The biggest problem I see related to that is the marked haziness over what exactly has been accomplished. As best I can tell, this paper claims to have deanonymized primary election ballots that were cast during the early voting period. But it's written as if it was deanonymizing general election ballots cast on election day.
Maybe. But this article was at the least drafted by claude. It does all the things, including that weird word density + concept vapidity that makes parsing so difficult and annoying.
> this allows you to know whether your neighbor voted, but never who they voted for.
There's probably an angle I'm not thinking of here, but imho, it's absolutely not John Q. Public's damned business what a person does or does not do on election day.
I was thinking the same. It's not as if visibility into whether someone voted or not has driven voter turnout significantly. Hell, I'd assumed this was private until I learned otherwise recently.
But it's such a specific structure, clearly there was an objective in mind when it was imlpemented.
The registry of people who voted has to exist because you're not allowed to vote more than once. That reason doesn't require the registry to be published, but it does require it to be compiled.
> It's not as if visibility into whether someone voted or not has driven voter turnout
Actually, it does. If the party you are registered with thinks are a voter who might not make it to the polls, and this is a close/important election, then there is a good chance you will receive numerous calls and/or visits reminding you to go out and vote. However, if you show up on the list of people who have voted by mail OR if you appear on the registry of people who have already voted in person, then they will stop reaching out to offer rides and reminders.
> It's not as if visibility into whether someone voted or not has driven voter turnout significantly.
It's hard to say how much impact it has, but presumably there's a degree of social pressure when people are seen wearing/posting all those "I voted today" stickers.
The practice of making public whether someone has voted dates back a very long time. There were practical reasons for it when it originated, and many of those remain valid today.
Originally, everyone in town knew most everyone else and could see them physically walking into the polling place. So long before electronic records were kept, the question of who voted was public information.
Even today, I run my local polling station and I know and recognize a significant portion of the voters in my precinct.
The fact that the list of who votes is made public protects against several kinds of abuses. It goes a long way to protect against "dead people voting" and other kinds of ballot box stuffing if the list of voters is public so anyone can review it and potentially catch such abuses.
I suspect the missing angle is that people are more likely to trust claims made to the public if, in principle, those claims could be verified by the public.
Of course it's pretty impractical that a bunch of concerned citizens might gather together and check the published data against how they each remember voting. But preserving the possibility in principle makes it easier to trust the published results. It gives a would-be deceiver yet another thing to worry about.
Its a trade-off I'd have opted into had I been asked. Though I'd feel a lot better about it if I had been asked.
Obviously there's broad uncertainty about what is and isn't genai. FWIW, to my eye you didn't make the right call on this one, and the software classifiers agree.
Since no two readers are going to agree about what is or isn't genai, no one is going to agree that the site guidelines are being enforced consistently. And that's only one of several things to be annoyed by! This area is a mess, and is going to remain a mess for awhile, unfortunately - governed by noise, inconsistencies, and implacable tradeoffs.
Of course, there's no such thing as a secret ballot in California, because they mail ballots to everyone. Therefore voter intimidation is always a possibility.
"In October 2022, a team of researchers published a report showing that certain ballot scanning machines used throughout the US had a critical privacy failure in how they anonymized ballots. Specifically, the machines would assign a seemingly random number to each electronic ballot record at the time of scanning to label each ballot for later auditing. However, the algorithm by which the machines generate this random number is actually deterministic and can be exactly reversed to identify the sequence in which ballots were cast.
...
Naturally, knowing the order ballots were cast is just one piece of the puzzle. But, when paired with publicly available records on the order in which voters cast their ballots (such as logbooks or poll watchers), a simple procedure exists to reconstruct the mapping from ballots back to voters."
---------------------
1. Either upgrade your pseudo-RNG's to real RNG's ($$$) or omit the "random" number from records.
2. Alternatively, just use plain paper ballots. (Yes, I know America is extra-superduper special and ordinary paper ballots that work everywhere else on the planet will never work in America. Special requirements, too many people, labour intensive, politicians hate them, the moon is in the wrong phase, etc..)
I understand there is the desire to provide a paper trail that can be used to validate results, but being able to track individual ballots back to the people who cast them is not a feature of a functioning democracy. This is the sort of thing Russia would want to do. People need to feel their secret ballots are, indeed, secret.
Eh … I can't tell from the article entirely, but the picture of the machine looks very familiar (and the one in the paper even moreso), and if it is the same machine as what my precinct uses, they are paper ballots. (My state is highlighted in the paper as having been vulnerable, too.) See figure 6a in the paper, which is a good view of the paper ballot.
