5 ms·

It's been working ok in Estonia for a decade: http://en.wikipedia.org/wiki/Electronic_voting_in_Estonia http://en.wikipedia.org/wiki/Electronic_voting_in_Estoni

by arkem 12y ago

It's been working ok in Estonia for a decade: http://en.wikipedia.org/wiki/Electronic_voting_in_Estonia http://en.wikipedia.org/wiki/Electronic_voting_in_Estonia Sure there are risks to online voting but it's significantly less risky than many of the other pieces of critical infrastructure that rely on the Internet. The risks of online voting can generally be controlled through policy and oversight, in a similar way to non-online elections.

jacques_chester 12y ago
Paper ballots work fine and, in Australia, would require the systematic subversion of hundreds of electoral officials and thousands of mutually-hostile scrutineers to rig a vote. Meanwhile, no electronic voting system, no matter how clever, is any further than one fuckup or one dirty sysadmin away from being a total fraud. Democratic legitimacy is an expensive feature, but it is worth every cent.
- lazaroclapp 12y ago
  > no electronic voting system, no matter how clever, is any further than one fuckup or one dirty sysadmin away from being a total fraud. Not entirely true. The best electronic voting systems require multiple fuckups and/or multiple dirty developers and hardware manufacturers to become a total fraud. Not saying that is safe enough for elections yet, though. But there is no reason why you can't add multiple checks and balances and mutually-hostile guarantors to an electronic voting system.
  - femto 12y ago
    The biggest problem is that the NSW Electoral Commission is holding secrets (the source code among other things). That's fundamentally at odds with a secure voting system. If the system is algorithmically secure, there should be no need to rely on the security of the NSWEC, past a set of secret keys. If the system relies on the security of the NSWEC then it is open to subversion by someone who knows the NSWEC's secrets. If the system is algorithmically secure, and the NSWEC is still not releasing information, then the NSWEC is simply undermining trust in its own system. I suspect that part of the problem is that the NSWEC is a bureaucracy, which has to justify its own existence. A secure on-line voting system, with minimal secrets, would largely make the NSWEC redundant on election day. The NSWEC need to accept that its job is to set up a secure system, then on the day relegate itself to a monitoring function on a par with any other interested citizen.
  - johnchristopher 12y ago
    > Not entirely true. The best electronic voting systems require multiple fuckups and/or multiple dirty developers and hardware manufacturers to become a total fraud. Not saying that is safe enough for elections yet, though. But there is no reason why you can't add multiple checks and balances and mutually-hostile guarantors to an electronic voting system. But any citizens can check each of the paper voting system steps and it is definitely not possible for electronic voting system.
    - lazaroclapp 12y ago
      It is possible: provided the system generates the right kind of audit information and voting receipts, and the citizen has a trusted device in which to check the protocol computation. You can use signatures for verification and mix-nets or homomorphic encryption for anonymity. There are plenty of security risks in practical implementations of electronic voting, but I would not say "definitely not possible". Not saying I trust the system being discussed or that I think we should have mass online elections just yet, but this is an area under research and the results look more in the direction of "likely feasible" rather than "likely unfeasible". Which is actually quite important if we are ever going to move towards any form of democracy more direct/gradual than voting every X years for people who vote on the actual decisions. Note that the paper voting systems are also quite hackable in practice. It is actually pretty hard to track your own vote and make sure it was counted correctly, that the votes in all districts were added correctly and, when you find your vote miscounted, proving fraud is quite hard as well. I should know, I voted in this election: https://en.wikipedia.org/wiki/Mexican_general_election,_2006#Post-election_controversy https://en.wikipedia.org/wiki/Mexican_general_election,_2006...
      - johnchristopher 12y ago
        > homomorphic encryption for anonymity. You lost me there but I agree you are right concerning the possibilities of electronic voting systems and its inherent safety and accountability depending on the implementation. But then I say paper requires less technical skills and is an order of magnitude less expensive than the cost associated with a safe and sane voting system ? > Note that the paper voting systems are also quite hackable in practice. It is actually pretty hard to track your own vote and make sure it was counted correctly, that the votes in all districts were added correctly and, when you find your vote miscounted, proving fraud is quite hard as well. I should know, I voted in this election: https://en.wikipedia.org/wiki/Mexican_general_election,_2006.. https://en.wikipedia.org/wiki/Mexican_general_election,_2006.... > On August 28, the TEPJF announced the results of the partial recount, subtracting 81,080 votes for Calderón, 76,897 votes for López Obrador, 63,114 for Roberto Madrazo, 5,962 for Patricia Mercado, 2,743 for Roberto Campa, and 7,940 for the remaining candidates. A total of 237,736 votes were annulled out of the approximately 4 million votes recounted. Than means around 6% of the recounted votes were annulled.[29][30] Wow. That is indeed a good example in favour of electronic voting system.
