7 ms·

I don't care how much maths and encryption you use, you can't get out of the fact that things can be anonymous (no one can know how you voted) or verifiable (pe

by ritzaco 7mo ago

I don't care how much maths and encryption you use, you can't get out of the fact that things can be anonymous (no one can know how you voted) or verifiable (people can prove that you only voted once) but not both. - Switzerland usually gets around this by knowing where everyone lives and mailing them a piece of paper 'something you have' - South Africa gets around this by putting ink on your fingernail I've read quite a bit about the e-voting systems in Switzerland and USA and I just don't see how they thread the needle. At some point, you have to give someone access to a database and they can change that database. Until we all have government-issued public keys or something, there isn't a technical solution to this? (Genuinely curious if I'm wrong here)

phoronixrly 7mo ago
> At some point, you have to give someone access to a database and they can change that database. It's the only problem in existence that can be solved by the blockchain...
- caminanteblanco 7mo ago
  But generally sacrifices that anonymous axis via a reproduceable public ledger
  - phoronixrly 7mo ago
    Unless pseudonymized...
- beautiful_apple 7mo ago
  Ironically most production e-voting systems do not use blockchains. That's because there isn't need for decentralization, just verifiability of a correct result and protecting voting secrecy.
kanapala 7mo ago
There's a goverment issued public & private key right here: https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card
- presentation 7mo ago
  Japan has them built into My Number Cards too https://www.digital.go.jp/en/policies/mynumber/private-business/jpki-introduction https://www.digital.go.jp/en/policies/mynumber/private-busin...
- BenjiWiebe 7mo ago
  Clearly the mark of the beast.
dmos62 7mo ago
You should care how much maths and encryption you use [0][1], because this is not only possible, but there are multiple approaches. [0] https://satoss.uni.lu/members/jun/papers/CSR13.pdf https://satoss.uni.lu/members/jun/papers/CSR13.pdf [1] https://fc16.ifca.ai/voting/papers/ABBT16.pdf https://fc16.ifca.ai/voting/papers/ABBT16.pdf
- jjmarr 7mo ago
  More important than lack of voter fraud is proving to the population a lack of voter fraud.
  - _0ffh 7mo ago
    I'm sure you could even let every voter verify that their vote has been registered correctly. Edit: But as a comment somewhere else in the tree noted ,,And if it could tell you that then a third party could force you to reveal that you voted "right" as agreed before.`` - I guess everything's trade-offs.
  - raron 7mo ago
    This. A voting system and it security must be understandable to the average people. You can not do that with electronic voting. (Even if electronic voting can be done securely.)
    - dmos62 7mo ago
      Why?
      - tauneutrin0 7mo ago
        One of the main goals of an electoral system is to ensure that the population trusts that their views are fairly represented. The reason that paper voting is so good in this regard is that everybody can fully understand the entire process. It is so very, very simple. And if you need proof, you can go see the counting for yourself. The issue with electronic voting is that there is far greater complexity. There are many valid reasons that someone could distrust it, for example: - You might not trust the cryptography experts that claim the algorithms are secure. - You might not trust the algorithms to be implemented correctly. - You might not trust the computer manufacturer to have designed a secure machine. - You might not trust the computer manufacturer to have built a defect-free machine. - You might not trust the machine hasn't been compromised by some bad actor. - You might not trust that there hasn't been some random bit-flips. - You might just not understand how computers work. - ect. ect. Note that it is not important whether it can be proved to be correct and secure. The unique goal here is that everyone can prove to themselves that it is correct and secure. It must be obvious to everyone that they can trust it. In my opinion, this is not possible to achieve with an electronic system.
SideburnsOfDoom 7mo ago
> South Africa gets around this by putting ink on your fingernail This is true, but its used in other countries as well, as it's a simple, effective, low-tech, affordable process. Most notably in India https://edition.cnn.com/2024/05/02/style/india-elections-purple-voter-ink-intl-hnk https://edition.cnn.com/2024/05/02/style/india-elections-pur... but also in many other countries: https://en.wikipedia.org/wiki/Election_ink#International_use https://en.wikipedia.org/wiki/Election_ink#International_use
deleted 7mo ago
[deleted]
beautiful_apple 7mo ago
