Hacker News Reader

Comment by chrisco255 | Hacker News Reader

I think it's nuts for a modern democracy to allow for anything but open source software being used to count paper ballots with chain-of-custody records, voter ID validation, biometric markings, and redacted ballots being published on the web for all to view and count independently.

Software systems can easily be hacked, and it isn't easy to inspect and tell. A vote is a one time, one sided transaction. It's not as easy to detect fraud in an election as it is with say, a double entry banking record.

View on HN

Open source doesn't really help here, because even if I can see the source I don't have a way to verify what was running. It's more important to just not rely on software for the critical path, and make sure there's an auditable paper trail.

Verifying what software is actually running is orthogonal to having that software be open for the public to inspect. You can have closed source software and still have a problem verifying what is running.

What he means is that it doesn’t matter what source code is published and open it only matters what is compiled and deployed to the machine last.

What if you used the combination of FOSS and a blockchain ledger?

Say more about how a blockchain ledger could allow verifying what software is running on a device?

The only way I can think of to actually do this is to have some trusted party go out and randomly sample voting machines (i.e. check the software on the disk matches the reproducible builds of the open source software, and decap the machine's CPU and other hardware to verify there's no bugs).

Anything else can be foiled by malicious software or hardware.

If there was a whole new voting system built from scratch, couldn't it be designed to use some sort of integrity key in combination with each voter's personal key? Kind of like how some CDNs have an integrity attribute to ensure the CDN's source code hasn't been manipulated.

One of the tricky things with voting is that a provably trustworthy system that voters don't understand is worse than an imperfect system that is totally transparent. Voting is only useful to the extent there's trust in the system.

I don't think that ends up working for voting machines because those are two different problems.

With the CDN, the user receives source code and they want to verify the source code is unchanged. Checking a hash of the data they received is sufficient.

For a voting machine, what's the analogue? If I walk up to a voting machine with an integrity key, how do I check that the source code it's running has a given hash or is signed with a given key?

If the voting machine itself shows the code or does the check, obviously a person who compromised the machine can fake that bit. If I have to remove the hdd and verify the data on it, and take apart the voting machine to verify there's no second hard drive... well, that seems like it's well out of reach of any voter verifying it.

Integrity keys, hashes, signatures, blockchains, etc can verify digital data, can verify the contents of data that servers serve... But they don't seem to solve the problem of "what code is this machine running", and that seems to be the important problem for voting machine code.

Tom Scott made an excellent summary of why electronic voting is a bad idea, and explicitly covers both open source and blockchain as proposed solutions (hint: they don't solve the problems that make e-voting bad)

https://www.youtube.com/watch?v=LkH2r-sNjQs

It seems to me a fundamental problem of it all being electronic is any records if the system is hacked can be downloaded by the million fairly easy. On the other hand if the records of which voter number voted which way are printed on bits of paper and put in a big locked box it's pretty hard to reconstruct that on the fly unnoticed. But they are there if there is a court ordered investigation.

The UK system I think is a bit like that. When I go in my name is checked against a voting slip number (on paper) and then I vote on a bit of paper so someone could theoretically figure which way I voted but the odds of someone going through both paper lists is minimal.

It's terrible to see some of the disinformation that is out there regarding open source software. Time and time again open source is shown to be the way to go, and you still hear lies about how it's not safe.

I can already hear the politicians going on about how "being open source" lets "anyone put their own back door in! BE AFRAID!"

Open source is good but there would need to also be some way to confirm that the last deployed binary was actually that source code, which with physical access to the machine you could always change. I don’t think computers should be used for this at all.

I think it would be acceptable to use digital scanners (themselves running open source code on open source hardware) to count physical ballots, with the caveat that the redacted ballots (personal info removed) are published the day after the election for anyone to count.

They are not lies. Open source is not safer than closed source, unless you can verify with 100% certainty that the code you saw is the code that's running.

And that's impossible.

People who think open source is the solution to the voting challenge haven't given this problem much thought.

That's like saying a car is only safer if you can be 100% certain it won't crash.

I think the main difference is that software being open source (and maintained by a larger community!) provides wider accountability and visibility to code changes, thus reducing potential security flaws.

You claim that open source is NOT safer than closed source, what is your reasoning there? Security through obscurity?

Yes, it’s either that or just use paper ballots, hand counted.

When I learned that the US actually uses software in its elections, I was shocked. It’s unthinkable here in the UK.

They have paper trails for every vote.

I believe you are both mistaken.

