New Jersey To Allow Voting By Email
state.nj.us
state.nj.us
Of course, some people complained because a system that allow someone to vote twice doesn't work. The biggest problem though was that they were able to fix it by removing a vote, meaning they could identify the votes and remove it without problems.
The bottom line is : from a technical/cryptographical perspective, the system is a joke (and they don't want to give access to the code). And that's my fear with e-voting : it seems like governments agencies (and their contractors) have a tendency to screw up very badly when it comes to new technology, at least in Switzerland. And I don't want to vote through an half-assed online system using MD5 and a 64 bits RSA key.
[1] http://www.tdg.ch/high-tech/web/Un-citoyen-a-pu-voter-deux-f... (in French)
With the going rate of botnets ($0.02 per computer from some quick googling?) and everyone would be voting online.... How much do you want to pay to be the president?
As if nobody would develop rootkits to fiddle with the HTTPS post (or whatever) going to the voting server...
Have a look at the papers of http://www.infsecmaster.ethz.ch/people/maurer
He also has a very good lecture on information hiding/binding principles where these principles are explained.
If you cam find two envelopes with my name, you can find out what my vote is ( I mean somewhere there is a decryption key)
Physical voting strips most links out from who voted and what they voted (you prove who you are at the desk then walk in and vote on a piece of paper in no way related to your name.
That is either impossible electronically or relies on unverifiable trust in the code. I know if someone looks over my shoulder. I cannot look at the code running - even if it is open source I cannot see what is really running.
Regardless of how this is couched, I can see the potential for challenges.
Not aware of any blanket deadline on changing voting processes, do you know which law that's in?
My knowledge on the matter is a bit fuzzy and goes back to 2000 with Florida's electors. Title 3 Section 5 seems to cover this, but only lists 6 days before appointment of electors, and 6 days before meeting of electors; and only when controversy arises.
A bit too dense with commas, prepositional phrases and conjunctions for me to decipher. I find D&D easier to understand than US election law.
There really is no supernatural magic to democracy that invests within the winner a moral or judgemental superiority. The ceremony and culture we surround democracy with can create that illusion. In an almost holy way, we anoint the winner and assign to them a minor god-like status. Their choice is said to reflect the will of the people, to be the personification of a mandate. But rationally, we should realise that a candidate who wins by 1% is about as likely to lose if the election was run the next day.
What's scary about e-voting is that democracy is really only very good at preventing complete tyranny. Potential tyrants are unlikely to gain enough votes. But with e-voting, errors of 50% are as easy and as likely as errors of 1%.
For a one-off like this, unplanned, I think it's fine to risk a reduction in anonymity, compared to not being able to vote at all. They are where they are, and they have to deal with it today.
The same type of anonymity can be provided by an automated program parsing emails that I can write in about an hour.
I'm proud that my state will be among the first to move in this obvious direction. Unfortunate that it had to be under such circumstances.
I believe our current system is somewhere in the middle, with moderate anonymity and moderate fraud protection.
You identify yourself to one person that is checking the registry. That person is supervised by another person to make sure there is nothing strange going on there. If OK, you're given a ballot in a plastic holder. After marking ballot, you slide your paper ballot into the secured box by letting it drop out of the plastic container. This means nobody but you saw your choice and now it is mixed in with all of the others. Later, during a recount, they can see who indeed voted, but not who they voted for. They only get the numbers.
There's a difference between CANNOT tell how you voted, vs we didn't look.
Paper ballots cast at a poll site is the only way to absolutely ensure voter privacy. The Australian Ballot method. The reason it works is because the ballot box scrambles the order of ballots, so they can't be tied to individual voters. (There are some exceptions, like very small precincts.)
Voting electronically eliminates that anonymizing scrambling. If it scrambled the order, they'd never be able to audit the process.
Postal ballots (aka vote by mail) has to be done just right to protect voter privacy. Many jurisdictions don't scramble the ballots because of the added expense.
No, it cannot. The process of the polling place can be verified by everybody who turns up. The integrity of your centralized program cannot.
