Almost all voting in America uses software to some extent. Whether it is the counting machines, Scantron readers or electronic voting booths, we are already using software.
What more software could do though, is create more transparency. And I can't believe I'm saying this, but this may actually be one of those cases where blockchain could be useful.
It is absolutely absurd to me that we have thousands of non-experts deciding to keep or throw out ballots based on comparing a signature.
With a more electronic method, a citizen's vote could be signed with a key generated from a few unique identifiers like social security number, numbers in your street address and maybe a credit card number. My vote could then be forever logged in the blockchain. This could create more transparency because everyone could see and count the votes.
After voting, you could also give every voter a "receipt" where they could go online and check in the public blockchain to confirm that their vote was counted successfully.
And I don't think we would need any sort of shared and distributed blockchain. Just a public one that can be verified by 3rd parties.
AWS has a managed blockchain service that I'm sure would work fine.
So while it may not be a good idea to open the actual voting to the entire public internet, that doesn't mean that sound math and technology couldn't be used to make elections more transparent and thus, secure.
Yes, but only if you are relying on a distributed system. You can still have a centrally controlled blockchain. And the blockchain would simply allow anyone to easily verify data integrity.
Why do you need a blockchain if you trust the local election operation? And if you don't trust the local election operation, I have terrible news for you; they are still the legal authority. Citizens are already able to verify their mail/absentee ballot online, today, without a blockchain [1].
I do agree with you that the US needs to adopt something like Estonia's national ID system [2], with cryptographic signing capabilities for official purposes, but this should only (for elections) be used to digitally sign your paper ballot (with similar weight that your hand signature on a paper ballot would carry). We should also encourage mail/absentee ballots for everyone in every state.
Not every state has tracking... at a glimpse Florida doesn't.
I think the best option is everyone has an issued id, don't remember it? You can use your SSN or state id (drivers license), the # is mailed to you when you register/re-register or get your ballot.
You can vote as you normally would, you can setup 2-factor methods on your id's. If you have a phone 2-factor set, the minute your vote is tallied you get notified of the result, if it's not what you chose, you can contest it.
Easy one-click-at-all-times access to voting trail, also uniformity, we need a system like this to be uniform, we need to end 50 states with different rules per county on how things are run.
Well, blockchain, mostly because it is simply a cryptographic way to confirm that data has not been tampered with and easily validate against other copies. If you simply make a database public, then it requires a bit more energy to validate copies. It would also require that anyone who wants to validate it has a complete copy of their own. Whereas with blockchain, you can merely take down a single hash at a certain timestamp and easily verify that hash later.
The usual response to this is that it enables vote buying.
However, vote buying literally stopped being an issue the day it started being prosecuted seriously and never came back. You simply can't do it at meaningful scale without getting caught.
>You simply can't do it at meaningful scale without getting caught.
Why not? Just run a Tor site, where users can submit their receipt/verification and get crypto. "Free money" will spread fast with barely any marketing, and as we've seen from voter turnouts, lots of people don't give a shit and will happily sell their vote to the highest bidder.
>After voting, you could also give every voter a "receipt" where they could go online and check in the public blockchain to confirm that their vote was counted successfully.
The problem with verifiable voting has always been that it opens the market to vote-selling. If you can prove how you voted, your vote can be sold for a significant amount of money -- or worse, your employer insisting you vote a certain way, and asking for your receipt after. This won't work until there's a mechanism where you can confirm your vote while also having plausible deniability.
You simply wouldn't identify the person making the vote. You are assigned a random identifier that is actually publicly available. So if I vote and give you my identifier to prove how I voted, you have no way of verifying if I am giving you my actual receipt or just some other receipt from the publicly accessible register of voters. The only way to truly validate the vote would be to match the receipt id with the internally held ballot that has your pii on it.
Then how do you prove x% of the voters for candidate A weren't just given the same identifier? This'd defeat the purpose of being able to verify your vote in the first place, something unique to you has to be in the record too.
Point is, you can verify your -own- vote only because you have the identifier that was given you. You can also see all the other votes and their identifiers, you just can't tell which people made which vote. Only the individual voter knows.
i.e. I can go look online and knowing that I am voter abc123, I can confirm my vote was counted correctly. I can also see vote def456 but I don't know who it belongs to.
Say we have 5 people voting. I know that 4/5 are going to vote for candidate A, but I don't like that, so I publish:
abc - A
def - A
ghi - B
jkl - B
mno - B
Then I simply give all the people who voted for A either abc or def. They all think they're identifying themselves, when really they're sharing identifiers.
I think coercion is the biggest issue with online electronic voting. In paper ballot format it's illegal to have someone else in the booth with you, but if everyone votes from home, there's no way to guarantee that the person voting doesn't do it some obligation.
I think you're missing a few things: Votes should never be identifiable and the count should be verifiable.
