8 ms·

Security Vulnerability of Switzerland's E-Voting System

89 points by mikece 3y ago

_joel 3y ago
Voting is one thing I don't think should ever be fully electronic. Hard to commit actions at scale with smaller paper ballots, in most places at least.
- trimethylpurine 3y ago
  Unless you happen to own the company that makes the machines, or manages them, or operates a significant number of them, or counts the votes. And even if those people can't, the public opinion is that they can, and that's just as bad.
  - progbits 3y ago
    Where I'm from, votes are hand counted by committee of multiple people in each voting district and anyone else can come and observe the process. You can't commit large scale fraud this way. And the results are available within 12 hours of the closing thanks to massive parallelism. There is no point in using machines other than enriching their manufacturer and enabling fraud.
    - the_snooze 3y ago
      >There is no point in using machines other than enriching their manufacturer and enabling fraud. This is a shortsighted take. To be clear, "machines" can fall anywhere from direct-recording electronic (DRE) machines where people vote on touchscreens with no paper record, to optical-scan machines that process Scantron-style bubble-in paper ballots. The latter is a really good option because you get all the security and usability benefits of paper with the speed of machine counts. That's especially important in jurisdictions that do ranked-choice voting (like Alaska) or places with very long and complicated ballots (like California). If you don't trust the scanner, then a risk-limiting audit [1] will detect discrepancies between what the machine says and what the paper ballots say. [1] https://en.wikipedia.org/wiki/Risk-limiting_audit https://en.wikipedia.org/wiki/Risk-limiting_audit
      - pivo 3y ago
        Even better than an RLA is a full machine recount from a different company to the one that recorded the votes in the first place. RLAs typically only count a small percentage of the total ballots, while a full machine Audit will count all ballots. I'm biased because this is what the company I work for does, but I think it's hard to argue that not counting all ballots is as good as counting all ballots.
    - deleted 3y ago
      [deleted]
    - deleted 3y ago
      [deleted]
  - _joel 3y ago
    We have tabulation machines and hand verification, both cross checked, where I'm from. No systematic issues, obviously attempts at localised fraud but this has been caught. More fraud in postal voting.
  - extraduder_ire 3y ago
    I'm surprised nobody who's opposed to voting machines has set up a company to build/sell them yet. I assume people would buy them off your competitors if your pitch was "e-voting is bad, insecure, and has intractable problems. these machines are the cheapest and least-bad ones." I was considering it for a while, calling them Expensive-Pencil machines or something, alluding to the paper they'd print out following your vote.
  - ta1243 3y ago
    Empty box is opened in front of multiple witnesses Voter comes along, name ticked off list of registered voters -- "this person has voted" Voter given stamped piece of paper with candidates on in front of multiple witnesses. Voter marks an X next to a name on a paper, folds paper, showing stamp, puts in a box in front of multiple witnesses Box fills and is then sealed in front of witnesses. Number of votes inside (from the ticking the list) written on. Box is then transferred to counting place. Box is unsealed at counting location in front of multiple witnesses Papers counted to confirm they have a stamp and the number of papers matches the number of votes on the box and accompanying paperwork Papers transferred to counting table in front of multiple witnesses Papers counted in front of multiple witnesses Any confusing ballots set aside to discuss between candidates and the adjudicator If the vote is close papers are recounted Winner announced. This works fine with elections with a turnout measured >30 million people in the UK, which means it works fine for the largest election in the US (California presidential election). So it's secure, scalable, and cheap At what point can you commit fraud to a scale where the effort to do it returns more than the effort to campaign for a few more votes?
    - deleted 3y ago
      [deleted]
    - FrenchyJiby 3y ago
      I'll note that France has a slight variant on that, where it's assumed that any identifiable marker of the ballot could reveal a voter's identity, bad in case of blackmail like "vote for X, and show it by having a stripe at at the top, or I [do bad things to family], I'll be checking the ballots"). To avoid this, no markers, but all possible votes are pieces of paper with printed text, grab N>2, go in the booth, put in one in an envelope. This way your vote and any other vote look identical, and vote is voided in case of any identifying mark (even weirdly bent paper etc). No stamp needed, just number of votes/envelopes.
      - ta1243 3y ago
