Slashdot Mirror
How Would You Design the Voting Technology?
Bob Glickstein asks: "Punch-card ballot machines are now universally reviled, and we techies all know the perils of electronic ones. But I haven't seen anyone talk about a better solution. It's gotta be inexpensive, rugged, reliable, accurate, verifiable, tamper-resistant, simple to use, and secret. Verifying a vote tally should not result in TV news images of rooms full of election officials, squinting at ambiguous marks on a piece of paper. What contraption can possibly meet all these criteria?"
Who would you like to see the next US President?
George W. Bush
Howard Dean
Ralph Nader
I am Canadian, you insensitive clod.
CowboyNeal
First ask weather a person wants to vote. A simple yes and no will suffice. Next ask, if they really want to vote, again, make it a yes/no question. Then make them choose a randomly generated picture on the screen. Finally get take the MD5 of that picture and based on that calculate the probability of them choosing a certain candidate using genetic algorithm. If you are not familiar with genetic algorithms, a simple ini-mini-myni-mo algorthm will suffice.
Note that is how California does it and if it good enough for California, by god it is good enough for everyone.
-----
One is born into aristocracy, but mediocrity can only be achieved through hard work.
An electronic voting machine which should produce a printed record. Some type of blind-numbering system should be used for identities -- crypto theory has plenty of theoretical models for this. Users should be able to pick from a drop-down menu or type in a candidate, though for other countries (i.e., rural Africa, etc) or for certain classes of handicapped people, other methods, such as picking from a set of pictures, should be available.
This is pretty strightforward, but as diebold found out, the devil is in the details...
Just have the candidates fight it out in armed combat.
Robert Anton Wilson
... would be like Battlebots.
"Derp de derp."
Use Scantrons, where you bubble in the answer with a black pen or a #2 pencil. Have the people bubble in their votes, and run them through. This makes reading them very easy, especially since the machines are already in use across the country, and verification is as simple as looking at which one is bubbled.
--That's the point of being root, you can do anything you want, even if it's stupid.
If the idea is to accurately count the voter's intentions (how absurd) this would work better:
:-)
1) Voter checks in at front desk, signs voter registration and is given a punch card.
2) Voter enters a voting booth, and inserts blank card.
3) Voter enters their vote choices on touch screen (with pictures of candidates even!) and when done, card is automatically punched with appropriate votes.
4) Voter takes punch card and inserts it into a Republican card reader.
5) Voter takes card and inserts it into a Democratic card reader.
6) Voter takes card and inserts it into independent card reader.
7) Voter gives card to election offical.
8) Election offical presses a button. If results from 4 & 5 & 6 do not ALL match, voter must start over (back to step 2) with a fresh card (current card is destroyed.)
9) Card where votes match placed into old fashioned voter box for recount broo-haa-haa. (sp?)
-------
But as Joseph Stalin, I would never advocate having multiple parties each having their own electronic systems in a polling place. Accurate vote counts are kind of antithetical for me.
"Those who cast the votes decide nothing; those who count the votes decide everything." - Josef Stalin
This is a matter of democracy not entertainment. The process is what is important. TV tries as hard as it can to influence the elections as it is, making the process entertaining would play into their manipulative agendas.
--
"we live in a post-ideological world..." - Billy Bragg.
OK, you get everybody in the whole country who is registered to vote, which I hear is about 25 people or something in America, and you put them all in a big room with only one way out and a big turnstile so once you're out you can't get back in and then I'm sure their is some room for electric cattle prods here and maybe a guy near the turnstile with a pencil and he can take notes on a piece of paper or the back of an old bus ticket or something and then as each voter tries to get through the turnstile to get away from the cattle prod guys this one guy with the pencil might say, 'Oh hey dude, who do you vote for?' and then the voter might say like, 'The Terminator' or 'That Wrestling Guy' or something like that and then the pencil guy could keep a tally right there on the bus ticket and then when everybody's gone except the cattle prod guy and the pencil guy then you could just add up the results and declare a winner. The only problem would be if the cattle prod guy or the pencil guy wanted to vote as well but I say those guys are barred from voting or even knowing who the candidates are because you can never trust some pencil using ludite I mean haven't you heard of biros and that cattle prod stuff is a little too kinky for me.