If I've the right machine, these are just paper ballots, marked with pen. The machine is just an automated vote-counter that can read the ink off the paper. I've always assumed these provide a rough, quick tally that can give information in elections that aren't close, while the real human tally follows up with the official count in due time. (I do not really see how an anonymized per-ballot record really proves election integrity, per TFA. Seems like the data could be faked, though it not matching the official count would also be suspect, too. … there is no substitute for poll watching?)
This (assigning a hardly-random number) is essentially tagging the ballot with a sequence number when you drop it in the box — an utterly unnecessary step.
(If your point is that the machine could simply be ditched for a locked wooden box … yes, quite possibly so.)
> Either upgrade your pseudo-RNG
It seems grossly negligent that a voting machine is using a non-CSPRNG.
> Dominion has not shared any details about the new PRNG.
As long as the official count is actually done, then that's fine... but there's a natural human tendency to want to skip unnecessary work. And any polling place where the workers get lazy and just rubber-stamp the machine's counts have now made it possible for someone who hacks the machine to get away with it.
The machines should be kept air-gapped, not connected to the Internet, and all that. But again, human nature kicks in. There have been some poll workers who swore under penalty of perjury that in their polling place, there had been election machines that got an over-the-wire software update on Election Day. That's just... all kinds of wrong, if those reports are accurate. It doesn't prove cheating, but it does prove that whoever was in charge of that polling place should be fired. Because part of the job is making sure everyone knows the results are valid and accurate, and having voting machines connected to the Internet goes directly against "hey, you can see that no hacking is possible here". Doesn't matter how much the machine's manufacturer promises their machines are unhackable, the machines should not be connected to the Internet at all once they are actively being used for voting.
At this point, I'm ready to go back to paper ballots and a locked wooden box (kept in public view, and publicly verified to be empty before locking it up) myself. The simpler the solution, the better, is what I'm arriving at.
Just remembered another report about a vote-counting machine with a security problem. Can't remember enough details to find the original report, but the guy found that the QR code the machine was scanning to read the vote did not have any kind of replay protection, and that although the ballots were printed on special paper, the machine did not have any verification of the paper being fed into it, and would accept plain photocopy paper. Meaning that all that would be needed to "hack" that particular machine, if the report was accurate, would have been to get hold of a ballot belonging to someone you know voted for your preferred candidates, and have it for 20-30 seconds of secrecy, long enough to make one photocopy before giving it back to the voter. Easy to do if the voter and the poll worker are in cahoots. And then you can run off 50, 100, 250 copies of that ballot and stuff the ballot box. Would be caught on a recount... probably. But it shouldn't be possible to do that sort of thing in the first place.
The simpler the machine, the better. As I said in my other comment, I'm about ready to go back to locked wooden boxes myself, opened and counted in full view with cameras rolling.
> And then you can run off 50, 100, 250 copies of that ballot and stuff the ballot box.
At least at my polling place (but I'd really hope this is universal), the machine (the ballot box, effectively) is in the middle of the room, and closely watched. You would not be permitted to stuff more than one ballot into it. (Not to mention this would be voter fraud.)
> Easy to do if the voter and the poll worker are in cahoots.
Again poll watchers are the answer.
> The simpler the machine, the better.
The simplicity of the machine does nothing for this attack? In fact a wooden box is perhaps most vulnerable. But, again, this is completely mitigated by poll watchers. (Not to mention such an attack would likely be mitigated by other voters simply going "yo, what are you doing?"…)
> Would be caught on a recount... probably.
… aside from perhaps a discrepancy between the count of voters who voted on the roll, and the number of ballots in the box (on the initial count), a recount isn't really catching this.
I suppose if I wanted to mitigate this, you could put a signed "This is the ballot for the 2026 election" (+nonce, so that if someone duplicates it, we can pick out the duplicates/replays) on the ballot paper, and attempt to control physical distribution of actual ballots. But now we need to generate a nonce, and we're right back to "I'm sure an LCG is sufficient, right?"
They are using paper ballots. GA for example has since 2020. Several methods of auditing the counts of paper ballots require some tabular record of the contents of the ballots (so that it's practical to perform risk limiting audits on random samples), and the problem here originates from the process by which that tabular record is produced and the way it is made public. The same problem could exist in a hand counting process with risk limiting audits.
