Hacker News Reader

Comment by henrikschroder | Hacker News Reader

> Since 2018, as part of a program called Defending Democracy, Benaloh has been working on voting software that attempts to solve the problem of trust in secret-ballot elections.

No. Stop. Listen, it's possible to write secure voting software that a domain-expert software engineer understands, and a general software engineer can understand. That's not the problem.

But for voting, that is not enough. The entire voting system has to be easily understandable by everyone in society, in order for society to trust the system.

Where I'm from, all voting is done with papers and envelopes and urns and seals, and with people having eyes on the process at all times. And the most important thing to realize is that this process is infinitely parallellizable, so getting election-night preliminary results isn't hard, even though every single vote is manually counted. You just need enough people to count the votes.

View on HN

This, plus the inherent blessing and curse of computers -- if you can do something one time, it's usually very easy to do it 1000 times. If you want to tamper with one precinct or one county, you have to write some exploit. If you want to tamper with all of them, still, one exploit.

However, if you want to tamper with a whole state of paper ballots, you have to stuff a thousand ballot boxes. The chances of getting caught are far higher.

I'm under the impression that computerized voting systems are in no way standardized nation-wide (USA, at least). But your point still stands that it seems easier to hack a computerized voting system to commit large-scale fraud than to fraud with paper ballots.

Yes this is true: federalism being applied to control of elections is probably good for election security. But there’s only a small handful of vendors and if an attacker was able to crack one of them they might be able scale the attack to many deployments of that vendor’s systems.

Not in a two party system. You really still only need to hack just one model of voting machines to steal the election, since the margins are so small.

The same goes for the paper ballots. You don't need to fix the vote everywhere.

Which incredibly difficult to do on scale, unless you rig the whole system. In which case voting is just a fig leave anyway.

With paper ballots you must make sure that most people at the voting stations are part of the conspiracy, which is tricky because all major parties will have representatives on each station. It’s possible you will get away with it in a few small places, but even that is hard.

It's the same reason why voting via mail is very hard to exploit. Voting functions as a secure handshake (register to vote via mail, government sends confirmation, government sends ballot, you send ballot back, government sends confirmation of vote) and requires you to sign it with some identifying information like a signature.

There might be some individuals trying to cheat the system at the family level, but trying to cheat it at a larger scale requires you to do so at a point of collection. It also becomes very easy to find this sort of tampering by sending voters a way of confirming who they voted for.

One of the most egregious incidents of proven voting fraud in recent American history may have been by Leslie McCrae, a hired political operative: https://www.npr.org/2019/07/30/746800630/north-carolina-gop-... He exploited the absentee (mail-in) ballot system.

OTOH, he was caught precisely because to exploit the system he had to directly or indirectly expose himself to many people in the county--the people whose absentee ballots he was fraudulently collecting. Eventually someone put 2+2 together and the scheme was discovered.

OTOOH, apparently he had been doing it for many years before he got caught.

More info at https://en.wikipedia.org/wiki/McCrae_Dowless

A more traditional voting system would have the same problem. He'd instead just put himself at a polling location and do the same trick there.

The fact that he had to pay people to collect individual absentee ballots means this sorta fraud is very hard to scale, easy to beat with some basic education and easily identifiable. Of course a lot of this goes out the window if you're doing it to help a party and that party has zero integrity but at least if one voting individual brings up an issue it can cause a ripple effect.

Part of the problem is also that we don't seem to take absentee ballots as serious as we do when we have full vote by mail.

I'm a pretty technical guy. Given enough time I'm confident that regardless of what technology stack/language you wrote the voting system in I could have reasonable confidence it was error-free enough and probably not deliberately backdoored.

Do I have that kind of time? No.

Am I going to give more than a cursory glance at open source voting software? No.

Am I going to catch 100% of accidental bugs? No way!

Even if I do, am I going to catch 100% of deliberate and obfuscated bugs? Hell no.

