> The intention behind this repository is to make source code of the Estonian online voting system available for public review.
> The repository is not used for active development, but will be kept up to date, so the code that can be found here is the code that is used for election.
The repository is not used for active development, but will be kept up to date, so the code that can be found here is the code that is used for election. As the voting system used for legally binding elections must strictly follow the legislation, the actual development of Estonian I-voting system and I-vote verification application is supervised by State Electoral Office of Estonia. Please refer to www.valimised.ee for further information.
But updates are promised, so GP's question is valid: where are they, and since they're not there, why? Is this the final product's source code and it has not been modified since?
If I understood correctly they make updates elsewhere, then update this repository only when elections happen, thus making the repository in the exact state it was used for that election.
Parliament elections in Estonia happen once every 4 years so don't expect frequent updates. Next one should be in 2027 so there are still ~5 months for them to publish next update. There was also a municipal election in 2025 and European parliament in 2024 which matches last 3 updates in git history. No elections in 2026 so no updates this year.
I know the answer is "you don't", but suppose I vote vote electronically for candidate A. In the end, the candidate loses with 764 votes. How do I convince myself that my vote was counted in the 764 votes, and that it was not a randomly chosen number (with a RNG skewed around "plausible" scores) ?
I've been an overseer at election booths several times. I kept a good look at the transparent ballot box, along with complete strangers. In the end, once, I may even have inadvertently recognized my envelope and bulletin during the opening and counting - because we where very very few people to choose that candidate in my polling station :D And I was lucky enough to follow the president of the polling station to the town hall where armies of public servant where doing the addition, and I checked the CSV on next Monday, etc, etc...
In any system, I suspect it is possible. There are strategies that allow doing private set intersections (or similar): https://en.wikipedia.org/wiki/Private_set_intersection (i.e. a set with one member is "you", and you can check to see if you're in that 764, without knowing who the others are)
I'm not sure what strategies would also allow you to not reveal to the vote collectors where your vote went, but there might be something.
> Private set intersection is a secure multiparty computation cryptographic technique[1] that allows two parties holding sets to compare encrypted versions of these sets in order to compute the intersection. In this scenario, neither party reveals anything to the counterparty except for the elements in the intersection.
Revealing even elements in the intersection, if that means revealing individual votes, breaks ballot secrecy.
Exactly, it means someone you could prove to someone else how you voted, which is the sine qua non condition for creating a vote economy. That's actually the main reason behind trying to keep the vote secret, much more than threats of intimidation for opposing parties voters, etc...
You convince yourself the way you do with any elections: you trust the people/system that counts the votes. If you think about it for a second, the requirements of a secret ballot (meaning it's not possible to know who voted who) and the fully verifiability you are asking for are mutually exclusive. You can have either one but not both at the same time.
That being said I think the Estonian voting system does a decent job of being trustworthy. Publishing the source code is a big step to the better as well. As far as I knew the system was written in Java but seems like they have upgraded it in Go. Good job! Probably the best in the world.
Yes. Sorry for the condescending tone of "thinking about if for a second". It is actually an interesting problem worthy for a longer time.
Still, if you had the authorities to announce a product of large primes - whatever that means - how do you know they announced the correct primes and not something they made up? I'm afraid any clever cryptographic scheme you come up with falls the victim of the same dilemma: if you can check that your vote was counted right, you lose anonymity.
As far as I know, the Estonian voting system works in two stages. First there is an authenticator, that verifies that each given vote is signed properly, is only given once and can be counted, without looking at the payload. Then it anonymizes the votes and signs the result file which is transferred to another system which counts the votes. The communication is unidirectional so that the front-end doesn't get any feedback from the back end save some data transfer acks.
As I said, a decent job. It's not perfect in any meaning of the word. It's practical and it works.
> Still, if you had the authorities to announce a product of large primes - whatever that means - how do you know they announced the correct primes and not something they made up? I'm afraid any clever cryptographic scheme you come up with falls the victim of the same dilemma: if you can check that your vote was counted right, you lose anonymity. Also how do you check no fake votes were added?