- nfm 12y ago
  Paper ballots tend to work. There have been significant screwups though: http://blogs.abc.net.au/antonygreen/2014/02/wa-senate-re-election-what-happens-next.html http://blogs.abc.net.au/antonygreen/2014/02/wa-senate-re-ele... Given that we're generally happy to trust online banking, my feeling is that there is a way to make electronic voting secure enough. Where you want to draw that line is subjective though!
  - graeme 12y ago
    >Given that we're generally happy to trust online banking, my feeling is that there is a way to make electronic voting secure enough. Where you want to draw that line is subjective though! I don't think this is the right analogy. * Citizens constantly monitor their bank accounts * Citizens are *extremely* upset if an error harms them. * There are procedures for reversing errors. * There is a legal system for recourse if errors aren't reversed. If a party wins an election fraudulently, and gains power, we don't have a good, non-traumatic mechanism for correcting that. Changing $15,000 back to $18,742 is an easy, painless process. Replacing the ruling party is anything but.
  - jacques_chester 12y ago
    Note that the screw up was easily observed and there was a mechanism in place to cope. It was also the first time in approximately 100 years that the recovery mechanism was needed. Show me one system -- one computer system ever -- with a proved, actual (not projected) MTBF of 100 years.
- vetler 12y ago
  > Paper ballots work fine and, in Australia, would require the systematic subversion of hundreds of electoral officials and thousands of mutually-hostile scrutineers to rig a vote The paper ballots are scanned: http://www.elections.act.gov.au/elections_and_voting/scanning_of_ballot_papers http://www.elections.act.gov.au/elections_and_voting/scannin... After scanning, "the preference data from those ballot papers was transferred to the electronic voting and counting system (eVACS)" So you do have an electronic voting system, just not end-user accessible.
  - jacques_chester 12y ago
    The ACT is not Australia. It's one of the territories and the ACT electoral commission has dabbled with electronic voting for a long time. Speaking frankly, ACT elections don't matter; it's basically a town council. Federal elections and state elections are actually important.
    - vetler 12y ago
      Aha, thanks for the clarification! Also found this: http://www.governmentnews.com.au/2015/02/electronic-vote-counting-one-step-closer/ http://www.governmentnews.com.au/2015/02/electronic-vote-cou... Interesting that Australia does not scan paper ballots yet, the amount of manual work must be enormous.
      - jacques_chester 12y ago
        > the amount of manual work must be enormous. This is a feature, not a bug. An "indicative count" is available on the night of an election, and final results take a few weeks. A few weeks versus extremely high assurance of a legitimate count is an excellent tradeoff, in my view. Who is hurt by the delay? Nobody. It's already expected and accounted for. As a profession we love benchmark porn -- latency! throughput! TPS! BPS! -- but optimisation is pointless if you undermine key guarantees. It's pointless to have an instant count if it can't be trusted. And the sheer unwieldiness of a paper ballot drastically amplifies the difficulty of subverting it.
shit_parade 12y ago
Recent independent security review of Estonia online voting suggests it really isn't secure. https://estoniaevoting.org/ https://estoniaevoting.org/
- TazeTSchnitzel 12y ago
  Unfortunately, if you point to that site, certain Estonians will claim it's political bullshit.
- arkem 12y ago
  The security flaws found by that independent review aren't particularly worrying. Clearly there are improvements that could be made but almost all of the problems that they found were procedural and the ones that were technical amounted to "if I can control the server I can control all the votes" or "if I can control a user's computer I can control their vote", which is not a surprising outcome. If I control the vote counting depot I also control all the votes, if I coerce a person I also control their votes. We have dealt with these problems for more than a century, we can deal with them in an online context.
im2w1l 12y ago
If it didn't work, how would you know?
- arkem 12y ago
  The same way we make sure that non-online votes aren't tampered with. Audits (of the procedures, devices and people involved in the votes as well as the results) as well as impartial (or mutually hostile) observers as well as a legal framework for declaring the legitimacy of the result with provision for partial or full reruns on the election in cases of doubt.