You can have e-voting systems that protect ballot secrecy and are verifiable. You can use homomorphic encryption or mixnets to prove that: 1) all valid votes were counted 2) no invalid votes were added 3) the totals for each candidate is correct And you can do that without providing proof of who any particular voter voted for. A few such systems: https://en.wikipedia.org/wiki/Helios_Voting https://en.wikipedia.org/wiki/Helios_Voting https://www.belenios.org/ https://www.belenios.org/ Authentication to these systems is another issue - there are problems with mailing people credentials (what if they discard them in the trash?). https://www.cbc.ca/news/canada/ontario-municipal-elections-online-voting-study-1.7644536 https://www.cbc.ca/news/canada/ontario-municipal-elections-o... Estonia (a major adopter of online voting) solves this with the national identity card, which essentially is government issued public/private keys. https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card Lots of cyber risks with the use of online voting though, especially in jurisdictions without standards/certification. I outline many in my thesis which explores the risks to online elections in Ontario, Canada (one of the largest and longest-running users of online voting in the world) https://uwo.scholaris.ca/items/705a25de-f5df-4f2d-a2c1-a07e96a23c1b https://uwo.scholaris.ca/items/705a25de-f5df-4f2d-a2c1-a07e9...
- dietr1ch 7mo ago
  > You can have e-voting systems that protect ballot secrecy and are verifiable. In these systems the voter cannot verify that their vote was secret as they cannot understand, and much less verify the voting machine. > And you can do that without providing proof of who any particular voter voted for. Which is good for preventing the sale of votes, but keeps things obscure in a magical and correct box. How can I tell the machine didn't alter my vote if it cannot tell me, and just me, who I voted for? The global sanity checks are worthless if the machine changed my vote as I entered it.
  - yason 7mo ago
    And if it could tell you that then a third party could force you to reveal that you voted "right" as agreed before. Paper ballots with mutually suspicious representatives of all parties watching themselves during handling and counting is the only way to go for big things like parliament/presidential elections and national referendums where, in the worst case, the greatest of all matters are at stake. And foolproof method for voting is most needed when the levels of trust are at the lowest.
fermisea 7mo ago
What about this? Consider a toy system: everyone gets issued a UUID, everyone can see how every UUID voted, but only you know which one is your vote. This is of course flawed because a person can be coerced to share their ID. In which case you could have a system in which the vote itself is encrypted and the encryption key is private. Any random encryption key works and will yield a valid vote (actual vote = public vote + private key), so under coercion you can always generate a key that will give the output that you want, but only you know the real one.
- looperhacks 7mo ago
  Besides the fact that 99% of the general population won't be able to understand this, a $5€ wrench says that you show me proof of the correct private key (either by you showing me the letter you received, me being present when you set it up, or however it is set up)
- Muromec 7mo ago
  You have to trust that both 1) the UUID issuing party is not keeping the actual id to uuid mapping in the logs 2) the same party isn't allocating an excessive number of uuids to mass-vote for the "good" choice. In-person voting does provide these guarantees, to extent that violating them will be discoverable and both parties have an incentive to discover such things.
swiftcoder 7mo ago
> Until we all have government-issued public keys or something That's actually pretty common in Europe. The Spanish DNI (national identity card) has a chip these days, which gives you an authenticated key pair for accessing digital services. In the pilot project for digital voting, that identity is only used to authenticate the user, and then an anonymous key needs generated that can be used to cast the final vote.
mothballed 7mo ago
South Africa is in a somewhat similar situation of having a gigantic (1-10%, government is too broken to figure out where in that range) illegal immigrant population and poor access to paperwork for many citizens that would make any heavily scrutinized citizenship for registration lean heavily towards disenfranchisement of the poorer segments.
zahlman 7mo ago
Sure you can, you just need an anonymous voting mechanism that's sufficiently naive. You use the verifiable process to restrict access to that anonymous mechanism. In Canada, at both federal and provincial levels, you walk up to a desk and identify yourself, are crossed off a list, and handed a paper ballot. You go behind a screen, mark an X on the ballot, fold it up, take it back out to another desk, and put it in the box. It's extraordinarily simple. > At some point, you have to give someone access to a database and they can change that database. Well, that kind of fraud is a different issue from someone reading the database and figuring out who someone voted for (you just... don't record identities in the database).
- Bender 7mo ago
  There will never be a technical or operational process that excludes cheating. The only deterrence that seems to work on humans and even then only most of the time is severe capitol punishment and that will only be as effective as people believe it happens thus requiring live streaming of the removal of cheaters heads without censorship. The current legal process of each country would have to be by-passed or people would just sit in a cage for 30 years. Even in such cases there will be people that sacrifice themselves if they think that bribe money can go to their family but that is at least a start.
  - SoftTalker 7mo ago
    Also cheating with paper ballots is much harder to scale and remain undetected than cheating by altering records in a database.
    - Bender 7mo ago
