8 ms·

Visibility of the source code is a side-show in electronic voting systems. Even if the source code is published, there is no way to be sure that that is the cod

Visibility of the source code is a side-show in electronic voting systems. Even if the source code is published, there is no way to be sure that that is the code that is running on the hardware, or to be certain that the hardware itself has not been tampered with. Votes need to be printed out on paper, verified by the voter, and counted by hand. Still, when we had the source code for the Irish system (now abandoned due to our efforts) analyzed by a commission, it was found it had actual counting errors. http://www.stdlib.net/~colmmacc/www.cev.ie/htm/report/part4_2.htm http://www.stdlib.net/~colmmacc/www.cev.ie/htm/report/part4_... Amazing!

mlandauer 12y ago
The Australian software is not used for recording votes. It's used to assist the counting of physical ballot papers because the Senate vote counting system is extremely complicated. In this environment it's more straightforward to ensure the integrity of the software (as long as it's open and verifiable of course)
- colmmacc 12y ago
  In that case a simpler fix would be to allow any independent party (within reason) to supply and use their own software and render their own tally. If the parties are mutually distrusting, and their tallies still agree, that can be enough to trust the outcome. Auditing the source code has no real utility; it's worthless because you can't be sure that the code you've audited is the code actually running. "Open and verifiable" means nothing in that context.
  - mlandauer 12y ago
    I would prefer if the input to the software was published and anyone could verify the outcome. Unfortunately, currently none of this information is published and the whole system is based on trust.
    - colmmacc 12y ago
      Let's say that the software is published, and the code is audited and it looks ok - it seems to implement all of the intricacies of the transfer system and so on correctly. Then what? What if the operator forgets to use the latest version? or puts a different piece of software entirely on the counting system? Having audited the source code really doesn't help; it won't remove the need to perform independent verification. Similarly, merely publishing the input won't help much either; how do you verify that the published input corresponds to the actual votes? It won't remove the need for independent parties to observe the raw input (paper votes) and to make their own tallies; in which case those parties can publish their own copies. Asking for the input to be published and the source to be published is just scraping the surface and won't add meaningful security. You need independent observation by mutually distrusting parties.
      - nl 12y ago
        You keep saying this like people don't understand your point. Personally I understand your point, but I think auditing the code is a good and important first step. Technically it's worth noting that a code audit is required in any "perfect solution", so it isn't wasted effort. Politically it is important to establish the principle that the AEC should be required to respond to reasonable requests to verify how the process is implemented. Similarly, merely publishing the input won't help much either; how do you verify that the published input corresponds to the actual votes? It won't remove the need for independent parties to observe the raw input (paper votes) and to make their own tallies; in which case those parties can publish their own copies. Note that in Australia vote counting itself is manual and is already observed by multiple hostile parties. No one is proposing removing that. Let's say that the software is published, and the code is audited and it looks ok - it seems to implement all of the intricacies of the transfer system and so on correctly. Then what? What if the operator forgets to use the latest version? or puts a different piece of software entirely on the counting system? Since we already have access to the raw counts the audited code can be run by anyone to verify it outputs the same output as the AEC claims.
    - femto 12y ago
      The AEC does publish the totals for each candidate, at each stage of the Senate count [1]. There is a PDF for each state, under the heading "Distribution of Preferences". An example for NSW is at [2] Are these numbers sufficient input, to duplicate and verify the results of the AEC software? [1] http://results.aec.gov.au/17496/Website/SenateResultsMenu-17496.htm http://results.aec.gov.au/17496/Website/SenateResultsMenu-17... [2] http://results.aec.gov.au/17496/Website/External/SenateStateDop-17496-NSW.pdf http://results.aec.gov.au/17496/Website/External/SenateState...
  - walshemj 12y ago
    the simpler fix would be have a simpler voting system that can be done by hand.
retroencabulato 12y ago
Australian elections ARE pen and paper. The ballots are entered (by hand AFAIK) into the AEC's central system to compute the complex preference flows. Realistically, the algorithm isn't that complicated, and the ABC does a good job at guestimating it [1]. This is why it is so surprising they refuse to release it, even after the Senate passed a motion demanding its release [2]. [1] http://www.abc.net.au/news/federal-election-2013/results/senate/nsw/ http://www.abc.net.au/news/federal-election-2013/results/sen... [2] http://www.computerworld.com.au/article/550114/electoral_commission_bucks_senate_voting_source_code/ http://www.computerworld.com.au/article/550114/electoral_com...
- vacri 12y ago