by arkem 12y ago

jacques_chester 12y ago

Paper ballots work fine and, in Australia, would require the systematic subversion of hundreds of electoral officials and thousands of mutually-hostile scrutineers to rig a vote. Meanwhile, no electronic voting system, no matter how clever, is any further than one fuckup or one dirty sysadmin away from being a total fraud. Democratic legitimacy is an expensive feature, but it is worth every cent.

lazaroclapp 12y ago
> no electronic voting system, no matter how clever, is any further than one fuckup or one dirty sysadmin away from being a total fraud. Not entirely true. The best electronic voting systems require multiple fuckups and/or multiple dirty developers and hardware manufacturers to become a total fraud. Not saying that is safe enough for elections yet, though. But there is no reason why you can't add multiple checks and balances and mutually-hostile guarantors to an electronic voting system.
- femto 12y ago
  The biggest problem is that the NSW Electoral Commission is holding secrets (the source code among other things). That's fundamentally at odds with a secure voting system. If the system is algorithmically secure, there should be no need to rely on the security of the NSWEC, past a set of secret keys. If the system relies on the security of the NSWEC then it is open to subversion by someone who knows the NSWEC's secrets. If the system is algorithmically secure, and the NSWEC is still not releasing information, then the NSWEC is simply undermining trust in its own system. I suspect that part of the problem is that the NSWEC is a bureaucracy, which has to justify its own existence. A secure on-line voting system, with minimal secrets, would largely make the NSWEC redundant on election day. The NSWEC need to accept that its job is to set up a secure system, then on the day relegate itself to a monitoring function on a par with any other interested citizen.
- johnchristopher 12y ago
  > Not entirely true. The best electronic voting systems require multiple fuckups and/or multiple dirty developers and hardware manufacturers to become a total fraud. Not saying that is safe enough for elections yet, though. But there is no reason why you can't add multiple checks and balances and mutually-hostile guarantors to an electronic voting system. But any citizens can check each of the paper voting system steps and it is definitely not possible for electronic voting system.
  - lazaroclapp 12y ago
    It is possible: provided the system generates the right kind of audit information and voting receipts, and the citizen has a trusted device in which to check the protocol computation. You can use signatures for verification and mix-nets or homomorphic encryption for anonymity. There are plenty of security risks in practical implementations of electronic voting, but I would not say "definitely not possible". Not saying I trust the system being discussed or that I think we should have mass online elections just yet, but this is an area under research and the results look more in the direction of "likely feasible" rather than "likely unfeasible". Which is actually quite important if we are ever going to move towards any form of democracy more direct/gradual than voting every X years for people who vote on the actual decisions. Note that the paper voting systems are also quite hackable in practice. It is actually pretty hard to track your own vote and make sure it was counted correctly, that the votes in all districts were added correctly and, when you find your vote miscounted, proving fraud is quite hard as well. I should know, I voted in this election: https://en.wikipedia.org/wiki/Mexican_general_election,_2006#Post-election_controversy https://en.wikipedia.org/wiki/Mexican_general_election,_2006...
    - johnchristopher 12y ago
      > homomorphic encryption for anonymity. You lost me there but I agree you are right concerning the possibilities of electronic voting systems and its inherent safety and accountability depending on the implementation. But then I say paper requires less technical skills and is an order of magnitude less expensive than the cost associated with a safe and sane voting system ? > Note that the paper voting systems are also quite hackable in practice. It is actually pretty hard to track your own vote and make sure it was counted correctly, that the votes in all districts were added correctly and, when you find your vote miscounted, proving fraud is quite hard as well. I should know, I voted in this election: https://en.wikipedia.org/wiki/Mexican_general_election,_2006.. https://en.wikipedia.org/wiki/Mexican_general_election,_2006.... > On August 28, the TEPJF announced the results of the partial recount, subtracting 81,080 votes for Calderón, 76,897 votes for López Obrador, 63,114 for Roberto Madrazo, 5,962 for Patricia Mercado, 2,743 for Roberto Campa, and 7,940 for the remaining candidates. A total of 237,736 votes were annulled out of the approximately 4 million votes recounted. Than means around 6% of the recounted votes were annulled.[29][30] Wow. That is indeed a good example in favour of electronic voting system.
