Slashdot Mirror
A Secure and Verifiable Voting System
meese writes "The cryptographer David Chaum, through discussion with top cryptographers such as Ron Rivest, has designed a secure and verifiable voting system. One of the goals of his design is that anyone can verify that votes were tabulated correctly. It's good to see real security/crypto people working on this problem. They also have a press release."
Will there be people involved at any point? If so then its not secure, however it may be verifiable.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Open source + Paper trail = secure voting.
How much longer till they figure this out?
I vote (ha! get it?) that we just stick with paper and pen until we have more chance to discuss and develop alternatives. Just voting is key to any democracy, so tread lightly!
Visit the best Liberal Blog: DU
It's too bad this won't get any support, as it doesn't make politicians any profit. Maybe if they could promise Bush Ohio's vote, or line some pockets with green, they'll get some government backing. I think there should be a law against a politician having invested interest into the means by which they are elected.
Everyone is entitled to their own opinion. It's just that yours is stupid.
How in the world do you expect the penny ante politicians to get elected with an honest, secure system? More importantly, how is Bu$h supposed to get re-elected with a fair, impartial, secure and verifiable voting system? Fortunately, here in the good ol' US of A, we're free to chose a more politically useful system. ;)
You must be the change you wish to see in the world - Ghandi
What if instead, the voter was given a printout of the MD5 of a combination of (digesting all of) everyone they voted for and their (the voter's) social security number?
Not a chance. First of all the SSN, even if it were as difficult to obtain as you suppose (hint: it's not), this wouldn't be of help in vote-selling, as the voter would cheerfully surrender his SSN if he wanted to get paid.
As for the rest, you're radically overestimating the number of permutations an election can typically have -- a dozen yes or no decisions and one or two candidates each for a handful of offices could be permuted by any cheap desktop PC in very short order.
The trouble with your MD5 approach is that it does not offer any protection against coercion. This is a relatively difficult thing to guard against.
If I were a bad guy in your system (remember, when dealing with security you must always be the bad guy) I'd give you a list of who to vote for, and you must bring me back a receipt and then tell me your SSN. I can probably get your SSN via some other channel, anyhow. Once you return, I put into my computer how I told you to vote, and your SSN and make sure you followed the rules. NO? I blow away your cute little pet dog! Or some other nefarious deed.
A one-way has is a useful thing in some circumstances... What you need is a zero-knowledge proof.
(disclaimer: I work for VoteHere, Inc and we have a somewhat better system than Chaum, but it is a bit harder to explain with pretty pictures.
We'll know that this is a real and secure voting method just as soon as all the incumbents and lobbyists come out and blast it as "dangerous" and find some way to connect it to terrorism.
A paper trail does make it magically more secure. This isn't referring to you keeping paper, it is referring to a piece of paper with the vote on it being stored somewhere.
Those machines with levers? They make paper trails.
Without this, the votes are ONLY digital. As such, any unauthorized access can, en-masse, change the only record of the votes. Paper cannot be changed nearly so easily, and especially not so secretly. It allows a recount if the machine count seems unreasonable.
It is genuinely an incredible increase in election reliability, especially for something so simple.
Here's what we need...
A touch screen voting booth that lets voters select the canidates they want.
After the voter casts their vote the booth prints out a ballot that's a machine readable scantron sheet.
The voter checks to make sure that the canidates they selected are recorded on the ballot and feeds it into a scantron reader. It's this machine that actually records the voter's vote.
This way not only do we get the benifit of a machine count but a paper trail to boot.
Even if there is an open audit of the source and a paper trail, most of the canidates will still request a recount of the ballots by hand. Call me a bit old fashion, but I still believe that the best way to hold an election is to do it on paper rather than on a computer. Even the most secure open-source OS can have security holes....
Incidentally, most of the alternative suggestions offered by slashdotters seem to compromise the secrecy of the ballot. Secrecy might not seem important to the average slashdotter, but it is important if your family will disappear when you get caught voting for the opposition.
but if they needed to verify their vote, they could specify all of their choices and their ssn again, and get the same MD5.
They do *not* want you to be able to verify how you voted, because then you might be *forced* to verify it. What they're trying to do is give you a recipt that you have delivered a valid vote, and that this vote can be verified as having been counted, without revealing for which candidate the vote was for.
The reason for this is simple - with manual counting, you need to involve a lot of people around the country to reasonably affect the vote. With an electronic count, who's to know if you simply replaced the final numbers?
Unfortunately, it's more difficult to show that your vote is a subset of a group (the total votes) than it is to make a 1-to-1 mapping. It sounds quite smart from the brief read-through I made, but yes, I wouldn't make any hasty decisions.
Kjella
Live today, because you never know what tomorrow brings
The problem is that if laymen can check that their votes were counted after the fact, it is possible to sell your vote and let a 3rd party check on this as well. Any design where you keep the recipet is flawed.
Jack Valenti and Orrin Hatch will be first up against the wall when the revolution comes.
Why spend all this time, money, and effort on such a small problem? Yes, all mechanical systems are going to have some error rate, but that error rate can be (and generally IS) miniscule. The only time error has the potential to change the outcome of a vote, even under the most poorly designed systems, is when the actual vote is extremely close. What's more, this mechanical error is essentially RANDOM, in other words, it's not likely to be biased towards one side or the other. Somehow to talk about this changing the "will of the people" strikes me as an extremely hollow complaint.
Do NOT confuse mechanical error with HUMAN error on the part of the voters (as in the case of Florida in 2000 "voting" for multiple candidates). It is very possible to design a mechanical system to make these sorts of HUMAN errors extremely rare (which are generally pretty exceptional in the first place); electronic voting generally provides no better assurances that this cannot happen. Even where HUMAN error occur, unless you believe certain groups of voters are innately dumber or more naive than other groups, this error can largely be made irrelevant by ensuring consistency in voting methods across all counties at far less cost and trouble than these electronic systems.
It's too early to really comment on this particular system, but as a general rule it comes out for me like this:
a)Face random error (0.3%) that comes with mechanical voting systems, without very little possibility for wide spread fraud.
b) Face no random error but accept the potential for massive fraud because of the very electronic nature of it. In other words, a small group of people who are smart or powerful enough could potentially alter the votes enough to put a candidate who is otherwise unelectable (e.g., some wacko on the far left or far right). These problems are unique to electronic voting. The integrity of the mechanical voting as a whole can be verified and audited by someone with modest intelligence. Either the lever swings and punches a HOLE or it does NOT--they are not complicated devices. All this at the cost of billions of dollars! WHY?
No group benefits is apt to benefit or be hurt statistically by spending the money on this (fixing the other problems is a different argument). So why bother, particularly when it increases the risks of some fringe group rising to power?
Yes, there is protection for the candidate.
:-)
The auditing process provides statistical guarantees that (in the absence of complete collusion by the polling agents) (a) every ballot is counted, (b) no extra ballots have been inserted, and (c) no ballot has been tampered with.
Furthermore, all of this information is provided on the web. Each voter can check that their vote was recorded and anybody at all can check the final tally (the plaintext electronic ballot papers are also published, but they cannot be traced back to individual voters.)
It's a great system. It's just a shame that the paper doesn't explain it simply enough (for the Slashdot crowd to understand, at any rate