      remain undetected than cheating by altering records in a database. Absolutely. Any time something is centralized it becomes an irresistible target for unlimited numbers of bad actors and the bar to entry for remote anonymous access makes it a much easier target. Anonymous access to paper ballots means someone is going to be on at least a handful of cameras and has to bypass many security systems so if cheating happens it is because the people gathering the votes want it that way. Such cities or states should be excluded from the voting process.
jfengel 7mo ago
The USA threads the needle by simply not having verifiable voting. And it turns out it works pretty well. Despite countless hours and lawsuits dedicated to finding people who voted more than once, only a handful of cases have actually turned up. It's not that there are no checks. You have to give your name, and they know if you've voted more than once at that station that day. To vote more than once you'd have to pretend to be somebody else, in person, which means that if you're caught you will go to jail. We could certainly do better, but thus far all efforts to defeat this non-problem are clearly targeted at making it harder for people to vote rather than any kind of election integrity.
- Joker_vD 7mo ago
  > You have to give your name, and they know if you've voted more than once at that station that day. So you go to other stations, duh. It's called "carousel voting" [0], if done on a large, organized scale. [0] https://en.wikipedia.org/wiki/Carousel_voting https://en.wikipedia.org/wiki/Carousel_voting
  - cj 7mo ago
    At least in NY, you would have to know the name of someone else assigned to the 2nd polling site, since your name is only on the list of 1 polling location?
    - drstewart 7mo ago
      This is of course a very high bar to clear, as data such as people's names is highly confidential and almost impossible to get unless you're any one of these 750+ data brokers: https://privacyrights.org/data-brokers https://privacyrights.org/data-brokers
      - alistairSH 7mo ago
        You'd also need a fake ID. And be willing to risk a felony conviction to add a single vote. It just doesn't happen here, despite the GOP trying to prove otherwise for decades.
nness 7mo ago
Australia has a system where you are anonymous and can prove that you only voted once: You have to be registered and must vote within your electorate, so your name appears on a certified list for that electorate and each voting location has that list. When you vote, they strike your name from the list. After the election, the lists from these locations are compared. Anyone who votes twice has their name struck twice, and are investigated for electoral fraud. Whether people know if you voted or not is immaterial, as voting is mandatory in Australia. Works pretty well for a paper system.
- pcchristie 7mo ago
  How does that prove that you only voted once? If I know someone's name and address (and by extension their electorate) I can rock up and vote as as many as I want.
  - nness 7mo ago
    Then you go to jail (penalty is 6 months for impersonating a person and voting on their behalf.) It's not like polling locations don't have cameras. (A few people voting more than once is unlikely to change the results of an election. If enough fraud is detected to impact the results, they'll run a new election.)
    - brainwad 7mo ago
      > It's not like polling locations don't have cameras. Given they are usually random primary schools and churches... do they have cameras? I think the bigger deterrent is just the risk of claiming to be someone who already got ticked off at the same booth, which would immediately raise suspicions.
spiddy 7mo ago
yes you can. each citizen gets an anonymized private key via a secure channel (eg. postal) and use that to vote. votes are double enveloped: outer envelop: anonymized id + inner envelop: vote. mixnet separates the votes and cryptographically shuffles them to decouple relationships. only at the end the shuffled votes are decrypted using the private key of the election itself that was split using shamir secret sharing (eg 5 out of 7 shares to reconstruct) the thing that’s not clear from the article and it’s a shame is that it seems the failure was the hardware (the 3 USB keys) not the election software. This could be simply avoided by having redundancy on the hardware (2 USBs per share) or more shares themselves (5 out of 9 shares)
jasonwatkinspdx 7mo ago
On the US keep in mind elections are run at the state level and below, so we don't have a single voting system, we have 50+. My state, Oregon, for example uses a very straightforward vote by mail system. They ask if you wanna register to vote when you get/update your drivers license or state id. Your ballot just comes in the mail, you fill it out, send it back. For folks that lack a permanent address or similar, you can get provisional ballots at libraries and similar city offices. The provisional ballots make you fill out enough information to check if you're allowed to vote. It's simple, convenient, secure, and efficient. So why don't more states do it this way? Unfortunately there's a long ugly history of using all sorts of dirty tricks for voter suppression in the US, in particular to keep Jim Crow going. And unfortunately variations of that continue today. I don't have the energy to dig into it fully here, I just want any international readers to be aware there's a whole lot of utterly craven bad faith when it comes to discussions around voting fraud and security in the US.