So there you have it. My New Voting System. Thank You.
Now wash your hands.
The most transparent technology there is at the moment for recording votes is for voters to tick boxes (or write numbers) on printed ballot papers and put them into ballot boxes. Voting slips are counted by hand based, in the presence of witnesses. If the result is close, the voting slips can be recounted. This system works well in Australia at all levels of government.
OK, we do get problems occasionally. But they are typically things like people impersonating other voters, and people voting multiple times at different polling booths. However, the system copes with this. If the number of voting irregularities detected is sufficient to effect the outcome of an election, a by-election is called in the seats in dispute. It really helps that the courts in Australia are not heavily politicised like they are in the US of A.
(The problems with voter impersonation, etc are also present when voting machines are used. The same solutions could be used in both cases; e.g. requiring voters to present photo ids, and throwing rorters into jail for a long time.)
That said, I absolutely insist on machine-readable and hand-countable pen-marked paper ballots. This is the only way to insure both fast and accurate election night returns *and* verifiable beyond-a-shadow-of-a-doubt recount ability. These machines have been manufactured for many years and they *were not* responsible for the Florida cluster-fsk.
"Eve of Destruction", it's not just for old hippies anymore...
Let the results of the election be open for everyone to tally the counts. Assign a voter registration number to each voter, and allow anyone to query the system with that number to find out who they voted for. This would allow for a couple important things:
1. individuals can later make sure their vote was registered correctly.
2. organizations could step through the enumerated voter numbers and publish their own results of the election. They would back up the database in the process.
3. individuals can submit their vote to as many organizations as they want. The groups would then cross verify the votes with their databases.
What to do if someone finds out their vote isn't correct, is debatable. I wouldn't allow them to change it, but if there are enough errors then the election needs to be done over again.
There could be a simple web site that takes your vote and submits it to as many organizations as it can.
I don't know what to do about people that don't vote, nor the people that don't verify their vote.
I'm sure there will be millions, and every one of them could be voted without their aproval. yikes. Damn lazy people.
None of this is really important anyway. What the fuck good does voting do when there are campaign finance laws that are only bipartisan.
-metric
In 1992 I worked an election as an inspector. Each step of the inspection was signed off by a Republican and a Democratic inspector, after both of us saw and confirmed each step of the procedure. I think it would be much easier to make a mechanical clock run fast after the back was sealed on than it would be for anyone to cheat by manipulating one of these machines.
These are the steps, as I recall:
- The machines are shown with both backs removed. This shows a
matrix of mechanical counters, all of which are shown to read 0. There
are "total for office" and "total for candidate" columns at the top
and right. These also read zero.
- The inner back is fastened on. This covers all but the summary
row and column. These are checked to still read all zeros.
- The outer back is fastened on. This covers the summary numbers.
- The election begins. As each voter comes in, he or she is checked
off, so the number of votes can be compared against the machines.
- Inspectors from both parties are sitting with a view of the back of the machines at all times, to further guard against tampering.
- After the election, the outer cover is removed and the summary
totals recorded on paper. The total voters for each office should be less than or equal to the number recorded at the door.
- Next the inner back is removed and the matrix is recorded on paper.
The totals are checked against the numbers recorded in the previous step. All inspectors sign off on this as well.
I just don't see where such a system leaves any room for cheating. Of course, it also couldn't handle an election among 135 candidates, but that's got to be a first anyway.For anyone who hasn't used these machines, they have mechanical safeguards against voting for more than the correct number of candidates for any office. No hanging chads, no votes for too many candidates, no butterfly ballot confusion, and there's a paper trail that can be verified quickly rather than in a vague and subjective way.
