5 ms·

One important thing about any voting system – digital or not – is that it has to be good at producing agreeable consent. That means bitter, betrayed and hurt (b

by atoav 2y ago

One important thing about any voting system – digital or not – is that it has to be good at producing agreeable consent. That means bitter, betrayed and hurt (but reasonable/democratic!) losing parties need to be able to say: yeah we accept the result because we are confident in the outcome of the election. This is something all digital systems are really bad at, even if everything is readable and verifiable, unless all your members know how to read that code. Edit: and even if they know how to read that code, can they trust the machines are running that code at the big day?

baobabKoodaa 2y ago
Disagree. It's enough for the average voter to trust that some other people - independent experts - are able to verify the vote. Not everyone needs to be an expert at anything. I wrote more about this trust aspect in the appendix of my thesis on voting: https://attejuvonen.fi/thesis https://attejuvonen.fi/thesis
- matheusmoreira 2y ago
  It's not enough. It's not enough at all. Experts are easily compromised. The system by which power is transferred from the people to representatives needs to be literally self-evident. Any system that the "average voter" cannot understand should be literally unconstitutional. Deviating from this puts the results of all elections in doubt. People will question the results, and they will have a point because the system is not actually verifiable and trustworthy to the average person and therefore they have no reason to accept the results. If you're lucky you'll end up with numerous political prisoners at the end of the whole process.
  - baobabKoodaa 2y ago
    Okay, so you will only accept some theoretical, idealistic, perfect voting system, which at this time does not exist. And until one is invented, you want all non-perfect voting systems to be "literally unconstitutional". How do you want government to function until a perfect voting system is invented? Should we just have dictatorship until that time?
    - unethical_ban 2y ago
      Decentralized paper ballot systems are counted locally, by people who live in your communities, and are plainly readable. This makes widespread, centralized election tampering much more difficult, in ways even a moron can usually grasp. (Edit: I mean the general public, not any reader here) Election skepticism is only going to get worse with China and Russia ramping up their neverending quest to discredit democracy. An unfortunate reality is that we need to operate our elections in ways that are unquestionably understandable and plainly resistant to tampering. Another example is voting systems. There are several voting systems that are objectively better than Instant Runoff Voting, but they require algebra to determine the winner. If the system isn't demonstrable in a short video or infographic, it is too complex for general population elections.
    - matheusmoreira 2y ago
      No one said anything about "perfect". I said black box systems that nobody but "experts" understand should be literally outlawed. Nowhere did I claim the system had to be "perfect". It needs to be a simple enough system that even laymen can understand, not some computer black box. What you fail to understand is that an "election" whose results can't be trusted is equivalent to a dictatorship. Actually they are even worse than dictatorships. In a dictatorship, at least you know you are being oppressed. When unreliable elections are institutionalized, they give an air of legitimacy to the dictator's rule, you're constantly gaslit by the dictator and his political and ideological supporters into believing that the oppression is just the democratic process at work.
      - baobabKoodaa 2y ago
        The average voter does not understand how a typical paper ballot system can be audited, or what coercion resistance properties the system has. It is not "simple enough system that even laymen can understand".
- jimhefferon 2y ago
  My reading of the news is that in the US (and that I can see, in many places) a lot of people have been convinced not to believe experts.
  - mmaul 2y ago
    The trend is growing here to, sadly. It's not people disagree with experts experts but that truth told by the, disagrees with a distorted perception or reality.
    - synecdoche 2y ago
      Or the other way around; the so called experts are actually tools in a propaganda machine, and people choose to rather believe their own experiences than second hand information.
- rcxdude 2y ago
  Yes, but then all that's needed to attack the voting system is to trot out your own experts that voice disagreement. Without the means to assess the system for themselves, voters will lose trust in it. Especially in this day and age, when trust in institutions and expects in general is extremely low. (Heck, this attack already works to some extent with the current, extremely transparent system of ballots)
  - eru 2y ago
    > (Heck, this attack already works to some extent with the current, extremely transparent system of ballots) Exactly, so the rest of your criticism isn't nearly as strong, if it applies to all means of voting.
    - atoav 2y ago
      Huh? That is not how this works. For a high stakes election I would take the most trustworthy system. So give me an argument why I should invest money into building a less trustworthy one? Because it I get results faster? I don't care about speed, high stakes elections are rare enough for that not to matter. Because it is more efficient? I don't care about efficiency, I want the result to be accurate and the process to be understandable by the stupid bloke in the pub with whom I have to discuss the result. There is literally no reason why this should be replaced by a digital system other than it makes us needs feel special.
      - baobabKoodaa 2y ago
        Paper ballot voting systems are generally more secure than electronic voting systems, but things are not black and white. There are differences amongst different paper ballot voting systems. There are also voting systems which combine both electronic and paper features. For example, a purely paper voting system can be trivially made more secure by adding electronic machines to prevent voters from accidentally spoiling ballots.
      - eru 2y ago
        The argument you make here might be right, but it's beside the point I was making. My point was narrowly that most of the argument made in https://news.ycombinator.com/item?id=41156898 https://news.ycombinator.com/item?id=41156898 applies to paper voting as well. For what it's worth, I prefer paper ballots, but I don't think that makes all arguments for them automatically valid.