Even for me, a very technical person, purely electronic voting is fatally flawed in terms of trust.

Or even side channel stuff not related to the voting code itself, or bugs in whatever ui people look at aggregated results in.

You don't know that the ballot box wasn't switched in transit, nor presumably that the postman in your area didn't switch all the voting papers.

Any system that's anonymised seems to require trust.

That's why you count locally and centrally. And you keep paper records for the counts at each level. And the ballot boxes.

With observers from all parties being allowed to witness the counting.

Again, paper ballots and mail ballots are solved problem in almost every western democracy. Multitudes of solutions out there. Just pick one.

Not having anonymous votes is the first step into totalitarianism, if you ask me.

Don't you need a large group prepared to enact revenge on people for voting "wrongly" for non-anonymous voting, in general, to be a problem? That seems like it's not a problem until you've got a large group of fascists/totalitarians already?

It doesn't matter, because a single postman or a single ballot box being tampered with isn't enough (in virtually all cases) to swing any major elections.

Any coordination to defraud paper ballots on a scale large enough to change the result of a major election would require so many individuals that it would be implausible for them to all keep a secret.

Massive election-changing widespread fraud of an electronic system could in theory be completed by a single individual acting entirely alone.

How does that work in the middle of a pandemic, where people shouldn't gather at a location like that?

How does it handle people who can't leave their home? Or people who are away on the voting day?

Carefully. Singapore just went through a general election, ~2.5M votes cast at 1,100 polling stations. Citizens were assigned a polling station and a 2-hour window to go vote. Masks required, distancing enforced, sanitizer and disposable gloves provided.

(Not a citizen so I can't comment on how it actually all went down)

https://en.wikipedia.org/wiki/2020_Singaporean_general_elect...

https://www.channelnewsasia.com/news/singapore/ge2020-singap...

> Where I'm from, all voting is done with papers and envelopes and urns and seals, and with people having eyes on the process at all times.

And it doesn't always work. I assume you're German, so I'm inclined to remind you of Bremen's election 2015 where a group of students change votes to advance one party. When you have a very politicized election, you're going to need more than trust in procedures.

I don't know that some software will help there, but "we're doing it on paper" doesn't solve the problem.

Ah, one case out of how many elections? It would also be nice to explain what happened and how. The AfD insisted, together with more right leaning media, on a recount. The happened and gave, initially, one additional seat. The SPD, who lost one seat, challenged that. It went to court, all 33k vote were recounted, roughly 500 corrections were necessary. 13 votes were lost. The AfD lost one seat (they failed to gain more than 5% of the vote). The election was deemed legit, not reelection was necessary.

So yeah, we are doing it on paper pretty much solved that problem.

> Ah, one case out of how many elections?

One prominent case that was _not_ caught by election officials and analytical measures. We have no way to tell how many others didn't get caught because nobody challenged them and our general systems failed.

I'm not arguing that it's a catastrophic failure of the election system. The point is that paper ballots aren't protecting you from manipulation. Had they not challenged the election, the fraud would've gone unnoticed.

And, importantly, it doesn't require coordination, there's no huge conspiracy required for this kind of fraud (and this specific instance also wasn't discovered because one of the perpetrators "spilled the beans"), so "large conspiracies are impossible to pull of" doesn't really apply.

A quick Google search showed alleged voter fraud, always claimed by our right wing AfD. And every time these allegations were investigated, it turned out everything was in order. Last case 2019, Thüringen and Sachsen.

So how many cases are there, in your opinion?

EDIT: You do know, that there was no voter fraud involved? After an investigation and court rulings one year after the election?

Right, at that point we're getting into semantics. If the votes aren't counted correctly, and a group of people are doing it somewhat systematically, I consider that fraud. Given that they were students (and the overall result did not change dramatically), judges were lenient and basically said "mistakes happen, no hard feelings".