My take is that one should be able to check that a blockchain has not been altered/substituted, and the way to do that is by being able to record encrypted running tally blockchain heads, but this gives you no indication that the published blockchain faithfully represents the cast votes so you have to add paper ballots and an immediate partial manual audit of the paper ballots checked against the digital cast vote record.
> Still, if you had the authorities to announce a product of large primes - whatever that means - how do you know they announced the correct primes and not something they made up?
Note, obviously I was not attempting to detail a cryptographic voting system here. My only point was that I don't see what you said as being obviously true, if it is true at all. For the purposes of that point, even an incorrect scheme that sounds plausible would prove my point.
That said, to answer your question as I think through the details right now...
- Authorities preassign N-digit primes to everybody, one per option on the ballot.
- Find a way to validate the total number of ballots cast in the election. (Assume for simplicity that every question has exactly one answer selected.) Exercise for the reader on how to do this; this ought to be easy. This is important to know how many digits to expect in the product(s).
- You "vote" by submitting the primes corresponding to the option you select, one per question.
- Authorities announce the products of primes corresponding to each option.
- If your prime isn't included in the product, then it's obviously trivial to prove it... you just reveal your number and show the result fails divisibility.
- If they included extra fake primes, then this is harder to prove, but I think you can catch this by looking at how many digits are in the result. I think you can make the error margin arbitrarily sharp by making all the primes lead with 10000000000..., for example, adding however many zeros you need to make sure a single fake number adds a detectable number of digits to the product.
This is just a sketch; fix & fill in details as appropriate. The biggest flaw I see right now is that it's susceptible to whatever eventual algorithm (quantum or otherwise) ends up breaking factoring and leaking everyone's votes. But otherwise, it sounds plausible to me, and there's probably another trapdoor function that can mitigate that better. And as mentioned initially, if you can't easily prove it's impossible to make it work, that's sufficient for my point, even if it is in fact wrong.
Nope. Vote tallying is public with random overseers, in transparent boxes watched by a room of people from diverse opinions, with random inspections - precisely because we DO NOT trust the system or the people who count the vote.
Which has always been my biggest beef about digital vote. I'm all trusting the people writing voting software to do their best, actually. Being a Software engineer myself, I'm more concerned about bugs and hacks than deliberate tampering by the government. Especially in an age where AI agents can access pretty much anything ever connected to an electric plug...
Yes. But I'm slightly less worried about deliberate mishaps (which tends to leave trace or organisation) than pure mistakes (which go unnoticed, except for malicious actors who are better at hiding their trace.)
I think this is an easy enough problem to solve, the issue is that someone else can how force you to reveal who you voted for. Spouse, rouge employers, mafia, corrupt politicians. You can now "sell" your vote.
I think such a system could still work, but just like the voter has to go to the booth alone to vote, they must go the booth alone to verify.
To take it one step further: how does the election authority convince everyone that their vote was counted?
Us "computer folks" convincing ourselves is the easy part. Maybe after enough studying of the system, I'd be absolutely sure that my vote was counted, but what would the other 90 % of the population think? This not a "people are stupid" argument, a brain surgeon or nuclear physicist or philosopher isn't going to put in the effort to understand fully homomorphic cryptography, hardware-based security, etc. Why should they?
The alternative works perfectly fine and it's so easy to explain. It's obvious to anyone, no matter their level or field of education, how their vote makes it from their hand into the tally, what prevents it from being misused and what they can do to further reduce that already tiny probability.
You can see, feel and experience the technical measures keeping your vote safe. The people keeping their eyes on the ballot box alp day may literally be your neighbours, as are the people counting. You can reason about their motivations, you can theorise in your head about what lengths you'd have to go to in order to change even a few votes and how unlikely you would be to succeed.
The biggest danger to elections, ultimately, isn't the risk of cheating. It's the risk of losing the people's trust.
(I'm in the local election commission (that's layer 2 out of 4 in our particular election management hierarcy), we just had a big referendum, everyone keeps asking me about online elections so this rant was fresh on my mind)
I'm really not worried at all about if my vote is tallied correctly. I'm more worried about mass fraud of the voting system.