- nihzm 2y ago
  > It's enough for the average voter to trust that some other people - independent experts - are able to verify the vote. I don't agree. This is plausible within a coesive electorate, but it feels like moving the problem. What guarantees that the experts are trusted by the voters? And more importantly, assuming that at some point the system (experts) is trusted, how is the trust in the voting system retained over time? (e.g. in case of disagreement over the results) I have argued in another thread like GP that because the ultimate purpose of voting systems is to collectively take decisions, and because disagreements are very common when deciding, the system needs to be able to justify itself to retain the electorate's trust. Otherwise it will eventually be replaced by a different voting system (or tyranny). A proxy for this is of course simplicity. If the voting system is clearly understood by everyone, it is more easy to persuade a losing party that the outcome is correct. Conversely, if a voting system needs high expertise to be understood, it is more difficult to bring everyone to agree on the result. So the latter is less robust than the former, especially if the disagreement is over a result that is close to a tie. A self-correcting mechanism is important to keep the voting system in place. In appendix B of your thesis you raise an interesting point I had not considered. > As an extreme example, consider the case where a voting system lacks verifiability, is trusted by the public, and is compromised by a foreign superpower: the people have lost their democracy and do not even realize it. Compare that to a hypothetical case where a voting system has perfect verifiability, thus can not be compromised (without triggering a new election etc.), and, for whatever reason, is not trusted by the people. > Clearly, the outcome where people are suspicious of a perfectly functioning voting system is superior to the outcome where people are blindly trusting a compromised voting system. We hope that this outlandish example is enough to support our argument that verifiability is more important than trust. The external threat is a very valid point but I do not think that this is sufficient to absolutely conclude that verifiability is more important than trust. If the system is rigged, it may eventually displease the electorate to the point that it will eventually be replaced. Unless, the rigged system doesn't displease the electorate and is essentially a hidden benevolent dictator, which would be an interesting situation. Only in that case verifiability could unambiguously be more important.
  - rraghur 2y ago
    Experts to verify but overall the entire system available for inspection to the populace at will (so open source, reproducible builds, verifiability) etc There will still be questions around compromised keys/secrets I suppose in this case paper ballots win
- maxdamantus 2y ago
  As a software developer myself, if an "independent expert" comes out and says that some software system is fully verified, I might trust their allegiance, but I probably won't trust their competence. I wouldn't expect the general population to trust them either.
  - eru 2y ago
    What if lots of experts come out that way, including people you already trust otherwise? Eg assume both Bill Gates and Linus Torvalds etc say they have reviewed the code?
    - maxdamantus 2y ago
      Then I would ask why the system they're reviewing is different to any other which is meant to be guaranteed-secure (or check that others are asking those questions). We're told every year or so about some SecureBoot vulnerability, which presumably involves code that has been reviewed. The system doesn't only include the code directly related to voting. It also includes OSes and everything involved in the infrastructure for hosting and communication (the Belenios system in particular involves sending private keys by email, and we're also relying on end user systems being uncompromised (who here likes browser extensions?)). It's not feasible to claim that such a system is secure from a remotely controlled attack (eg, by a lone external actor). Most of the attack scenarios against an offline voting system are ones that the general population can at least reason about, and they probably involve multiple insiders that would face a serious risk of being ratted out by one another.
      - eru 2y ago
        See https://news.ycombinator.com/item?id=41158861 https://news.ycombinator.com/item?id=41158861 Sending private keys (by mail or any other way) does sound bad, so the specific system mentioned in the article might not be worth bothering with.
    - atoav 2y ago
      If we assume that: - how do you know the code running on these machines on day X is actually the code they tested? - how do you know the code running does the same thing the code they tested does, even if it is the same code (e.g. hardware instructions could be doing different things on the machine, the OS could provide different functionality, other programs could interfere)? - how do you (and for that matter: every single voter) know their vote was counted towards the correct candidates in the whole process towards the end results, which likely involves transmitting data through the internet and/or people carrying USB thumb drives and sticking them into computers I am not saying it can't be done, but I say you can tell appart who knows computers really well (hackers) from those who know it kinda (geeks), by how doable they think this is.
- makmanalp 2y ago
  As a person who's from a country with, let's say, VERY VERY contested, controversial and eventful elections, the fact that independent poll watchers from different parties and NGOs can independently observe ballot boxes, take photo evidence of countersigned and publicly posted box tallies to send them to their HQs, and then compare and contrast results amongst each other as well as with the official results is a huge boon for transparency and trust in the electoral system. It's not perfect: more remote and less popular areas go unobserved, and what happens after an official complaint is made is anyone's guess. But at least almost anyone can add up numbers for themselves and come to a conclusion about what to trust and not trust. And you might think no one would bother, but in my brief experience as a volunteer poll worker they surely do, and zealously so. I can't even begin to imagine what'd happen if the paper ballot was replaced with "trust us, the machine says 37 for party A" or "the magical fingerprint number you don't understand says this ballot was cast for someone else".
- atoav 2y ago