        Much larger problems with voter intimidation in the UK through the postal vote system. I've been to several counts in the UK, spotting a specific ballot, even if you know which box it's in, is impossible. You've then got to be able to enforce that enough to make a difference. You'd have to have a unique mark for every person (at least at every station) you're trying to enforce, one that can be quickly spotted by one of about 5 people you can get at the verification stage. Even then there's no guarantee you didn't just miss it. Sure, you can write "WANK" next to everyone you don't like, and that's great, but again the number of votes you could affect in this way would be a tiny number.
- artificialLimbs 3y ago
  In the US, we used to be able to tabulate votes in 1 day, fairly correctly, with little corruption. Where there were problems, we could manually audit quickly and effectively. Then we switched away from paper ballots to e-voting.
  - the_snooze 3y ago
    >In the US, we used to be able to tabulate votes in 1 day Have we? Do you have a particular state in mind? As far as I know, all states have a post-election canvassing period of at least a week or two (if not longer) before official results are certified. Some states like California and New York are notoriously slow to certify. Election night results are always preliminary and subject to shifts, especially as mail and provisional ballots get processed.
    - ASalazarMX 3y ago
      Voting is a massively parallel process. Officials can count ballots, fill acts and seal the urns in the same day. In fact, elections in other countries, like Mexico, usually have at least 95% of votes certified by the next day, even if the last few percent drags their feet for some reason. There's no sensible reason to wait weeks for voting results, just put more people to the task, for the sake of transparency and promptness.
      - the_snooze 3y ago
        >In fact, elections in other countries, like Mexico, usually have at least 95% of votes certified by the next day, even if the last few percent drags their feet for some reason. I don't know what this means. "Certification" is when a state finalizes the official legally-binding results for elections. Votes aren't certified, election results are. It's when a state says "Coca-Cola got 832,992 votes and Pepsi got 902,311 votes" and enters it into its legal and historical record. All US states take time to certify results precisely to make sure the process is carried out correctly. They do things like archiving paper ballots, electronic records, and signed affidavits in case of legal challenges, processing provisional ballots and same-day registrations, and cross-checking the number of registered voters who showed up with the number of ballots cast at each precinct.
- Tainnor 3y ago
  It might be theoretically possible to devise an electronic voting scheme that is reasonably secure against various threat models (possibly with slightly different tradeoffs than paper ballots), but so far, every scheme that has been used in practice seems to have been severely flawed. Plus, even if such a "good" e-voting system existed, it would probably be almost impossible to explain to people how it works. With paper ballots, you can have people observe the process and verify that it was fair. With all the wild accusations of fraud that we have already, I don't want to know what the world would look like if people had to do operations on the blockchain or something to verify that votes were counted correctly.
- xinayder 3y ago
  Let's also stop using electronic techonology for banking and do it manually because it's harder to commit actions at scale with physical bank notes. This is a non sequitur, if we use it for banking (which is much more critical than voting), why is it a problem if we use electronic technology for voting? Estonia has it and it's working well so far. Brazil has a complete different system and it's much more auditable and less prone to manipulation and vote output alteration from human error. Edit: conclusion of the article is "lets switch back to paper because this system uses the internet". well, do you know that you can still have a 100% electronic voting system that - brace yourselves - don't use the internet? Take a look at Brazil's electronic ballots for example. They aren't connected to the internet at all, everything is stored locally on a memory card that is collected by the authorities at the end of the voting period, then sent to Brasilia for counting at a special room where the machines that read the cards don't have access to the internet.
  - iinnPP 3y ago
    When politicians can clean out your bank account for protesting, or simply sending money to a protest fundraiser, your vote matters more. Canada.
  - dns_snek 3y ago
    > if we use it for banking (which is much more critical than voting), why is it a problem if we use electronic technology for voting? If a bank makes a significant mistake, the average person WILL notice and the bank can resolve it through extensive audit logs and other records. This isn't the case with voting where any audit logs are purposefully anonymized. The average person can't identify electronic voting fraud or even honest mistakes/bugs while anyone can be present during ballot counts, re-counts and add up the numbers as long as they have a calculator. A process as fundamental as voting should be completely transparent, simple to understand for the average person and shouldn't require blind trust in "experts" and institutions.
  - the_snooze 3y ago