It's funny too - 15 years ago on HN people would discuss blockchain voting systems or ways to make it 100% secure. It seems like lately a lot of people carrying water for the potential that one party is associated with 95% of the fraud - and don't wish to discuss the vote being fair.
There is a separate verification tool I've used that lets me confirm who I voted for, and that the server has registered my vote. Also, like in elections in other places, every election has observers take part. OSCE regularly send their lot, their report on the last parliamentary election can be read here https://odihr.osce.org/odihr/elections/estonia/551179.
Fully software, even a combo of software and hardware, cannot by itself make elections secure. Think of the On Trusting Trust problem, the need to verify firmware, etc. You can't ensure that machines _will_ work correctly, but you _can_ verify that they _did_. To do verify the machines' functioning after the fact you have to do it very soon after closing of the polls, and you have to devise a manual, statistical random sampling method where you manually check randomly sampled, marked paper ballots, against the digital cast vote record, then do a digital risk limiting audit to check that the CVR totals up to the machines' reported results. The sooner after closing of the polls you do this, the better the likelihood that any cheating will be caught. I.e., an immediate manual, partial audit of enough randomly-selected polling locations.
That still leaves tons of other technical problems to address, like security of mail-ballots / absentee ballots, the security of ballot boxes used for early voting (because you probably cannot run the above manual partial audit due to then having nightly results available to the public; or maybe you accept that), etc.
GP means inefficient in the sense of cost. Paper ballots add costs. Partial manual audits / hand-counts add costs. Full audits / hand-counts add a lot of cost, and in particular hand-counts require a lot of staff in order to yield results on election night.
The costliest item is counting by hand, so... don't. Use ballot scanning and counting machines and then implement a timely partial manual audit to demonstrate that the BMDs and BSCDs functioned correctly.
I agree, but if your location has abandoned hand-counts then justifying the extra expense and extra logistics complications can be infeasible. Thus in some places it is easy to justify taking a detour through machine counts + immediate partial hand-count random sampling statistical audits designed to detect machine malfunctions with high probability.
As I wrote in another comment we had to repeat local state elections because of problems in the paper process - including shortages of ballot papers, unusually long queues to vote, ballots being delivered to the wrong locations, and in some cases voters being turned away.
While I’m a proponent of the paper process let’s not pretend it immediately means you can be confident about the election
Oh, you absolutely can and it worked in your state. There were problems with the process and you had to repeat the election for people to be confident. People can understand all problems of the above.
With some abstract math and computers? Any real or imaginary issues are incomprehensible to most of the voters and concerns can be easily shooed away.
If we are talking about the Berlin elections there had to be great public pressure for the election being repeated. Officials denied any impact on the final result. Afair courts had to be involved. Pretty shameful. The whole thing didn't further my trust in German democracy.
It definitely didn’t help with trust even though I think German democracy is still mostly fine and something worth fighting for- but I guess that’s a different topic
But Brazilian gov says their electronic election system is unhackable... Yeah.
Only a selected few orgs and groups are allowed to audit and in a very controlled environment because they also rely on security through obscurity. The source code is not available to the citizens.
If by any chance I'm wrong and someone can point me a source code repo, please enlighten me.
In my country we still rely on a paper process - which is very hard to tamper with but also has a bunch of problems - recently we needed to repeat local state elections because of such problems including shortages of ballot papers, unusually long queues to vote, ballots being delivered to the wrong locations, and in some cases voters being turned away.
Many of these problems go away with digital voting - but then you have other issues.
Those problems can also be solved with a better organised electoral commission. Here in Australia we sometimes have long lines at polling stations, but I’ve never heard of any of those other issues occurring.
Yea and it’s not like they have this problem every time.
My state is also notoriously chaotic and this is the first time (in my memory) it happened.
Just wanted to point out that paper is not perfect either
Paper ballots definitely have security problems too, it's just harder to compromise an election with many polling locations if it uses paper.
