Ask HN: Why Isn't Open Source Voting Software Mandated?
Why doesn't the United States (and other democracies) require open source voting software for all elections? Software that can be externally verified and validated and that could reproduce the results of an election (given the voting data set). Why are citizens expected to trust private companies and closed source software to elect officials? All software has bugs. This fact is not disputed. Citizens should have access to inspect the software used during national and state elections. This should be a basic democratic right. Why don't we do this? Why don't people demand it?
133 comments
[ 0.19 ms ] story [ 216 ms ] threadWe're basically doing some degree of electronic voting with the machines that count the paper ballots anyway. And with the introduction of large-scale mail-in ballots, the argument against electronic voting is starting to fall apart.
There are many races to vote in at the national, state, and local level. Besides President, every ballot would have included house rep and 2/3 of states had a Senate race. Then add state governor, house rep, and senate which often align on the same cycle. Most states also elect attorney general, treasurer, education and several other statewide executive offices. Some states elect state supreme court judges. Then there can be mayor, city council, school board, port commissioner, and other local offices, although many states align these to non presidential election years. Then there are states like California that always have several initiatives.
In practice, you are looking at dozens of races on this year's general election ballot in many states. Counting all those on paper would be time consuming and possibly less accurate than using an optical scan counter.
A typical U.S. ballot may have 20 or 30 issues on it.
Even if one assumed that all other factors were equal (they aren't), even the raw counting might be expected to consume 20 or 30 times as much time.
We vote on a LOT of things here, and it becomes quite complicated.
A U.S. voter may well be voting on issues related to the sewer district, and the school district, and the library district, and the city council, and (this is important) those various districts might be overlapping or even disjoint. Just because both Bob and Alice are in Sewer District 5 doesn't mean they're both in Road District A. Far from it.
It takes time just to ensure that everyone has been given the proper ballot, much less count and combine the figures from various polling stations (Sewer District 5 may cover multiple polling stations, as may Road District A, but they may not be, and probably aren't the same stations).
It's a mess, granted, but we prefer voting on stuff rather than electing a council or MP who takes care of everything for us.
The moment you introduce any kind of electronic system into the voting or counting process nobody can understand it all anymore, there's a million lines of code and billions of transistors, nobody can validate the entire thing and even if they could, you couldn't, you'd have to trust the people can.
Obviously I defer to the experts in the field for what is and isn't possible, but something about it scratches at the back of my mind...
In my county, paper ballots are used (used to use electronic booths) and the form is printed in English, Spanish, Korean, and Vietnamese. Hypothetically an electronic ballot has no issues with localizing to an infinite number of languages without regards to costs of printing out separate ballots. Electronic voting isn't impeded by the restrictions of paper. It could have rich media, sound, videos, etc.
Accessibility is another potential advantage. Right now with paper ballots the expected procedure for voting as a person who is unable to use the ballot is to have a family member fill it out for them. Electronic voting means that you can make accommodations for all sorts of disabilities and special needs while still allowing the person to vote without the need for a proxy.
Electronic voting could be more convenient than in person paper ballots. Hypothetically if a person could vote online on their phone, the process would be more convenient and more people may vote. It also makes it easier to vote for people that are traditionally disenfranchised due to time constraints of voting in person (they can't afford to go to the polls, even if there exists laws that require employers to allow for time to go vote on election day). It also limits avenues for voter intimidation.
Finally, electronic voting would (hypothetically) be instantaneous and accurate. It isn't dependent on humans for counting. There isn't really a potential for 'hanging chad' incidents. We'd know the victors of an election as soon as polls close.
The issue is unfortunately all of these advantages don't really outweigh the issues that we don't have good solutions for (yet, or maybe ever).
Electronic voting isn't tamper proof. Having open source voting software doesn't really help verify that the software that you say is running is what actually is running. If it is exploited, it is much easier to tamper with electronic votes than it is paper ones. If it is online, that opens it up to even larger issues of exploitation.
There's no way to verify that what you intend to vote for is how you actually voted according to the machine. With a paper ballot there is tangible proof of how you voted, while that doesn't exist on a purely electronic vote.