First of all: using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea. All of those have been leaked and are present on things you present to identify yourself or pay. Also requiring a credit card or home to vote would almost certainly be unconstitutional.
Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it.
I'm not saying it's impossible but there are so many problems with electronic voting that I don't even know where to start. At least with physical ballots we can manually recount if we need.
And that's before we even start talking about how current systems are basically swiss cheese for hacks, just look at the voting village for the last couple of defcons.
Sorry can't reply to your reply but... Making the ballot a zk-SNARK[0] would allow it to be queried for validity of certain assertions like "Did this ballot contain a vote for Candidate A or Proposition B" without leaking the identity of the voter. The voter's private key could decrypt the entire ballot perhaps for the voter's verification or even as another verifiable assertion that the ballot was signed with the specific key. Perhaps there would be a key provided by the voting authority body as another verifiable assertion that would allow the voting authority body to verify the user for their purposes if required.
I agree that the more difficult part of this would be encouraging adoption and supporting use. There are hardware keys like yubikeys or hardware crypto wallets that can be populated with voter-generated keys to be used in the voting process, and these hardware keys could be populated in a process similar to getting a driver's license perhaps, except not waiting for it to arrive in the mail. Perhaps you go into your local clerk's office and they have a one-time key generator that populates your hardware key. I definitely haven't fleshed this idea out beyond some basic musings.
Doesn't that still allow for vote-selling and vote extortion? Like if my employer threatens to fire me unless I vote a certain way, they'll accept me giving them my receipt saying I voted the way they wanted. Now, they can't prove that the receipt actually belonged to me, but it's certainly harder to procure someone else's receipt (from someone who voted the way the employer wanted).
>Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it.
Your receipt does not have to mention who you voted for in a way that's verifiable by a third party. But this problem is also a problem for mail-in ballots.
>using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea.
Agreed, this does not mean that it is not feasible. You could use some zero-knowledge based proof that ensure that the person is allowed to vote and has voted only once without knowing his identity. Mail-in ballots are also problematic in that regard.
I dislike that people say evoting is a bad idea when we already have things like mail in ballots which are analogous to a poor e voting system.
>Also requiring a credit card or home to vote would almost certainly be unconstitutional.
> But don't you need a registered address to vote?
I'm not 100% sure here but I thought homeless could vote?
> mail in ballots which are analogous to a poor e voting system.
I think it is mostly about scale. It is hard to impersonate 10000 people it requires physical objects, it is easier if it is digital. One of the videos deals with this, timecode here: https://youtu.be/LkH2r-sNjQs?t=140
That timestamp is talking about physical voting. I'd posit it's easier to impersonate 10k mail in ballots of the same state than (let's say) crack 10k private keys or whatever is used for that system. I agree though that a new system will bring about exploits vectors that are unknown, but I'm not convinced they are as bad as what is implied in that video and this thread.
I'm not talking about using SSN or other identifiers to validate voter identity, that would already be done at the polls or however we currently validate mail in ballots (should be something better than forensic signature comparison, though).
The identifiers would simply be used so that the individual could check and validate that their vote was counted and counted correctly. But perhaps those identifiers wouldn't be necessary since you could simply assign a random uuid after the person votes that they can then use to look up.
Electronic voting changes the threat model which opens the door for large scale voting fraud which is impossible with the current system.
Also in the US you don’t have a single election, you have 50 individual elections all with different ballots and different rules, the federal government doesn’t run the elections in each state.
This means that you’ll have 50 different systems.
There is little that technology can do with a system that already provides transparency by having a physical hard copy of each vote cast and allowing essentially any citizen to become an observer.
This article is very poor in that it has no real argument as for why it's bad. Here's what it asserts:
- We don't care about the speed of the results. That is trivially false, everyone is following the reporting, Trump is out there saying he won, people question the delays and suggest they may give time for bad actors to rig the vote.
- It's too expensive - There is no backing to this claim except "it systems routinely go over budget"
- It disregards secrecy as important - secrecy is a vital part of an election process. It allows people to freely have any opinion they want without consequence or fear of people forcing them to vote for someone else (violence or other).
- Accessibility - I'm not sure how they can assert that we can't make e voting accessible?
EDIT: For those downvoting, please do provide a reason why you disagree with what I said. Is any argument in that article actually strong?
Tom Scott still has the best argument against e-voting IMO [1].
Briefly: an election only counts if everybody can believe the results. Making an expert level understanding of CS a requirement to verify your voting system means that Joe Q. Average who doesn't hold a PhD (or maybe even a college degree) has to rely on spooky experts telling him what to believe. If I were in his shoes then I would have no confidence that I participated in a fair and valid election.
We kind of live in a bubble here on HN where most people are sort of in the tech space and could take a weekend or two to understand blockchain. I think its easy to forget that most people don't have the required background to learn it easily (or would want to use up their time to understand it). I almost have a PhD in the hard sciences and I don't fully understand the finer details of block chain. I think I would have to write my own implementation to fully appreciate it.