E.g., a counter can put a bit of pencil lead under a fingernail and mark overvotes on ballots they don't like, thus causing them to be adjudicated or not counted.
This is in some contexts solved by having different ballots per choice. In Norway you go into a booth and select the ballot of your preferred party, fold it (they all look the same on the outside) and drop it in the box.
It's a shame the technical discussion behind our voting machines has been completely ruined by political discussion. The paper trail bill is an objective improvement over the current system and unfortunately (why?) it has been denied.
Surprisingly there has been little to no partisanship in _this_ HN post's commentary. That's quite refreshing. I suppose you're talking about discussion in Brazil. But you know, a few years ago this thread would have been extremely partisan here in the U.S.
Officially, it's because of total horseshit reasons.
They said it was unconstitutional because it would "compromise the secrecy of the vote". It most certainly wouldn't: the paper would be deposited on a sealed ballot box that obscures the voting order, and the voter wouldn't be given a copy.
They also said it was unconstitutional because it couldn't be implemented in a timely manner. I barely have words to express how dumb that is.
The discussion is all about politics because these "official" reasons are obviously stupid and don't fly. We're trying to infer the real reasons why they resist the auditable system.
2022 elections exposed the supreme court judges as unabashedly partidarian and more than willing to violate the constitution to favor the left wing candidate Lula. There's also the fact that Lula never won an election back when Brazil used paper ballots, but dominated the country for nearly 20 years after the introduction of the voting machines.
More than enough to start raising some serious doubts about these so called "authorities".
I've always wondered why we don't publish all ballots online, accessible via some anonymous key given to each voter when they vote. Then anyone could go online to see their own ballot and confirm it was tallied as they intended.
I'm sure this is overly naive, but what am I missing?
There’s a reason all ballots are destroyed after the contesting period ends. Someone in the future might find a way to compromise that anonymous key and there’s no reason to take that risk.
True. Nothing can be fully trusted. That’s true for everything, though, including paper voting. Clear schemes exist to cheat there and there’s computers involved in tallying the votes anyway. So what’s the reason to trust that stuff? The goal of e-voting is not to become absolutely secure, they need to be secure enough not to make the elections as a whole less secure when used in them. That’s a big difference.
There’s also the bear mechanism. In the forest, you don’t have to run faster than a bear, you need to run faster, than the person you are with. Let’s say there’s an issue with id-cards or electronic signatures in general. The attackers could wait several years and attack voting risking, that all electronic votes are annulled as their attacks are uncovered. Or they could just wreak complete havoc on the entire society right now. The electronic signatures are so ubiquitous here you can literally do anything. Sign a document as the President, take out loans on behalf of everyone, get everyone divorced (or married), take all their money etc. why would you wait?
There are a lot of folks who, whenever this topic comes up, seem to have no knowledge of the systems which already exist and have actually been used in real elections already. For instance, ElectionGuard has been used in several real elections in the US since 2020[1].
Living in Estonia, I have a hard time deciding how I feel about this voting system.
Currently, with people trusting the government, this system is great. I can just cast my vote online, like I do everything else here, and I can be reasonably sure that my vote is counted thanks to the aforementioned trust in the system.
But I really fear the day that trust erodes.
On the other hand, though, once the trust is gone, I think it doesn’t really matter whether it’s an analog or digital count. People won’t trust the system anyways.
Then again, there’s a lot of nuances and different levels of trust, which is the reason why I don’t know what the right answer is.
The advantage of paper ballots is that the possible ways that the system can be rigged are technologically limited. Either ballots are forged or ballot are miscounted. Both are mitigated by having election officials physically present who validate that voter registrations are valid and that counting is being done accurately, and having those officials be made up of representatives from each participating political party.
Then the defense-in-depth is that paper ballots are inherently decentralized. Even if you manage to pull off a complex operation to rig ballots at a local voting location, you'd have to do the same at hundreds or thousands of other locations to affect the results of the election.
Oh my sweet summer child. During the paper voting, only the act of casting the vote happens on paper, the rest (tallying, allocation, voter lists etc) is all electronic. Both in Estonia and elsewhere.