    >This is a non sequitur, if we use it for banking (which is much more critical than voting), why is it a problem if we use electronic technology for voting? Banking as a use-case is far more fault-tolerant than elections. Bad transactions can be reversed and redone. You can insure transactions, and all parties involved have visibility into the amounts, senders, and recipients. Elections are one-off events involving secret ballots. You can't have a do-over without throwing the whole system into question. You can't take out insurance for elections.
d-z-m 3y ago
> > Like any internet voting system, it has inherent security vulnerabilities: if there are malicious insiders, they can corrupt the vote count Malicious insiders can always corrupt the vote count. This isn't unique to e-voting systems.
- ortichic 3y ago
  The difference here is that they can do it with few people or alone, possibly hard do detect, and most importartly, at scale. Attacks on paper voting require many people in differet locations, can be re-counted, an they don't scale.
  - the_snooze 3y ago
    Exactly this. Paper voting has some really great properties, like being easy to understand, easy to administer, easy to examine after the fact, and hard to attack at scale or at a distance. It's not perfect, but as the National Academies of Sciences found in its review of election security research [1], it's the best option we've currently got. Security is a "better than" game. Just because option X isn't perfect doesn't mean X isn't a worthwhile solution given all other alternatives. [1] https://nap.nationalacademies.org/resource/25120/interactive/ https://nap.nationalacademies.org/resource/25120/interactive...
    - gjsman-1000 3y ago
      I think in the future, whenever elections are lost, blaming the electronic voting system is just too easy a scapegoat. And, for any politician who does that... I can't say they are completely making stuff up. It might just be better if we acknowledge and accept that old technology isn't bad. Windows XP is perfectly fine for controlling CNCs and medical devices to this day, as long as it's not connected to the internet. Probably better for it actually, because it won't restart to install an update with modern Windows. I'm not in favor of "new for the sake of new."
    - mariusor 3y ago
      > it's the best option we've currently got. And if everyone continues with the kind of sentiment prevalent in this thread that's likely the best we're ever going to get.
trimethylpurine 3y ago
They could simply advertise the instructions. Especially the correct server address. There's no need to panic. Sure a few voters would still be duped, but that's on par with the status quo. I don't see the issue.
viktorcode 3y ago
> Online voting is insecure, period Starting like that the author saves our time by letting us know that 1. This is a biased take. 2. There will be no attempt to asses overall security, its weak and strong points. But I still have read it to learn that the author says that paper voting solves security problems. Here’s the bonus point: 3. The author ignores security issues with paper voting.
- gonzo41 3y ago
  Voting is a human trust problem. More people can understand voting with paper and pencil than computers. And this is mostly because everyone knows someone who's been ripped off online with no recourse. No one really trusts computers. Pencil and paper solves the trust issue. And the issues of security around paper voting such as it's security, lots of guards, public counts etc, costing a bit more, are better understood than SSL, layer 1,2,3,4 securities, and verifiable systems.
  - FirmwareBurner 3y ago
    >And this is mostly because everyone knows someone who's been ripped off online with no recourse. No one really trusts computers. Online scams are a human problem, not a computer problem. People also get scammed via telephone. If someone asks you for your CC number and you give it to them, then the medium is not that important.
    - SV_BubbleTime 3y ago
      Our current technology encourages human misunderstanding. There’s nothing in the human evolution that would prepare us for nonstop phishing attacks. It absolutely is a computer failure because we haven’t changed, they have.
  - meowfly 3y ago
    I think you make a good point. Purely from the public trust perspective, paper and pencil seems so simple it makes people trust the system is secure. If the claim is it's cryptographically impossible for this system to be cheated, most of us would still have to trust the experts making those claims. However, it's beyond simply the public needing simple systems; the number of experts that would be required to lie about the certainty of a system is low enough that you really do create a less secure system. Paper ballots are harder to cheat because the systems scale in a way that you require more people in on the heist, which is the hardest part of any scam.
steve1977 3y ago
Considering my experience with anything digital made by (or for) Swiss government agencies, I can absolutely imagine that it's a horror show. For example, we had a digital vaccination certificate application (before COVID, calm down tin foil hats). This application/website apparently had issues so bad that the government had no other option than to just close it down for good from one day to another. Essentially, f..d up beyond repair. People couldn't even get their data out it anymore. It now seems that data rescue might be possible "soon"... 2.5 years after the platform has been taken down. Basically, everything IT our government touches is doomed ;) Source: I'm Swiss