someguynamedq 7mo ago
Sorry, isn't this dead simple? Maintain a list of identity hashes. When someone goes to vote, deny them if they're already in the list . Otherwise, add their hash to the list then allow a vote to be cast.
- Muromec 7mo ago
  This makes the secrecy aspect problematic. You can't have zero trust in authority, verifiability and resistance to sabotage all at once.
kolinko 7mo ago
I think with zero knowledge proofs we can have it both ways?
pmontra 7mo ago
The Italian way looks similar to the Swiss way. In detail: When I go to cast a vote in Italy I bring with me my state issued photo ID (everybody has one, I mean: must have one) and a state issued sheet of paper with the address of the place I must go to vote and a grid of empty spaces. I don't have to register to vote, basically I'm registered at birth. The people at the polling station take my two cards and look for me in their registry. They mark that I came to vote, stamp an empty space on the second card and handle me the paper ballots. I think that in this way it's both anonymous and verifiable. When the card with the stamps is full, they mail me a new one. The state definitely know where people live. Babies are registered when they are born and people have to register any change of their address of residence. It's been like that at least since Italy became a country in the 1860s. By the way, how do I know that they counted my vote as I cast it? I can't know it. I must trust that they did not open the box and replaced the ballots, but people from the several competing parties visit the polling station and can attend the counting. I trust that process much more than something happening inside a computer program.
irq-1 7mo ago
> ...the fact that things can be anonymous (no one can know how you voted) or verifiable (people can prove that you only voted once) but not both. Isn't that what secure hashes do? ID to hash is anonymous and checking for duplicate hashes verifies only voting once.
XCSme 7mo ago
Blockchain!
emilfihlman 7mo ago
This is just plain wrong. An extremely simple scheme is allowing voters to enter an identifier of their choosing and displaying that with the votes publicly. This is both verifiable and anonymous. Any issues you can come up with this scheme are also iirc pretty easily solvable.
yellowapple 7mo ago
> you can't get out of the fact that things can be anonymous (no one can know how you voted) or verifiable (people can prove that you only voted once) but not both Seems like the obvious solution here would be for the voting machine to generate two separate records: - A record of the vote itself, without specifying the voter - A record of the voter having voted, without specifying for whom/what And of course, if the number of vote records doesn't match the number of voter records, then shenanigans have likely ensued, warranting an election fraud investigation.
deleted 7mo ago
[deleted]
zvqcMMV6Zcr 7mo ago
> Until we all have government-issued public keys or something Nah, that still boils down to "you have to trust government". And I preferred when "Why would they care how I vote?" was a rhetorical question.
rainmaking 7mo ago
Swiss vote one-time private key comes in the same envelope as your certificate of eligibility and ballots for postal votes.
askelia 7mo ago
> you can't get out of the fact that things can be anonymous (no one can know how you voted) or verifiable (people can prove that you only voted once) but not both. Actually, I think there might be a way to get both. I've been thinking about this while building my app SoWasIt. The idea: A public chain records that "user X voted at time T" (like a digital voter roll). It's immutable and public. "user X" could contain voter Id, name, like on a signing sheet. The vote itself (the choice) is stored separately, with a random UUID generated. Privately during the vote, no timestamp, no incremental id, no link to the voter. The UUID is sent back to the voter who will use it to verify his vote integrity. At the end, all votes are published in batches (anonymous UUID + choice in clear). Ideally in an immutable chain so it can't be altered later (and ideally for me on my app ) => You can verify your vote by looking for your UUID in the final table. => You can verify that the number of votes matches the number of voters (public chain count = final table size) => you can verify the counting for each candidate => You can't link a UUID to a voter unless you have both the UUID and the voter's identity, which only the voter knows. It's not perfect, you still need to trust that the system doesn't secretly store the link between voter and UUID, or have a man-in-the-middle system to intercept votes whil it's processed. And to not add fake voters: That's why you need to publish something like voter cards ids, so that anyone can go to the administration, check that a specific voter actually exists. So no, it's not impossible to have both anonymity and verifiability – it's just hard, and it shifts the trust to other parts of the system. But that's politics, not just tech Anyway, in my humble opinion, people manage to cheat with traditional paper vote (mostly because citizens don't care enough to spend time lokking after the ballot box till the end), electronic can only make things worse. And as the French comedian Coluche once said: "If voting really changed anything, it would have been banned a long time ago."