In Germany it's not, at least not fully. Ballots are hand counted and tallied at the voting stations, and then those results are phoned in, where i assume they are input into software.
It doesn't matter, if the counts were changed after being handed off to election authorities higher up, it would be caught by observers who have the real counts as soon as the incorrect numbers were published.
Not in Spain, we only use electronic means for preliminary aggregate results.
Each voting station gets a paper voter list. When one votes, their name is struck off this list and added to a new one by different people. Then ballots are tallied one by one in front of observers, and the tally and both lists have to match.
Finally, the preliminary count is sent, but the physical evidence is brought to a close court for custody so the electoral boards can aggregate the results during public sessions.
Not in the UK. I've been in one of the many rooms where they count the votes, it's all human powered. If one wanted to rig the counting, there are an awful lot of people to pay off.
In Ireland, tallying is done by hand and in public. You can go along and watch, if you have a high tolerance for tedium!
(As Ireland is a PR-STV country, this leads to _extremely long_ vote counts. I think the most recent European Parliament election didn't assign all the seats for about a week.)
To be fair, you can cheat by a couple of percentages at most then. Otherwise it will be pretty obvious that the global results don’t align with the local votes.
Hmmm, maybe I’m underselling this, you probably can cheat by a lot of percentage points still and get away with it. But at some point if the official results are like Putin’s while local results show everyone hates your guts, it might start tipping people off.
An Estonian here. E-voting is widely accepted and approved here. We've been doing it since 2001, and extensivelly (first parliamentary e-voting) since 2007.
The fact that it's open source is long known (at least in the IT community) and highly appreciated.
There's no inherent doubt about its validity in the local expert and international community.
There is plenty of doubt about the Estonian voting system [1]. It would be an extremely bad idea to use it in a country with more international influence.
That doubt usually turns out to be politically motivated rubbish. People publish nice blog posts and videos before their articles get published. People scolding there being an open wifi hotspot during vote counting. People being explicitly funded by the political parties not liking the electronic voting.
But the rest is very useful. During last elections, one of the opposition parties I’m not a fan of finally got their act together and put actual pressure on the electoral committee rather than ludicrous nonsense: procedural issues, hygiene etc. That’s great! Very much appreciated. When the op sais we don’t have doubts he probably means we don’t have doubts about there being sufficient process to keep this thing getting better
Lots of concerns in the discussion yet the fact is that e-voting is used for quite a long time in Estonia, and proved robust and secure. It will scale well. Check the source code.
I believe the Swiss also open sourced their e-voting software.
The lack of clear evidence for manipulation in Estonia is not a strong argument to introduce it in a more high-value target. Switzerland has been "trialing" e-voting for decades with very limited success.
The societal context is different. In Estonia, everyone uses the id-card for everything and has for 10+ years. Everyone understands, that handing your card and pin-codes over has severe consequences. Also, the e-voting does not function in isolation. If a person has voted electronically, whatever paper vote they cast will override their electronic vote.
Any computer hardware or software that there is a big enough incentive to compromise will be hacked.
We saw this with the Bitcoin wallets recently, with hidden 5g modems being added in a supply chain attack. The payoff in this case for the attackers was large enough to motivate them go to such extreme lengths.
Interfering with a democratic countries elections is a pretty big incentive for across like Russia. They also have the resources to do it.
15+ years of Estonian public sector IT experience, former chief architect of the country here. AMA.
This source code being open is great, but it’s not the wole story. E-voting is deliberately designed to fit into the context of voting in general and into the societal context. Your paper vote always overrides your electronic vote and there’s provisions in the law allowing cancellation of electronic voting and immediately falling back to paper. In the societal context, electronic identity and signatures are ubiquitous, voting is the least it’s used for.
Thus, the question is not if the system the code implements is secure but if the whole thing is. Of course, if you find a security issue in the code, get in touch and your contribution will be welcomed. But please do not claim e-voting to be inherently insecure without an understanding of how it works on the ground and what happens around it. Happy to explain.
