7 ms·

It prints the selected votes on a piece of paper that can be viewed by person who entered the vote and counted by hand (which was done in 2020) No system is 10

It prints the selected votes on a piece of paper that can be viewed by person who entered the vote and counted by hand (which was done in 2020) No system is 100% secure and while Georgia in particular seems to have some improvements they should be making, it’s important to be rational about implications the existence given vulnerabilities have on accuracy of an actual election.

drewmol 3y ago
The section titled “Isn’t there a paper trail? Why is malware a risk?” explains a bit about this. The printout is read by QR code so it’s possible to list the correct selections but modify the QR code that gets read. It also addresses the percentage of voters who verify and how thoroughly (it’s not many). “If an attacker changes only the QR code, voters have no way to detect the change by looking at their ballots, since voters can’t read the QR code. The change might be detected in a manual recount or a risk-limiting audit (RLA) based on a review of the printed text, but that is unlikely given Georgia’s weak audit requirements, which have recently been further diluted.” Also it’s a poor decision by Georgia to not install security updates until after next election, but that’s the state’s position currently. I watched some of the Georgia congressional hearings regarding election security, audits, and safe guards after the 2020 election and it seems like their board of election was a total shit show. It seems like paper ballots and counting could prevent all of the problems or alleged problems they experienced in the last two major elections.
- rudolph9 3y ago
  Again, there is definitely room for improvement but I don’t believe the data in the QR code encrypted, and it only takes one person to record them selves voting and a different vote getting printed on that piece of paper for this to become a big deal. It just seems very unlikely that even a small percentage of the votes getting changes would go completely unnoticed.
  - drewmol 3y ago
    I don’t think it would be legal to do that (record). EDIT: It’s illegal, GA 21-2-413. I’m not sure how the validation works, but I assume that there is an identifier in the QR code, and it likely doesn’t have plaintext candidate names so I’m not sure if you could even validate the QR code with available data, but it would most certainly be a crime. The scenario they exposed as possible is : voter receives a printout paper ballot with the vote selection printed correctly in text, but the included QR code has modified selection(s). That paper is then fed into the reader/scanner/tabulation machine. No further confirmation. The whole point of the printout is for voters to confirm their selections, the whole QR code step is a design flaw. Just print regular ballots with filled in circles that can go through a standard tabulation machine and still be read/checked by humans if you really need to add a (required) touchscreen interface to the process. “If an attacker changes only the QR code, voters have no way to detect the change by looking at their ballots, since voters can’t read the QR code. The change might be detected in a manual recount or a risk-limiting audit (RLA) based on a review of the printed text, but that is unlikely given Georgia’s weak audit requirements, which have recently been further diluted.” It seems very unlikely that lots of votes getting changed would get noticed to me. Maybe I have a misunderstanding of the process. An RLA would help, but Georgia has had difficulty in conducting audits due to incompetence of officials and people not following process rules, QR codes seem like unnecessary complexity.
    - rudolph9 3y ago