The way this sort of problem has been fixed in Texas since 2024 is to require that all ballots be sequentially numbered -- that is, they arrive at polling locations in packs of 50 or 100 ballots, each pack having sequentially numbered ballots, but the presiding judge takes 10-20 at a time, signs them, then shuffles them, places them with the serial number facing down towards the table, and voters get to pick one at random when they check in.
> To keep the published record anonymous, ballot scanners shuffle the electronic records randomly before releasing them
So they were never secret in the first place.
I have never understood the desire to have voting machines when a paper ballot works just fine. We tried electronic voting in three municipal elections in 2008 and courts ended up invalidating the results due to horrible usability issues.
They are using paper ballots. The problem identified here comes from the counting process, and hand counting with similar audit records could end up having the exact same problem if the count audit ledgers were shuffled by similar means. The ballots are shuffled in the audit logs because it is known that a time/order correlation problem exists (ballots tend to be counted in the order they are cast), but the reason that Dominion uses a poor method of randomization, and that some (but not all!) election administrators include count sequence numbers in their publicly released records at all, seem to come down to a lack of care.
Hand counting paper ballots by a somewhat random assembly of people might make that less easy (as people might need to collude). Also, why would the ledgers be accessible to everyone counting? Other than using them to check off who voted/eligibility when a voter shows up, what are they needed for at the counting stage?
In this case, the ledgers were published on the internet, there was no collusion necessary to obtain them. The problem here is more the level of record-keeping and transparency about the counting process, not how the counting itself was done.
The decision to publish the ledger is one made by the election administrator in the interest of transparency - there is no requirement to do so, but it is believed to increase public trust in the process. Unfortunately these types of transparency measures haven't necessarily been rigorously evaluated and the tradeoffs with ballot secrecy may not be favorable. that is the real point of this research, not really anything about the use of machines.
Some states do quite the opposite, e.g. seal ballots after the election and only allow inspection by court order. This has obvious benefits for secrecy, but then creates a lot of objections when people/organizations that doubt the election outcome are told that they cannot review the actual ballots (without meeting some threshold to justify such an order, which can be quite high since these rules were often put in place to try to counter pay-to-vote or voter intimidation schemes).
In person, pure paper voting, in local community halls etc, run by volunteers is the best voting system.
Incredibly resistant to influencing at scale, resistant to voter coercion, transparent, and invokes a sense of occasion and community spirit.
The problem with electronic systems is the public can't see the piles of votes, can't get involved in the count, and ultimately it's the perfect system for being able to tip the scales subtly.
Even vote counting machines for paper ballots are a mistake in my view.
I've got over a decade of experience supporting elections using a ballot scanner.
The need to balance voter security, with auditability, rapid Ness of results, with ease of setup/teardown of the voting place, is hard to beat with scanners.
Extend the question why are rapidity of results and ease of setup/teardown of the voting place design goals at all?
There are elections in India and the US to control billions of people and some very aggressive military people armed with weapons capable of ending modern civilisation. This is one of the most fundamental social technologies we have to keep the whole system stable (up there with limited liability corporations and courts). The downside of one of those elections failing because of voting machine trickery is stupendous.
Frankly, I'm not sure even auditability is that important as a design goal compared to voter security. If the election is close enough that an audit matters the two candidates are pretty similar. In practice, if there is any meaningful gap in preferences then the outcome of the election should be clear enough that an audit isn't that meaningful. It's nice to have and it is cheap enough to include in a paper ballot.
The last 3 US elections were very close and had very different candidates with very different ideas. The closeness of the election has nothing to do with the “similarity” of any candidates. And to imply a “coin flip” would be fine is ludicrous.
> Hand-counting the ballots instead of scanning would be expensive in terms of time and money, and error-prone.
Why?
It's not that expensive - what price democracy? And in terms of error rate - if there is a very close vote, in the UK they just do a recount - sometimes more than once - the variation between recounts is very very small - single digit ( votes not percent ) at most.
to be fair, I guess one difference between the US and the UK is the distributed nature of the vote - in the UK it's broken up into constituencies of ~70K voters - so any recount is scoped to that ( ~ 50K actual votes ).
For a non-trivial amount of ballots, the overhead of securely managing the ballots is substantial. You're casually driving up staffing costs all over the place, and legal challenges will ensue if everything is less than meticulous.
Even the next day is silly. If the election is Thursday, it seems reasonable to count on Friday and the weekend, and have the new MPs declared on Sunday, ready to travel to London on Monday and get sworn in.
In the US, the election is in November and the president doesn't get sworn in until January. It could take a couple of weeks to count the votes and it would be fine.