I have little doubt that it would have been quite different, had the situation been reversed, but I don't care enough to argue about it with you.

Man, courts mandated a full recount. The only mistake they found was 13 missing votes. Which the court deemed to be within expected margins (don't ask me, I have zero experience with that). The result was a lost seat for the AfD, and an election deemed legitimate. So no fraud whatsoever.

And no, I have zero doubt the judges would have enforced a result that gave the AfD a seat at the expense of another party, if that was what the recounted result said. Only that it didn't.

This was a legal question, one that was answered. What you or I deem fraud or not became irrelevant at that point.

Imagine you have a single majority party that controls all the branches of the government. For them paper voting is a solved problem:

- restrict the rights of observers - on every polling station where there are no observers, stuff the ballot boxes or just write the "right" tallies - on polling stations with observers get rid of them using the police or just use at-home voting with mobile ballot boxes to commit fraud - if any single instance of fraud is uncovered and goes to court, use every nitpick possible to dismiss the case - finally, a single polling station results overturned do not change the result of the election

The problem is solved all right. Of course, letting them implement e-voting doesn't solve anything. But if the Evil Party is ousted from power by the Good Party via, I don't know, a revolution, there's nothing in the system preventing the Good Party from using the same well-tested vote manipulation processes to start winning every election.

But if the Good Party for some reason is forced to implement an end-to-end auditable e-voting system they will have a much harder time manipulating the results.

No one gets that day off, and voting closes before the line outside is gone.

It is disturbing how much voter disenfranchisement is allowed in this system.

Every workplace I've been at allowed you to leave briefly to go cast a vote.

Sounds like you worked for some really disenfranchising companies.

"briefly" and hours long waits for voting don't really mesh up...

https://www.brennancenter.org/sites/default/files/analysis/L...

https://www.theguardian.com/us-news/2020/jun/11/atlanta-geor...

Ask the cleaning staff, security, or any blue collar workers at your company if they are allowed to leave to vote. You might not be the target for disenfranchisement.

A majority of people don't have the luxury of choosing their employer.

Lincoln abolished slavery years ago.

Personally I make it a habit to vote first thing in the morning, before going to work. Lines are negligible, and I've never had an employer complain about me showing up a few minutes late wearing an "I voted" sticker. But YMMV.

YMMV is a huge caveat. Not everyone has this privilege.

We've lost the fair part of free and fair elections and you blow it off with YMMV.

Miss me with that entitled bullshit

Are you able to vote early or via mail? Wouldn't one of those count your vote? I vote early in almost all elections, and that takes care of this issue for me.

> Texas, for instance, is one of the four states that hasn't expanded access to mail ballots in response to the pandemic, and Republicans there are engaged in high-profile court battles to keep it that way.

> Texas Attorney General Ken Paxton has said in statements that "fear of contracting COVID-19 does not amount to a sickness or physical condition as required by state law." He also said that his office would prosecute people for voter fraud if they use a mail-in ballot in a matter he said is improper.

https://www.npr.org/2020/06/04/864899178/why-is-voting-by-ma...

I appreciate your Google skills.

Your link points to an expanded reference of the 46 states who have expanded access to mail in ballots!

Regarding, your second point, take a look at the Texas Secretary of State's page on Absentee Ballots. https://www.sos.texas.gov/elections/voter/reqabbm.shtml. The AG that was quoted is absolutely correct, according to the listed reasons.

The AG doesn't make law. The Texas legislature makes law. So, what was your point in quoting that scare article?

Instead of repeatedly posting links to scare articles, do you have a link to an actual person who has (not expects to) already experienced voter suppression?

That's why people can vote early or can even request a mail-in ballot.

It's disturbing how people talk about voting as if there is disenfranchisement, without knowing the various times and ways they can vote.