Simplicity and the ability to explain the system to every American is a requirement of any voting system.
>Joe Q. Average who doesn't hold a PhD (or maybe even a college degree) has to rely on spooky experts telling him what to believe.
The Joe is for example driving a car full of electronics and somehow he doesn't have issue trusting his life to it. And, if anything, i'm pretty sure that deep understanding of that car's electronics and software would make the Joe to only trust his car less (one can google the software expert's opinions during the Prius self-acceleration story)
How is that observable in the current system? I mailed my ballot in a couple weeks ago, and BallotTrax told me when it was picked up by the post office, and then when it was delivered to election officials and accepted. But that's just an email telling me this; anyone can type up an email and send it, while dropping my ballot into a shredder.
Now, I do believe that my vote was actually counted, but I have no rational basis for this, as I don't have any kind of record or visibility into the process.
I don't think any voting process can actually really tell you that your vote was counted. At the end of the day you're just trusting that the people running it aren't corrupt, or at least that there are enough people involved that keeping shenanigans a secret would be incredibly difficult.
Because I could, reasonably, find the damn thing; the evidence physically exists. And the threat of doing so increases trust in the system (even if no one does it), because if worst comes to worst, I can just find the slip.
In a digital system, I'm not finding jack shit. It doesn't exist anywhere except as a counter, I can't check whether it's my vote or randomly created after the fact (after suspicion was announced), and I can't trust the system itself, because it's defined by, developed by, and operated by some random group of people who managed to slap the thing together and make a sale. I can't get in there and check out any of it myself (even as just a vague threat), and the conspiracy group is sufficiently small as to be viable (I only have to "convince", what, 40 people, to cheat the votes?).
What I don't understand is why not use something like the SAT exams -- trivially hardware-counted, but also physically transparent and available -- and solve like 90% of the problem that way?
No issues with because he usually ends up at his destination intact. If, through no fault of his own, he didn't arrive intact, spooky experts probably didn't know what they were doing.
I can see how the argument still holds water if half the time the outcome of the election didn't go his way.
We aren't trusting the car. We're trusting the car has not been tampered with.
We know many people want to tamper with elections. The CIA has done that much. The same is not true for cars. Steal cars, yes. But cause a random car to crash on purpose? Thats pretty rare. If were common, I personally would not trust my cars electronics either. And neither should you.
Hard disagree. The world is complex enough that every person in the world relies on the words of "spooky experts telling [them] what to believe".
Even outside of that, elections require trust in the process. Already, with a "simple" system in place, we have to trust that no one is committing fraud, that votes aren't being surreptitiously added or thrown out, etc. E-voting doesn't fundamentally change the trust dynamics at all: people ultimately need to believe that the people in charge of the process aren't up to any funny business or bad at their jobs.
This argument gets used a lot to argue in favor of first past the post. Explaining a Borda count or single non-transferable vote is harder than explaining: most votes = win. But I think it ultimately comes down to trust: if the people voting trust the people involved with the process (even if they don't understand the nitty-gritty details) they will accept the results of an election.
> E-voting doesn't fundamentally change the trust dynamics at all: people ultimately need to believe that the people in charge of the process aren't up to any funny business or bad at their jobs.
A notable difference is that any John or Jane Doe can become a poll worker or poll watcher with little barrier to entry no matter their background, and verify the integrity of their elections should they choose to do so.
To me, the lack of the ability for an average person to do this would significantly change the trust dynamics.
> relies on the words of "spooky experts telling [them] what to believe".
Widespread distrust of subject matter experts already exists in the US. You can't just tell people to shut up and listen to the experts.
The efficacy of vaccines is one of those things that is almost impossible for the average person to verify. I can get in a plane and confirm for myself that it doesn't fall out of the sky. I can't get a vaccine and directly compare it with my chances of catching the flu without one. That's the reason why people widely trust the safety of planes, but there exists an anti-vax movement in the US.
Even with alternatives to first past the post, the complexity is of a wildly different scale than blockchain. I can sit down with someone and go step by step how ranked-choice works right now without looking up material. I'd have to pull out reference material and then start with the basics of hash functions or something to explain blockchain.
I used to think the same thing until last night. Watching the different results come in. The average person already has no clue what is going on. You need a degree in high level statistics to understand why races are called when they are.
After you cast your vote what happens after that? Who counts them? How are they counted? How are those counts counted toward the total? Who is certifying all of this? How are those people chosen?
Why would it? Each state is roughly the size of a country the parent is referring to, each state organizes their elections, so each state should be able to be equally efficient.
That's not an argument against e-voting, but rather the election media circus and craziness of the electoral college. With e-voting you get the complexity of both.
All this "calling races" bullshit is only because the ballot counting process is so utterly fucked up in the US. I live in Germany. When there is an election for federal or state parliament, polls close at 6 PM and results appear around 8-10 PM on the websites of the state election offices. Somewhere around midnight, the "preliminary official result" is released. (The official result follows about a week later, after the routine recounts are done, but they never differ by more than a few votes.)