> In person, pure paper voting, in local community halls etc, run by volunteers is the best voting system.
Unless those volunteers are all die-hard fans of a particular party/candidate and thereby intimidating everybody that has a different opinion. (Not openly of course, but if everybody knows everybody, the mere presence suffices to sway people.)
This would need at least a majority of die-hards present in a (near) majority of polling locations. At this point, the party can probably win the election without fraud.
For the counting process you have "auditors" from all the different parties. We have that system in Argentina and it works pretty well in terms of electoral transparency. People's choices are another thing.
These volunteers will have a far easier time scaling their conspiracy if voting machines are involved. There are fewer points of failure to corrupt and it is easier to produce a plausible sketchy result where their guy wins by 100 votes.
In Blighty, the counters (paid volunteers from the local council working voluntery overtime) are supervised and audited. Not to mention representitives from the local political parties will be present as well as the local press to oversee the proceedings. Typically the returing officer will also allow anybody else to be present and observe the proceedings, space and practicalities permitting.
> Even vote counting machines for paper ballots are a mistake in my view
I think machines are only acceptable if they sort ballots into multiple bins, not if you are using them for the actual count. The bins should be designed so you can casually see that the last ballot to be added is correct for that bin while the machine is working. Something to insert a marker every 100 ballots is probably a good idea, then you can count the number of hundreds, and randomly sample a few of them to check they are correct.
> In person, pure paper voting, in local community halls etc, run by volunteers is the best voting system.
This is the right answer. Using tech as an auditor for batches after manually counting could be useful. Getting everyone together to count votes in a process that everyone can see, understand, and be personally invested in - that process is what is needed far more than efficiency, at this point in time.
This is a BIG discussion in Brazil, where the election is basically 100% electronic, no paper involved. There's a large portion of the population that distrusts the electronic voting machines, partly due to rightwing propaganda, but partly due to a genuine distrust of a system they can't understand.
In person paper voting, however, only works on a relatively healthy democractic community. What used to happen around here was that whoever was the local hegemonic power, mostly oligarcs, sometimes gangs, would just plant a grunt in the voting halls and coerce people to reveal their votes. That or they would simply have a bag of pre-cast votes and drop them all in the ballot box. Lots of absentees and dead people used to happily cast votes at the time.
So ultimately the full electronic system has been working quite well over here for the past 30-something years. It has only really started to be aggressively questioned since 2016 with the rise of social-media as an election driving powerhouse.
I also think it's pretty clear that this "aggressive questioning" has ulterior motives, since it never points out specific flaws in the transparency of the system, and never advocates for actual improvements to electronic voting machines, while there are very obvious low-hanging fruit to criticize and improve.
For example, while the software and hardware is audited by a very diverse panel, it's too institutional: you can't inspect it as an independent researcher. It's also not clear which parts of the supply chain are subject to the audits. I trust it's all of them, and these institutions are doing their job of pointing out the parts that they have _not_ audited, but I, as a member of the public, can't verify.
I'd argue ff you have thuggery at that level in public then you have bigger problems than voting systems.
And if that's country wide then the country isn't a democracy so the voting system is moot.
In terms of voter fraud, it's the very inefficiency of paper in person voting that provides the large scale protection - it's incredibly hard to do what you describe at a national level.
On the other hand, it's much easier for organised crime to influence voting machines nationally - in an undetected way - you probably only need to intimidate a handful of key people.
Yeap, like I said: you need a relatively healthy democracy for the community counting to work. This wasn't the case of Brazil 30 years ago: Brazil was a military dictatorship until 1985. In 1996 when these electronic voting machines debuted, a large portion of the country was pretty much owned by a small number of families linked to the old regime. That's especially true for relatively uninhabited areas such as the states around the Amazon rainforest, where population density is in the single digits per square mile.
Brazil has another particularity in comparison to the US and some other countries: we don't have a 2 party system, we have a lot of parties. It's probably around 30 today, but used to be more. It's impractical for each party to have people on every voting hall. It's much easier to oversee hardware and software production of the machines.
Is it still possible to intimidate or bribe this handful of key people? Probably yes, but as far as we know that never happened, and the parties are very obstinant in how they oversee the whole process.
One thing I definitely think we lose is the sense of community, especially in times like these when individualism is on the rise: we employ a couple people on each voting section, maybe a cople dozen on each voting hall. In the end of election day they simply run the closing protocol and go home. Having a bunch of folks counting votes for a few days definitely could make people more engaged with the election, and with democracy overall. The "electronicness" of the whole thing alienates people from the process.