by ritzaco 7mo ago

phoronixrly 7mo ago

> At some point, you have to give someone access to a database and they can change that database. It's the only problem in existence that can be solved by the blockchain...

caminanteblanco 7mo ago
But generally sacrifices that anonymous axis via a reproduceable public ledger
- phoronixrly 7mo ago
  Unless pseudonymized...
beautiful_apple 7mo ago
Ironically most production e-voting systems do not use blockchains. That's because there isn't need for decentralization, just verifiability of a correct result and protecting voting secrecy.

kanapala 7mo ago

There's a goverment issued public & private key right here: https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card

presentation 7mo ago
Japan has them built into My Number Cards too https://www.digital.go.jp/en/policies/mynumber/private-business/jpki-introduction https://www.digital.go.jp/en/policies/mynumber/private-busin...
BenjiWiebe 7mo ago
Clearly the mark of the beast.

dmos62 7mo ago

You should care how much maths and encryption you use [0][1], because this is not only possible, but there are multiple approaches. [0] https://satoss.uni.lu/members/jun/papers/CSR13.pdf https://satoss.uni.lu/members/jun/papers/CSR13.pdf [1] https://fc16.ifca.ai/voting/papers/ABBT16.pdf https://fc16.ifca.ai/voting/papers/ABBT16.pdf

jjmarr 7mo ago
More important than lack of voter fraud is proving to the population a lack of voter fraud.
- _0ffh 7mo ago
  I'm sure you could even let every voter verify that their vote has been registered correctly. Edit: But as a comment somewhere else in the tree noted ,,And if it could tell you that then a third party could force you to reveal that you voted "right" as agreed before.`` - I guess everything's trade-offs.
- raron 7mo ago
  This. A voting system and it security must be understandable to the average people. You can not do that with electronic voting. (Even if electronic voting can be done securely.)
  - dmos62 7mo ago
    Why?
    - tauneutrin0 7mo ago
      One of the main goals of an electoral system is to ensure that the population trusts that their views are fairly represented. The reason that paper voting is so good in this regard is that everybody can fully understand the entire process. It is so very, very simple. And if you need proof, you can go see the counting for yourself. The issue with electronic voting is that there is far greater complexity. There are many valid reasons that someone could distrust it, for example: - You might not trust the cryptography experts that claim the algorithms are secure. - You might not trust the algorithms to be implemented correctly. - You might not trust the computer manufacturer to have designed a secure machine. - You might not trust the computer manufacturer to have built a defect-free machine. - You might not trust the machine hasn't been compromised by some bad actor. - You might not trust that there hasn't been some random bit-flips. - You might just not understand how computers work. - ect. ect. Note that it is not important whether it can be proved to be correct and secure. The unique goal here is that everyone can prove to themselves that it is correct and secure. It must be obvious to everyone that they can trust it. In my opinion, this is not possible to achieve with an electronic system.

SideburnsOfDoom 7mo ago

> South Africa gets around this by putting ink on your fingernail This is true, but its used in other countries as well, as it's a simple, effective, low-tech, affordable process. Most notably in India https://edition.cnn.com/2024/05/02/style/india-elections-purple-voter-ink-intl-hnk https://edition.cnn.com/2024/05/02/style/india-elections-pur... but also in many other countries: https://en.wikipedia.org/wiki/Election_ink#International_use https://en.wikipedia.org/wiki/Election_ink#International_use

deleted 7mo ago

[deleted]