We do also have predictions on TV as soon as the polls close at 6PM, and they are always off by a few percentage points, but they rapidly converge, especially because the official results come so fast. By 8 PM there is not much chance for surprises (maybe one or two parliament seats get reallocated as percentages shift), by 10 PM the predictions have pretty much reached their final destination.
(And by the way, we have a ton of mail-in ballots, too. The federal supreme court ruled in 2009 that everyone can have a mail-in ballot if they want, so it's getting more popular every election.)
If a citizen wants to check the election process, they can go to any polling place (including the ones where mail-in ballots are counted) and watch the polling workers count the paper ballots. The volunteers are obligated to announce the final tallies to all citizens that are present to observe. (There are not always people present, but I've seen it happen a few times when volunteering as a polling worker.)
Then afterwards they can go to the state election office's website and verify that the same numbers appear for that particular voting district. I've done it once just to see how the verification process works, and I think the whole process is very easy to understand and verify for every citizen.
The flaw in the argument is the assumption that knowledge is a requirement for trust. But look for example at elections in Brazil: most people don't really understand how it works, but they like it nonetheless[1] because the good experience of instant gratification plants a positive initial seed in people's minds and association fallacy[2] is a thing.
There's plenty of other scenarios where we can see discrepancies between trust and understanding (for example, the general public's trust in recycling vs what actually happens w/ plastics). Heck, the US election system is quite complicated today and yet people trust it. For better or for worse, humans are often fallible and illogical.
I definitely see the point here, but it depends on what you mean by “understand”. I don’t think that understanding blockchain or the technical components of how such a system works would be important to the average voter.
If such a system could improve the visibility and auditability of results down to small regions, and intuitively show how that cascades up to state level results, it could be a win.
Making an e-voting system believable seems more like a UX/design challenge than a technical/engineering challenge.
I'm watching the US election from the outside, and the President declared a win, said the Democrats were trying to steal the election and he is going to the supreme court to stop voting. Twitter is packed with people apparently saying that it's impossible for PA to swing from Trump to Biden just by counting the postal votes, or that counting postal votes after the polls close is cheating, or that the postal votes were made up, or that the polling station votes are untrustworthy because there's no need to prove ID, or that polling stations were closed, or that the whole system is illegitimate if voting is not a public holiday, or not mandatory, or not proportional representation and no electoral college.
Again, whichever outcome, USA is going to have half a country that doesn't like or trust the election results. Not the voting booth ones, not the mail-in ones, not the popular vote, not the official result or the "official" result.
Seems to me that if people trust the leadership, they would trust the voting system endorsed by the leadership, not the other way round.
The main issue with us is the strong divide of the country. It's obcene to me that a leader can be choosen whom ~50% of the population disagree with. I understand democracy is about pleasing the majority, but how is a 51%-49% split a majority in any major way?
I think it is time to implement things correctly in US as well. Closed unverifiable voting system is as good as an e-voting system as DocuSign is good as an e-signature system. There are proven mathematical ways that make sure, without using blockchain, that the votes and voters are correct [1].
Then again, I am biased as I am lucky enough to enjoy the benefits of well implemented electronic voting and signing system in Estonia. Source code for Estonian voting system is published in GitHub [2].
Estonia has a National ID with a smart card on it.
This isn’t possible for nations which do not want mandatory ID laws.
It also then makes the ID card a good target which specifically the Estonian one was found to have quite a few issues.
Lastly trust in a voting system isn’t just can someone alter the vote but how easy it would be to deny people from voting and any electronic voting system will be susceptible to a wide range of denial of service attacks, what’s worse that these systems are susceptible to denial of service attacks that could corrupt votes cast causing not only those votes to be cast out but making the entire system being suspect.
For me it looks like voting with no ID or by mail is much more of a trash idea. I can't understand how you can verify who is voting in this type of system. Doing it electronically or not is the least of my concerns, it is the process in the US that is inherently wrong.
I am surprised that there is no digital option to preselect your candidates before going to the polling place. i.e. Make your choices, receive QR code. Go to polling place, scan, verify selections on voting machine, press big red button and walk out of there.
If each vote took 1 minute instead of 10, would there still be a line?
edit: Or if not shorter lines, maybe 5 voting machines instead of 20? or 4 poll workers instead of 10? Seems more efficient all around.
We never needed electronic voting to prevent the hanging chad issue. All we needed to do was help people properly encode their paper ballots.
That can be done with open source software running on a PC connected to a punch card machine.
We could also let voters confirm their choices with a punch card reader hooked up to another PC running separately developed software at the polling place.
You can still the votes electronically. But also count the physical ballots. Two counts are better than one. Somebody woould have to change both to hide cheating.
Record the raw ballot in a block at the same time to make it even harder.