- born2discover 3y ago
  Yep, that pretty much mirrors my own experience as well, and I am also Swiss. Sadly, IT companies in Switzerland aren't serious about security. Even big, reputable firms have been shown to be sub par when it comes to it... One of such incidents involved a highly reputable firm in Geneva that had many federal contracts. They got a data breach and their dirty laundry got aired out in the open: passwords to client networks/accounts/... were stored in clear text, contracts and other confidential information barely protected... So I'd say, while in Switzerland we do some things right, IT ain't it.
  - Tainnor 3y ago
    Then on the other hand, Scala was developed in Switzerland, and Pascal before that. :)
- Tainnor 3y ago
  I wouldn't say everything. I find the SBB app quite usable, for example. Compare that to the German DB app...
  - steve1977 3y ago
    Fair enough, I guess our public transport system is pretty good anyway, especially compared to others. Of course it’s not everything. We also have great official geo mapping for example: https://www.swisstopo.admin.ch/ https://www.swisstopo.admin.ch/
gottorf 3y ago
In the eternal words of DevOps Borat: "To make error is human. To propagate error to all server in automatic way is devops."[0] Not everything in society has to be about maximum efficiency. Paper ballots aren't maximally efficient in terms of resources required to count, but has other desirable characteristics that we may prefer. [0]: https://twitter.com/DEVOPS_BORAT/status/41587168870797312 https://twitter.com/DEVOPS_BORAT/status/41587168870797312
- ta1243 3y ago
  Just this morning I wrote "to err requires a human, to really foul things up requires automation"
red_admiral 3y ago
The Swiss e-voting system is currently being used in a trial in three (2.5 if you count the Swiss way) out of 20-odd cantons. It's real, but not deployed nationally yet. That doesn't change any of the arguments here, but it is context that I wish had been provided in the article.
- chrisandchris 3y ago
  They could also have mentioned that each time the system is tested, some serious security incident pops up, like [1]. Each vote counts and if a digital system cannot provide accuracy, then don't trust it at all. People wilm start with "but the system cannot lie" when in truth it did. The british postal office did that, and we know where that went... [1] https://democracychronicles.org/swiss-post-e-voting-system/ https://democracychronicles.org/swiss-post-e-voting-system/
  - red_admiral 3y ago
    From that page (which is from 2019): > A second error in the Swiss Post planned e-voting system has been discovered as the public intrusion test phase comes to an end. The Federal Chancellery announced the need for action and confirmed a review of the e-voting certification and approval process. I would argue that the whole point of a public intrusion test phase _before_ the system is ever used live, is to find and eliminate bugs like this. Flaws being found in this phase is surely the process working as intended? It would be a very different matter if a verifiability bug was found in the live system in 2023 as opposed to the test system in 2019.
happytiger 3y ago
At least they have an e-voting system to patch vulnerabilities in. The US is so hung up on “this is the one system that should never be fully electronic” that we end up with absolutely terrible systems.
- xxiiiiiii 3y ago
  [flagged]
  - happytiger 3y ago
    Not MAGA or a troll, but you sure are showing a lack of kindness to others with your comment. I’m sure it’s unintended, but I don’t think showing off your egotism or distain for Americans makes your point better or encourage healthy conversation. Aka, I would love it if you could help me keep HN from becoming another Reddit. I agree that I would have loved to have seen the ultimate truth come out. I don’t think that particular situation is the best example perhaps, but the voting systems in the US have been repeatedly obliterated at DEFCON year after year. It’s more that you can make terrible systems and discharge the concequences with a settlement that I meant to refer to. But the way in which it immediately made the whole conversation polarize around political parties is also the point I’m trying to make. It’s so difficult to discuss the failure of the system because of the insane politics. You’re not even American (presumably) but you’re jumping in with a judgement about political parties and voting systems. That’s some pretty intense social commentary about how messed up voting in the US is.
    - xxiiiiiii 3y ago
      [flagged]
WelcomeShorty 3y ago
Once the "install malware" card has been drawn, you can forget security. Hell, with his argument, you can't even be sure you read what he wrote. To all experts here: Give it a shot! https://yeswehack.com/programs/swiss-post-evoting https://yeswehack.com/programs/swiss-post-evoting https://gitlab.com/swisspost-evoting/e-voting/e-voting https://gitlab.com/swisspost-evoting/e-voting/e-voting