beautiful_apple 7mo ago

You can have e-voting systems that protect ballot secrecy and are verifiable. You can use homomorphic encryption or mixnets to prove that: 1) all valid votes were counted 2) no invalid votes were added 3) the totals for each candidate is correct And you can do that without providing proof of who any particular voter voted for. A few such systems: https://en.wikipedia.org/wiki/Helios_Voting https://en.wikipedia.org/wiki/Helios_Voting https://www.belenios.org/ https://www.belenios.org/ Authentication to these systems is another issue - there are problems with mailing people credentials (what if they discard them in the trash?). https://www.cbc.ca/news/canada/ontario-municipal-elections-online-voting-study-1.7644536 https://www.cbc.ca/news/canada/ontario-municipal-elections-o... Estonia (a major adopter of online voting) solves this with the national identity card, which essentially is government issued public/private keys. https://en.wikipedia.org/wiki/Estonian_identity_card https://en.wikipedia.org/wiki/Estonian_identity_card Lots of cyber risks with the use of online voting though, especially in jurisdictions without standards/certification. I outline many in my thesis which explores the risks to online elections in Ontario, Canada (one of the largest and longest-running users of online voting in the world) https://uwo.scholaris.ca/items/705a25de-f5df-4f2d-a2c1-a07e96a23c1b https://uwo.scholaris.ca/items/705a25de-f5df-4f2d-a2c1-a07e9...

dietr1ch 7mo ago
> You can have e-voting systems that protect ballot secrecy and are verifiable. In these systems the voter cannot verify that their vote was secret as they cannot understand, and much less verify the voting machine. > And you can do that without providing proof of who any particular voter voted for. Which is good for preventing the sale of votes, but keeps things obscure in a magical and correct box. How can I tell the machine didn't alter my vote if it cannot tell me, and just me, who I voted for? The global sanity checks are worthless if the machine changed my vote as I entered it.
- yason 7mo ago
  And if it could tell you that then a third party could force you to reveal that you voted "right" as agreed before. Paper ballots with mutually suspicious representatives of all parties watching themselves during handling and counting is the only way to go for big things like parliament/presidential elections and national referendums where, in the worst case, the greatest of all matters are at stake. And foolproof method for voting is most needed when the levels of trust are at the lowest.

fermisea 7mo ago

What about this? Consider a toy system: everyone gets issued a UUID, everyone can see how every UUID voted, but only you know which one is your vote. This is of course flawed because a person can be coerced to share their ID. In which case you could have a system in which the vote itself is encrypted and the encryption key is private. Any random encryption key works and will yield a valid vote (actual vote = public vote + private key), so under coercion you can always generate a key that will give the output that you want, but only you know the real one.

looperhacks 7mo ago
Besides the fact that 99% of the general population won't be able to understand this, a $5€ wrench says that you show me proof of the correct private key (either by you showing me the letter you received, me being present when you set it up, or however it is set up)
Muromec 7mo ago
You have to trust that both 1) the UUID issuing party is not keeping the actual id to uuid mapping in the logs 2) the same party isn't allocating an excessive number of uuids to mass-vote for the "good" choice. In-person voting does provide these guarantees, to extent that violating them will be discoverable and both parties have an incentive to discover such things.

swiftcoder 7mo ago

> Until we all have government-issued public keys or something That's actually pretty common in Europe. The Spanish DNI (national identity card) has a chip these days, which gives you an authenticated key pair for accessing digital services. In the pilot project for digital voting, that identity is only used to authenticate the user, and then an anonymous key needs generated that can be used to cast the final vote.

mothballed 7mo ago

South Africa is in a somewhat similar situation of having a gigantic (1-10%, government is too broken to figure out where in that range) illegal immigrant population and poor access to paperwork for many citizens that would make any heavily scrutinized citizenship for registration lean heavily towards disenfranchisement of the poorer segments.

zahlman 7mo ago

Sure you can, you just need an anonymous voting mechanism that's sufficiently naive. You use the verifiable process to restrict access to that anonymous mechanism. In Canada, at both federal and provincial levels, you walk up to a desk and identify yourself, are crossed off a list, and handed a paper ballot. You go behind a screen, mark an X on the ballot, fold it up, take it back out to another desk, and put it in the box. It's extraordinarily simple. > At some point, you have to give someone access to a database and they can change that database. Well, that kind of fraud is a different issue from someone reading the database and figuring out who someone voted for (you just... don't record identities in the database).