I can't respond to this without being mean, so I'd recommend just googling "us voter disenfranchisement".

https://www.aclu.org/facts-about-voter-suppression

https://www.aclu.org/news/civil-liberties/block-the-vote-vot...

https://www.brennancenter.org/our-work/research-reports/new-...

https://prospect.org/politics/the-many-varieties-of-voter-su...

https://www.npr.org/2018/10/23/659784277/republican-voter-su...

https://www.americanprogress.org/issues/democracy/reports/20...

Honest question: What is an actual example of a disenfranchised voter, not articles that say "there will be disenfranchised voters"?

Just to be clear, is it your position that voter disenfranchisement does not happen in the United States?

You replied to a question I wrote, not a statement. I'd like to know under what conditions an actual real person has suddenly become disenfranchised and was unable to vote early, on regular poll days, or via mail.

> And nearly 56,000 of them re-registered within the same county, according to the AJC/APM Reports analysis. If their registrations hadn’t been canceled, they would have been able to vote without having to re-register.

> More than half, almost 30,000 Georgia voters, re-registered too late to participate in the close 2018 election for Georgia governor. It’s impossible to know how many of them attempted to vote, but those who tried wouldn’t have had their ballots counted.

https://www.ajc.com/news/state--regional-govt--politics/many...

> Long lines and malfunctioning voting machines marred statewide primary elections in Georgia, renewing attention on voting rights there.

https://www.nytimes.com/2020/06/09/us/politics/atlanta-votin...

> Hourslong waits, problems with new voting machines and a lack of available ballots plagued voters in majority minority counties in Georgia on Tuesday — conditions the secretary of state called "unacceptable" and vowed to investigate.

https://www.nbcnews.com/politics/2020-election/georgia-secre...

> In the 2014 midterms, only 33 percent of eligible voters cast a ballot—setting the record for the lowest turnout in any national election of any advanced democracy (except Andorra) since 1945.

> In 25 states, employers are not required to give their employees paid leave to vote; in 19 states, employers are not required to let their employees leave work to vote.

https://www.countable.us/articles/12558-americans-get-day-vo...

Do you comment or just Google? This is the last one of your Google sessions I will reply to. If you actually have a comment, I would be happy to discuss.

And 0 of those had voted in several prior elections, which is why the law was followed to remove them from the registered rolls.

It doesn't sound like they are active participants. They didn't vote for some time, then they said they registered too late to vote. It's best not to use them as people who are being denied a vote. It is their choices not to have voted for a long time.

> Long lines and malfunctioning voting machines marred statewide primary elections in Georgia, renewing attention on voting rights there.

These voting machines are almost 100% a laughingstock. The very article said that! They have to do with the rush that happened a few years ago to institute voting machines - not with voter suppression but the exact opposite.

From the same article you quoted: "Georgia’s secretary of state, Brad Raffensperger, blamed local officials in Fulton County, which includes most of the City of Atlanta, and said there were few issues elsewhere, while by midafternoon counties outside Atlanta had begun extending voting hours to account for time lost tending to the new machines."

If everyone else could do what needed to be done, outside of Atlanta, then Atlanta should be investigated - not invisible suppression from the rest of the state onto Atlanta.

If people don't know these ways they're worthless.

I find it hard to believe that a democracy is unable to create a law that gives their voters a day off for voting every four years. Realistically speaking, even half a day off would suffice.

That, or vote on Sundays.

is there some reason you can't get a random id associated w/ your ballot?

then just list all results (by that id) on a website somewhere.

you hang onto your id stub, and can tell if your vote was mistallied or left out.

this can work w/ a digital or traditional analog system.

(maybe need some more work to figure out how to ensure there aren't just extra "ghost" votes padding the results.)

That allows vote buying/coercion.

You show me your receipt, I verify that you voted the way I wanted, and you get money. Or, if the receipt shows you didn't vote like I told you to, I punch you in the face.

No more so than vote by mail which we already have though (and is all Oregon does), right?

Which is why vote by mail is so controversial; it eliminates the secret ballot.