Open source it. And not in the traditional sense, either. I mean setup the server to expose source code. Have a 3rd party verify security and integrity.
This is actually much easier to do than in the traditional process.
Please explain how you envision this being implemented.
(Warning: while 'remote attestation' is a valid answer for some assertions, it means that we are once again back to trusting the central signing authority. which might seem less scary, but we'd really be having the same argument at a much more technical and nitpicky level)
Make the directory containing source code read-accessible using your web server?
There is nothing you can truly implement that can guarantee that the code being executed is the same as the code being exposed, but you can hire a 3rd party to audit the server and verify as much.
Please read up on actual electronic voting systems, what properties are expected of them, and what properties the state of the art ones can actually provide.
http://www.schneier.com/blog/archives/2006/01/countering_tru...
Edited to add:
Which is to say, it's actually a pretty cool idea, and not super complicated[1], and amazing it took 20ish years to spot.
[1] Though do be careful; I'm amazed at the number of comments that misunderstand it.
I was assuming you would write your own.
Of course, if you keep going along this line of thinking, you end up wire wrapping your own computer and writing your OS and other utilities in assembly.
That only works if you do it in machine code (and your hex-editor is clean). The point of the whole thing is that you can use compilers from untrusted sources, just provided you use several of them, and trust that at least one of the compilers you are checking won't have the same modifications as the others.
Not necessarily. It would be very hard to get a ken trojan to propagate if you were to write your compiler in a high-level language such as python and then use a C compiler to Compile the Java runtime which you would use to run a C compiler to compile say go, then use the go-based c compiler to compile the python source, which you would then use to compile gcc. Gcc would then compile itself, resulting in an almost certainly clean gcc. If the gcc were compiled by the go compiler, presumably that gcc would be functionally equivalent to any other gcc binary of the same version. If it's functionally equivalent then when you compile the clean gcc with your go compiled gcc, it should be binary equivalent to any other gcc binary compiled with the same compiler, flags, and version.
EDIT: Now that I think about it, you wouldn't need to write your own compiler at all at that point, making your earlier point correct. But I meant something else when I was talking about checksums and versioning.
Another approach would be to use assembly to implement a higher level language such as scheme, and then use that to write a C compiler.
Also, I would pay $50 to see a hex editor or assembler that can detect that it is writing a C compiler in all possible cases and bug the users final program.
Of course, none of that matters if your hardware has a backdoor in it. So everything enumerated here depends on the assumption that your hardware is trustworthy.
* First thing that comes to mind: how ready is NJ.gov for a denial of service attack?
1.) Overseas / abroad resident has to apply for the email ballot. This should go through some sort of human approval process, making sure that the names for those particular voters voting in this method are recorded - to compare against in-person voting locations and ensure no double-voting. Hopefully should any double+ voting occur, this ballot will be invalidated.
2.) They are either faxed or sent, via email, an electronic PDF form based ballot. These PDF forms are true forms in that they allow for the voter to type in entries and save the new version (complete with entered information).
3.) The faxed form would be faxed back, with entries. The PDF version would be sent back, with entries, via email.
Unless Adobe has (once again) extended the PDF format to include encryption of PDF form entries, then yes, the emailed returned ballot will expose the voter's preferences via plaintext transmission.
The only way they'd be able to avoid that would be to have, for instance, an https accessible website that allows for PDF ballot upload. Somehow I doubt this is what they're doing.
Whether that, however, should also apply to electronic means of voting is questionable. Everyone understands papers and pencils. Computers are too much of a black box for me to ever feel comfortable with voting mediated by them.
I did the following:
1) Applied for a ballot by email, using a scanned Federal Post Card Application (FPCA) sent to the county clerk of the county I last resided in.
2) A ballot was sent to me by post. This is just a big piece of paper with some stuff printed on it.
3) I check the boxes I want to vote for.
4) I mail back my ballot.
Overall it doesn't seem much harder to spoof the existing process, since there's no verification of who sent back the ballot. The only security is that there might be various codes (or bar-codes) on that paper ballot which you'd have to know something about to fake.