  At Ruxcon last year there was a very interesting talk by an electoral systems researcher (I can't recall her name). She went through a number of electronic voting systems, and they all suck. Some more than others. The only case where she found a system that was close to acceptable was in a crypto organisation where everyone was highly technically fluent in the system. Certainly not transferable to the general public. She also noted that computerised systems tend to favour right-wing policies even if the algorithm is fair - people who vote for leftist policies are over-represented amongst migrants, people with disabilities, and other non-mainstream demographics. She did have the opinion though that there was as place for electronic machines in the voting booth, and it was this: register your vote on a machine. It prints out a slip with clear, unambiguous markings against your selected candidate(s). Verify that it has the content you want, then go lodge the slip like any other paper ballot. You now have a clearer, less ambiguous version of the paper ballot, which is more accessible to people with certain kinds of disabilities to boot. Most of the times that a paper ballot recount differs is not because of inept counters, but because some voters leave ambiguous marks. She said that in Australia, it has about the best system possible (edit: probably 'in current use') in terms of verifying the count: an AEC official does the counting, and the major parties volunteer scrutineers to challenge ambiguous voting slips. As there are mutually opposing witnesses, you get a fairly robust count - the differences come when one set of scrutineers allows one ambiguous mark, but on a recount that same ambiguous mark gets treated differently by another set of scrutineers. The important thing is the pile of paper though - the evidence that people voted a certain way. In effect, as soon as you don't have the physical evidence, you're at the mercy of "trust us, it's accurate". How do you scrutinise that?
zmmmmm 12y ago
It's not a side show at all, it's the most important thing. By showing us the code the AEC is making the implicit commitment that this is the code running on their systems. Until they show us some code they are not even making that commitment at all - they could be running anything, they could change it every day to match their whims. My own suspicion is that they DO know of numerous problems either current or past and quite likely these will cast enough doubt on some particular past results that it would bring about a constitutional crisis.
- colmmacc 12y ago
  I don't mean any offense - but your position is not self-consistent. "Showing us the code" does not invalidate "could change it every day to match their whims". For example the entire source code to Linux is public, but looking from the outside, you as an observer have no way to know that a particular copy of the Linux code is what is running on my laptop. Which is why I say it's a side-show. If the source code is shabby, getting it might help a little in the short-term; it makes the whole process less reputable. But code can be rewritten. It distracts from the real need; independent verification of the process itself.
  - jfoster 12y ago
    If they could be legally compelled to release it once, perhaps there is some way of legally compelling them to always have the most recent version published.
  - gipp 12y ago
    The point, though, is that releasing the source code under the pretense that it is the running code can create a legal obligation that what's released is what's run. No, it doesn't prevent them from running something else, but it at least creates the possibility of audits and consequences if they do so.
    - zmmmmm 12y ago
      Thanks - this is exactly my point.
Maxious 12y ago
The Australian counting system is VB6 on embedded MSSQL upgraded from a COBOL implementation. "Two AEC data entry operators enter the same ballot data into the system separately, so their counts can be compared to verify that data entry discrepancies are not allowed to influence the final outcome." http://www.itnews.com.au/News/360504,the-tech-behind-was-senate-recount.aspx http://www.itnews.com.au/News/360504,the-tech-behind-was-sen...
aianus 12y ago
> counted by hand. By whom? Overseen by whom? Who oversees the overseers? Not to mention people make mistakes, ballots get dumped, and nobody has any evidence their vote was actually counted. Here's a long but fascinating tech talk on a real solution: https://www.youtube.com/watch?v=ZDnShu5V99s https://www.youtube.com/watch?v=ZDnShu5V99s
- colmmacc 12y ago
  I can talk about Ireland, as I've been an election observer there. The way we do it is that ballot boxes are locked and sealed with tamper-evident seals after a polling station has closed. Elections observers; including representatives from the political parties may request to add their own seals. In some particularly contentious districts this is done, but for the most part people are happy with the official seals. The ballot boxes are then transported by the police force to the nearest "count center". The next morning, the seals are inspected and those ballot boxes are opened. All of the ballot boxes in a constituency are counted together in a secure, but open area. Here's a flickr set with a good number of photos showing how it's done: https://www.flickr.com/photos/redmum/sets/72157600270850764 https://www.flickr.com/photos/redmum/sets/72157600270850764 the counters are within the fenced area, and the observers - including many people from the political parties, surround the fence. The entire process is easy to see. One particularly important part is what happens when the boxes are opened. The contents are just dumped out on the table and one by one each vote is turned to face up and towards the observers. The observers then "tally" the votes and mark which candidate (or referendum choice) the voter marked as their first preference. All parties participate in this tally and it provides the first take on what the result will be. The margin of error on the tally is < 1%. Some tallies with enough tally-takers also count the 2nd and 3rd preferences, but most tallies just project the transfers (we use a transfer based voting system) and that too is generally accurate. Contentious votes with identifying or ambiguous marks and so on are kept aside and argued over by people like me for an hour or so, but they never make much of a difference. The end result is a process is very verifiable and auditable, in easy-to-understand human ways; you can literally show up at a count center and count the votes yourself as they come out of the boxes, and make sure that you're not being duped. That's a nice accessibility property too.