86 comments
[ 3.8 ms ] story [ 49.3 ms ] thread> The intention behind this repository is to make source code of the Estonian online voting system available for public review.
> The repository is not used for active development, but will be kept up to date, so the code that can be found here is the code that is used for election.
The repository is not used for active development, but will be kept up to date, so the code that can be found here is the code that is used for election. As the voting system used for legally binding elections must strictly follow the legislation, the actual development of Estonian I-voting system and I-vote verification application is supervised by State Electoral Office of Estonia. Please refer to www.valimised.ee for further information.
In any system, I suspect it is possible. There are strategies that allow doing private set intersections (or similar): https://en.wikipedia.org/wiki/Private_set_intersection (i.e. a set with one member is "you", and you can check to see if you're in that 764, without knowing who the others are)
I'm not sure what strategies would also allow you to not reveal to the vote collectors where your vote went, but there might be something.
> Private set intersection is a secure multiparty computation cryptographic technique[1] that allows two parties holding sets to compare encrypted versions of these sets in order to compute the intersection. In this scenario, neither party reveals anything to the counterparty except for the elements in the intersection.
Revealing even elements in the intersection, if that means revealing individual votes, breaks ballot secrecy.
That being said I think the Estonian voting system does a decent job of being trustworthy. Publishing the source code is a big step to the better as well. As far as I knew the system was written in Java but seems like they have upgraded it in Go. Good job! Probably the best in the world.
Still, if you had the authorities to announce a product of large primes - whatever that means - how do you know they announced the correct primes and not something they made up? I'm afraid any clever cryptographic scheme you come up with falls the victim of the same dilemma: if you can check that your vote was counted right, you lose anonymity.
As far as I know, the Estonian voting system works in two stages. First there is an authenticator, that verifies that each given vote is signed properly, is only given once and can be counted, without looking at the payload. Then it anonymizes the votes and signs the result file which is transferred to another system which counts the votes. The communication is unidirectional so that the front-end doesn't get any feedback from the back end save some data transfer acks.
As I said, a decent job. It's not perfect in any meaning of the word. It's practical and it works.
My take is that one should be able to check that a blockchain has not been altered/substituted, and the way to do that is by being able to record encrypted running tally blockchain heads, but this gives you no indication that the published blockchain faithfully represents the cast votes so you have to add paper ballots and an immediate partial manual audit of the paper ballots checked against the digital cast vote record.
Note, obviously I was not attempting to detail a cryptographic voting system here. My only point was that I don't see what you said as being obviously true, if it is true at all. For the purposes of that point, even an incorrect scheme that sounds plausible would prove my point.
That said, to answer your question as I think through the details right now...
- Authorities preassign N-digit primes to everybody, one per option on the ballot.
- Find a way to validate the total number of ballots cast in the election. (Assume for simplicity that every question has exactly one answer selected.) Exercise for the reader on how to do this; this ought to be easy. This is important to know how many digits to expect in the product(s).
- You "vote" by submitting the primes corresponding to the option you select, one per question.
- Authorities announce the products of primes corresponding to each option.
- If your prime isn't included in the product, then it's obviously trivial to prove it... you just reveal your number and show the result fails divisibility.
- If they included extra fake primes, then this is harder to prove, but I think you can catch this by looking at how many digits are in the result. I think you can make the error margin arbitrarily sharp by making all the primes lead with 10000000000..., for example, adding however many zeros you need to make sure a single fake number adds a detectable number of digits to the product.
This is just a sketch; fix & fill in details as appropriate. The biggest flaw I see right now is that it's susceptible to whatever eventual algorithm (quantum or otherwise) ends up breaking factoring and leaking everyone's votes. But otherwise, it sounds plausible to me, and there's probably another trapdoor function that can mitigate that better. And as mentioned initially, if you can't easily prove it's impossible to make it work, that's sufficient for my point, even if it is in fact wrong.