Paper ballots have their own set of issues, but they are manageable compared to the current limitations we have for dealing with electronic voting.
PS: One could easily envision an electronic system backed with paper printouts. The electronic system provides immediacy and avoids human counting errors, while any large scale manipulation of the electronic system can be verified by counting the paper ballots.
Because paper is simpler and better. It works just fine in other countries.
> All software has bugs.
So why do you want software? What do you think the advantages are?
We just had an election amid a pandemic where electronic voting could have literally saved lives.
Then we have a president who refuses to concede and states that are still counting and recounting votes in a tight election weeks after it took place, people don't expect a final tally until December.
No?
> We just had an election amid a pandemic where electronic voting could have literally saved lives.
The electronic voting machines the OP is talking about are still in-person. It doesn't make any difference to the risk in the pandemic.
> Then we have a president who refuses to concede
That's nothing to do with paper/electronic voting, is it?
> states that are still counting and recounting votes
Well why do they take so long? Why can it be done in hours in other countries but not in the US?
> people don't expect a final tally until December
I think a single person could count all the ballots in that time. What are they possibly doing?
It's always been this way, even before the pandemic. States have 30 days to certify their results. It always been this way. Many trump supporters believe that results will magically change in December. The reason it took longer this time is because:
1. Majority of people voted by mail
2. Many states were not allowed to count as the votes were arriving
3. Many states weren't even allowed to check signature and remove voted from envelopes in advance
4. Dismantling sorting machines in USPS before election causing delays (it took 10 days for my friend's ballot to be delivered within the same county) because of that many states extended wait time for incoming ballots.
Also this should be emphasized that you don't need a PhD to tell a fraud is being committed in front of you with paper ballots. I believe that's the most important thing about it.
look at tax software for another perfect example.
US is pretty busted
(edit: legal publishing, maps, insurance....)
To answer OP's question, I personally have no idea but think it should be. Much of our scientific work is open sourced (e.g. codes from national labs, NASA, etc). But I think a lot of people don't understand what open source is or means. They think you can't have open sourced software and still privately own it. We still honestly haven't figured out how to deal with this adequately in the law (there's a post on the front page about FB taking their OS project, and these posts happen at least once a month). People don't demand it because frankly people aren't very tech literate.
The solution to a problem that should not be solved with software is not to have different software.
I agree that paper ballots are ideal, but the machines are already in use.
They aren't inefficient. In the UK (paper ballots) an accurate estimate is available when the polls close, and a certain result is available within a few hours before next morning. This is much faster than US voting machines.
1. You didn't have to count 151 million votes in the UK election
2. You didn't have to wait a few days for mail-in ballots that were delayed in transit to arrive
3. You didn't have to do this in the middle of a global pandemic that required poll workers to stay 6 feet apart
Generally the US election results can be predicted the same day, this year had additional challenges due to extremely high turn-out, high use of mail-in ballots, and limited number of pool workers due to pandemic.
In my opinion, elections should be done using paper ballots, and those ballots are counted using electronic tabulation machines. After a batch of ballots are counted, a random sample of them are selected and manually counted. Should the results match, then you can have a high certainty of the accuracy of the count. Electronic tabulation machines are actually more accurate than hand-counting, and by hand counting again, you reduce the risk of the machines making "mistakes" due to technical glitches or malicious backdoors etc.
[Edited to add: 46 states have a lower population density than the UK, adding further logistical consideration]
If each community counts their votes... why does it matter how large an area they collectively cover?
St Ives constituency in the UK is generally the last to declare, presumably because the island populations are so small and remote it's considered unsafe for them to individually count and report the results for collation, for multiple potential reasons (Gugh: 3 residents)
Why is it about the US that means it takes a week... even with these machines which supposedly make it better?
If your count in the UK doesn't finish for a week, the parliamentary session opens, and you don't have local representation in parliament. There's an immediate procedural consequence that disadvantages the local area and may result in concentrated unrest.
If your count in the US doesn't finish, the relevant [Congressional] term doesn't start until January 3rd, 2021. As such, there's no immediately comparable procedural consequence.