mlandauer 12y ago

The Australian software is not used for recording votes. It's used to assist the counting of physical ballot papers because the Senate vote counting system is extremely complicated. In this environment it's more straightforward to ensure the integrity of the software (as long as it's open and verifiable of course)

colmmacc 12y ago
In that case a simpler fix would be to allow any independent party (within reason) to supply and use their own software and render their own tally. If the parties are mutually distrusting, and their tallies still agree, that can be enough to trust the outcome. Auditing the source code has no real utility; it's worthless because you can't be sure that the code you've audited is the code actually running. "Open and verifiable" means nothing in that context.
- mlandauer 12y ago
  I would prefer if the input to the software was published and anyone could verify the outcome. Unfortunately, currently none of this information is published and the whole system is based on trust.
  - colmmacc 12y ago
    Let's say that the software is published, and the code is audited and it looks ok - it seems to implement all of the intricacies of the transfer system and so on correctly. Then what? What if the operator forgets to use the latest version? or puts a different piece of software entirely on the counting system? Having audited the source code really doesn't help; it won't remove the need to perform independent verification. Similarly, merely publishing the input won't help much either; how do you verify that the published input corresponds to the actual votes? It won't remove the need for independent parties to observe the raw input (paper votes) and to make their own tallies; in which case those parties can publish their own copies. Asking for the input to be published and the source to be published is just scraping the surface and won't add meaningful security. You need independent observation by mutually distrusting parties.
    - nl 12y ago
      You keep saying this like people don't understand your point. Personally I understand your point, but I think auditing the code is a good and important first step. Technically it's worth noting that a code audit is required in any "perfect solution", so it isn't wasted effort. Politically it is important to establish the principle that the AEC should be required to respond to reasonable requests to verify how the process is implemented. Similarly, merely publishing the input won't help much either; how do you verify that the published input corresponds to the actual votes? It won't remove the need for independent parties to observe the raw input (paper votes) and to make their own tallies; in which case those parties can publish their own copies. Note that in Australia vote counting itself is manual and is already observed by multiple hostile parties. No one is proposing removing that. Let's say that the software is published, and the code is audited and it looks ok - it seems to implement all of the intricacies of the transfer system and so on correctly. Then what? What if the operator forgets to use the latest version? or puts a different piece of software entirely on the counting system? Since we already have access to the raw counts the audited code can be run by anyone to verify it outputs the same output as the AEC claims.
  - femto 12y ago
    The AEC does publish the totals for each candidate, at each stage of the Senate count [1]. There is a PDF for each state, under the heading "Distribution of Preferences". An example for NSW is at [2] Are these numbers sufficient input, to duplicate and verify the results of the AEC software? [1] http://results.aec.gov.au/17496/Website/SenateResultsMenu-17496.htm http://results.aec.gov.au/17496/Website/SenateResultsMenu-17... [2] http://results.aec.gov.au/17496/Website/External/SenateStateDop-17496-NSW.pdf http://results.aec.gov.au/17496/Website/External/SenateState...
- walshemj 12y ago
  the simpler fix would be have a simpler voting system that can be done by hand.

retroencabulato 12y ago

Australian elections ARE pen and paper. The ballots are entered (by hand AFAIK) into the AEC's central system to compute the complex preference flows. Realistically, the algorithm isn't that complicated, and the ABC does a good job at guestimating it [1]. This is why it is so surprising they refuse to release it, even after the Senate passed a motion demanding its release [2]. [1] http://www.abc.net.au/news/federal-election-2013/results/senate/nsw/ http://www.abc.net.au/news/federal-election-2013/results/sen... [2] http://www.computerworld.com.au/article/550114/electoral_commission_bucks_senate_voting_source_code/ http://www.computerworld.com.au/article/550114/electoral_com...