Diego Aranha had found an exploit with brazilian voting machines back in 2017. They scrambled votes whenever every vote was cast using a CSPRNG, but initialized its seed with the time the voting machine had been turned on (rounded to the second), which due to voting protocols at the time meant you only had to have one person vote a specific way and bruteforce 3600 orderings to find that person's vote and ballot secrecy for everyone else who voted on the same machine.
Seems like this is the same mode of failure, which is strange considering diebold made the brazilian machines back then and should have fixed that.
Wow, a Diebold voting machine with security vulnerabilities? You think they would stop making so many silly mistakes after two decades[0] of making faulty voting machines.
What a bunch of silly clowns with their silly little whoopsies! Maybe they'll get it right someday.
The machines used in Brazil, while based originally on a Diebold design, are widely different from the ones used in US. There are genuine complaints: for instance some of us belive the software and hardware should be open source, but it has passed the test of time in the last 30 years.
> Through the history of computer security, there has usually been a moat of expertise separating a vulnerability from its exploitation. ... Large Language Models (LLMs), the systems behind chatbots like ChatGPT, are building bridges across that moat.
We've moved beyond secret ballots making sense. The security of the vote is far more important. As far as concerns over voter intimidation... let someone just try that and see what happens. Besides, if they have to "shuffle" the ballots to anonymize them, then they weren't actually secret to the people initially collecting them anyways, so the secrecy was just theater anyways.
"a security vulnerability disclosed back in 2022 shows the shuffle can be reversed, and some states have not applied the software update that resolves it."
"a team of researchers published a report showing that certain ballot scanning machines used throughout the US had a critical privacy failure in how they anonymized ballots"
"Specifically, the machines would assign a seemingly random number to each electronic ballot record at the time of scanning to label each ballot for later auditing."
I can tell you that before WA went to all-mail voting it wouldn't have happened, because I served as a pollworker and election site inspector. There was a optical scan ballot reader / counter, my confidence is high it only kept running totals. The ballots fell into a bin, at the end of the day the bin was unlocked and the ballots were tossed into bags (no particular order) which were then sealed. As inspector I printed a copy of the tape which went downtown with the bag(s); they would have been able to print a new tape until the machine's memory was wiped (at which point they still had "hardcopy backup"). The ballots were not marked upon by the scanner in any manner. There was an incident where one of the ballot printing / counting companies (because they both typically had to come from the same manufacturer) started printing sequence numbers on ballots (not just ballot styles) and that went to court.
I've not witnessed what happens with all-mail voting, but there is no sequence number on the ballots. ;-) The count is not supposed to start until the polls close. Before that the ballots are ostensibly separated from their identity (the envelope) in an identity confirmation ceremony. My impression is that they're scanned at this point and the scans are utilized for counting / optical scan, but I'm not certain about this or that it's the same everywhere. I don't know what happens to the physical ballots; back in the day what I know is that if a ballot needed to be corrected (defacement or damage renders it unreadable) then a new ballot was prepared under the supervision and adjudication of election observers and the old ballot was destroyed; but that's the exception which proves the rule that physical, anonymized ballots were retained.
The voting process is in the hands of the individual (United) States; in WA it's largely in the hands of the County administrators and varies to a degree Statewide.
77 comments
[ 0.28 ms ] story [ 22.0 ms ] threadThe biggest problem I see related to that is the marked haziness over what exactly has been accomplished. As best I can tell, this paper claims to have deanonymized primary election ballots that were cast during the early voting period. But it's written as if it was deanonymizing general election ballots cast on election day.
> Tied to a specific ballot is the stronger claim and requires one additional public record.
clearly a claude-ism
I guess the author went back and forth running pangram and slightly tweaking the text until it read "0% LLM text"
There's probably an angle I'm not thinking of here, but imho, it's absolutely not John Q. Public's damned business what a person does or does not do on election day.
But it's such a specific structure, clearly there was an objective in mind when it was imlpemented.
Actually, it does. If the party you are registered with thinks are a voter who might not make it to the polls, and this is a close/important election, then there is a good chance you will receive numerous calls and/or visits reminding you to go out and vote. However, if you show up on the list of people who have voted by mail OR if you appear on the registry of people who have already voted in person, then they will stop reaching out to offer rides and reminders.
It's hard to say how much impact it has, but presumably there's a degree of social pressure when people are seen wearing/posting all those "I voted today" stickers.
Originally, everyone in town knew most everyone else and could see them physically walking into the polling place. So long before electronic records were kept, the question of who voted was public information.