  I think in your thesis you make some interesting points on how E-Voting systems differ. But I have critizism. Let me paraphrase your points: 1. Paper ballots are in some ways more ambigous, because there are many ways to scribble a sign into a circle, a fraction of which will not result in the intended outcome 2. Understanding these handwritten symbols is harder than understanding the electronic system, because of that ambiguity 3. People understand the paper ballot system, but there are some statistical checks and security measures that they don't understand or know of, so their knowledge of the paper system is superficial 4. Trust in voting systems does not primarily arise from understandability but from trust in other people. To quote: your grandmum doesn’t have to become an expert cryptographer in order to trust a system like X. She just has to believe that cryptography experts exist and at least one of them would speak out if this transparent voting system was not as secure as the election officials claim I don't want to question your thesis here, but I teach electronics and programming at a University level and points 1 and 2 are ridiculous and maybe even disingenuous. Sure, I understand that for a certain type of mind a digital/electronic system feels less ambigous and more clear. But most people are not like that – not even among academics – not even among academics that involve themselves with technology. Point 3 is a rethorical trick that – if applied equally to E-Voting would be a strong argument against it. Yeah sure people don't understand X completely so lets do Y which is one-thousand magnitudes more complex is not an argument in favour of Y even if phrased in such a way. Point 4 is the actual thought we disagree about, but given the unscientific nature of the 3 arguments before I can't simply trust you that you did research here (there are no sources cited that strengthen your point either). So as it is you just stated the opinion, as I stated the opposite. Sure, paper ballot elections are not dead simple, but any living being with basic understanding of object permanence could veryify a ballot isn't manipulated by just standing next to it. Meanwhile with computers you have to delegate that trust. And as computers can be reprogrammed, potentially remotely, even your experts can't be sure – especially in elections where powerful nation state actors seek to destroy the public trust in your election. This is a problem – just claiming that it isn't doesn't cut it. And people who claim that it isn't should not be the ones designing such systems. The important thing to understand about agreeable consent is that a person's willingness to subject themselves to the will of a democratically elected majority is directly linked to their trust into the process. Your voting system has to produce that trust even if voters don't want to trust the process. The surest way to do that is to get a part of them involved into the process – ideally not always the same people. If then a single poll watcher claims a thing and 400 others that have been present plus three trusted NGOs can claim otherwise the election is not in question. Someone will have to convince me this works for E-Voting with a bit more than rethorical tricks. Note that I am not against E-Voting per se. I just don't think the highest stake elections which have the potential to shift political powers should be electronic/computerized.
- guyomes 2y ago
  The experts from Belenios do not recommend to use remote e-voting for high-stake elections [1]. Some issues they mention are the risks that the users sells their credentials or that a malware on their computer leaks who they voted for. [1]: https://www.belenios.org/faq.html https://www.belenios.org/faq.html
  - baobabKoodaa 2y ago
    I don't recommend remote e-voting for high-stake elections either. But this is orthogonal to the point here.
- tivert 2y ago
  > Disagree. It's enough for the average voter to trust that some other people - independent experts - are able to verify the vote. It's interesting how attitudes about digital voting seemed to flip overnight once Trump challenged the 2020 election. Beforehand there as a lot of serious concern about the trustworthiness and security of digital voting machines, now I get the impression that's all been muted and its taboo to do anything except trust the authorities.
lesuorac 2y ago
Non-digital systems have claims of fake ballots being inserted all the time. I don't think the answer to people being suspicious of digital systems is to abandon them. It's to either disprove their suspicion or add controls so they become disproven. https://www.google.com/search?q=ballot+stuffing+2020 https://www.google.com/search?q=ballot+stuffing+2020 https://www.google.com/search?q=ballot+stuffing+2016 https://www.google.com/search?q=ballot+stuffing+2016 https://www.google.com/search?q=ballot+stuffing+2012 https://www.google.com/search?q=ballot+stuffing+2012
- codedokode 2y ago
  With analog voting you can at least count people coming and see their ballots when tallying. With digital systems this is typically a black box where you have to trust the government.
  - lesuorac 2y ago
    I don't think you understand how wrong your post is. Literally no election updates the raw tally of candidates the second a ballot comes in. If you count 1000 people entering and 1000 total votes that doesn't mean 1000 individials voted. Literally some of the cases of fraud are the same person entering multiple times and voting multiple times. You will need a control beyond "count people". (And if your control is to just do mail-in voting process in-person then what's the point). Additionally, if you have 1000 people entering and 1050 total votes; which 50 do you discard? This is where the mail-in votes have a better control than a simplistic ballot box as you only start co-mingling the votes once you know it's legit. W.r.t. Digital systems, there's nothing that stops there from being a paper audit trail you can verify. [1] Also, you don't need to "trust the government" (aka your neighbors) you can volunteer yourself to be a poll worker at your local elections to see how things are done or you can run to be on the board of elections in your local government. And if you're working the election you only need to trust yourself to have made it secure. [1]: https://en.wikipedia.org/wiki/Voter-verified_paper_audit_trail https://en.wikipedia.org/wiki/Voter-verified_paper_audit_tra...
    - 2y ago
mmaul 2y ago
Yea I guess the problem is with a party that is intent on disregarding truth or facts or verifiability or reality is not going to prevail against attacks against the system (unless it is rigged in their favor). What does code matter to them.