vacri 12y ago
At Ruxcon last year there was a very interesting talk by an electoral systems researcher (I can't recall her name). She went through a number of electronic voting systems, and they all suck. Some more than others. The only case where she found a system that was close to acceptable was in a crypto organisation where everyone was highly technically fluent in the system. Certainly not transferable to the general public. She also noted that computerised systems tend to favour right-wing policies even if the algorithm is fair - people who vote for leftist policies are over-represented amongst migrants, people with disabilities, and other non-mainstream demographics. She did have the opinion though that there was as place for electronic machines in the voting booth, and it was this: register your vote on a machine. It prints out a slip with clear, unambiguous markings against your selected candidate(s). Verify that it has the content you want, then go lodge the slip like any other paper ballot. You now have a clearer, less ambiguous version of the paper ballot, which is more accessible to people with certain kinds of disabilities to boot. Most of the times that a paper ballot recount differs is not because of inept counters, but because some voters leave ambiguous marks. She said that in Australia, it has about the best system possible (edit: probably 'in current use') in terms of verifying the count: an AEC official does the counting, and the major parties volunteer scrutineers to challenge ambiguous voting slips. As there are mutually opposing witnesses, you get a fairly robust count - the differences come when one set of scrutineers allows one ambiguous mark, but on a recount that same ambiguous mark gets treated differently by another set of scrutineers. The important thing is the pile of paper though - the evidence that people voted a certain way. In effect, as soon as you don't have the physical evidence, you're at the mercy of "trust us, it's accurate". How do you scrutinise that?

zmmmmm 12y ago

It's not a side show at all, it's the most important thing. By showing us the code the AEC is making the implicit commitment that this is the code running on their systems. Until they show us some code they are not even making that commitment at all - they could be running anything, they could change it every day to match their whims. My own suspicion is that they DO know of numerous problems either current or past and quite likely these will cast enough doubt on some particular past results that it would bring about a constitutional crisis.

colmmacc 12y ago
I don't mean any offense - but your position is not self-consistent. "Showing us the code" does not invalidate "could change it every day to match their whims". For example the entire source code to Linux is public, but looking from the outside, you as an observer have no way to know that a particular copy of the Linux code is what is running on my laptop. Which is why I say it's a side-show. If the source code is shabby, getting it might help a little in the short-term; it makes the whole process less reputable. But code can be rewritten. It distracts from the real need; independent verification of the process itself.
- jfoster 12y ago
  If they could be legally compelled to release it once, perhaps there is some way of legally compelling them to always have the most recent version published.
- gipp 12y ago
  The point, though, is that releasing the source code under the pretense that it is the running code can create a legal obligation that what's released is what's run. No, it doesn't prevent them from running something else, but it at least creates the possibility of audits and consequences if they do so.
  - zmmmmm 12y ago
    Thanks - this is exactly my point.

Maxious 12y ago

The Australian counting system is VB6 on embedded MSSQL upgraded from a COBOL implementation. "Two AEC data entry operators enter the same ballot data into the system separately, so their counts can be compared to verify that data entry discrepancies are not allowed to influence the final outcome." http://www.itnews.com.au/News/360504,the-tech-behind-was-senate-recount.aspx http://www.itnews.com.au/News/360504,the-tech-behind-was-sen...

aianus 12y ago

> counted by hand. By whom? Overseen by whom? Who oversees the overseers? Not to mention people make mistakes, ballots get dumped, and nobody has any evidence their vote was actually counted. Here's a long but fascinating tech talk on a real solution: https://www.youtube.com/watch?v=ZDnShu5V99s https://www.youtube.com/watch?v=ZDnShu5V99s

colmmacc 12y ago
I can talk about Ireland, as I've been an election observer there. The way we do it is that ballot boxes are locked and sealed with tamper-evident seals after a polling station has closed. Elections observers; including representatives from the political parties may request to add their own seals. In some particularly contentious districts this is done, but for the most part people are happy with the official seals. The ballot boxes are then transported by the police force to the nearest "count center". The next morning, the seals are inspected and those ballot boxes are opened. All of the ballot boxes in a constituency are counted together in a secure, but open area. Here's a flickr set with a good number of photos showing how it's done: https://www.flickr.com/photos/redmum/sets/72157600270850764 https://www.flickr.com/photos/redmum/sets/72157600270850764 the counters are within the fenced area, and the observers - including many people from the political parties, surround the fence. The entire process is easy to see. One particularly important part is what happens when the boxes are opened. The contents are just dumped out on the table and one by one each vote is turned to face up and towards the observers. The observers then "tally" the votes and mark which candidate (or referendum choice) the voter marked as their first preference. All parties participate in this tally and it provides the first take on what the result will be. The margin of error on the tally is < 1%. Some tallies with enough tally-takers also count the 2nd and 3rd preferences, but most tallies just project the transfers (we use a transfer based voting system) and that too is generally accurate. Contentious votes with identifying or ambiguous marks and so on are kept aside and argued over by people like me for an hour or so, but they never make much of a difference. The end result is a process is very verifiable and auditable, in easy-to-understand human ways; you can literally show up at a count center and count the votes yourself as they come out of the boxes, and make sure that you're not being duped. That's a nice accessibility property too.