Even today, I run my local polling station and I know and recognize a significant portion of the voters in my precinct.
The fact that the list of who votes is made public protects against several kinds of abuses. It goes a long way to protect against "dead people voting" and other kinds of ballot box stuffing if the list of voters is public so anyone can review it and potentially catch such abuses.
Of course it's pretty impractical that a bunch of concerned citizens might gather together and check the published data against how they each remember voting. But preserving the possibility in principle makes it easier to trust the published results. It gives a would-be deceiver yet another thing to worry about.
Its a trade-off I'd have opted into had I been asked. Though I'd feel a lot better about it if I had been asked.
... sigh
> Yet within a few hours, using AI tools and nothing but public records, I was able to
The "I" in that sentence was the AI. The AI is wrote the article. The AI did not use AI tools.
The human had AI do a thing and didn't care enough to write about it, instead they had AI write about.
This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html.
> HN is for sharing between humans
Since no two readers are going to agree about what is or isn't genai, no one is going to agree that the site guidelines are being enforced consistently. And that's only one of several things to be annoyed by! This area is a mess, and is going to remain a mess for awhile, unfortunately - governed by noise, inconsistencies, and implacable tradeoffs.
...
Naturally, knowing the order ballots were cast is just one piece of the puzzle. But, when paired with publicly available records on the order in which voters cast their ballots (such as logbooks or poll watchers), a simple procedure exists to reconstruct the mapping from ballots back to voters."
---------------------
1. Either upgrade your pseudo-RNG's to real RNG's ($$$) or omit the "random" number from records.
2. Alternatively, just use plain paper ballots. (Yes, I know America is extra-superduper special and ordinary paper ballots that work everywhere else on the planet will never work in America. Special requirements, too many people, labour intensive, politicians hate them, the moon is in the wrong phase, etc..)
I understand there is the desire to provide a paper trail that can be used to validate results, but being able to track individual ballots back to the people who cast them is not a feature of a functioning democracy. This is the sort of thing Russia would want to do. People need to feel their secret ballots are, indeed, secret.
Eh … I can't tell from the article entirely, but the picture of the machine looks very familiar (and the one in the paper even moreso), and if it is the same machine as what my precinct uses, they are paper ballots. (My state is highlighted in the paper as having been vulnerable, too.) See figure 6a in the paper, which is a good view of the paper ballot.
If I've the right machine, these are just paper ballots, marked with pen. The machine is just an automated vote-counter that can read the ink off the paper. I've always assumed these provide a rough, quick tally that can give information in elections that aren't close, while the real human tally follows up with the official count in due time. (I do not really see how an anonymized per-ballot record really proves election integrity, per TFA. Seems like the data could be faked, though it not matching the official count would also be suspect, too. … there is no substitute for poll watching?)
This (assigning a hardly-random number) is essentially tagging the ballot with a sequence number when you drop it in the box — an utterly unnecessary step.
(If your point is that the machine could simply be ditched for a locked wooden box … yes, quite possibly so.)
> Either upgrade your pseudo-RNG
It seems grossly negligent that a voting machine is using a non-CSPRNG.
> Dominion has not shared any details about the new PRNG.
The machines should be kept air-gapped, not connected to the Internet, and all that. But again, human nature kicks in. There have been some poll workers who swore under penalty of perjury that in their polling place, there had been election machines that got an over-the-wire software update on Election Day. That's just... all kinds of wrong, if those reports are accurate. It doesn't prove cheating, but it does prove that whoever was in charge of that polling place should be fired. Because part of the job is making sure everyone knows the results are valid and accurate, and having voting machines connected to the Internet goes directly against "hey, you can see that no hacking is possible here". Doesn't matter how much the machine's manufacturer promises their machines are unhackable, the machines should not be connected to the Internet at all once they are actively being used for voting.
At this point, I'm ready to go back to paper ballots and a locked wooden box (kept in public view, and publicly verified to be empty before locking it up) myself. The simpler the solution, the better, is what I'm arriving at.
The simpler the machine, the better. As I said in my other comment, I'm about ready to go back to locked wooden boxes myself, opened and counted in full view with cameras rolling.
At least at my polling place (but I'd really hope this is universal), the machine (the ballot box, effectively) is in the middle of the room, and closely watched. You would not be permitted to stuff more than one ballot into it. (Not to mention this would be voter fraud.)
> Easy to do if the voter and the poll worker are in cahoots.
Again poll watchers are the answer.