- atoav 2y ago
  The point I am trying to make here is that the creation of that agreeable consent ("I didn't like the result, but I am going to accept it") is easier when the process is tangible and people know that they can understand manipulation, tampering, tracking without an academic degree in computer science and decades of experience in the field. However no voting system is perfect and 100% consent is next to impossible to achieve. But for major, high stakes elections we have to take any tiny sliver of trust we can take, even if it is at the expense of getting results fast or cheap. As a young nerd I would've said: "How hard can it be", as an older nerd I understand that the computer part is the easy part, getting people to be able to trust and follow the process is the hard part.
EGreg 2y ago
All? Really? How would you make such a sweeping statement? Can you list the systems you had looked at?
- atoav 2y ago
  Huh? Yeah, all. I teach electronics at the University level and I know: 1. How hard it is for already highly educated people to understand electronics and programming 2. What kind of complexity is needed on how many technological layers to just even have it work reliably and how much more complexity is needed to have it formally variable and tamper-proof 3. How many attack vectors exist in such systems — many of which mean a single motivated and skilled attacker could exploit on grand scale All of that necessarily leads to a process that is less transparent than a paper ballot, because there are more moving parts. Your bloke from the pub will be able to understand how to check the integrity of a paper ballot. But of an E-voting system? In my eyes it is a feature if within a democracy if all participants in that democracy can understand the whole election process.
  - EGreg 2y ago
    That didn’t answer my question. What systems have you looked at? Saying “all systems” is such a sweeping statement, it is very unlikely to be true. Technology always improves and if you looked at any modern system, people some day in the past would be incredulous that it could possibly replace a bunch of smart humans with pen and paper. Experts said airplanes couldn’t ever fly and the wright brothers were fools. Then they said there are many safety problems with airplanes. If you told someone it would be the safest form of travel for long distances, people would laugh. Just as you are laughing now. They would claim their logic would hold for “all” forms of air transportation. People laughed that a chess playing program could beat a human, citing seemingly (to them) insurmountable challenges much as you do now. You could have said exactly 1,2,3 about the Internet and many other things in the past.
    - Biganon 2y ago
      You're missing their point. It's not that it cannot be done. It's that even if you do it perfectly (whatever that means), you cannot expect people to trust it. People trust papers in envelopes in transparent boxes in classrooms all around the country because it's intrinsically trustable, decentralised, easy to understand, extremely hard to manipulate at a global scale, etc. People do not trust an electronic system. You can explain to them that it's safe until you're red in the face, it's not the point. Democracy works if people have sufficient trust in it.
illiac786 2y ago
It’s a simple trust problem. No one is counting all ballots in the entire country, they trust others to do so, and do so in a truthful manner. Same for machines, they’ll have to trust that some people did their job and checked these machines. Not saying this will happen any time soon though ;)
- atoav 2y ago
  One question: How would a machine have to look that you use in a high stakes process, that someone else (potentially your adversary) purchases and setups and that you and the majority of the electorate can be able to trust? Elections with paper ballots are somewhat straightforward in that regard. Any party member that doesn't trust the process can literally apply to check part of it and be able to see for themselves that there is nothing fishy going on in the part they checked. And they can do that with nearly no prior expertise. If they don't get to check it for themselves they can trust that enough people like them are envolved in the process that someone would collect evidence of wrongdoing if it happened. And these people are normal people and many, so bribing them doesn't make sense. Adversaries that want to make that election untrustworthy would have to insert so many people at so many steps and at such number, an attack against it quickly becomes impractical. Not with a computer system, I am not even sure if I would trust a system that I myself setup and software that I myself had written if used in a high stakes election. But the few experts that are able to verify the process and have the computer knowledge to do so without naive optimism now are high stakes targets and each party now needs to have one at each polling station at some point after which the machines (air gapped?) need to be completely isolated unless you want that verification to become meaningless. The voter now needs to trust the expert and for a hint about how well that works I want to point you to the Covid pandemic. So digital voting is a non-trivial problem to solve, especially for high stakes, anonymous, but transparent elections. And we computer people can't just hand-wave the doubts away, you need to address each attack vector a major nation state attacker could/would exploit. And even if we did that the result would be a system that nobody without special education could understand. Sure, paper ballots are slow and the process lengthy and labour intensive. But the results are surprisingly stable and trustworthy even in many places where one would expect corruption and manipulation.
a_c_s 2y ago
Right: most systems with paper ballots are simple enough that the vast majority of the electorate, including those with lower-than-average IQ's (50% of the population), can understand and could participate in if they were inclined. I have yet to see a digital system that I would trust myself to validate, much less the non-technical majority of the public.
imtringued 2y ago
Agreed. One of the most common objections against democracy is that popular vote does not select for competence and therefore our politicians are not acting in the best interests of the population. That isn't actually what voting is meant to do. The purpose of democracy is to kick out the old guy and stop the concentration of power by rotating the people in power frequently. The problem is that when you get rid of the old guy, you also need people to agree and consent that the new guy is indeed the new guy.