From what I've read, there are some states/localities that have paper ballots they can check, including swing states like Georgia, where they did audit that exact thing.

But then there are other states that do not keep the paper trail, most of which went "red" according to an article I read but did not verify.

A few states are using direct recording systems, without a paper trail:

https://ballotpedia.org/Voting_methods_and_equipment_by_stat...

"Currently only one state — Louisiana — keeps no paper trail of votes at all. Counties in eight states — Indiana, Kansas, Kentucky, Mississippi, New Jersey, Oklahoma, Tennessee and Texas — use a hybrid system" where some, but not all votes will have a paper trail.

(from https://madison.com/on-paper-ballots-for-the-2020-election/a...)

Correct, this is all in the dominion voting machine documentation. In some implementations if a ballot goes to adjudication based on some configured error threshold it means the machine operation gets a chance to look and decide what the ballot actually says, at which point it generates a new “corrected” ballot image and discards the “unreadable” one.

I'm not sure if you're under the impression that everywhere uses Dominion machines. I don't think that's the case. As I mentioned in another comment, it appears that in NY they're made by ES&S.

The problem with Georgia and Dominion Voting Systems in particular is that the ballots are digitally printed and can be printed on the fly. They are subject to manipulation by a single compromised person in a voting precinct through the system's "adjudication" process. In some precincts, DVS machines were failing at a rate of 70%, leading all ballots to be sent to the precinct overseer who literally just clicks and drags ballots into whatever candidate they think the person voted for. Doing this actually changes the record. Yes, the original ballot record gets destroyed and a new one gets created. It's that insecure. These machines also require USB transfers between ballot machines and a central machine. In some cases thousands of votes were found a a USB thumb drive weeks after the election. DVS is that convoluted and that bad.

Not in every jurisdiction, no.

Handcounting every single vote? That seems much more error prone than anything the U.S. uses. Ballot-marking devices used in many states[1] produce paper ballots that voter can validate and have some guarantee that it can be scanned in tabulation. I trust audited software to tabulate my vote much more than an overworked ballot counter.

[1]: https://ballotpedia.org/Voting_methods_and_equipment_by_stat...

> It’s unthinkable here in the UK.

Not just in the UK. Most Western democracies consider the idea completely crazy because nothing can be properly audited once papers are removed.

They need only do [risk-limiting audits](https://en.wikipedia.org/wiki/Risk-limiting_audit) (which some states did do!) to verify the results.

Whose risk are they trying to limit by not doing a full audit?

This. > I think it's nuts for a modern democracy to allow for anything but open source software being used to count paper ballots.. I cannot agree more.

There is little if any actual evidence of voter fraud, but plenty of evidence that making voting harder (via voter ID validation, biometric markings, etc) simply disenfranchises voters.

It's easy to say that software can just be hacked, but just because its a possibility doesn't give you the right to invalidate an election.

This is a cop-out. Other countries seem to be able to have voter identification, the US should be capable of it, too. Start by making the identity card free-as-in-beer, bonus points for not requiring a permanent address.

"Start by making the identity card free-as-in-beer..."

The people putting forward voter ID laws usually do the opposite. They want to make obtaining an ID more difficult and make that ID a requirement to vote. If we just say "getting and ID should be easy" but don't actually make it easy, and then we increase voter ID requirements, we are disenfranchising voters.

Yeah but those people existing doesn’t change the actual merits of the idea itself.

If the end result is that someone who could vote in the last election cannot vote in the next election, we need a better idea.

That's a good heuristic. I would only counterbalance it with the possibility of enabling people to vote who could not in the last election (thinking again of people with no fixed address).

Which idea?

Requiring id and then making it hard to get doesn't have a lot of merit if there aren't a bunch of people exploiting the lack of id checks.

Who doesn't have an ID in 2020? You can't fly without one. You can't drive without one. You can't go to a bar without one. You can't book a hotel in most cases without one. It just seems like people are arguing that edge cases exist and therefore we cant require ID. There is no conspiracy against people getting an ID in 2020. Everybody very much wants you to have one.

None of that is an argument for requiring an id to vote though, it's just things you think it would be ridiculous to go without.

If someone has registered and voted in the past and has an expired id, should they be excluded from voting if they don't renew in time? Even though registration is already a sufficient barrier to fraud?

Doing it right is the best way to foil the ones trying to do it wrong.

I don't present ID in the UK when I vote. I show my polling card (which they send me in the mail as a registered voter), state my name and address and receive my ballot.

Reply on news.ycombinator.com