With the traditional (paper ballot) voting there are several principles that are key to the legitimacy of the election process:
1) The paper ballot could be verified by any citizen and doesn't require any specific knowledge. Any voter could be sure that his vote is accounted for correctly. The ballots could be counted and re-counted without any technical obstacles and alterations. Various NGOs, organizations and individuals could act as guardians of the fair and independent process. This is very important as it provides trust in the process by making it more open. It's technically impossible to make the electronic process easily verifiable and tamper-proof. Any verification will require specialized knowledge, automatically barring a majority of the citizens from any verification. In most democratic elections the process is open to participation by the members of the general public as either observers (controllers) or counters.
And I'm not even talking about gaping security problems that have been discovered in the past with eg. Diebold's e-voting machines [1][2][3] - I never quite understood how the citizens of USA and the government could accept such a thing in the first place as this undermines the whole election process.
2) The paper ballot leaves a trail that is easy to verify and rather difficult to falsify on a large scale without leaving a ton of traces. This process has been refined and improved for a long time and is quite durable if followed properly. Electronic voting (either remote or using e-voting machines) on the other hand provides lots of opportunities for errors and fraud - software bugs, accidental or deliberate software modifications, poor UX choices, etc. The incentives and the payout of fraud are simply too big.
3) It provides decent protection against double-voting. Double voting with paper ballot is still possible, but is so hard to implement on a scale of any significance, that it's almost pointless.
4) Paper ballot guarantees the secrecy of the voting. This might not seem very important for countries like USA where oppressive regimes are not the norm, but is crucial for other places where vote bullying or outright buying are rampant. Even if I was in USA I'd prefer to keep my political preferences and whom I vote for to myself. I wouldn't want elected officials to use my competitor's services only because the CEO enticed his employees to vote for a particular candidate (yes, I do realize that lobbying and political campaign financing are closely tied in USA, but that's tangential).
The Germans have considered electronic voting in 2009 and their Constitutional Court has declared electronic voting as non-constitutional. The motives, in English, could be found on the court's press pages [4].
The technical details of the Estonian system in English could be found on their site [5].
[1] http://www.salon.com/2011/09/27/votinghack/
[2] http://www.securityfocus.com/news/11391
[3] http://www.blackboxvoting.org/presskit.html#hack (terrible design, but has a lot of info)
[4] http://www.bundesverfassungsgericht.de/en/press/bvg09-019en....
I've been studying election administration in the USA for a few years, having worked as a pull judge, pull inspector, and observer. I've attended HAVA hearings, EAC hearings, and testified many times. Etc.
New Jersey is now issuing and CASTING ballots electronically. In the clear.
By "complications for privacy", you must mean the complete lack of privacy. There is no privacy. Zero. None. Zilch.
The only balloting system in the USA that preserves the secret ballot is a dropping your ballot into the ballot box at a poll site. Because the box scrambles the order. Postal balloting can partially preserve the secret ballot (on the receiving end) if proper rules are followed (but generally aren't). Exactly no electronic system preserves the secret ballot.
You misrepresent the photo identification requirement. Meaning it's a complete non-issue trumped to scare people. In the USA, everyone must first be registered (except in North Dakota?), which establishes your eligibility to vote. On election day, until recently, voters merely have to prove who they are with any form of identification showing their current address. This is mostly to ensure voters are issued the correct ballot (for their precinct).
Knowing what I know about the history of election administration and its current direction, I'm curious to learn what you'd consider "moves us forward"? I'll even give you an out: Anyone advocating any form of electronically mediated voting must admit that it eliminates all voter privacy (secret ballot) and most of the public vote count (ability to audit). So the challenge is to create the digital successor to the Australian Ballot system used in the USA. Something that will give all observers confidence that elections are run clean and fair, despite the lose of voter privacy.
Any thing short of that, you're just blowing smoke.
"Brave New Ballot: The Battle to Safeguard Democracy in the Age of Electronic Voting". Aviel Rubin.
The principle is the same.
We also have Republicans favoring and Democrats opposing laws requiring voters to show ID, because they both know which side benefits in relative terms from making voting more difficult.
Any chance this will become the norm for all states?