by atoav 2y ago

baobabKoodaa 2y ago

Disagree. It's enough for the average voter to trust that some other people - independent experts - are able to verify the vote. Not everyone needs to be an expert at anything. I wrote more about this trust aspect in the appendix of my thesis on voting: https://attejuvonen.fi/thesis https://attejuvonen.fi/thesis

matheusmoreira 2y ago
It's not enough. It's not enough at all. Experts are easily compromised. The system by which power is transferred from the people to representatives needs to be literally self-evident. Any system that the "average voter" cannot understand should be literally unconstitutional. Deviating from this puts the results of all elections in doubt. People will question the results, and they will have a point because the system is not actually verifiable and trustworthy to the average person and therefore they have no reason to accept the results. If you're lucky you'll end up with numerous political prisoners at the end of the whole process.
- baobabKoodaa 2y ago
  Okay, so you will only accept some theoretical, idealistic, perfect voting system, which at this time does not exist. And until one is invented, you want all non-perfect voting systems to be "literally unconstitutional". How do you want government to function until a perfect voting system is invented? Should we just have dictatorship until that time?
  - unethical_ban 2y ago
    Decentralized paper ballot systems are counted locally, by people who live in your communities, and are plainly readable. This makes widespread, centralized election tampering much more difficult, in ways even a moron can usually grasp. (Edit: I mean the general public, not any reader here) Election skepticism is only going to get worse with China and Russia ramping up their neverending quest to discredit democracy. An unfortunate reality is that we need to operate our elections in ways that are unquestionably understandable and plainly resistant to tampering. Another example is voting systems. There are several voting systems that are objectively better than Instant Runoff Voting, but they require algebra to determine the winner. If the system isn't demonstrable in a short video or infographic, it is too complex for general population elections.
  - matheusmoreira 2y ago
    No one said anything about "perfect". I said black box systems that nobody but "experts" understand should be literally outlawed. Nowhere did I claim the system had to be "perfect". It needs to be a simple enough system that even laymen can understand, not some computer black box. What you fail to understand is that an "election" whose results can't be trusted is equivalent to a dictatorship. Actually they are even worse than dictatorships. In a dictatorship, at least you know you are being oppressed. When unreliable elections are institutionalized, they give an air of legitimacy to the dictator's rule, you're constantly gaslit by the dictator and his political and ideological supporters into believing that the oppression is just the democratic process at work.
    - baobabKoodaa 2y ago
      The average voter does not understand how a typical paper ballot system can be audited, or what coercion resistance properties the system has. It is not "simple enough system that even laymen can understand".
jimhefferon 2y ago
My reading of the news is that in the US (and that I can see, in many places) a lot of people have been convinced not to believe experts.
- mmaul 2y ago
  The trend is growing here to, sadly. It's not people disagree with experts experts but that truth told by the, disagrees with a distorted perception or reality.
  - synecdoche 2y ago
    Or the other way around; the so called experts are actually tools in a propaganda machine, and people choose to rather believe their own experiences than second hand information.
rcxdude 2y ago
Yes, but then all that's needed to attack the voting system is to trot out your own experts that voice disagreement. Without the means to assess the system for themselves, voters will lose trust in it. Especially in this day and age, when trust in institutions and expects in general is extremely low. (Heck, this attack already works to some extent with the current, extremely transparent system of ballots)
- eru 2y ago
  > (Heck, this attack already works to some extent with the current, extremely transparent system of ballots) Exactly, so the rest of your criticism isn't nearly as strong, if it applies to all means of voting.
  - atoav 2y ago
    Huh? That is not how this works. For a high stakes election I would take the most trustworthy system. So give me an argument why I should invest money into building a less trustworthy one? Because it I get results faster? I don't care about speed, high stakes elections are rare enough for that not to matter. Because it is more efficient? I don't care about efficiency, I want the result to be accurate and the process to be understandable by the stupid bloke in the pub with whom I have to discuss the result. There is literally no reason why this should be replaced by a digital system other than it makes us needs feel special.
    - baobabKoodaa 2y ago
      Paper ballot voting systems are generally more secure than electronic voting systems, but things are not black and white. There are differences amongst different paper ballot voting systems. There are also voting systems which combine both electronic and paper features. For example, a purely paper voting system can be trivially made more secure by adding electronic machines to prevent voters from accidentally spoiling ballots.
    - eru 2y ago
      The argument you make here might be right, but it's beside the point I was making. My point was narrowly that most of the argument made in https://news.ycombinator.com/item?id=41156898 https://news.ycombinator.com/item?id=41156898 applies to paper voting as well. For what it's worth, I prefer paper ballots, but I don't think that makes all arguments for them automatically valid.
nihzm 2y ago
> It's enough for the average voter to trust that some other people - independent experts - are able to verify the vote. I don't agree. This is plausible within a coesive electorate, but it feels like moving the problem. What guarantees that the experts are trusted by the voters? And more importantly, assuming that at some point the system (experts) is trusted, how is the trust in the voting system retained over time? (e.g. in case of disagreement over the results) I have argued in another thread like GP that because the ultimate purpose of voting systems is to collectively take decisions, and because disagreements are very common when deciding, the system needs to be able to justify itself to retain the electorate's trust. Otherwise it will eventually be replaced by a different voting system (or tyranny). A proxy for this is of course simplicity. If the voting system is clearly understood by everyone, it is more easy to persuade a losing party that the outcome is correct. Conversely, if a voting system needs high expertise to be understood, it is more difficult to bring everyone to agree on the result. So the latter is less robust than the former, especially if the disagreement is over a result that is close to a tie. A self-correcting mechanism is important to keep the voting system in place. In appendix B of your thesis you raise an interesting point I had not considered. > As an extreme example, consider the case where a voting system lacks verifiability, is trusted by the public, and is compromised by a foreign superpower: the people have lost their democracy and do not even realize it. Compare that to a hypothetical case where a voting system has perfect verifiability, thus can not be compromised (without triggering a new election etc.), and, for whatever reason, is not trusted by the people. > Clearly, the outcome where people are suspicious of a perfectly functioning voting system is superior to the outcome where people are blindly trusting a compromised voting system. We hope that this outlandish example is enough to support our argument that verifiability is more important than trust. The external threat is a very valid point but I do not think that this is sufficient to absolutely conclude that verifiability is more important than trust. If the system is rigged, it may eventually displease the electorate to the point that it will eventually be replaced. Unless, the rigged system doesn't displease the electorate and is essentially a hidden benevolent dictator, which would be an interesting situation. Only in that case verifiability could unambiguously be more important.