Which has always been my biggest beef about digital vote. I'm all trusting the people writing voting software to do their best, actually. Being a Software engineer myself, I'm more concerned about bugs and hacks than deliberate tampering by the government. Especially in an age where AI agents can access pretty much anything ever connected to an electric plug...
You are aware of malicious hacking.
Hanlon's razor, etc...
This, and the need for everyday Joe to be able to understand what is done at every step.
I think such a system could still work, but just like the voter has to go to the booth alone to vote, they must go the booth alone to verify.
Us "computer folks" convincing ourselves is the easy part. Maybe after enough studying of the system, I'd be absolutely sure that my vote was counted, but what would the other 90 % of the population think? This not a "people are stupid" argument, a brain surgeon or nuclear physicist or philosopher isn't going to put in the effort to understand fully homomorphic cryptography, hardware-based security, etc. Why should they?
The alternative works perfectly fine and it's so easy to explain. It's obvious to anyone, no matter their level or field of education, how their vote makes it from their hand into the tally, what prevents it from being misused and what they can do to further reduce that already tiny probability.
You can see, feel and experience the technical measures keeping your vote safe. The people keeping their eyes on the ballot box alp day may literally be your neighbours, as are the people counting. You can reason about their motivations, you can theorise in your head about what lengths you'd have to go to in order to change even a few votes and how unlikely you would be to succeed.
The biggest danger to elections, ultimately, isn't the risk of cheating. It's the risk of losing the people's trust.
(I'm in the local election commission (that's layer 2 out of 4 in our particular election management hierarcy), we just had a big referendum, everyone keeps asking me about online elections so this rant was fresh on my mind)
It's funny too - 15 years ago on HN people would discuss blockchain voting systems or ways to make it 100% secure. It seems like lately a lot of people carrying water for the potential that one party is associated with 95% of the fraud - and don't wish to discuss the vote being fair.
However, how do you know you're one of the X votes displayed in the final tally ?
That still leaves tons of other technical problems to address, like security of mail-ballots / absentee ballots, the security of ballot boxes used for early voting (because you probably cannot run the above manual partial audit due to then having nightly results available to the public; or maybe you accept that), etc.
What is the goal? Having fancy crypto or people being confident about elections?
If spreading the trust is the goal what makes you say "inefficient". It is orders of magnitude better then any crypto system.
The costliest item is counting by hand, so... don't. Use ballot scanning and counting machines and then implement a timely partial manual audit to demonstrate that the BMDs and BSCDs functioned correctly.
Automating any of the process is (imho) harmful to above.
While I’m a proponent of the paper process let’s not pretend it immediately means you can be confident about the election
With some abstract math and computers? Any real or imaginary issues are incomprehensible to most of the voters and concerns can be easily shooed away.
It definitely didn’t help with trust even though I think German democracy is still mostly fine and something worth fighting for- but I guess that’s a different topic
Only a selected few orgs and groups are allowed to audit and in a very controlled environment because they also rely on security through obscurity. The source code is not available to the citizens.
If by any chance I'm wrong and someone can point me a source code repo, please enlighten me.
https://international.tse.jus.br/en/electronic-ballot-box/pr...
You just need to find the right balance.
In my country we still rely on a paper process - which is very hard to tamper with but also has a bunch of problems - recently we needed to repeat local state elections because of such problems including shortages of ballot papers, unusually long queues to vote, ballots being delivered to the wrong locations, and in some cases voters being turned away. Many of these problems go away with digital voting - but then you have other issues.
I don’t think a perfect solution can exist
E.g., a counter can put a bit of pencil lead under a fingernail and mark overvotes on ballots they don't like, thus causing them to be adjudicated or not counted.
Officially, it's because of total horseshit reasons.
They said it was unconstitutional because it would "compromise the secrecy of the vote". It most certainly wouldn't: the paper would be deposited on a sealed ballot box that obscures the voting order, and the voter wouldn't be given a copy.
They also said it was unconstitutional because it couldn't be implemented in a timely manner. I barely have words to express how dumb that is.
The discussion is all about politics because these "official" reasons are obviously stupid and don't fly. We're trying to infer the real reasons why they resist the auditable system.