The Electoral College doesn't cast its votes until December 14th.
The Supreme Court won't get involved, to hurry you up, until December 8th.
Correctly postmarked ballots will (in some states) still be counted if they arrive late, up to November 23rd.
Today is still November 15th. In theory, not all the votes have even arrived to be counted yet.
The US is vast. The political geography is different because the physical geography is different.
In US there were some laws that counting couldn't start before polls are closed. Despite mail in ballots arriving a month earlier. In some places they weren't even allowed to prepare them for counting (like verifying signatures and removing ballots from envelopes).
This is a good time to remind everyone that in the U.S. there are many different voting jurisdictions, and at the very least 50 different sets of rules. Some similar, some not. So it's difficult to generalize, some places count early, some not, some allow late arrivals, some not, etc.
That's actually pretty much on par for much of the U.S. We have paper ballots and results mostly finished before the next morning. There are stragglers, of course, for good reasons, but you don't really hear much about those unless they are possibly going to decide the election, like this year.
And then of course 2020 is it's own special kind of fun, not typical of any other year.
This year, my ballot had about a dozen individual races (including two state referendums and an advisory question) to vote on, and this is probably about or below the US median ballot complexity each presidential election.
But can you not return a presidential result in the first few hours, and then go back in priority order?
With electronic voting, the bar for being able to validate vote counts is raised to requiring computer experts who understand public-key encryption.
With paper ballots, anyone who can count is able to validate votes.
Electronic voting would be prime for obfuscated attempts at influencing elections because only a handful of people would be able to verify that the machines counted votes correctly.
All these phishing schemes that are extremely effective with IT workers and other security conscious people. I say just keep elections analog for the time being. Perhaps someday the technology will be mature, well understood, and distributed far enough to work but I don't see it happening this decade.
I agree with this - in addition, it makes it a lot easier for everyone to understand the system, and therefore more likely to trust it.
Is this the USA system we are talking about? Because a significant proportion don’t seem to understand or trust the system right now!
I would be happy if we could have a national popular vote to choose the president, that reduces complexity. I'm wary of anything more, though I do like that there are now some experiments here and there with other systems.
Edit: I've recently come to the conclusion that the real value of elections is as a national show of force.
"1xx,000,000 of us are here and paying attention and expecting the government to respond to our interests and willing to do something about it"
I'm extremely confused by this statement. All the systems the parent is talking about still use plurality. Substituting in another voting method doesn't change the fact that each state works slightly differently (and really every county).
I'd also say that if this was your goal then you'd want something besides plurality. RCV/IRV would probably be good because it is highly inefficient because you have to do many different rounds whereas systems like plurality and condorcet (exception to STAR, which has 2 rounds) are single round methods.
I should mention Ireland and Australia does hand counting with IRV (Australia has had IRV for 100+ years). I don't think the hand counting is really a major factor, though I will still contend that ordinal systems are needlessly complicated when we have cardinal systems available to us (which also give higher fidelity).
As for part more information Clay (who might be in this thread somewhere?) put out a pretty good video on voting methods and towards the end he shows a sample of an Oakland Mayoral result that used IRV[0] (around 15:20). It isn't too useful in isolation but I do encourage watching the whole thing because it is from someone who is a HN member and an expert on voting.
[0] https://www.youtube.com/watch?v=HyBm_Hcu4DI
In the general case, however, tabulating ballots via a scantron machine or similar seems reasonable.
I'm also trying to imagine elections with the number of people we have and number of races being counted by hand from the beginning, with no digital storage or tabulation, and it is rife with errors and even harder to validate in a reasonable way.
It’s not actually that hard at all, including validation, through simple physical processes (that are incredibly tried and tested!). Write the contents of the vote totals on the outside of the box containing the ballots (total must reconcile to number of ballots placed in), then total all the box totals at the end for a single constituency. Constituencies then report back.
We get results back within a day and the validity has never been seriously questioned. The process can easily scale linearly too.
What is not reflected however is the sheer number of votes that people tend to cast in the US - often voting on dozens of different measures.