This would really hurt Trump, since he seems to have an unusually high percentage of “shy” voters.

Mail voting is totally normal in Germany. And secret. Just because one country didn't solve it, doesn't mean it is an unsolved problem.

It’s secret but not private. I really don’t care if my name is attached to my vote in a way that the gov’t potentially knows how I vote but it seems a lot of people do.

Historically, there are a lot of cases were this turned out to be a huge problem. A lot of the German system, voting and otherwise, is influenced by the Nazi regime and it rise to power.

That's why we have things like the 5% margin for parties to get seats in parliament. During the Weimar republic, one of the reasons why it was close to impossible to form stable coalitions was the high number of parties with seats. And the list goes on.

That sounds impossible. How do you prevent a dominant member of your household from checking what party you choose before the envelope is sealed?

True. But where I'm from you can vote by mail and in person, and if you do, your in-person vote cancels your mail-in vote. This means that even if someone coerces my mail vote, I can still override it on election day by showing up in person and vote in secret.

...and if whomever is coercing you to vote a certain way can also prohibit you from voting in person, you have bigger problems that border on kidnapping and illegal captivity.

> ...and if whomever is coercing you to vote a certain way can also prohibit you from voting in person, you have bigger problems that border on kidnapping and illegal captivity.

Nonsense. You have whatever problems made your vote susceptible to coercion in the first place, no more and no less. It's not necessary for the other party to physically prevent you from voting in person. All they need to do is observe whether you do, and punish you accordingly.

> All they need to do is observe whether you do, and punish you accordingly.

Yes, but this doesn't scale, and again, it's bordering on illegal captivity. One person can maybe prohibit a couple of others into not going to vote in person, by living with them.

Whereas if you have paper receipts that show what you voted for, one person can easily validate thousands of those, and punch everyone in the face who voted "wrong".

It does scale of course. The one example you mention is couples. Perhaps men prefer one candidate over women and pressure their wives to vote a certain way. How is that not scaling?

Another example is unions. Perhaps the union and many colleagues prefer one candidate - if you sneak off to the voting booth you risk ostracization.

Is it possible to get verification and not have coercion?

I was thinking that the verification would show you a list (with per vote random letters)

Jones : D

Vivek : J

McAlan : C

LaRousse : Q

and you'd remember the letter next to your candidate. You could just lie to a coercer, "I voted Q" and actually have voted D, say.

Not sure how you get from there to a confirmed vote though. It seems to require someone at some point to hold a key that can de-anonymise one's vote.

That said de-anonymising votes in UK elections seems pretty easy, ballot papers have codes on; name and address is checked prior to vote.

Check out https://en.wikipedia.org/wiki/ThreeBallot

It has some criticism, but IMO this is a very simple and effective method. And there are better ideas out there too.

I think we can even build a mechanical machine (like out of buttons connected to stamps/ink) that can create valid threeballots. That way you don't have to explain the instructions.

You can still do that via mail voting.

There are cryptographic schemes where you can verify that a vote was counted but not how it was actually cast. Physical ballots going through an optical scan machine sometimes have an id stub that gets detached before they go into the counting pile -- imagine that it wasn't possible to add a stub to the "counted" list without also adding a ballot.

> The entire voting system has to be easily understandable by everyone in society, in order for society to trust the system.

Can you tell me how current voting systems work, because it is a black box to me and I can't even verify that my vote counted for the person I picked. From what I can tell, the local election officials can tally the votes however they want.

GP's critique is not a defense of the status quo. Please do not construe it as such.

See https://freeandfair.us/# for voting technology that still wisely involves much paper.

So where is the explanation of how it works, because I could go to a Bitcoin website and learn more about how it works quickly than on that site.

I'm not an US citizen, I've never voted in the US, I have no idea how your shit works or not.