> The simpler the machine, the better.
The simplicity of the machine does nothing for this attack? In fact a wooden box is perhaps most vulnerable. But, again, this is completely mitigated by poll watchers. (Not to mention such an attack would likely be mitigated by other voters simply going "yo, what are you doing?"…)
> Would be caught on a recount... probably.
… aside from perhaps a discrepancy between the count of voters who voted on the roll, and the number of ballots in the box (on the initial count), a recount isn't really catching this.
I suppose if I wanted to mitigate this, you could put a signed "This is the ballot for the 2026 election" (+nonce, so that if someone duplicates it, we can pick out the duplicates/replays) on the ballot paper, and attempt to control physical distribution of actual ballots. But now we need to generate a nonce, and we're right back to "I'm sure an LCG is sufficient, right?"
[1]: https://en.wikipedia.org/wiki/K-anonymity
So they were never secret in the first place.
I have never understood the desire to have voting machines when a paper ballot works just fine. We tried electronic voting in three municipal elections in 2008 and courts ended up invalidating the results due to horrible usability issues.
Some states do quite the opposite, e.g. seal ballots after the election and only allow inspection by court order. This has obvious benefits for secrecy, but then creates a lot of objections when people/organizations that doubt the election outcome are told that they cannot review the actual ballots (without meeting some threshold to justify such an order, which can be quite high since these rules were often put in place to try to counter pay-to-vote or voter intimidation schemes).
Incredibly resistant to influencing at scale, resistant to voter coercion, transparent, and invokes a sense of occasion and community spirit.
The problem with electronic systems is the public can't see the piles of votes, can't get involved in the count, and ultimately it's the perfect system for being able to tip the scales subtly.
Even vote counting machines for paper ballots are a mistake in my view.
The need to balance voter security, with auditability, rapid Ness of results, with ease of setup/teardown of the voting place, is hard to beat with scanners.
(Within reasonable limits, I mean.)
There are elections in India and the US to control billions of people and some very aggressive military people armed with weapons capable of ending modern civilisation. This is one of the most fundamental social technologies we have to keep the whole system stable (up there with limited liability corporations and courts). The downside of one of those elections failing because of voting machine trickery is stupendous.
Frankly, I'm not sure even auditability is that important as a design goal compared to voter security. If the election is close enough that an audit matters the two candidates are pretty similar. In practice, if there is any meaningful gap in preferences then the outcome of the election should be clear enough that an audit isn't that meaningful. It's nice to have and it is cheap enough to include in a paper ballot.
Because it is a low-frequency, high-importance activity that uses public facilities.
We close the polls at 1900 and have a Collector Officer run one copy of the data on a thumb drive to the County.
The Chief gets to deliver a backup a couple hours later.
Hand-counting the ballots instead of scanning would be expensive in terms of time and money, and error-prone.
I'd argue that Fairfax County, VA is about optimal, all factors considered.
As I'm fond of saying: "Virginia is for lovers...of elections."
Why?
It's not that expensive - what price democracy? And in terms of error rate - if there is a very close vote, in the UK they just do a recount - sometimes more than once - the variation between recounts is very very small - single digit ( votes not percent ) at most.
to be fair, I guess one difference between the US and the UK is the distributed nature of the vote - in the UK it's broken up into constituencies of ~70K voters - so any recount is scoped to that ( ~ 50K actual votes ).
For a non-trivial amount of ballots, the overhead of securely managing the ballots is substantial. You're casually driving up staffing costs all over the place, and legal challenges will ensue if everything is less than meticulous.
To your point, though, Virginia blows a great deal of money on elections. Check out all 19" of our local glory: https://www.fairfaxcounty.gov/elections/sites/elections/file...
https://www.gov.uk/government/publications/costs-of-the-2019...
So ~3 pounds per registered voter.
I'd say that's good value - I find US data harder to find- but I see estimates in the region of $10 per voter.
In Blighty, we have paper voting. The polls close at 10pm, the manual count takes place overnight, and the result is typically known the next day.
How much more rapid do you need?
In the US, the election is in November and the president doesn't get sworn in until January. It could take a couple of weeks to count the votes and it would be fine.
Unless those volunteers are all die-hard fans of a particular party/candidate and thereby intimidating everybody that has a different opinion. (Not openly of course, but if everybody knows everybody, the mere presence suffices to sway people.)
The process is quite fair and rigorous.
