3 ms·

> For mail-in ballots, use envelope-inside-envelope to preserve secrecy. This would work better if mail-in ballots were only printed on request, and had some k

> For mail-in ballots, use envelope-inside-envelope to preserve secrecy. This would work better if mail-in ballots were only printed on request, and had some kind of one way hashing so that someone who voted by mail could optionally verify their vote was counted correctly. Otherwise, isn't the count unauditable as soon as ballots are separated from their envelopes? You can only verify that the number of ballots matches the number of envelopes, and perhaps that there exists a bijection between them - but you cannot verify that the same set of ballots that was in the envelopes was the set of ballots which was counted. How can you verify that ballots were not replaced, after removing them from the envelopes but before counting them, with duplicate ballots that contained different votes? An attacker might not even need to duplicate a unique ID on each ballot, depending on how the "verify my vote" system is setup, because the verification is only that you removed a ballot from my envelope. As a voter, I can call my county and offer the ID number from my envelope, and the county can honestly tell me they "processed" it - but I cannot verify that my ballot itself was "processed," nor can I verify that it was counted toward the total votes with the weight I'd expect given the number of voters. Inversely, it's important that mail-in ballots only be printed on request, and that the (potential) voter receive a unique hash upon requesting the ballot (not just after voting with it). Because that way you can ensure that if someone receives a ballot but doesn't vote, they can call to verify that their vote was not processed. Whereas if they only receive a unique hash after voting, then only those who executed their ballot could verify it was counted, and any unexecuted mail-in ballots could be mixed into the tally with confidence that nobody would call to verify they were not counted. Surely there is some kind of "accumulator" system that can be used here, but I'm not familiar enough with the literature to identify it. However, I think it's clear that this is a deceptively hard problem, and worth the effort of our best minds publicly solving it, rather than deferring it to a private Canadian-owned, Serbian-operated corporation that produces proprietary systems and sues anyone who questions their trustworthiness.

jcranmer 4y ago
The idea is that the mail-in ballots go into the same kind of chain-of-custody ballot box that happens in a polling place once the identity is verified (same as what would happen at the in-processing table in a polling place). Once your ballot makes it in that box, it's counted. If you've got a competent election system (e.g., Oregon), it's easy to figure out if your ballot has made it into that box or not. You don't need anything fancier than that.
- TechBro8615 4y ago
  Well, you need an escalation path when chain of custody is broken. It's great to say you depend on chain of custody, but how do you handle the violations of it? Mistakes happen. But so do attacks. It's probably not reasonable to cancel the whole election based on some missing chain of custody documents, and the (mostly volunteer) election workers can legitimately claim human error. But isn't that an ideal environment for an attacker to commit plausibly deniable ballot fraud? For example: Swap a pile of mail-in ballots (recently separated from their envelopes) with an equally sized pile of pre-filled malicious ballots. Or, take a bag of ballots from rejected envelopes, mix them with uncounted ballots from accepted envelopes, and then replace some of them with prefilled ballots. Or commit any other uncorrectable chain of custody violation that allows you to introduce new ballots into the count, but that could also feasibly be an accident. When challenged, don't admit to introducing additional ballots, but openly admit to the tainted chain of custody, and claim it was a mistake. It's unlikely you'll face any real consequence, and you can accuse your opponents of being election deniers. Yet you had the chance to intentionally introduce phantom ballots into the counting process while increasing the expected error margin of any potential audit. Note that you can still process every legitimate ballot, and confirm to any voter that you processed their ballot. And maybe you can even confirm to any non-voter that you did not process their pre-mailed ballot. But you cannot confirm that you processed only legitimate ballots. In other words: one plausibly inconsequential broken chain of custody is sufficient opportunity to introduce new ballots unassociated with any real voters.
  - jcranmer 4y ago
    > It's unlikely you'll face any real consequence, and you can accuse your opponents of being election deniers. https://en.wikipedia.org/wiki/2018_North_Carolina%27s_9th_congressional_district_election https://en.wikipedia.org/wiki/2018_North_Carolina%27s_9th_co... Due to possible voter mail fraud, the election results were not certified and the election was redone. Chicanery in vote counting doesn't happen in the US. There's just too many eyes on the system, and the system is just too distributed, for it to be effective. If you look at the way that political parties try to manipulate the elections, it's by attempting to prevent people from voting in the first place (and those attempts are much, much more successful than they should be).

jcranmer 4y ago

The idea is that the mail-in ballots go into the same kind of chain-of-custody ballot box that happens in a polling place once the identity is verified (same as what would happen at the in-processing table in a polling place). Once your ballot makes it in that box, it's counted. If you've got a competent election system (e.g., Oregon), it's easy to figure out if your ballot has made it into that box or not. You don't need anything fancier than that.

TechBro8615 4y ago
Well, you need an escalation path when chain of custody is broken. It's great to say you depend on chain of custody, but how do you handle the violations of it? Mistakes happen. But so do attacks. It's probably not reasonable to cancel the whole election based on some missing chain of custody documents, and the (mostly volunteer) election workers can legitimately claim human error. But isn't that an ideal environment for an attacker to commit plausibly deniable ballot fraud? For example: Swap a pile of mail-in ballots (recently separated from their envelopes) with an equally sized pile of pre-filled malicious ballots. Or, take a bag of ballots from rejected envelopes, mix them with uncounted ballots from accepted envelopes, and then replace some of them with prefilled ballots. Or commit any other uncorrectable chain of custody violation that allows you to introduce new ballots into the count, but that could also feasibly be an accident. When challenged, don't admit to introducing additional ballots, but openly admit to the tainted chain of custody, and claim it was a mistake. It's unlikely you'll face any real consequence, and you can accuse your opponents of being election deniers. Yet you had the chance to intentionally introduce phantom ballots into the counting process while increasing the expected error margin of any potential audit. Note that you can still process every legitimate ballot, and confirm to any voter that you processed their ballot. And maybe you can even confirm to any non-voter that you did not process their pre-mailed ballot. But you cannot confirm that you processed only legitimate ballots. In other words: one plausibly inconsequential broken chain of custody is sufficient opportunity to introduce new ballots unassociated with any real voters.
- jcranmer 4y ago
  > It's unlikely you'll face any real consequence, and you can accuse your opponents of being election deniers. https://en.wikipedia.org/wiki/2018_North_Carolina%27s_9th_congressional_district_election https://en.wikipedia.org/wiki/2018_North_Carolina%27s_9th_co... Due to possible voter mail fraud, the election results were not certified and the election was redone. Chicanery in vote counting doesn't happen in the US. There's just too many eyes on the system, and the system is just too distributed, for it to be effective. If you look at the way that political parties try to manipulate the elections, it's by attempting to prevent people from voting in the first place (and those attempts are much, much more successful than they should be).