Bender 7mo ago
There will never be a technical or operational process that excludes cheating. The only deterrence that seems to work on humans and even then only most of the time is severe capitol punishment and that will only be as effective as people believe it happens thus requiring live streaming of the removal of cheaters heads without censorship. The current legal process of each country would have to be by-passed or people would just sit in a cage for 30 years. Even in such cases there will be people that sacrifice themselves if they think that bribe money can go to their family but that is at least a start.
- SoftTalker 7mo ago
  Also cheating with paper ballots is much harder to scale and remain undetected than cheating by altering records in a database.
  - Bender 7mo ago
    remain undetected than cheating by altering records in a database. Absolutely. Any time something is centralized it becomes an irresistible target for unlimited numbers of bad actors and the bar to entry for remote anonymous access makes it a much easier target. Anonymous access to paper ballots means someone is going to be on at least a handful of cameras and has to bypass many security systems so if cheating happens it is because the people gathering the votes want it that way. Such cities or states should be excluded from the voting process.

jfengel 7mo ago

The USA threads the needle by simply not having verifiable voting. And it turns out it works pretty well. Despite countless hours and lawsuits dedicated to finding people who voted more than once, only a handful of cases have actually turned up. It's not that there are no checks. You have to give your name, and they know if you've voted more than once at that station that day. To vote more than once you'd have to pretend to be somebody else, in person, which means that if you're caught you will go to jail. We could certainly do better, but thus far all efforts to defeat this non-problem are clearly targeted at making it harder for people to vote rather than any kind of election integrity.

Joker_vD 7mo ago
> You have to give your name, and they know if you've voted more than once at that station that day. So you go to other stations, duh. It's called "carousel voting" [0], if done on a large, organized scale. [0] https://en.wikipedia.org/wiki/Carousel_voting https://en.wikipedia.org/wiki/Carousel_voting
- cj 7mo ago
  At least in NY, you would have to know the name of someone else assigned to the 2nd polling site, since your name is only on the list of 1 polling location?
  - drstewart 7mo ago
    This is of course a very high bar to clear, as data such as people's names is highly confidential and almost impossible to get unless you're any one of these 750+ data brokers: https://privacyrights.org/data-brokers https://privacyrights.org/data-brokers
    - alistairSH 7mo ago
      You'd also need a fake ID. And be willing to risk a felony conviction to add a single vote. It just doesn't happen here, despite the GOP trying to prove otherwise for decades.

nness 7mo ago

Australia has a system where you are anonymous and can prove that you only voted once: You have to be registered and must vote within your electorate, so your name appears on a certified list for that electorate and each voting location has that list. When you vote, they strike your name from the list. After the election, the lists from these locations are compared. Anyone who votes twice has their name struck twice, and are investigated for electoral fraud. Whether people know if you voted or not is immaterial, as voting is mandatory in Australia. Works pretty well for a paper system.

pcchristie 7mo ago
How does that prove that you only voted once? If I know someone's name and address (and by extension their electorate) I can rock up and vote as as many as I want.
- nness 7mo ago
  Then you go to jail (penalty is 6 months for impersonating a person and voting on their behalf.) It's not like polling locations don't have cameras. (A few people voting more than once is unlikely to change the results of an election. If enough fraud is detected to impact the results, they'll run a new election.)
  - brainwad 7mo ago
    > It's not like polling locations don't have cameras. Given they are usually random primary schools and churches... do they have cameras? I think the bigger deterrent is just the risk of claiming to be someone who already got ticked off at the same booth, which would immediately raise suspicions.

spiddy 7mo ago

yes you can. each citizen gets an anonymized private key via a secure channel (eg. postal) and use that to vote. votes are double enveloped: outer envelop: anonymized id + inner envelop: vote. mixnet separates the votes and cryptographically shuffles them to decouple relationships. only at the end the shuffled votes are decrypted using the private key of the election itself that was split using shamir secret sharing (eg 5 out of 7 shares to reconstruct) the thing that’s not clear from the article and it’s a shame is that it seems the failure was the hardware (the 3 USB keys) not the election software. This could be simply avoided by having redundancy on the hardware (2 USBs per share) or more shares themselves (5 out of 9 shares)

jasonwatkinspdx 7mo ago

On the US keep in mind elections are run at the state level and below, so we don't have a single voting system, we have 50+. My state, Oregon, for example uses a very straightforward vote by mail system. They ask if you wanna register to vote when you get/update your drivers license or state id. Your ballot just comes in the mail, you fill it out, send it back. For folks that lack a permanent address or similar, you can get provisional ballots at libraries and similar city offices. The provisional ballots make you fill out enough information to check if you're allowed to vote. It's simple, convenient, secure, and efficient. So why don't more states do it this way? Unfortunately there's a long ugly history of using all sorts of dirty tricks for voter suppression in the US, in particular to keep Jim Crow going. And unfortunately variations of that continue today. I don't have the energy to dig into it fully here, I just want any international readers to be aware there's a whole lot of utterly craven bad faith when it comes to discussions around voting fraud and security in the US.

someguynamedq 7mo ago

Sorry, isn't this dead simple? Maintain a list of identity hashes. When someone goes to vote, deny them if they're already in the list . Otherwise, add their hash to the list then allow a vote to be cast.