      > No person shall use photographic or other electronic monitoring or recording devices, cameras, or cellular telephones while such person is in a polling place while voting is taking place; provided, however, that a poll manager, in his or her discretion, may allow the use of photographic devices in the polling place under such conditions and limitations as the election superintendent finds appropriate, and provided, further, that no photography shall be allowed of a ballot or the face of a voting machine or DRE unit or electronic ballot marker while an elector is voting such ballot or machine or DRE unit or using such electronic ballot marker, and no photography shall be allowed of an electors list, electronic electors list, or the use of an electors list or electronic electors list. This subsection shall not prohibit the use of photographic or other electronic monitoring or recording devices, cameras, or cellular telephones by poll officials for official purposes Yeah that’s pretty strict. It seems at least remotely plausible now. But still, I doubt the content of the QR code data is encrypted (probably cryptographically signed) especially given the vote is already written in plain text. And if votes of any significant percentage could make a difference were being switched someone would have a video (assuming the QR code data contains the chosen vote in plane text)
nurple 3y ago
Were the votes that were counted on paper (or even the electronic ones) then made available online for voters to check that their vote was recorded as cast? Why does the IRS have the technology the positively identify a citizen remotely to allow them access to information that's arguably more sensitive than a vote and yet we can't use this tech for that purpose? Why is this the second time that a Dominion machine was found by a third party to fail under scrutiny by security experts and CISA _then_ comes in to investigate whether the exploits were, well, exploited amidst the well-documented "fortification"? Why doesn't Georgia want to update these vulnerable systems before the presidential election? Why aren't all elections given a third-party statistical forensic analysis? Why, if the machines _are_ flawed (as we found out in 2022), did Dominion win a slander case against Fox et al? Why in the ... is Dominon, a private company (and apparently a poor dev shop), the bastion of our democracy? I think the implications are pretty clear. “The very word 'secrecy' is repugnant in a free and open society; and we are as a people inherently and historically opposed to secret societies, to secret oaths and to secret proceedings. We decided long ago that the dangers of excessive and unwarranted concealment of pertinent facts far outweighed the dangers which are cited to justify it.” -JFK
- drewmol 3y ago
  Are you open to eliminating the secret ballot? I would be, I think the verifiably and integrity of election results would be greatly improved by making voting records public, I see no easy way to do the same while maintaining ballot secrecy. I’m open to the possibility there is a good transparent secret ballot system, but I haven’t heard of one that isn’t massively vulnerable to the possibility of fraudulent efforts by election administration officials.
  - nurple 3y ago
    I'm not against it, coercion/bribery always seemed to be a bit of an underwhelming justification for it; I just have a difficult time seeing it being done at scale (at least at the same scale as mutating the records can apparently be done), and like you said, it seems to excessively complicate the task. Even thinking of the possibilty of self-auditing, it leaves a large hole in the conceptual capability of validating the aggregate numbers. What I'd like to see is a human-to-human system, even if electronic (a la "venmo me"), where groups of people gather, discuss the issues, and cast their votes to eachother in a tree. The recievers meet and transfer their counts to the root of their branch, and so on to the tree's root. Every group knows their aggregate count, and even if you made the values of each node in the tree public it may be possible to keep the actual votes private outside of the individuals that make up each of the leafs.