89 points by mikece 3y ago

Voting is one thing I don't think should ever be fully electronic. Hard to commit actions at scale with smaller paper ballots, in most places at least.

trimethylpurine 3y ago
Unless you happen to own the company that makes the machines, or manages them, or operates a significant number of them, or counts the votes. And even if those people can't, the public opinion is that they can, and that's just as bad.
- progbits 3y ago
  Where I'm from, votes are hand counted by committee of multiple people in each voting district and anyone else can come and observe the process. You can't commit large scale fraud this way. And the results are available within 12 hours of the closing thanks to massive parallelism. There is no point in using machines other than enriching their manufacturer and enabling fraud.
  - the_snooze 3y ago
    >There is no point in using machines other than enriching their manufacturer and enabling fraud. This is a shortsighted take. To be clear, "machines" can fall anywhere from direct-recording electronic (DRE) machines where people vote on touchscreens with no paper record, to optical-scan machines that process Scantron-style bubble-in paper ballots. The latter is a really good option because you get all the security and usability benefits of paper with the speed of machine counts. That's especially important in jurisdictions that do ranked-choice voting (like Alaska) or places with very long and complicated ballots (like California). If you don't trust the scanner, then a risk-limiting audit [1] will detect discrepancies between what the machine says and what the paper ballots say. [1] https://en.wikipedia.org/wiki/Risk-limiting_audit https://en.wikipedia.org/wiki/Risk-limiting_audit
    - pivo 3y ago
      Even better than an RLA is a full machine recount from a different company to the one that recorded the votes in the first place. RLAs typically only count a small percentage of the total ballots, while a full machine Audit will count all ballots. I'm biased because this is what the company I work for does, but I think it's hard to argue that not counting all ballots is as good as counting all ballots.
  - deleted 3y ago
    [deleted]
  - deleted 3y ago
    [deleted]
- _joel 3y ago
  We have tabulation machines and hand verification, both cross checked, where I'm from. No systematic issues, obviously attempts at localised fraud but this has been caught. More fraud in postal voting.
- extraduder_ire 3y ago
  I'm surprised nobody who's opposed to voting machines has set up a company to build/sell them yet. I assume people would buy them off your competitors if your pitch was "e-voting is bad, insecure, and has intractable problems. these machines are the cheapest and least-bad ones." I was considering it for a while, calling them Expensive-Pencil machines or something, alluding to the paper they'd print out following your vote.
- ta1243 3y ago
  Empty box is opened in front of multiple witnesses Voter comes along, name ticked off list of registered voters -- "this person has voted" Voter given stamped piece of paper with candidates on in front of multiple witnesses. Voter marks an X next to a name on a paper, folds paper, showing stamp, puts in a box in front of multiple witnesses Box fills and is then sealed in front of witnesses. Number of votes inside (from the ticking the list) written on. Box is then transferred to counting place. Box is unsealed at counting location in front of multiple witnesses Papers counted to confirm they have a stamp and the number of papers matches the number of votes on the box and accompanying paperwork Papers transferred to counting table in front of multiple witnesses Papers counted in front of multiple witnesses Any confusing ballots set aside to discuss between candidates and the adjudicator If the vote is close papers are recounted Winner announced. This works fine with elections with a turnout measured >30 million people in the UK, which means it works fine for the largest election in the US (California presidential election). So it's secure, scalable, and cheap At what point can you commit fraud to a scale where the effort to do it returns more than the effort to campaign for a few more votes?
  - deleted 3y ago
    [deleted]
  - FrenchyJiby 3y ago
    I'll note that France has a slight variant on that, where it's assumed that any identifiable marker of the ballot could reveal a voter's identity, bad in case of blackmail like "vote for X, and show it by having a stripe at at the top, or I [do bad things to family], I'll be checking the ballots"). To avoid this, no markers, but all possible votes are pieces of paper with printed text, grab N>2, go in the booth, put in one in an envelope. This way your vote and any other vote look identical, and vote is voided in case of any identifying mark (even weirdly bent paper etc). No stamp needed, just number of votes/envelopes.
    - ta1243 3y ago
      Much larger problems with voter intimidation in the UK through the postal vote system. I've been to several counts in the UK, spotting a specific ballot, even if you know which box it's in, is impossible. You've then got to be able to enforce that enough to make a difference. You'd have to have a unique mark for every person (at least at every station) you're trying to enforce, one that can be quickly spotted by one of about 5 people you can get at the verification stage. Even then there's no guarantee you didn't just miss it. Sure, you can write "WANK" next to everyone you don't like, and that's great, but again the number of votes you could affect in this way would be a tiny number.