But I know how my country's system works, and it's super fucking easy. On election day, I got to my voting place for my voting district. Each district contains a couple of thousand voters. For each election I'm participating in - national, regional, local - I place one piece of paper with the name of the party I'm voting for in an envelope, secretly.

I then go to the election officials, identify myself, and they look me up in their voter roll, which is simply a printout of the couple of thousand voters who should be voting in this place. We all check that I'm in there, and that I'm not already marked as having voted. Then they strikethrough my name in the roll, and put my envelopes in the corresponding urn. I am now certain that my secret vote went into the right urn, and everyone else can be certain that I've only voted once.

Once the voting ends in the evening, election officials in each voting place opens their urns, and opens each envelope, removing the vote inside. Then they simply sort and count the individual pieces of paper that are the votes. You count the total number of votes, you count the total number of voters crossed out in the voter roll, and make sure it all matches up. And this gives you a preliminary vote count for each political party in each district, so you only need to report a couple of numbers to the election authority.

Anyone can watch this process! I can go and watch it. You can come and watch! And it's so simple to count pieces of paper that anyone can do it. And with observers from the various political parties, you can't cheat.

After the preliminary counting, you take all the votes and your voter roll and put it in a sealed box and send it to the regional voting authority where they do a final control count, and archive the votes for history.

As for me and my vote, I can check my district on the website of the election authority: https://data.val.se/val/val2018/slutresultat/R/valdistrikt/0...

I am one of the 1160 voters out of the 1363 eligible, I can see that the party I voted for got at least one vote, so I can be fairly certain that my vote was counted, while what I voted for is still a secret.

Compromising this system is incredibly hard, because it is parallellized and distributed. And the paper trail will always be there. Somewhere in a vault, there are 6,535,271 pieces of paper representing the 2018 vote for the national parliament. You can't accidentally erase that or lose that.

Fair, I know that US elections are more complicated because there's so many elected positions to make a choice for.

I'm all for technology to help create ballots. You can have a touch-screen system that walks a voter through all the choices and prints a correct ballot, as long as the voter then manually takes this piece of paper, verifies that it says what he thinks it should say, puts it in an envelope, and observers watch him place the envelope in an urn.

I'm all for OCR systems that can rapidly scan and count a large number of ballots, your voter ballot creator machine can put OCR codes that make it easier to count as well, I don't care. As long as there's no identifying info on the ballot, it is human readable, and as long as the preliminary vote count is done manually. Later on you can send all your ballots to a central counting facility and OCR the crap out of it for every single elected position, that's fine.

> as long as the voter then manually takes this piece of paper, verifies that it says what he thinks it should say,

You can make a system that allows the voter to do that but how many actually will?

The majority of them which happens to also be “enough of them to catch any widespread attempted fraud by printing ballots different than what the user picked”.

Force a time delay that’s long enough for a typical user to validate their picks before proceeding and you might bump the figure some.

A majority would be easily enough, but I'm not that optimistic.

That, and have an UNOFFICIAL digital count as well, the one that's done quickly for the news and everyone making planning, with the official, double-counting verified recount reaching the same numbers as the electronic and previous hand count (within a very small % for human error).

If there's a disagreement the human counts are repeated until within 0.001% and then they're official.

Except we are lazy and will come to rely on the digital system, then we will never care to recount unless there's a lot of pressure, and even then it might take so long that we will probably not wait. Already a US presidential election was decided on the wrong count, when the proper count came out it was too late.

do randomly-selected sampling of paper buckets.

e.g. you transmit your digital results, on a per-machine level, at t+1 minute to the central precinct. at t+5 minutes the central precinct sends back a random request to have X% of the machines audited by hand. If there is a significant abnormality, we move to a larger recount and withhold electronic results. If things match up, we announce the full electronic results around t+1 hour.

Works for me?

>Already a US presidential election was decided on the wrong count, when the proper count came out it was too late.

The majority of media "recounts" after the fact showed that Bush did win Florida in 2000.

Reply on news.ycombinator.com