Isn't it easier to trust clockwork you can inspect than code you can't? For one thing, no one's going to "download" you new clockwork when you aren't looking at it... and it's 100 years easier to audit.
--
I don't want to rule the world... I just want to be in charge of mayonnaise.
Just pick people at random from the population. You'll end up with a government which is just as incompetent, but a lot less corrupt. Also, it will be a good incentive to have a real education system.
If I seem short sighted, it is because I stand on the shoulders of midgets
Regardless of the system chosen, make sure that the same system is implemented consistently across the entire electorate. Voting procedures should be the same for each and every electorate and polling place - none of the BS where each state and/or county can decide how the elections are to be run. One system implemented identically across the whole country.
Why not stick to paper voting? The ballot box is locked for the whole day, and usually every party sends an observer/militant to scrutinize each voting place. Having around 500/1000 registered voters per ballot box makes it easy to count by hand (1 hour for 10 people). And every citizen is wellcome to look at the counting. So in every place, every citizen can be sure there was no cheating in his/her area. Then the authorities come out with spreadsheets of the result, and everybody can check the summing and the result for his/her area.
I'm strongly against any automatic machine counting, because cheating is too easy to conceal with those. No citizen can double check the process, and if a court apoints an expert to scrutinize the system, he's again a single point of failure.
Having a machine to count for you is a waste of resources, and driven only by lazyness, or by somebody who wants to look hip, and the danger of cheating is increased.
Let me explain a method used by a country that has more votes and ballots than any other country (2 - 4 dates per year, typically with several federal and other ballots each)
The method may not be perfect, but it's impossible to organize some tampering nation-wide without being noticed. And unlike the technical solutions, the method is transparent enough that anybody will understand how it works and why the results are trustworthy.
The method is: <drumroll> Have volunteers sort them out.
Zurich (biggest city here) for instance has hundreds of vote counters (appointed by the council) and in addition pays volunteers 20$ an hour on voting sundays (again, a couple of times a year). Work is roughly from 9.30 am to 3.30 pm. It's fast too, we get the results the same day no problem.
Obviously, you want to have more than one person go through those stacks and make sure they agree. Some towns do use machines for the counting. They still have real people sorting the papers (there's one per vote per person), but a machine counts the resulting stacks. They either use the very same machines that count bills in banks (no OCR, just counting the number of sheets in the stack), or they weigh them with high precision scales (often in addition to manual counting).
This method is proven, robust, and scales very well with the number of people in the country.
I shop on the Internet. I have paid all my bills over the Internet for half a decade now. But there's one thing I hope we won't do via Internet or through specialised machines for at least the next decades, and that's voting. The more sophisticated the proposed technical solutions, the less likely ordinary people are going to understand (or trust) it. Don't trust those freaks at the voting office? Well, volunteer to count yourself. Simple as that.
When I visited Florida as a teenager fourteen years ago, I saw one of USA Today's cover polls that asked five year-olds who they'd like to have as their president. Top of the poll (with over 50 percent of the votes, if I remember correctly) was Big Bird from Sesame Street. Then came another bunch of fictional figures with Bill Cosby being the highest ranked human being (with around 10 percent, again IIRC).
Now, fourteen years on, these kids are just becoming elligible to vote for real. I'd think that either of those two choices, Big Bird or Bill Cosby, would make great candidates. For one thing, they have tangible diplomatic skills that have been tested over the years by the most feisty allies (Mr. Snuf-a-lufagus, Dr. Huxtable's wife), adversaries (Oscar the Grouch, the younger Huxtable kids) and special interest groups (Count Dracula, the older Huxtable kids).
Personally, my vote would go to Big Bird. I'd like to see a cabinet with real weight and authority and I think that his staff, including Bert and Ernie, would bring a certain gravitas to the West Wing that's been missing for the last few decades.
So, please, if we're going to see a Slashdot poll, can we add these two candidates for the benefit of that generation? Oh, and perhaps Britney Spears too.
"Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
I guess you didn't understand my earlier post.
If there is ANY way to trace my vote to me, I can be compelled to vote a certain way. Blackmail, death threats, etc. If how I voted can be found out AFTER the election, it's still just as bad. Don't try to tell me that I wouldn't accidentally let my voter ID number slip if someone was holding a gun to my head.
The complementary scenario is where someone offers to pay $100 per vote in a certain district, payable upon proof of a certain vote. You think campaign finance laws are bad! Whoot! I think this scenario is significantly more open to abuse!
"Those who cast the votes decide nothing; those who count the votes decide everything." - Josef Stalin
In the traditional UK system, every single step of the process is open to the public and visible, except for the voter marking the paper.
That's actually really surprising. I can watch in my local polling stations as voters ask for ballot papers, are given them, hide in a booth to mark them, come out and put them in a box. I can watch the box all day. I can see the box carried to the counting room, and stand on the balcony as counters take the papers out of the boxes and sort them into piles. I don't have to trust anyone else to oversee the process, it's all there for me (or any other voter or candidate) to check.
Nothing that happens inside a box with electronics is visible to an outsider.
The manual system is vulnerable to small human errors and small opportunistic fraud. It is totally immune to large systematic fraud.
The only disadvantage is the expense, but the authorities are considering switching from it to new systems that are several times more expensive to run.
Oregon abolished the polling place. That's right, we haven't had a voting booth set up for an official election in Oregon starting with the 2000 Presidential Election (don't blame us, we didn't vote for him, and we didn't leave home to vote against him!).
So how do Oregonians vote? In the comfort of their own homes. About six weeks before election day, every residence with a mailbox gets a voter's guide that comes with a voter registration card (if you're not registered and want to vote, you turn it in at least 30 days before the first election you want to vote in). A week or two after that, your ballot, secrecy envelope and return mailing envelope come in the mail. You punch out the appropriate holes on the punch card. Stuff your ballot in the secrecy envelope, stuff the secrecy envelope in the mailing envelope, and put your signature on the back, and either mail it or drop it off at the elections office, or if it's within a week of election day, at any of dozens handy points at various public facilities (libraries, town squares, city halls, courthouses, election offices, etc) staffed by elections officials specifically to collect ballots.
But how does Oregon prevent voting fraud? Easy. We check signatures on the envelopes against the voter registration. Not sure what the sample rate is, but fraud has not been an issue. If you don't get the ballot and you were supposed to, you go down to the elections office, show your ID, they verify your registration and they void out the missing ballot (so even if someone turns it in, when they go to scan the barcode before checking sigs, they see it's void and throw it out). They issue you a ballot and hand it to you and you're on your way.
What does all this mean? Well, for starters, you get three or four weeks with your ballot instead of three or four minutes. Time is on your side in making an informed, well-thought decision without having to stress out that you're missing out on having a life to go down to the polls and vote.
Encourage your state to abolish the polling place
Help us build a better map!
Next time you catch a flight, take a look at that boarding pass in your hand, and consider the possibilites it presents for a voting system:
:-)
1) On a touchscreen, choose your candidates, then confirm your vote by pressing the "Vote & Print" button.
2) In the background, your vote is electronically counted.
3) The voting machine prints out your boarding pass / ballot, while also encoding the magnetic strip on the back with the details.
4) The voter can read the printed ballot to confirm it is correct, before dropping it into the ballot box.
5) When the polls close, the ballots are fed through a magnetic reader, and the tally compared to the electronic tally to confirm its validity.
6) If someone challenges the count, then the ballots are manually tallied using the print-out on the front.
The strong points for this system are transparency (you can still see the ballot), redundancy (for printer, magnetic encoder and electronic count to all fail is highly unlikely), clarity (no hanging or dimpled chads), security (you can hack the electronic count, but not the printed one) and cheap ubiquity (every airline clerk has a printer and a stack of cards).