artificialLimbs 3y ago
In the US, we used to be able to tabulate votes in 1 day, fairly correctly, with little corruption. Where there were problems, we could manually audit quickly and effectively. Then we switched away from paper ballots to e-voting.
- the_snooze 3y ago
  >In the US, we used to be able to tabulate votes in 1 day Have we? Do you have a particular state in mind? As far as I know, all states have a post-election canvassing period of at least a week or two (if not longer) before official results are certified. Some states like California and New York are notoriously slow to certify. Election night results are always preliminary and subject to shifts, especially as mail and provisional ballots get processed.
  - ASalazarMX 3y ago
    Voting is a massively parallel process. Officials can count ballots, fill acts and seal the urns in the same day. In fact, elections in other countries, like Mexico, usually have at least 95% of votes certified by the next day, even if the last few percent drags their feet for some reason. There's no sensible reason to wait weeks for voting results, just put more people to the task, for the sake of transparency and promptness.
    - the_snooze 3y ago
      >In fact, elections in other countries, like Mexico, usually have at least 95% of votes certified by the next day, even if the last few percent drags their feet for some reason. I don't know what this means. "Certification" is when a state finalizes the official legally-binding results for elections. Votes aren't certified, election results are. It's when a state says "Coca-Cola got 832,992 votes and Pepsi got 902,311 votes" and enters it into its legal and historical record. All US states take time to certify results precisely to make sure the process is carried out correctly. They do things like archiving paper ballots, electronic records, and signed affidavits in case of legal challenges, processing provisional ballots and same-day registrations, and cross-checking the number of registered voters who showed up with the number of ballots cast at each precinct.
Tainnor 3y ago
It might be theoretically possible to devise an electronic voting scheme that is reasonably secure against various threat models (possibly with slightly different tradeoffs than paper ballots), but so far, every scheme that has been used in practice seems to have been severely flawed. Plus, even if such a "good" e-voting system existed, it would probably be almost impossible to explain to people how it works. With paper ballots, you can have people observe the process and verify that it was fair. With all the wild accusations of fraud that we have already, I don't want to know what the world would look like if people had to do operations on the blockchain or something to verify that votes were counted correctly.
xinayder 3y ago
Let's also stop using electronic techonology for banking and do it manually because it's harder to commit actions at scale with physical bank notes. This is a non sequitur, if we use it for banking (which is much more critical than voting), why is it a problem if we use electronic technology for voting? Estonia has it and it's working well so far. Brazil has a complete different system and it's much more auditable and less prone to manipulation and vote output alteration from human error. Edit: conclusion of the article is "lets switch back to paper because this system uses the internet". well, do you know that you can still have a 100% electronic voting system that - brace yourselves - don't use the internet? Take a look at Brazil's electronic ballots for example. They aren't connected to the internet at all, everything is stored locally on a memory card that is collected by the authorities at the end of the voting period, then sent to Brasilia for counting at a special room where the machines that read the cards don't have access to the internet.
- iinnPP 3y ago
  When politicians can clean out your bank account for protesting, or simply sending money to a protest fundraiser, your vote matters more. Canada.
- dns_snek 3y ago
  > if we use it for banking (which is much more critical than voting), why is it a problem if we use electronic technology for voting? If a bank makes a significant mistake, the average person WILL notice and the bank can resolve it through extensive audit logs and other records. This isn't the case with voting where any audit logs are purposefully anonymized. The average person can't identify electronic voting fraud or even honest mistakes/bugs while anyone can be present during ballot counts, re-counts and add up the numbers as long as they have a calculator. A process as fundamental as voting should be completely transparent, simple to understand for the average person and shouldn't require blind trust in "experts" and institutions.
- the_snooze 3y ago
  >This is a non sequitur, if we use it for banking (which is much more critical than voting), why is it a problem if we use electronic technology for voting? Banking as a use-case is far more fault-tolerant than elections. Bad transactions can be reversed and redone. You can insure transactions, and all parties involved have visibility into the amounts, senders, and recipients. Elections are one-off events involving secret ballots. You can't have a do-over without throwing the whole system into question. You can't take out insurance for elections.