These are solvable problems. If we can keep cryptocurrency honest, we can do it with votes.
I'm from Estonia and Estonia has an e-voting system. It seems to be relatively decent as far as decent can be, but I still don't like it.
Estonia's government issued ID card has a chip on it, like a debit card. The card contains a private key. The card uses a two-factor authentication system: you have the physical card itself (with the private key) and 3 PIN codes. PIN1 along with the card is used to identify you. PIN2 along with the card can be used to give electronic signatures. A PUK code along with the card can be used to unblock the card if the user enters a PIN incorrectly 3 times in a row.
The system is pretty convenient. It allows us to do things like online banking, give electronic signatures on documents (you put the file in a container and sign the container), and also electronically vote. Effectively, it's a way to electronically verify whether somebody is who they say they are, and this verification is backed by the government.
It is convenient to electronically vote. Some time before election day people can cast their vote via an application on their PC. They can vote multiple times. Online voting ends before election day and anybody can go vote in person even if they've cast an electronic vote. The last vote cast counts. This makes buying votes ineffective, because a person could sell their vote any number of times to different candidates. After you vote a QR code appears in the application. You can read that QR code with your smartphone to check on your vote for 30 minutes or 1 hour after voting.
The server side source code is open.[0] The votes get moved to a counting server and get counted. There are quite a few issues in this process as found by an independent audit.[1] (I really recommend reading it if you're interested in this topic.) However, most of those problems seem to be relatively unlikely or at least there's a good chance we would know that something is fishy.
However, I don't like e-voting. I have three main problems with this system:
1. The system is opaque to the layman. The government can take every step to ensure transparency in the e-voting process, but it doesn't matter to the average person. An average person doesn't understand enough about how software and computers work to be able to tell whether foul-play was happening or not. The process of voting in person, counting those votes and tallying them up are much easier to understand. It's easier for an average person to tell whether the in-person voting process is being tampered with or not. I think this point alone makes e-voting a bad choice.
2. It relies on the security of the average user's devices. It's conceivable that a large scale malware attack could compromise the machine the user votes on and the device the user uses to verify their vote. It's unlikely, but Estonia is small - it can never put in the resources that a large country could.
3. It relies on the security of third party software and hardware. If consumer/enterprise hardware is compromised on a global scale, then that likely means that the e-voting system is vulnerable too.
E-voting is more convenient, but ultimately I think that such convenience is overshadowed by the risk. In person voting in Estonia is very easy (at least in cities). It has never taken me more than 10 minutes from arriving at the voting location to leaving. If the goal was to just make voting more convenient, then they could've just added more voting booths and put them in supermarkets.
Hi, I'm very curious about the process of transferring the cryptographic key from your national id to the device you're voting with. Is this even done, or is the national id just used to generate an intermediate certificate key?
The way I understand it is that it works a lot like credit cards with a chip. The private key never leaves the chip. If that's what you mean by an intermediate key then yeah.
I think this article can give you a better overview.[0] It talks about a vulnerability previous generation id cards had, but it also explains more on how they work in general.
Throw opposition to voter ID laws (you know, the kind every country in Europe has) on the trash-heap with it. At this point Republicans mostly believe the Democrats have or are in the process of stealing the election, and they collectively will have little faith in presidential elections going forward until robust voter ID laws are put into effect. The arguments against these laws are underwhelming, given how often you need to show ID for other things, and lead Republicans to suspect Progressives want to stuff ballot boxes.
66 comments
[ 109 ms ] story [ 2955 ms ] threadWhat more software could do though, is create more transparency. And I can't believe I'm saying this, but this may actually be one of those cases where blockchain could be useful.
It is absolutely absurd to me that we have thousands of non-experts deciding to keep or throw out ballots based on comparing a signature.
With a more electronic method, a citizen's vote could be signed with a key generated from a few unique identifiers like social security number, numbers in your street address and maybe a credit card number. My vote could then be forever logged in the blockchain. This could create more transparency because everyone could see and count the votes.
After voting, you could also give every voter a "receipt" where they could go online and check in the public blockchain to confirm that their vote was counted successfully.
And I don't think we would need any sort of shared and distributed blockchain. Just a public one that can be verified by 3rd parties.
AWS has a managed blockchain service that I'm sure would work fine.
So while it may not be a good idea to open the actual voting to the entire public internet, that doesn't mean that sound math and technology couldn't be used to make elections more transparent and thus, secure.
I do agree with you that the US needs to adopt something like Estonia's national ID system [2], with cryptographic signing capabilities for official purposes, but this should only (for elections) be used to digitally sign your paper ballot (with similar weight that your hand signature on a paper ballot would carry). We should also encourage mail/absentee ballots for everyone in every state.
[1] https://www.pcmag.com/how-to/how-to-track-your-absentee-ball... (How to Track Your Absentee Ballot by State)
[2] https://en.wikipedia.org/wiki/Estonian_identity_card
I think the best option is everyone has an issued id, don't remember it? You can use your SSN or state id (drivers license), the # is mailed to you when you register/re-register or get your ballot.