I belive this combines the best features of electronic and paper voting, using each ones strenghts to overcome the others limitations.
If any boarding pass manufacturers choose to implement this, I expect royalties and a cushy seat on the board
Here on Brazil we have this kind of machine, check here:
http://www.procomp.com.br/projesp.asp
Unfortunelly the page is available just on Portuguese, but for the core stuff you can use a web translator.
Its not a perfect system, but it help us a lot here.
- Each machine is totally independent of all others, and -this is important- not connected to any network. Each machine has a unique serial number, and is equipped with a touch screen, speakers, and a microphone, a button, and a printer.
- The first thing the user encounters is a choice of languages. This is pretty self-explanatory.
- The user is then presented with the list of candidates. Each candidate is presented in sequence, with the presentation consisting of the following:
- A voter can select the candidate by touching the screen, pressing the button, or giving a voice command while the candidate is onscreen. Each candidate will be onscreen for six seconds, or the time it takes for the candidate with the longest name to say it plus a second of padding on each side, whichever is greater. This should give ample time to recognize a candidate.
- The user is given a chance to confirm the vote. All their votes are read sequentially, and the user may confirm that this is in fact what they want to do.
- The ballot is printed. It carries a barcode stating what machine it came from, but no information which can be used to identify the voter. This way, if a machine is found to be malfunctioning or compromised, the votes which came from it can be tracked and examined further, but the vote itself remains anonymous.
- A receipt is also printed. This does not carry the vote information, but does carry the barcode for the machine it came from, in case there is need for proof that a voter used a specific machine.
- The voter takes the ballot to the ballot box and casts it.
The idea behind this system is to both maximize security and minimize damage potential. Not networking the machines, for example, does not do terribly much for the security, but does ensure that a hacker could only exploit one machine at a time; to manipulate many machines would take a huge effort. Likewise, the fact that ballots are both machine- and human-readable ensures that the more secure machine counting can be used as a primary system, but hand counts can be used as a fallback mechanism.- A picture of the candidate.
- The candidate's name onscreen, rendered however best fits the language the user chose.
- An audio clip of the candidate saying his or her name.
The idea behind this whole spiel is to present as many ways as possible for a voter to recognize the desired candidate. In this case, the user has text, visual, and aural cues.In my state we use optical scan ballots and it seems to be an ideal balance between verifiable paper trail and machine counting. Once the ballot is marked the optical scanning does indeed work well and is very quick.
The ballot is placed inside an opaque folder to hide the actual votes, but an end sticks out. A poll assistant aids the voter in feeding the machine, which sucks the ballot in and counts it. If there's a problem the ballot doesn't get sucked in and corrective action can be taken.
What could be done to improve the process is a screen-based marking station. Do away with the pen and use a touch screen in its place. This would eliminate the "stray mark" problem.
After a voter touches up a ballot, print it out in the booth. Voter then verifies it and submits it to the counting machine. If the ballot is incorrectly marked the voter would take it to the poll taker as a spoiled ballot and have it destroyed and try again.
This two-phase process has the added benefit of increasing the difficulty of hacking the system, since there are now two separate components instead of a single box to compromise.
Ok - This is a huge myth. The problem in florida wasn't with butterfly ballots or punch card systems at all... It was with a faulty law saying that the vote counters had to determine the "intent of the voter" rather than just count votes. Simplify the law and say the intent of the voter is expressed when more than two corners (three, one, whatever) of the box are torn and there isn't a double vote of any kind... That removes ambiguity.
Now go back and realize that ALL of the florida recounts - No matter what any silly liberal will attempt to tell you - came out with GWBush in front. The problem being is that in each and every count the closeness of the count was well under 3 sigma to the error of the counting process, however we are rather sure that he got more votes than Gore did. If Gore wants to complain - why the heck didn't he win Tennesee, his home state - and make Florida mute.