d-z-m 3y ago

> > Like any internet voting system, it has inherent security vulnerabilities: if there are malicious insiders, they can corrupt the vote count Malicious insiders can always corrupt the vote count. This isn't unique to e-voting systems.

ortichic 3y ago
The difference here is that they can do it with few people or alone, possibly hard do detect, and most importartly, at scale. Attacks on paper voting require many people in differet locations, can be re-counted, an they don't scale.
- the_snooze 3y ago
  Exactly this. Paper voting has some really great properties, like being easy to understand, easy to administer, easy to examine after the fact, and hard to attack at scale or at a distance. It's not perfect, but as the National Academies of Sciences found in its review of election security research [1], it's the best option we've currently got. Security is a "better than" game. Just because option X isn't perfect doesn't mean X isn't a worthwhile solution given all other alternatives. [1] https://nap.nationalacademies.org/resource/25120/interactive/ https://nap.nationalacademies.org/resource/25120/interactive...
  - gjsman-1000 3y ago
    I think in the future, whenever elections are lost, blaming the electronic voting system is just too easy a scapegoat. And, for any politician who does that... I can't say they are completely making stuff up. It might just be better if we acknowledge and accept that old technology isn't bad. Windows XP is perfectly fine for controlling CNCs and medical devices to this day, as long as it's not connected to the internet. Probably better for it actually, because it won't restart to install an update with modern Windows. I'm not in favor of "new for the sake of new."
  - mariusor 3y ago
    > it's the best option we've currently got. And if everyone continues with the kind of sentiment prevalent in this thread that's likely the best we're ever going to get.

trimethylpurine 3y ago

They could simply advertise the instructions. Especially the correct server address. There's no need to panic. Sure a few voters would still be duped, but that's on par with the status quo. I don't see the issue.

viktorcode 3y ago

> Online voting is insecure, period Starting like that the author saves our time by letting us know that 1. This is a biased take. 2. There will be no attempt to asses overall security, its weak and strong points. But I still have read it to learn that the author says that paper voting solves security problems. Here’s the bonus point: 3. The author ignores security issues with paper voting.

gonzo41 3y ago
Voting is a human trust problem. More people can understand voting with paper and pencil than computers. And this is mostly because everyone knows someone who's been ripped off online with no recourse. No one really trusts computers. Pencil and paper solves the trust issue. And the issues of security around paper voting such as it's security, lots of guards, public counts etc, costing a bit more, are better understood than SSL, layer 1,2,3,4 securities, and verifiable systems.
- FirmwareBurner 3y ago
  >And this is mostly because everyone knows someone who's been ripped off online with no recourse. No one really trusts computers. Online scams are a human problem, not a computer problem. People also get scammed via telephone. If someone asks you for your CC number and you give it to them, then the medium is not that important.
  - SV_BubbleTime 3y ago
    Our current technology encourages human misunderstanding. There’s nothing in the human evolution that would prepare us for nonstop phishing attacks. It absolutely is a computer failure because we haven’t changed, they have.
- meowfly 3y ago
  I think you make a good point. Purely from the public trust perspective, paper and pencil seems so simple it makes people trust the system is secure. If the claim is it's cryptographically impossible for this system to be cheated, most of us would still have to trust the experts making those claims. However, it's beyond simply the public needing simple systems; the number of experts that would be required to lie about the certainty of a system is low enough that you really do create a less secure system. Paper ballots are harder to cheat because the systems scale in a way that you require more people in on the heist, which is the hardest part of any scam.