- rraghur 2y ago
  Experts to verify but overall the entire system available for inspection to the populace at will (so open source, reproducible builds, verifiability) etc There will still be questions around compromised keys/secrets I suppose in this case paper ballots win
maxdamantus 2y ago
As a software developer myself, if an "independent expert" comes out and says that some software system is fully verified, I might trust their allegiance, but I probably won't trust their competence. I wouldn't expect the general population to trust them either.
- eru 2y ago
  What if lots of experts come out that way, including people you already trust otherwise? Eg assume both Bill Gates and Linus Torvalds etc say they have reviewed the code?
  - maxdamantus 2y ago
    Then I would ask why the system they're reviewing is different to any other which is meant to be guaranteed-secure (or check that others are asking those questions). We're told every year or so about some SecureBoot vulnerability, which presumably involves code that has been reviewed. The system doesn't only include the code directly related to voting. It also includes OSes and everything involved in the infrastructure for hosting and communication (the Belenios system in particular involves sending private keys by email, and we're also relying on end user systems being uncompromised (who here likes browser extensions?)). It's not feasible to claim that such a system is secure from a remotely controlled attack (eg, by a lone external actor). Most of the attack scenarios against an offline voting system are ones that the general population can at least reason about, and they probably involve multiple insiders that would face a serious risk of being ratted out by one another.
    - eru 2y ago
      See https://news.ycombinator.com/item?id=41158861 https://news.ycombinator.com/item?id=41158861 Sending private keys (by mail or any other way) does sound bad, so the specific system mentioned in the article might not be worth bothering with.
  - atoav 2y ago
    If we assume that: - how do you know the code running on these machines on day X is actually the code they tested? - how do you know the code running does the same thing the code they tested does, even if it is the same code (e.g. hardware instructions could be doing different things on the machine, the OS could provide different functionality, other programs could interfere)? - how do you (and for that matter: every single voter) know their vote was counted towards the correct candidates in the whole process towards the end results, which likely involves transmitting data through the internet and/or people carrying USB thumb drives and sticking them into computers I am not saying it can't be done, but I say you can tell appart who knows computers really well (hackers) from those who know it kinda (geeks), by how doable they think this is.
makmanalp 2y ago
As a person who's from a country with, let's say, VERY VERY contested, controversial and eventful elections, the fact that independent poll watchers from different parties and NGOs can independently observe ballot boxes, take photo evidence of countersigned and publicly posted box tallies to send them to their HQs, and then compare and contrast results amongst each other as well as with the official results is a huge boon for transparency and trust in the electoral system. It's not perfect: more remote and less popular areas go unobserved, and what happens after an official complaint is made is anyone's guess. But at least almost anyone can add up numbers for themselves and come to a conclusion about what to trust and not trust. And you might think no one would bother, but in my brief experience as a volunteer poll worker they surely do, and zealously so. I can't even begin to imagine what'd happen if the paper ballot was replaced with "trust us, the machine says 37 for party A" or "the magical fingerprint number you don't understand says this ballot was cast for someone else".
atoav 2y ago
I think in your thesis you make some interesting points on how E-Voting systems differ. But I have critizism. Let me paraphrase your points: 1. Paper ballots are in some ways more ambigous, because there are many ways to scribble a sign into a circle, a fraction of which will not result in the intended outcome 2. Understanding these handwritten symbols is harder than understanding the electronic system, because of that ambiguity 3. People understand the paper ballot system, but there are some statistical checks and security measures that they don't understand or know of, so their knowledge of the paper system is superficial 4. Trust in voting systems does not primarily arise from understandability but from trust in other people. To quote: your grandmum doesn’t have to become an expert cryptographer in order to trust a system like X. She just has to believe that cryptography experts exist and at least one of them would speak out if this transparent voting system was not as secure as the election officials claim I don't want to question your thesis here, but I teach electronics and programming at a University level and points 1 and 2 are ridiculous and maybe even disingenuous. Sure, I understand that for a certain type of mind a digital/electronic system feels less ambigous and more clear. But most people are not like that – not even among academics – not even among academics that involve themselves with technology. Point 3 is a rethorical trick that – if applied equally to E-Voting would be a strong argument against it. Yeah sure people don't understand X completely so lets do Y which is one-thousand magnitudes more complex is not an argument in favour of Y even if phrased in such a way. Point 4 is the actual thought we disagree about, but given the unscientific nature of the 3 arguments before I can't simply trust you that you did research here (there are no sources cited that strengthen your point either). So as it is you just stated the opinion, as I stated the opposite. Sure, paper ballot elections are not dead simple, but any living being with basic understanding of object permanence could veryify a ballot isn't manipulated by just standing next to it. Meanwhile with computers you have to delegate that trust. And as computers can be reprogrammed, potentially remotely, even your experts can't be sure – especially in elections where powerful nation state actors seek to destroy the public trust in your election. This is a problem – just claiming that it isn't doesn't cut it. And people who claim that it isn't should not be the ones designing such systems. The important thing to understand about agreeable consent is that a person's willingness to subject themselves to the will of a democratically elected majority is directly linked to their trust into the process. Your voting system has to produce that trust even if voters don't want to trust the process. The surest way to do that is to get a part of them involved into the process – ideally not always the same people. If then a single poll watcher claims a thing and 400 others that have been present plus three trusted NGOs can claim otherwise the election is not in question. Someone will have to convince me this works for E-Voting with a bit more than rethorical tricks. Note that I am not against E-Voting per se. I just don't think the highest stake elections which have the potential to shift political powers should be electronic/computerized.
guyomes 2y ago
The experts from Belenios do not recommend to use remote e-voting for high-stake elections [1]. Some issues they mention are the risks that the users sells their credentials or that a malware on their computer leaks who they voted for. [1]: https://www.belenios.org/faq.html https://www.belenios.org/faq.html
- baobabKoodaa 2y ago
  I don't recommend remote e-voting for high-stake elections either. But this is orthogonal to the point here.
tivert 2y ago
> Disagree. It's enough for the average voter to trust that some other people - independent experts - are able to verify the vote. It's interesting how attitudes about digital voting seemed to flip overnight once Trump challenged the 2020 election. Beforehand there as a lot of serious concern about the trustworthiness and security of digital voting machines, now I get the impression that's all been muted and its taboo to do anything except trust the authorities.