The UK process does not have this aspect - at worst there may be a Westminster, country-specific parliament and city or town council on the same election day, and they are handled via separate ballot papers.
It’s literally an ‘embarrassingly parallel’ problem.
A hundred people can count ten times the ballots that ten people can, and then merge their results.
The first is that there are a lot of reduction steps where we're doing many to one communication. The more nodes you have the more communication there has to be and this is an issue.
The second issue is that if we (naively) assume that there's a consistent error at each step, that the error will grow in each gather step. So if each worker has a 0.5% error rate, each gather has a 0.5% error rate, then our error rate depends on the number of workers and gather steps.
For what it is worth there is at least a gather step at each poll station, then each precinct, then the state, and then the country. It is also likely that these all get worse as the election is closer and there's more pressure on.
US elections are also operated entirely regionally; the largest US election is that in California, which is smaller than the UK.
You have to look at the 2000 election[0] where there was a switch to digital means. I don't have exact numbers, but I am under the impression that these machines are easier to use and are less error prone than the previous punch card methods. Your digital machines can also print you a receipt. So "why have a (digital) voting machine at all" is because it is easier and less error prone. Having election results going to the Supreme Court is a pretty big deal and should be avoided.
[0]https://en.wikipedia.org/wiki/2000_United_States_presidentia...
I think you're trying to work your solution into being correct rather than recognizing that the problem itself is extremely complicated. Given your other comments and our other conversations it is clear that you're overly simplifying the subject matter and frankly you are wrong about certain aspects of it (like that all votes are counted the night of rather than "enough"). If you flat out ignore these parts of the problem then you're going to get the wrong result. You should also not start with a solution and work towards an explanation, but rather work the other way around. These conversations feel really disingenuous to be honest. They feel more like they are based on how the UK is so much better without any real justification.
Hanging chads? You even brought up the 2000 election in the US yourself. Pencil and paper (and no machines) would have avoided that mess.
With paper, it's 100% guaranteed that "No two recounts will ever be the same". It's a human process. Two humans verifying it will never come to the same conclusion. One will say the "ballot stamp was not in the right place", another will say "chad did not fall off the paper", someone else may just be tired in the night, so on and on. As a democratic society, we have had large cases of recounts that it's not even a surprise anymore. It has become the go to whining and agitation tool for losers.
For the continued functioning of democracy, we have to put an end to this recount problem. If a winner wins by 1 vote, it should recount to the same 1 vote difference no matter how many times you do it. If not, elections are undermined (and thus democracy).
As for the "voting machine", people in this forum are really not good for judging as they think in terms of "modern" tech software with C or Python with a running OS. Read this thread for more info [0].
A good way to describe the voting machine, is a dumb printer. It originally exists to print a proper valid ballot for the elector who then drops it off. The machine just so happens to also have a secondary counter in it while it prints, so it can be secondary verified for extra safety. The paper is what matters and it's still there. This is called VVPAT, Voter Verified Paper Audit Trail [1].
Over the course of time, after many many recounts, it becomes obvious that the machine-printed ballot and machine do not ever diverge. So it just so happens that for convenience, the machine has grown to get counted first. If anyone has a doubt, they can easily go back and verify the ballots which are stored forever. It has been proven over and over to give consistent recounts and restore trust in elections.
Trivia: First time a Cabinet-rank senator in India lost election by 1 vote [2]. Recounts tallied down to 1. It has happened again. Chaos still did not break out. Candidates were not fighting over who was the winner. Reason? Voting machines and verified ballots. Recounts won't change reality.
I'll finally leave you with the summary of an excellent video on elections in India before/after voting machines. Every loser will complain and blame something. Hacking the voting process, obstructionism, who's issued voter IDs, where and how many voting centers are placed, gerrymeandering, media, pre-mature leading polls, on and on and on. All this thing about Voting machines is a classic case of shooting the messenger. The voting machine only exists to give one less reason to blame on. Don't shoot the messenger [3].
0: https://news.ycombinator.com/item?id=25106044
1: https://en.wikipedia.org/wiki/Voter-verified_paper_audit_tra...