You can vote as you normally would, you can setup 2-factor methods on your id's. If you have a phone 2-factor set, the minute your vote is tallied you get notified of the result, if it's not what you chose, you can contest it.
Easy one-click-at-all-times access to voting trail, also uniformity, we need a system like this to be uniform, we need to end 50 states with different rules per county on how things are run.
I went to look at this. It operates on the honor system; what purpose is it supposed to serve?
An actual ballot-tracking system would need to provide me some evidence that they knew something about my ballot. This doesn't.
However, vote buying literally stopped being an issue the day it started being prosecuted seriously and never came back. You simply can't do it at meaningful scale without getting caught.
Why not? Just run a Tor site, where users can submit their receipt/verification and get crypto. "Free money" will spread fast with barely any marketing, and as we've seen from voter turnouts, lots of people don't give a shit and will happily sell their vote to the highest bidder.
Which of the 11 tor sites will you submit your receipt to now?
The problem with verifiable voting has always been that it opens the market to vote-selling. If you can prove how you voted, your vote can be sold for a significant amount of money -- or worse, your employer insisting you vote a certain way, and asking for your receipt after. This won't work until there's a mechanism where you can confirm your vote while also having plausible deniability.
For example, an employer who threatens to fire employees who "vote wrong" would not be blackmail.
i.e. I can go look online and knowing that I am voter abc123, I can confirm my vote was counted correctly. I can also see vote def456 but I don't know who it belongs to.
First of all: using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea. All of those have been leaked and are present on things you present to identify yourself or pay. Also requiring a credit card or home to vote would almost certainly be unconstitutional.
Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it.
I'm not saying it's impossible but there are so many problems with electronic voting that I don't even know where to start. At least with physical ballots we can manually recount if we need.
And that's before we even start talking about how current systems are basically swiss cheese for hacks, just look at the voting village for the last couple of defcons.
Related (and amusing) links:
https://www.youtube.com/watch?v=w3_0x6oaDmI
https://www.youtube.com/watch?v=LkH2r-sNjQs
https://xkcd.com/2030/
If it does do you think that you can make the general public trust/understand it enough to run a election?
I agree that the more difficult part of this would be encouraging adoption and supporting use. There are hardware keys like yubikeys or hardware crypto wallets that can be populated with voter-generated keys to be used in the voting process, and these hardware keys could be populated in a process similar to getting a driver's license perhaps, except not waiting for it to arrive in the mail. Perhaps you go into your local clerk's office and they have a one-time key generator that populates your hardware key. I definitely haven't fleshed this idea out beyond some basic musings.
[0]https://z.cash/technology/zksnarks/
PS: Well at least the first two, third one being the mandatory xkcd meta-reference :D
Your receipt does not have to mention who you voted for in a way that's verifiable by a third party. But this problem is also a problem for mail-in ballots.
>using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea.
Agreed, this does not mean that it is not feasible. You could use some zero-knowledge based proof that ensure that the person is allowed to vote and has voted only once without knowing his identity. Mail-in ballots are also problematic in that regard.
I dislike that people say evoting is a bad idea when we already have things like mail in ballots which are analogous to a poor e voting system.
>Also requiring a credit card or home to vote would almost certainly be unconstitutional.
But don't you need a registered address to vote?
I'm not 100% sure here but I thought homeless could vote?
> mail in ballots which are analogous to a poor e voting system.
I think it is mostly about scale. It is hard to impersonate 10000 people it requires physical objects, it is easier if it is digital. One of the videos deals with this, timecode here: https://youtu.be/LkH2r-sNjQs?t=140
The identifiers would simply be used so that the individual could check and validate that their vote was counted and counted correctly. But perhaps those identifiers wouldn't be necessary since you could simply assign a random uuid after the person votes that they can then use to look up.
Also in the US you don’t have a single election, you have 50 individual elections all with different ballots and different rules, the federal government doesn’t run the elections in each state. This means that you’ll have 50 different systems. There is little that technology can do with a system that already provides transparency by having a physical hard copy of each vote cast and allowing essentially any citizen to become an observer.
- We don't care about the speed of the results. That is trivially false, everyone is following the reporting, Trump is out there saying he won, people question the delays and suggest they may give time for bad actors to rig the vote.
- It's too expensive - There is no backing to this claim except "it systems routinely go over budget"
- It disregards secrecy as important - secrecy is a vital part of an election process. It allows people to freely have any opinion they want without consequence or fear of people forcing them to vote for someone else (violence or other).
- Accessibility - I'm not sure how they can assert that we can't make e voting accessible?
EDIT: For those downvoting, please do provide a reason why you disagree with what I said. Is any argument in that article actually strong?