lesuorac 2y ago

Non-digital systems have claims of fake ballots being inserted all the time. I don't think the answer to people being suspicious of digital systems is to abandon them. It's to either disprove their suspicion or add controls so they become disproven. https://www.google.com/search?q=ballot+stuffing+2020 https://www.google.com/search?q=ballot+stuffing+2020 https://www.google.com/search?q=ballot+stuffing+2016 https://www.google.com/search?q=ballot+stuffing+2016 https://www.google.com/search?q=ballot+stuffing+2012 https://www.google.com/search?q=ballot+stuffing+2012

codedokode 2y ago
With analog voting you can at least count people coming and see their ballots when tallying. With digital systems this is typically a black box where you have to trust the government.
- lesuorac 2y ago
  I don't think you understand how wrong your post is. Literally no election updates the raw tally of candidates the second a ballot comes in. If you count 1000 people entering and 1000 total votes that doesn't mean 1000 individials voted. Literally some of the cases of fraud are the same person entering multiple times and voting multiple times. You will need a control beyond "count people". (And if your control is to just do mail-in voting process in-person then what's the point). Additionally, if you have 1000 people entering and 1050 total votes; which 50 do you discard? This is where the mail-in votes have a better control than a simplistic ballot box as you only start co-mingling the votes once you know it's legit. W.r.t. Digital systems, there's nothing that stops there from being a paper audit trail you can verify. [1] Also, you don't need to "trust the government" (aka your neighbors) you can volunteer yourself to be a poll worker at your local elections to see how things are done or you can run to be on the board of elections in your local government. And if you're working the election you only need to trust yourself to have made it secure. [1]: https://en.wikipedia.org/wiki/Voter-verified_paper_audit_trail https://en.wikipedia.org/wiki/Voter-verified_paper_audit_tra...
  - 2y ago

mmaul 2y ago

Yea I guess the problem is with a party that is intent on disregarding truth or facts or verifiability or reality is not going to prevail against attacks against the system (unless it is rigged in their favor). What does code matter to them.

atoav 2y ago
The point I am trying to make here is that the creation of that agreeable consent ("I didn't like the result, but I am going to accept it") is easier when the process is tangible and people know that they can understand manipulation, tampering, tracking without an academic degree in computer science and decades of experience in the field. However no voting system is perfect and 100% consent is next to impossible to achieve. But for major, high stakes elections we have to take any tiny sliver of trust we can take, even if it is at the expense of getting results fast or cheap. As a young nerd I would've said: "How hard can it be", as an older nerd I understand that the computer part is the easy part, getting people to be able to trust and follow the process is the hard part.