Muromec 7mo ago
This makes the secrecy aspect problematic. You can't have zero trust in authority, verifiability and resistance to sabotage all at once.

kolinko 7mo ago

I think with zero knowledge proofs we can have it both ways?

pmontra 7mo ago

The Italian way looks similar to the Swiss way. In detail: When I go to cast a vote in Italy I bring with me my state issued photo ID (everybody has one, I mean: must have one) and a state issued sheet of paper with the address of the place I must go to vote and a grid of empty spaces. I don't have to register to vote, basically I'm registered at birth. The people at the polling station take my two cards and look for me in their registry. They mark that I came to vote, stamp an empty space on the second card and handle me the paper ballots. I think that in this way it's both anonymous and verifiable. When the card with the stamps is full, they mail me a new one. The state definitely know where people live. Babies are registered when they are born and people have to register any change of their address of residence. It's been like that at least since Italy became a country in the 1860s. By the way, how do I know that they counted my vote as I cast it? I can't know it. I must trust that they did not open the box and replaced the ballots, but people from the several competing parties visit the polling station and can attend the counting. I trust that process much more than something happening inside a computer program.

irq-1 7mo ago

> ...the fact that things can be anonymous (no one can know how you voted) or verifiable (people can prove that you only voted once) but not both. Isn't that what secure hashes do? ID to hash is anonymous and checking for duplicate hashes verifies only voting once.

XCSme 7mo ago

Blockchain!

emilfihlman 7mo ago

This is just plain wrong. An extremely simple scheme is allowing voters to enter an identifier of their choosing and displaying that with the votes publicly. This is both verifiable and anonymous. Any issues you can come up with this scheme are also iirc pretty easily solvable.

yellowapple 7mo ago

> you can't get out of the fact that things can be anonymous (no one can know how you voted) or verifiable (people can prove that you only voted once) but not both Seems like the obvious solution here would be for the voting machine to generate two separate records: - A record of the vote itself, without specifying the voter - A record of the voter having voted, without specifying for whom/what And of course, if the number of vote records doesn't match the number of voter records, then shenanigans have likely ensued, warranting an election fraud investigation.

deleted 7mo ago

[deleted]

zvqcMMV6Zcr 7mo ago

> Until we all have government-issued public keys or something Nah, that still boils down to "you have to trust government". And I preferred when "Why would they care how I vote?" was a rhetorical question.

rainmaking 7mo ago

Swiss vote one-time private key comes in the same envelope as your certificate of eligibility and ballots for postal votes.

askelia 7mo ago

> you can't get out of the fact that things can be anonymous (no one can know how you voted) or verifiable (people can prove that you only voted once) but not both. Actually, I think there might be a way to get both. I've been thinking about this while building my app SoWasIt. The idea: A public chain records that "user X voted at time T" (like a digital voter roll). It's immutable and public. "user X" could contain voter Id, name, like on a signing sheet. The vote itself (the choice) is stored separately, with a random UUID generated. Privately during the vote, no timestamp, no incremental id, no link to the voter. The UUID is sent back to the voter who will use it to verify his vote integrity. At the end, all votes are published in batches (anonymous UUID + choice in clear). Ideally in an immutable chain so it can't be altered later (and ideally for me on my app ) => You can verify your vote by looking for your UUID in the final table. => You can verify that the number of votes matches the number of voters (public chain count = final table size) => you can verify the counting for each candidate => You can't link a UUID to a voter unless you have both the UUID and the voter's identity, which only the voter knows. It's not perfect, you still need to trust that the system doesn't secretly store the link between voter and UUID, or have a man-in-the-middle system to intercept votes whil it's processed. And to not add fake voters: That's why you need to publish something like voter cards ids, so that anyone can go to the administration, check that a specific voter actually exists. So no, it's not impossible to have both anonymity and verifiability – it's just hard, and it shifts the trust to other parts of the system. But that's politics, not just tech Anyway, in my humble opinion, people manage to cheat with traditional paper vote (mostly because citizens don't care enough to spend time lokking after the ballot box till the end), electronic can only make things worse. And as the French comedian Coluche once said: "If voting really changed anything, it would have been banned a long time ago."