The topic is nearly the same, - some people found some irregularities in some counties - but the tone and treatment of the claims is drastically different. It's worth considering how we discuss election security through a partisan lens. [0] https://www.schneier.com/blog/archives/2016/11/hacking_and_the.html https://www.schneier.com/blog/archives/2016/11/hacking_and_t... [1] https://www.schneier.com/blog/archives/2020/11/undermining-democracy.html https://www.schneier.com/blog/archives/2020/11/undermining-d...

quantified 4y ago

This is it.

tzs 4y ago

That's almost the solution. Just add this [1], which requires just minor changes to how the ballots are printed and the use of special pens to fill in the ovals, and you gain these properties: 1. The ballots can be published after the vote allowed anyone to verify the counts, 2. Individual voters can, if they want to, note some information when they vote that will allow them to verify when the ballots are published that their vote was counted and it was counted correctly, but will not allow them to prove to a third party that they voted a particular way, 3. Individual voters can check before they vote that the ballot they have been given has probably not been tampered with. [1] https://www.usenix.org/legacy/events/evt08/tech/full_papers/chaum/chaum.pdf https://www.usenix.org/legacy/events/evt08/tech/full_papers/...

TechBro8615 4y ago

> For mail-in ballots, use envelope-inside-envelope to preserve secrecy. This would work better if mail-in ballots were only printed on request, and had some kind of one way hashing so that someone who voted by mail could optionally verify their vote was counted correctly. Otherwise, isn't the count unauditable as soon as ballots are separated from their envelopes? You can only verify that the number of ballots matches the number of envelopes, and perhaps that there exists a bijection between them - but you cannot verify that the same set of ballots that was in the envelopes was the set of ballots which was counted. How can you verify that ballots were not replaced, after removing them from the envelopes but before counting them, with duplicate ballots that contained different votes? An attacker might not even need to duplicate a unique ID on each ballot, depending on how the "verify my vote" system is setup, because the verification is only that you removed a ballot from my envelope. As a voter, I can call my county and offer the ID number from my envelope, and the county can honestly tell me they "processed" it - but I cannot verify that my ballot itself was "processed," nor can I verify that it was counted toward the total votes with the weight I'd expect given the number of voters. Inversely, it's important that mail-in ballots only be printed on request, and that the (potential) voter receive a unique hash upon requesting the ballot (not just after voting with it). Because that way you can ensure that if someone receives a ballot but doesn't vote, they can call to verify that their vote was not processed. Whereas if they only receive a unique hash after voting, then only those who executed their ballot could verify it was counted, and any unexecuted mail-in ballots could be mixed into the tally with confidence that nobody would call to verify they were not counted. Surely there is some kind of "accumulator" system that can be used here, but I'm not familiar enough with the literature to identify it. However, I think it's clear that this is a deceptively hard problem, and worth the effort of our best minds publicly solving it, rather than deferring it to a private Canadian-owned, Serbian-operated corporation that produces proprietary systems and sues anyone who questions their trustworthiness.

jcranmer 4y ago
The idea is that the mail-in ballots go into the same kind of chain-of-custody ballot box that happens in a polling place once the identity is verified (same as what would happen at the in-processing table in a polling place). Once your ballot makes it in that box, it's counted. If you've got a competent election system (e.g., Oregon), it's easy to figure out if your ballot has made it into that box or not. You don't need anything fancier than that.