steve1977 3y ago

Considering my experience with anything digital made by (or for) Swiss government agencies, I can absolutely imagine that it's a horror show. For example, we had a digital vaccination certificate application (before COVID, calm down tin foil hats). This application/website apparently had issues so bad that the government had no other option than to just close it down for good from one day to another. Essentially, f..d up beyond repair. People couldn't even get their data out it anymore. It now seems that data rescue might be possible "soon"... 2.5 years after the platform has been taken down. Basically, everything IT our government touches is doomed ;) Source: I'm Swiss

born2discover 3y ago
Yep, that pretty much mirrors my own experience as well, and I am also Swiss. Sadly, IT companies in Switzerland aren't serious about security. Even big, reputable firms have been shown to be sub par when it comes to it... One of such incidents involved a highly reputable firm in Geneva that had many federal contracts. They got a data breach and their dirty laundry got aired out in the open: passwords to client networks/accounts/... were stored in clear text, contracts and other confidential information barely protected... So I'd say, while in Switzerland we do some things right, IT ain't it.
- Tainnor 3y ago
  Then on the other hand, Scala was developed in Switzerland, and Pascal before that. :)
Tainnor 3y ago
I wouldn't say everything. I find the SBB app quite usable, for example. Compare that to the German DB app...
- steve1977 3y ago
  Fair enough, I guess our public transport system is pretty good anyway, especially compared to others. Of course it’s not everything. We also have great official geo mapping for example: https://www.swisstopo.admin.ch/ https://www.swisstopo.admin.ch/

gottorf 3y ago

In the eternal words of DevOps Borat: "To make error is human. To propagate error to all server in automatic way is devops."[0] Not everything in society has to be about maximum efficiency. Paper ballots aren't maximally efficient in terms of resources required to count, but has other desirable characteristics that we may prefer. [0]: https://twitter.com/DEVOPS_BORAT/status/41587168870797312 https://twitter.com/DEVOPS_BORAT/status/41587168870797312

ta1243 3y ago
Just this morning I wrote "to err requires a human, to really foul things up requires automation"

red_admiral 3y ago

The Swiss e-voting system is currently being used in a trial in three (2.5 if you count the Swiss way) out of 20-odd cantons. It's real, but not deployed nationally yet. That doesn't change any of the arguments here, but it is context that I wish had been provided in the article.

chrisandchris 3y ago
They could also have mentioned that each time the system is tested, some serious security incident pops up, like [1]. Each vote counts and if a digital system cannot provide accuracy, then don't trust it at all. People wilm start with "but the system cannot lie" when in truth it did. The british postal office did that, and we know where that went... [1] https://democracychronicles.org/swiss-post-e-voting-system/ https://democracychronicles.org/swiss-post-e-voting-system/
- red_admiral 3y ago
  From that page (which is from 2019): > A second error in the Swiss Post planned e-voting system has been discovered as the public intrusion test phase comes to an end. The Federal Chancellery announced the need for action and confirmed a review of the e-voting certification and approval process. I would argue that the whole point of a public intrusion test phase _before_ the system is ever used live, is to find and eliminate bugs like this. Flaws being found in this phase is surely the process working as intended? It would be a very different matter if a verifiability bug was found in the live system in 2023 as opposed to the test system in 2019.

happytiger 3y ago

At least they have an e-voting system to patch vulnerabilities in. The US is so hung up on “this is the one system that should never be fully electronic” that we end up with absolutely terrible systems.

xxiiiiiii 3y ago
[flagged]
- happytiger 3y ago
  Not MAGA or a troll, but you sure are showing a lack of kindness to others with your comment. I’m sure it’s unintended, but I don’t think showing off your egotism or distain for Americans makes your point better or encourage healthy conversation. Aka, I would love it if you could help me keep HN from becoming another Reddit. I agree that I would have loved to have seen the ultimate truth come out. I don’t think that particular situation is the best example perhaps, but the voting systems in the US have been repeatedly obliterated at DEFCON year after year. It’s more that you can make terrible systems and discharge the concequences with a settlement that I meant to refer to. But the way in which it immediately made the whole conversation polarize around political parties is also the point I’m trying to make. It’s so difficult to discuss the failure of the system because of the insane politics. You’re not even American (presumably) but you’re jumping in with a judgement about political parties and voting systems. That’s some pretty intense social commentary about how messed up voting in the US is.
  - xxiiiiiii 3y ago
    [flagged]

WelcomeShorty 3y ago

Once the "install malware" card has been drawn, you can forget security. Hell, with his argument, you can't even be sure you read what he wrote. To all experts here: Give it a shot! https://yeswehack.com/programs/swiss-post-evoting https://yeswehack.com/programs/swiss-post-evoting https://gitlab.com/swisspost-evoting/e-voting/e-voting https://gitlab.com/swisspost-evoting/e-voting/e-voting