2: https://en.wikipedia.org/wiki/C._P._Joshi
3: https://www.youtube.com/watch?v=zdo43a4JfYQ
But this is basically what your [1] is, which got cut off.
/wiki/Voter-verified_paper_audit_trail
And yes, the voting machines have evolved to deal with that as well. Now, the printed paper is clearly displayed, the citizen looks at it and then they press OK if it's fine, and it falls straight into the ballot box. A bit easier :)
1: https://en.wikipedia.org/wiki/Voter-verified_paper_audit_tra...
2: https://youtu.be/DqcZZ-QrNgc?t=198
[2] That is an interesting solution but I don't think solves the problem. How does the voter know that their receipt matches the one in the bottom compartment? I can's speak Hindi so maybe they verbally addressed this issue but it wasn't apparent from the visuals alone.
I'm not sure myself, just asking. I don't know the sound or experience of dropping ballots into a box, since (for good or bad) paper ballots were already extinct when I started to vote...
Before the first step happens, expecting the next steps would be premature I guess.
But reality is: The printed paper shown to the voter has to go somewhere. It cannot disappear or be hidden in the machine in secret compartments because the paper is in the mechanical side of things, not software. Such hidden compartments will not fall invisible to officials on the ground. It's not a black box machine in that sense, officials run basic physical and mechanical tests on it before voting happens. The machine is dumb and tiny.
I still understand your point about "anything can be hacked", but at this point, to hide something in physical sight needs on the ground support (which can happen regardless of machines), or needs discrete parts like a shredder which will make it mechanically huge and does not go unnoticed by such a large chain of command.
Three, surely, by that metric? 2016 was closer than 2020.
Voting is in itself a simple process, even in the USA where the ballot can be filled with multiple options. Computers are not simple, are not transparent and are not understood by the majority of the population. They can be used for quick counts, for producing fancy graphics, for doing all sorts of statistical trickery and whatnot but they should not be relied upon to produce the final results of an election.
And you still have other issues like radio waves being emitted based on the computers' calculations, which (in theory) makes it possible to determine what you've voted. Researchers in The Netherlands proved that it was possible with the machines there, which is why we went back to pencil and paper.
If the former, we already have that. If the latter, that will enable vote buying and is specifically avoided.
These ballots would be verified in the same way as normal ballots, but wouldn't count. Then, you could show a prospective vote buyer a poisoned ballot verified vote which they wouldn't be able to distinguish from a counted vote, rendering vote buying unprofitable.
One thing that's different about the US is that each state is responsible for carrying out its own elections. There is some federal involvement, but it's mostly up to the states to implement.
One often-cited advantage of this approach is that it makes it difficult to attack a presidential election because you'd have to work across different state voting systems.
So a national mandate would face opposition on the federalism issue.
A vote counting software based on dedicated buttons- one for each option to vote on - should be something that is simple enough to be assigned as an CS undergraduate course project.
We have built very sophisticated banking software that handles several orders of magnitude more computations and has been ticking away bug-free for decades now.
What am I missing?
2. Electronic elections are a thorny mix of privacy and transparency requirements. Example: Electors need to be able to confirm their own vote was counted but not be able to prove who they voted for (this is to prevent vote-selling and voter intimidation).
3. Even if you get everything right in #2, you need to prove that the software running on the machines is in fact the software with the correct properties, and doesn't break privacy through a side-channel.
4. There are UI concerns that aren't immediately obvious. Example: the list of candidates should be randomised so that donkey votes don't skew the result to one candidate.
5. This is software that potentially every citizen needs to interact with, which means accessibility is important. You need to cater for blindness, people with limited motor control, i18n and l10n for all the languages in the voting cohort, etc.
6. Related to #3, you need to secure your voting machines and both the hardware and software supply chains between elections.
tl;dr: In the US that decision would be up to each state.
In the US at least, the management of elections is left to the individual states. Assuming you're most interested in the US Presidential election, it's also specifically delegated to the states to choose how they wish to select their electors (it just happens that most use a popular vote of their citizens in a winner-take-all setup per state).