I have mod points and I am not afraid to use them
1. Electonic polling machine accepts voter's choices.
2. Polling machine adds voters choices to internal counters.
3. Polling machine prints paper slip with both a human readable and a machine readable record of voter's choices. This slip is placed in a sealed ballot box as in the current punched card system.
4. Once the polls close, the poll-workers, with the candidate's/party's representitives, record the tally from each machine. This becomes the official result unless a descrepancy is found in the following steps.
5. A random sample of n paper slips from each machine is machine counted based on the machine readable information. If this dosen't match the results from 4 pretty closely, a full hand count will be necessary.
6. A random sample of m paper slips (where m can be less than n) is counted based on the human readable information. If this dosent' match the results from 4 and 5 pretty closely, a full hand count will be necessary.
By printing the paper slips with human readable information, and machines mistalling votes will likely be noticed immediatly by the voters. Step 5 prevents tampering with the polling machine's internal results by ensuring that the printed slips match the internal tally. Step 6 prevents a more clever attacker from printing his or her desired vote on the machine-readable portion while recording the voter's choice on the human-readable portion.
Come test your mettle in the world of Alter Aeon!
show of hands?
I think I have this nailed.
First and foremost, I believe everything has it's place. I think that zelots that think that EVERYTHING should be run in Linux or EVERYTHING should be open sourced are nuts.
Everything has it's place.
And the electronic voteing booth just screams for open source.
That is where I would start. I am closed minded to any company or individual that won't go open sourced on these things.
If I was in charge I would offer the electronic voteing booth contract in the same fashion that the Navy has 'fly offs' for new jet contracts.
I would find a company, or three and give them my requirements for the voteing booth. I would ask them to design something to my specifications and it must be open source.
Then I would put up a challenge to the Linux community. I would post the same requirements that I gave those companies on the net and look for some people to put together a free software open source voteing booth.
In a year I would do the 'fly off' (or vote off, sans actual election) and either pick the free software project or one of the companies.
That is part one of my plan.
The second part are my security requirements.
At some part in either the registration process or possibly at the polling place (or even both) the voter is issued a blank smart card. The card contains no personal information either digitally or printed on the surface.
The voter goes to vote.
When they cast a vote the computer tallies it up in memory (naturaly) and then they are issued a paper reciept.
The paper reciept does not need to contain any personal information either. It does need to list who the person voted for in clear bold English. A senior citizen should be able (and encouraged) to read the reciept to see that no mistakes were made. Also on the reciept is a bar code to aid in computer tabulation.
At this point the smart card comes into play.
Here is where the smart card gets, well smart.
It is totally optional. If someone leaves the card at home, or is opposed for any reason they don't need to use it.
The user inserts the smart card and some information is stored on the card.
**note** Feel free to add suggestions to this, I am not a comp sci person at all. I came up with this on my own***
The information is something like this:
1. The exact time that the card is written to.
2. The number of voters to have used the machine that day.
3. A hash file representing the exact size of the program data on the machine (like you would use to double check the a file you would get off of usenet)
4. A running total of all the results of the voteing on that booth so far.
Finally all this data is secured with a key that is kept private in the voteing booth itself. I would make it a law that once the elections ended the key had to be made public.
Here is what I am accomplishing:
1. You can always do a normal tally and not worry about my back ups. If everything appears normal and people are happy then there you go.
2. If recounts are asked for they can be easily accomplished by using the paper reciepts from the voteing machines. If someone cries foul at the bar code they can read the type on the reciepts.
3. If people are still crying foul - the voters keep the smart cards. Since every machine has a different key and all keys are public as soon as the voteing is done then it is a simple enough matter for independent programmers to verify the votes on there own.
But what most people will do is go back to the polling place and swipe the smart cards into a reader. The reader will record the information and produce a graph showing the real time voteing that happened at each booth. Sans personal information (thank you very much).
In the event that someone tries to cheat the system it will be obvious. Even if someone reencrypts the card they will show up like a sore thumb next to the next card that is read (see... we did a running tally of the votes.