2022 elections exposed the supreme court judges as unabashedly partidarian and more than willing to violate the constitution to favor the left wing candidate Lula. There's also the fact that Lula never won an election back when Brazil used paper ballots, but dominated the country for nearly 20 years after the introduction of the voting machines.
More than enough to start raising some serious doubts about these so called "authorities".
I'm sure this is overly naive, but what am I missing?
There’s also the bear mechanism. In the forest, you don’t have to run faster than a bear, you need to run faster, than the person you are with. Let’s say there’s an issue with id-cards or electronic signatures in general. The attackers could wait several years and attack voting risking, that all electronic votes are annulled as their attacks are uncovered. Or they could just wreak complete havoc on the entire society right now. The electronic signatures are so ubiquitous here you can literally do anything. Sign a document as the President, take out loans on behalf of everyone, get everyone divorced (or married), take all their money etc. why would you wait?
[1]: https://electionguard.vote/
Currently, with people trusting the government, this system is great. I can just cast my vote online, like I do everything else here, and I can be reasonably sure that my vote is counted thanks to the aforementioned trust in the system.
But I really fear the day that trust erodes.
On the other hand, though, once the trust is gone, I think it doesn’t really matter whether it’s an analog or digital count. People won’t trust the system anyways.
Then again, there’s a lot of nuances and different levels of trust, which is the reason why I don’t know what the right answer is.
Then the defense-in-depth is that paper ballots are inherently decentralized. Even if you manage to pull off a complex operation to rig ballots at a local voting location, you'd have to do the same at hundreds or thousands of other locations to affect the results of the election.
https://media.ccc.de/v/34c3-9247-der_pc-wahl-hack
Granted, that's the benefit of paper votes: You can always count them again.
Each voting station gets a paper voter list. When one votes, their name is struck off this list and added to a new one by different people. Then ballots are tallied one by one in front of observers, and the tally and both lists have to match.
Finally, the preliminary count is sent, but the physical evidence is brought to a close court for custody so the electoral boards can aggregate the results during public sessions.
(As Ireland is a PR-STV country, this leads to _extremely long_ vote counts. I think the most recent European Parliament election didn't assign all the seats for about a week.)
Hmmm, maybe I’m underselling this, you probably can cheat by a lot of percentage points still and get away with it. But at some point if the official results are like Putin’s while local results show everyone hates your guts, it might start tipping people off.
[1] https://en.wikipedia.org/wiki/Electronic_voting_in_Estonia
But the rest is very useful. During last elections, one of the opposition parties I’m not a fan of finally got their act together and put actual pressure on the electoral committee rather than ludicrous nonsense: procedural issues, hygiene etc. That’s great! Very much appreciated. When the op sais we don’t have doubts he probably means we don’t have doubts about there being sufficient process to keep this thing getting better
oH tHeY mUsT hAvE mAdE sOmE lAsT miNuTe bUgFiXeS.
Everyone with half a brain should know that this is completely compromised. Nobody wanting to run fair elections would support electronic voting.
I believe the Swiss also open sourced their e-voting software.
We saw this with the Bitcoin wallets recently, with hidden 5g modems being added in a supply chain attack. The payoff in this case for the attackers was large enough to motivate them go to such extreme lengths.
Interfering with a democratic countries elections is a pretty big incentive for across like Russia. They also have the resources to do it.
It works great for the military and for the clergy where it is even worse. I don't know why we don't something like for the rulers.
This source code being open is great, but it’s not the wole story. E-voting is deliberately designed to fit into the context of voting in general and into the societal context. Your paper vote always overrides your electronic vote and there’s provisions in the law allowing cancellation of electronic voting and immediately falling back to paper. In the societal context, electronic identity and signatures are ubiquitous, voting is the least it’s used for.
Thus, the question is not if the system the code implements is secure but if the whole thing is. Of course, if you find a security issue in the code, get in touch and your contribution will be welcomed. But please do not claim e-voting to be inherently insecure without an understanding of how it works on the ground and what happens around it. Happy to explain.