drewmol 3y ago

The section titled “Isn’t there a paper trail? Why is malware a risk?” explains a bit about this. The printout is read by QR code so it’s possible to list the correct selections but modify the QR code that gets read. It also addresses the percentage of voters who verify and how thoroughly (it’s not many). “If an attacker changes only the QR code, voters have no way to detect the change by looking at their ballots, since voters can’t read the QR code. The change might be detected in a manual recount or a risk-limiting audit (RLA) based on a review of the printed text, but that is unlikely given Georgia’s weak audit requirements, which have recently been further diluted.” Also it’s a poor decision by Georgia to not install security updates until after next election, but that’s the state’s position currently. I watched some of the Georgia congressional hearings regarding election security, audits, and safe guards after the 2020 election and it seems like their board of election was a total shit show. It seems like paper ballots and counting could prevent all of the problems or alleged problems they experienced in the last two major elections.

rudolph9 3y ago
Again, there is definitely room for improvement but I don’t believe the data in the QR code encrypted, and it only takes one person to record them selves voting and a different vote getting printed on that piece of paper for this to become a big deal. It just seems very unlikely that even a small percentage of the votes getting changes would go completely unnoticed.
- drewmol 3y ago
  I don’t think it would be legal to do that (record). EDIT: It’s illegal, GA 21-2-413. I’m not sure how the validation works, but I assume that there is an identifier in the QR code, and it likely doesn’t have plaintext candidate names so I’m not sure if you could even validate the QR code with available data, but it would most certainly be a crime. The scenario they exposed as possible is : voter receives a printout paper ballot with the vote selection printed correctly in text, but the included QR code has modified selection(s). That paper is then fed into the reader/scanner/tabulation machine. No further confirmation. The whole point of the printout is for voters to confirm their selections, the whole QR code step is a design flaw. Just print regular ballots with filled in circles that can go through a standard tabulation machine and still be read/checked by humans if you really need to add a (required) touchscreen interface to the process. “If an attacker changes only the QR code, voters have no way to detect the change by looking at their ballots, since voters can’t read the QR code. The change might be detected in a manual recount or a risk-limiting audit (RLA) based on a review of the printed text, but that is unlikely given Georgia’s weak audit requirements, which have recently been further diluted.” It seems very unlikely that lots of votes getting changed would get noticed to me. Maybe I have a misunderstanding of the process. An RLA would help, but Georgia has had difficulty in conducting audits due to incompetence of officials and people not following process rules, QR codes seem like unnecessary complexity.
  - rudolph9 3y ago
    > No person shall use photographic or other electronic monitoring or recording devices, cameras, or cellular telephones while such person is in a polling place while voting is taking place; provided, however, that a poll manager, in his or her discretion, may allow the use of photographic devices in the polling place under such conditions and limitations as the election superintendent finds appropriate, and provided, further, that no photography shall be allowed of a ballot or the face of a voting machine or DRE unit or electronic ballot marker while an elector is voting such ballot or machine or DRE unit or using such electronic ballot marker, and no photography shall be allowed of an electors list, electronic electors list, or the use of an electors list or electronic electors list. This subsection shall not prohibit the use of photographic or other electronic monitoring or recording devices, cameras, or cellular telephones by poll officials for official purposes Yeah that’s pretty strict. It seems at least remotely plausible now. But still, I doubt the content of the QR code data is encrypted (probably cryptographically signed) especially given the vote is already written in plain text. And if votes of any significant percentage could make a difference were being switched someone would have a video (assuming the QR code data contains the chosen vote in plane text)

nurple 3y ago

Were the votes that were counted on paper (or even the electronic ones) then made available online for voters to check that their vote was recorded as cast? Why does the IRS have the technology the positively identify a citizen remotely to allow them access to information that's arguably more sensitive than a vote and yet we can't use this tech for that purpose? Why is this the second time that a Dominion machine was found by a third party to fail under scrutiny by security experts and CISA _then_ comes in to investigate whether the exploits were, well, exploited amidst the well-documented "fortification"? Why doesn't Georgia want to update these vulnerable systems before the presidential election? Why aren't all elections given a third-party statistical forensic analysis? Why, if the machines _are_ flawed (as we found out in 2022), did Dominion win a slander case against Fox et al? Why in the ... is Dominon, a private company (and apparently a poor dev shop), the bastion of our democracy? I think the implications are pretty clear. “The very word 'secrecy' is repugnant in a free and open society; and we are as a people inherently and historically opposed to secret societies, to secret oaths and to secret proceedings. We decided long ago that the dangers of excessive and unwarranted concealment of pertinent facts far outweighed the dangers which are cited to justify it.” -JFK

drewmol 3y ago
Are you open to eliminating the secret ballot? I would be, I think the verifiably and integrity of election results would be greatly improved by making voting records public, I see no easy way to do the same while maintaining ballot secrecy. I’m open to the possibility there is a good transparent secret ballot system, but I haven’t heard of one that isn’t massively vulnerable to the possibility of fraudulent efforts by election administration officials.
- nurple 3y ago
  I'm not against it, coercion/bribery always seemed to be a bit of an underwhelming justification for it; I just have a difficult time seeing it being done at scale (at least at the same scale as mutating the records can apparently be done), and like you said, it seems to excessively complicate the task. Even thinking of the possibilty of self-auditing, it leaves a large hole in the conceptual capability of validating the aggregate numbers. What I'd like to see is a human-to-human system, even if electronic (a la "venmo me"), where groups of people gather, discuss the issues, and cast their votes to eachother in a tree. The recievers meet and transfer their counts to the root of their branch, and so on to the tree's root. Every group knows their aggregate count, and even if you made the values of each node in the tree public it may be possible to keep the actual votes private outside of the individuals that make up each of the leafs.