I think machines are only acceptable if they sort ballots into multiple bins, not if you are using them for the actual count. The bins should be designed so you can casually see that the last ballot to be added is correct for that bin while the machine is working. Something to insert a marker every 100 ballots is probably a good idea, then you can count the number of hundreds, and randomly sample a few of them to check they are correct.
This is the right answer. Using tech as an auditor for batches after manually counting could be useful. Getting everyone together to count votes in a process that everyone can see, understand, and be personally invested in - that process is what is needed far more than efficiency, at this point in time.
In person paper voting, however, only works on a relatively healthy democractic community. What used to happen around here was that whoever was the local hegemonic power, mostly oligarcs, sometimes gangs, would just plant a grunt in the voting halls and coerce people to reveal their votes. That or they would simply have a bag of pre-cast votes and drop them all in the ballot box. Lots of absentees and dead people used to happily cast votes at the time.
So ultimately the full electronic system has been working quite well over here for the past 30-something years. It has only really started to be aggressively questioned since 2016 with the rise of social-media as an election driving powerhouse.
For example, while the software and hardware is audited by a very diverse panel, it's too institutional: you can't inspect it as an independent researcher. It's also not clear which parts of the supply chain are subject to the audits. I trust it's all of them, and these institutions are doing their job of pointing out the parts that they have _not_ audited, but I, as a member of the public, can't verify.
And if that's country wide then the country isn't a democracy so the voting system is moot.
In terms of voter fraud, it's the very inefficiency of paper in person voting that provides the large scale protection - it's incredibly hard to do what you describe at a national level.
On the other hand, it's much easier for organised crime to influence voting machines nationally - in an undetected way - you probably only need to intimidate a handful of key people.
Brazil has another particularity in comparison to the US and some other countries: we don't have a 2 party system, we have a lot of parties. It's probably around 30 today, but used to be more. It's impractical for each party to have people on every voting hall. It's much easier to oversee hardware and software production of the machines.
Is it still possible to intimidate or bribe this handful of key people? Probably yes, but as far as we know that never happened, and the parties are very obstinant in how they oversee the whole process.
One thing I definitely think we lose is the sense of community, especially in times like these when individualism is on the rise: we employ a couple people on each voting section, maybe a cople dozen on each voting hall. In the end of election day they simply run the closing protocol and go home. Having a bunch of folks counting votes for a few days definitely could make people more engaged with the election, and with democracy overall. The "electronicness" of the whole thing alienates people from the process.
Seems like this is the same mode of failure, which is strange considering diebold made the brazilian machines back then and should have fixed that.
What a bunch of silly clowns with their silly little whoopsies! Maybe they'll get it right someday.
[0] https://www.wired.com/2006/09/e-voting-machine-an-easy-hack/
We forgot what it took to be where we are.
Draining it, more like.
"a security vulnerability disclosed back in 2022 shows the shuffle can be reversed, and some states have not applied the software update that resolves it."
"a team of researchers published a report showing that certain ballot scanning machines used throughout the US had a critical privacy failure in how they anonymized ballots"
"Specifically, the machines would assign a seemingly random number to each electronic ballot record at the time of scanning to label each ballot for later auditing."
I can tell you that before WA went to all-mail voting it wouldn't have happened, because I served as a pollworker and election site inspector. There was a optical scan ballot reader / counter, my confidence is high it only kept running totals. The ballots fell into a bin, at the end of the day the bin was unlocked and the ballots were tossed into bags (no particular order) which were then sealed. As inspector I printed a copy of the tape which went downtown with the bag(s); they would have been able to print a new tape until the machine's memory was wiped (at which point they still had "hardcopy backup"). The ballots were not marked upon by the scanner in any manner. There was an incident where one of the ballot printing / counting companies (because they both typically had to come from the same manufacturer) started printing sequence numbers on ballots (not just ballot styles) and that went to court.
I've not witnessed what happens with all-mail voting, but there is no sequence number on the ballots. ;-) The count is not supposed to start until the polls close. Before that the ballots are ostensibly separated from their identity (the envelope) in an identity confirmation ceremony. My impression is that they're scanned at this point and the scans are utilized for counting / optical scan, but I'm not certain about this or that it's the same everywhere. I don't know what happens to the physical ballots; back in the day what I know is that if a ballot needed to be corrected (defacement or damage renders it unreadable) then a new ballot was prepared under the supervision and adjudication of election observers and the old ballot was destroyed; but that's the exception which proves the rule that physical, anonymized ballots were retained.
The voting process is in the hands of the individual (United) States; in WA it's largely in the hands of the County administrators and varies to a degree Statewide.