Briefly: an election only counts if everybody can believe the results. Making an expert level understanding of CS a requirement to verify your voting system means that Joe Q. Average who doesn't hold a PhD (or maybe even a college degree) has to rely on spooky experts telling him what to believe. If I were in his shoes then I would have no confidence that I participated in a fair and valid election.
We kind of live in a bubble here on HN where most people are sort of in the tech space and could take a weekend or two to understand blockchain. I think its easy to forget that most people don't have the required background to learn it easily (or would want to use up their time to understand it). I almost have a PhD in the hard sciences and I don't fully understand the finer details of block chain. I think I would have to write my own implementation to fully appreciate it.
Simplicity and the ability to explain the system to every American is a requirement of any voting system.
[1] https://www.youtube.com/watch?v=LkH2r-sNjQs&t=12s
The Joe is for example driving a car full of electronics and somehow he doesn't have issue trusting his life to it. And, if anything, i'm pretty sure that deep understanding of that car's electronics and software would make the Joe to only trust his car less (one can google the software expert's opinions during the Prius self-acceleration story)
Now, I do believe that my vote was actually counted, but I have no rational basis for this, as I don't have any kind of record or visibility into the process.
I don't think any voting process can actually really tell you that your vote was counted. At the end of the day you're just trusting that the people running it aren't corrupt, or at least that there are enough people involved that keeping shenanigans a secret would be incredibly difficult.
In a digital system, I'm not finding jack shit. It doesn't exist anywhere except as a counter, I can't check whether it's my vote or randomly created after the fact (after suspicion was announced), and I can't trust the system itself, because it's defined by, developed by, and operated by some random group of people who managed to slap the thing together and make a sale. I can't get in there and check out any of it myself (even as just a vague threat), and the conspiracy group is sufficiently small as to be viable (I only have to "convince", what, 40 people, to cheat the votes?).
What I don't understand is why not use something like the SAT exams -- trivially hardware-counted, but also physically transparent and available -- and solve like 90% of the problem that way?
If people don't believe the results of an election, then it is de facto illegitimate.
I can see how the argument still holds water if half the time the outcome of the election didn't go his way.
We know many people want to tamper with elections. The CIA has done that much. The same is not true for cars. Steal cars, yes. But cause a random car to crash on purpose? Thats pretty rare. If were common, I personally would not trust my cars electronics either. And neither should you.
Even outside of that, elections require trust in the process. Already, with a "simple" system in place, we have to trust that no one is committing fraud, that votes aren't being surreptitiously added or thrown out, etc. E-voting doesn't fundamentally change the trust dynamics at all: people ultimately need to believe that the people in charge of the process aren't up to any funny business or bad at their jobs.
This argument gets used a lot to argue in favor of first past the post. Explaining a Borda count or single non-transferable vote is harder than explaining: most votes = win. But I think it ultimately comes down to trust: if the people voting trust the people involved with the process (even if they don't understand the nitty-gritty details) they will accept the results of an election.
A notable difference is that any John or Jane Doe can become a poll worker or poll watcher with little barrier to entry no matter their background, and verify the integrity of their elections should they choose to do so.
To me, the lack of the ability for an average person to do this would significantly change the trust dynamics.
Widespread distrust of subject matter experts already exists in the US. You can't just tell people to shut up and listen to the experts.
The efficacy of vaccines is one of those things that is almost impossible for the average person to verify. I can get in a plane and confirm for myself that it doesn't fall out of the sky. I can't get a vaccine and directly compare it with my chances of catching the flu without one. That's the reason why people widely trust the safety of planes, but there exists an anti-vax movement in the US.
Even with alternatives to first past the post, the complexity is of a wildly different scale than blockchain. I can sit down with someone and go step by step how ranked-choice works right now without looking up material. I'd have to pull out reference material and then start with the basics of hash functions or something to explain blockchain.
After you cast your vote what happens after that? Who counts them? How are they counted? How are those counts counted toward the total? Who is certifying all of this? How are those people chosen?
We do also have predictions on TV as soon as the polls close at 6PM, and they are always off by a few percentage points, but they rapidly converge, especially because the official results come so fast. By 8 PM there is not much chance for surprises (maybe one or two parliament seats get reallocated as percentages shift), by 10 PM the predictions have pretty much reached their final destination.
(And by the way, we have a ton of mail-in ballots, too. The federal supreme court ruled in 2009 that everyone can have a mail-in ballot if they want, so it's getting more popular every election.)
If a citizen wants to check the election process, they can go to any polling place (including the ones where mail-in ballots are counted) and watch the polling workers count the paper ballots. The volunteers are obligated to announce the final tallies to all citizens that are present to observe. (There are not always people present, but I've seen it happen a few times when volunteering as a polling worker.)
Then afterwards they can go to the state election office's website and verify that the same numbers appear for that particular voting district. I've done it once just to see how the verification process works, and I think the whole process is very easy to understand and verify for every citizen.