nfm 12y ago
Paper ballots tend to work. There have been significant screwups though: http://blogs.abc.net.au/antonygreen/2014/02/wa-senate-re-election-what-happens-next.html http://blogs.abc.net.au/antonygreen/2014/02/wa-senate-re-ele... Given that we're generally happy to trust online banking, my feeling is that there is a way to make electronic voting secure enough. Where you want to draw that line is subjective though!
- graeme 12y ago
  >Given that we're generally happy to trust online banking, my feeling is that there is a way to make electronic voting secure enough. Where you want to draw that line is subjective though! I don't think this is the right analogy. * Citizens constantly monitor their bank accounts * Citizens are *extremely* upset if an error harms them. * There are procedures for reversing errors. * There is a legal system for recourse if errors aren't reversed. If a party wins an election fraudulently, and gains power, we don't have a good, non-traumatic mechanism for correcting that. Changing $15,000 back to $18,742 is an easy, painless process. Replacing the ruling party is anything but.
- jacques_chester 12y ago
  Note that the screw up was easily observed and there was a mechanism in place to cope. It was also the first time in approximately 100 years that the recovery mechanism was needed. Show me one system -- one computer system ever -- with a proved, actual (not projected) MTBF of 100 years.
vetler 12y ago
> Paper ballots work fine and, in Australia, would require the systematic subversion of hundreds of electoral officials and thousands of mutually-hostile scrutineers to rig a vote The paper ballots are scanned: http://www.elections.act.gov.au/elections_and_voting/scanning_of_ballot_papers http://www.elections.act.gov.au/elections_and_voting/scannin... After scanning, "the preference data from those ballot papers was transferred to the electronic voting and counting system (eVACS)" So you do have an electronic voting system, just not end-user accessible.
- jacques_chester 12y ago
  The ACT is not Australia. It's one of the territories and the ACT electoral commission has dabbled with electronic voting for a long time. Speaking frankly, ACT elections don't matter; it's basically a town council. Federal elections and state elections are actually important.
  - vetler 12y ago
    Aha, thanks for the clarification! Also found this: http://www.governmentnews.com.au/2015/02/electronic-vote-counting-one-step-closer/ http://www.governmentnews.com.au/2015/02/electronic-vote-cou... Interesting that Australia does not scan paper ballots yet, the amount of manual work must be enormous.
    - jacques_chester 12y ago
      > the amount of manual work must be enormous. This is a feature, not a bug. An "indicative count" is available on the night of an election, and final results take a few weeks. A few weeks versus extremely high assurance of a legitimate count is an excellent tradeoff, in my view. Who is hurt by the delay? Nobody. It's already expected and accounted for. As a profession we love benchmark porn -- latency! throughput! TPS! BPS! -- but optimisation is pointless if you undermine key guarantees. It's pointless to have an instant count if it can't be trusted. And the sheer unwieldiness of a paper ballot drastically amplifies the difficulty of subverting it.

shit_parade 12y ago

Recent independent security review of Estonia online voting suggests it really isn't secure. https://estoniaevoting.org/ https://estoniaevoting.org/

TazeTSchnitzel 12y ago
Unfortunately, if you point to that site, certain Estonians will claim it's political bullshit.
arkem 12y ago
The security flaws found by that independent review aren't particularly worrying. Clearly there are improvements that could be made but almost all of the problems that they found were procedural and the ones that were technical amounted to "if I can control the server I can control all the votes" or "if I can control a user's computer I can control their vote", which is not a surprising outcome. If I control the vote counting depot I also control all the votes, if I coerce a person I also control their votes. We have dealt with these problems for more than a century, we can deal with them in an online context.

im2w1l 12y ago

If it didn't work, how would you know?

arkem 12y ago
The same way we make sure that non-online votes aren't tampered with. Audits (of the procedures, devices and people involved in the votes as well as the results) as well as impartial (or mutually hostile) observers as well as a legal framework for declaring the legitimacy of the result with provision for partial or full reruns on the election in cases of doubt.