There are a number of groups trying to push for more transparency, but it's fundamentally a per-state issue in the US. California has a bill [1] that seems like it "passed" but is referred to committee (stuck). It would establish $16M in funding, at least half of which goes to development, which must be AGPL 3:
> (1) All of the system’s software developed at least in part using state or county funds pursuant to this section must be licensed exclusively under the GNU Affero General Public License 3.0 or a later version.
and
> (2) All of the system’s software components must be open source during development, using a process that is open to public feedback. Development must be carried out in public repositories by January 1, 2021.
So some folks definitely agree we should have open-source election software. Most likely, if a system becomes successful in California (the largest market) it could spread to other states. As frustrating and repetitive as it sounds: you need people to vote in local elections, and contact their local representatives.
[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
I can understand why it's not open source.
A good way to describe it is a dumb printer. It exists to print a proper ballot for the elector who then drops it off. The machine _just so happens_ to also have a secondary counter while it prints, so it can be secondary verified for extra safety. The paper is what matters and it's still there. This is called VVPAT, Voter Verified Paper Audit Trail [1]. It has been proven over and over to give consistent recounts and restore trust in elections.
Over the course of time, after many many recounts, it becomes obvious that the machine-printed ballot and machine do not ever diverge. So it _just so happens_ that for convenience, the machine has grown to get counted first. If anyone has a doubt, they can easily go back and count the ballots which are stored forever.
Trivia: First time a Cabinet-rank senator in India lost election by 1 vote [2]. Recounts tallied down to the dot. It since happened again. Chaos still did not break out. Candidates were not fighting over who was the winner. Reason? Voting machines and verified ballots. Recounts won't change reality.
Answer to the primary OP's question: "Why not open source the software" – is the crux of the Voting machine is mainly 1950s pseudo-mechanical hardware. They are not networked. This is technology older than floppy disks. A lot of in this forum imagining "software" think in terms of C or Python, because that's the target audience here. Yo, it's not. It's not running an x86 processor.
It does not have a turing complete language to open source. If you want it, get a thrown away one. But open sourcing the "software" (if you call a few registers and a counter that) – doesn't make any sense as it doesn't give any picture.
Second – to a lot of commenters, why these machines? Single answer: Consistent recounts. With paper, it's 100% guaranteed that "No two recounts will ever be the same". It's a human process. Two humans verifying it will never come to the same conclusion. One will say the "ballot stamp was not in the right place", another will say "chad did not fall off the paper", someone else might just be tired in the night, so on and on. As a democratic society, we have had large cases of recounts that it's not even a surprise anymore. It has become the go to whining and agitation tool for every single loser of every close election. For the continued functioning of democracy, we have to put an end to this recount problem.
It's a pity that in the US where you had two really high profile elections (2000 and 2020), and you still cannot figure out how many times to recount to believe the result. Best of 3 recounts? Best of 5? Does that even improve trust?
I'll finally leave you with the summary of an excellent video on elections in India before/after voting machines. "Don't shoot the messenger" [3]. Every loser will complain and blame something. Hacking the voting process, obstructionism, who's issued voter IDs, where and how many voting centers are placed, gerrymeandering, media, pre-mature leading polls, on and on and on. All this thing about Voting machines is a classic case of shooting the messenger. The voting machine only exists to give one less reason to blame on. Don't shoot the messenger.
1: https://en.wikipedia.org/wiki/Voter-verified_paper_audit_tra...
2: https://en.wikipedia.org/wiki/C._P._Joshi
3: https://www.youtube.com/watch?v=zdo43a4JfYQ
Additionally, voting doesn’t happen often enough for that to be at the top of our minds among all the other things we have to deal with that have more immediate and visceral impact. Only a small portion of the American population lives well enough to be able to look beyond next month or even next week. Unlike the EU, we are largely reliant on our own resources for major life emergencies, and we’re gathering (or failing to gather) resources to mitigate them.
It will take many generations of work to fix that situation so that people can worry more about long term needs rather than staying focused on the short term. It will also take a lot of money that the middle class can’t afford and the wealthy won’t spend.
I don’t expect it to happen in my lifetime.