There's plenty of other scenarios where we can see discrepancies between trust and understanding (for example, the general public's trust in recycling vs what actually happens w/ plastics). Heck, the US election system is quite complicated today and yet people trust it. For better or for worse, humans are often fallible and illogical.
[1] https://en.wikipedia.org/wiki/Electronic_voting_in_Brazil#Be...
[2] https://en.wikipedia.org/wiki/Association_fallacy
If such a system could improve the visibility and auditability of results down to small regions, and intuitively show how that cascades up to state level results, it could be a win.
Making an e-voting system believable seems more like a UX/design challenge than a technical/engineering challenge.
Again, whichever outcome, USA is going to have half a country that doesn't like or trust the election results. Not the voting booth ones, not the mail-in ones, not the popular vote, not the official result or the "official" result.
Seems to me that if people trust the leadership, they would trust the voting system endorsed by the leadership, not the other way round.
Then again, I am biased as I am lucky enough to enjoy the benefits of well implemented electronic voting and signing system in Estonia. Source code for Estonian voting system is published in GitHub [2].
[1] http://research.cyber.ee/~jan/publ/mobileverification-ieee.p...
[2]https://github.com/vvk-ehk
This isn’t possible for nations which do not want mandatory ID laws.
It also then makes the ID card a good target which specifically the Estonian one was found to have quite a few issues.
Lastly trust in a voting system isn’t just can someone alter the vote but how easy it would be to deny people from voting and any electronic voting system will be susceptible to a wide range of denial of service attacks, what’s worse that these systems are susceptible to denial of service attacks that could corrupt votes cast causing not only those votes to be cast out but making the entire system being suspect.
If each vote took 1 minute instead of 10, would there still be a line?
edit: Or if not shorter lines, maybe 5 voting machines instead of 20? or 4 poll workers instead of 10? Seems more efficient all around.
That can be done with open source software running on a PC connected to a punch card machine.
We could also let voters confirm their choices with a punch card reader hooked up to another PC running separately developed software at the polling place.
You can still the votes electronically. But also count the physical ballots. Two counts are better than one. Somebody woould have to change both to hide cheating.
Record the raw ballot in a block at the same time to make it even harder.
These are solvable problems. If we can keep cryptocurrency honest, we can do it with votes.
Estonia's government issued ID card has a chip on it, like a debit card. The card contains a private key. The card uses a two-factor authentication system: you have the physical card itself (with the private key) and 3 PIN codes. PIN1 along with the card is used to identify you. PIN2 along with the card can be used to give electronic signatures. A PUK code along with the card can be used to unblock the card if the user enters a PIN incorrectly 3 times in a row.
The system is pretty convenient. It allows us to do things like online banking, give electronic signatures on documents (you put the file in a container and sign the container), and also electronically vote. Effectively, it's a way to electronically verify whether somebody is who they say they are, and this verification is backed by the government.
It is convenient to electronically vote. Some time before election day people can cast their vote via an application on their PC. They can vote multiple times. Online voting ends before election day and anybody can go vote in person even if they've cast an electronic vote. The last vote cast counts. This makes buying votes ineffective, because a person could sell their vote any number of times to different candidates. After you vote a QR code appears in the application. You can read that QR code with your smartphone to check on your vote for 30 minutes or 1 hour after voting.
The server side source code is open.[0] The votes get moved to a counting server and get counted. There are quite a few issues in this process as found by an independent audit.[1] (I really recommend reading it if you're interested in this topic.) However, most of those problems seem to be relatively unlikely or at least there's a good chance we would know that something is fishy.
However, I don't like e-voting. I have three main problems with this system:
1. The system is opaque to the layman. The government can take every step to ensure transparency in the e-voting process, but it doesn't matter to the average person. An average person doesn't understand enough about how software and computers work to be able to tell whether foul-play was happening or not. The process of voting in person, counting those votes and tallying them up are much easier to understand. It's easier for an average person to tell whether the in-person voting process is being tampered with or not. I think this point alone makes e-voting a bad choice.
2. It relies on the security of the average user's devices. It's conceivable that a large scale malware attack could compromise the machine the user votes on and the device the user uses to verify their vote. It's unlikely, but Estonia is small - it can never put in the resources that a large country could.
3. It relies on the security of third party software and hardware. If consumer/enterprise hardware is compromised on a global scale, then that likely means that the e-voting system is vulnerable too.
E-voting is more convenient, but ultimately I think that such convenience is overshadowed by the risk. In person voting in Estonia is very easy (at least in cities). It has never taken me more than 10 minutes from arriving at the voting location to leaving. If the goal was to just make voting more convenient, then they could've just added more voting booths and put them in supermarkets.
[0] https://github.com/vvk-ehk
[1] https://estoniaevoting.org/findings/summary/
I think this article can give you a better overview.[0] It talks about a vulnerability previous generation id cards had, but it also explains more on how they work in general.
[0] https://news.postimees.ee/4234809/criminals-could-have-theor...