EGreg 2y ago

All? Really? How would you make such a sweeping statement? Can you list the systems you had looked at?

atoav 2y ago
Huh? Yeah, all. I teach electronics at the University level and I know: 1. How hard it is for already highly educated people to understand electronics and programming 2. What kind of complexity is needed on how many technological layers to just even have it work reliably and how much more complexity is needed to have it formally variable and tamper-proof 3. How many attack vectors exist in such systems — many of which mean a single motivated and skilled attacker could exploit on grand scale All of that necessarily leads to a process that is less transparent than a paper ballot, because there are more moving parts. Your bloke from the pub will be able to understand how to check the integrity of a paper ballot. But of an E-voting system? In my eyes it is a feature if within a democracy if all participants in that democracy can understand the whole election process.
- EGreg 2y ago
  That didn’t answer my question. What systems have you looked at? Saying “all systems” is such a sweeping statement, it is very unlikely to be true. Technology always improves and if you looked at any modern system, people some day in the past would be incredulous that it could possibly replace a bunch of smart humans with pen and paper. Experts said airplanes couldn’t ever fly and the wright brothers were fools. Then they said there are many safety problems with airplanes. If you told someone it would be the safest form of travel for long distances, people would laugh. Just as you are laughing now. They would claim their logic would hold for “all” forms of air transportation. People laughed that a chess playing program could beat a human, citing seemingly (to them) insurmountable challenges much as you do now. You could have said exactly 1,2,3 about the Internet and many other things in the past.
  - Biganon 2y ago
    You're missing their point. It's not that it cannot be done. It's that even if you do it perfectly (whatever that means), you cannot expect people to trust it. People trust papers in envelopes in transparent boxes in classrooms all around the country because it's intrinsically trustable, decentralised, easy to understand, extremely hard to manipulate at a global scale, etc. People do not trust an electronic system. You can explain to them that it's safe until you're red in the face, it's not the point. Democracy works if people have sufficient trust in it.

illiac786 2y ago

It’s a simple trust problem. No one is counting all ballots in the entire country, they trust others to do so, and do so in a truthful manner. Same for machines, they’ll have to trust that some people did their job and checked these machines. Not saying this will happen any time soon though ;)

atoav 2y ago
One question: How would a machine have to look that you use in a high stakes process, that someone else (potentially your adversary) purchases and setups and that you and the majority of the electorate can be able to trust? Elections with paper ballots are somewhat straightforward in that regard. Any party member that doesn't trust the process can literally apply to check part of it and be able to see for themselves that there is nothing fishy going on in the part they checked. And they can do that with nearly no prior expertise. If they don't get to check it for themselves they can trust that enough people like them are envolved in the process that someone would collect evidence of wrongdoing if it happened. And these people are normal people and many, so bribing them doesn't make sense. Adversaries that want to make that election untrustworthy would have to insert so many people at so many steps and at such number, an attack against it quickly becomes impractical. Not with a computer system, I am not even sure if I would trust a system that I myself setup and software that I myself had written if used in a high stakes election. But the few experts that are able to verify the process and have the computer knowledge to do so without naive optimism now are high stakes targets and each party now needs to have one at each polling station at some point after which the machines (air gapped?) need to be completely isolated unless you want that verification to become meaningless. The voter now needs to trust the expert and for a hint about how well that works I want to point you to the Covid pandemic. So digital voting is a non-trivial problem to solve, especially for high stakes, anonymous, but transparent elections. And we computer people can't just hand-wave the doubts away, you need to address each attack vector a major nation state attacker could/would exploit. And even if we did that the result would be a system that nobody without special education could understand. Sure, paper ballots are slow and the process lengthy and labour intensive. But the results are surprisingly stable and trustworthy even in many places where one would expect corruption and manipulation.

a_c_s 2y ago

Right: most systems with paper ballots are simple enough that the vast majority of the electorate, including those with lower-than-average IQ's (50% of the population), can understand and could participate in if they were inclined. I have yet to see a digital system that I would trust myself to validate, much less the non-technical majority of the public.

imtringued 2y ago

Agreed. One of the most common objections against democracy is that popular vote does not select for competence and therefore our politicians are not acting in the best interests of the population. That isn't actually what voting is meant to do. The purpose of democracy is to kick out the old guy and stop the concentration of power by rotating the people in power frequently. The problem is that when you get rid of the old guy, you also need people to agree and consent that the new guy is indeed the new guy.