Two Faces of Electronic Voting

IEEEmember writes "The Swiss are claiming the world's first binding Internet vote in a national referendum. Voters were given lottery style scratch-off cards that allowed them to vote either by Internet, snail mail or in person. Internet votes can be cast from any computer accessing the elections site securely over the web. Electronic voting has been implemented to combat declining participation in elections. Stories from The Age, swissinfo and CBS available at Google News. The IEEE is calling attention to the current process for establishing standards for electronic voting. Project 1583 - Voting Equipment Standard and Project 1622 - Electronic Data Interchange are being developed by Standards Coordinating Committee 38 rather than being relegated to a single society to ensure the broad range of electronic voting issues can be addressed adequately. These standards are being written for use in the U.S. however some parties have shown an interest in extending them to other countries."

Comments

Verification

[sofakingon]

Two Words: Paper Trail.

There must be a verifiable, permanent, physical record in any election to ensure that any and all democratic elections are not tampered with.

Re:Verification

[rhakka]

for now, perhaps.

However people who spout this act like you can't tamper with physical records. You can. Physical records are not secure.

The question is not can elections be secure. They cannot. The question is HOW SECURE can they be, and while we may not be there yet, it is certainly possible down the road that a fully electronic method could be made AS secure as leafs of paper in boxes in someone's basement, IMHO

Re:Verification

[sofakingon]

People do things that they believe are in their best individual iterest.

Online transactions are, for the most part, secure and trustworthy because it is in the best interest of the businesses and financial institutions to provide the best service possible.

What, then, would be in the best interest of the [current] government in regards to electronic voting?

Food for thought.

"Power tends to corrupt, and absolute power corrupts absolutely." -Lord John Acton

Re:Verification

[rhakka]

Not allowing it to progress at all, since if it ever did become reasonably secure and easy to access, things they would be changing pretty quickly....

Re:Verification

[Jerf]

However people who spout this act like you can't tamper with physical records. You can.

No, people who "spout" this think that it is much harder to systematically tamper with physical records than electronic records, and that this fact shows no signs of becoming less true any time soon.

Moreover, auditable electronic voting combines many of the nice parts of electronic voting with all of the nice parts of physical voting.

I think us "physically auditable voting"-type folks understand what is going on; it is exactly that understanding that has us calling for the hybrid, best-of-both-worlds solution, instead of the "God only knows what happened for sure" world of electronic-only voting.

Re:Verification

[rhakka]

I certainly agree, *at this time*.

Re:Verification

[ibeleo]

Agreed. Look at financial services, who try to eliminate paper to save costs. There are techniques to create auditable records, accepted (heck mandated) by third parties such as the SEC.

Problem is getting everyone to agree that it's secure. A box of paper seems not to be the best we can do, but people are comfortable with it.

Re:Verification

[swillden]

However people who spout this act like you can't tamper with physical records. You can. Physical records are not secure.

Yes, they are.

Not because there's anything about them that's inherently more secure, but because we know how to secure physical objects. After all, we've been doing it for tens of thousands of years.

Physical records have the advantages that they are visible to the naked eye, cannot easily be modified en masse (except destructively), and take up space. This means that even non-technical people can *watch* them through each stage of the process, able to see that they do not leave the location under observation and that they are not modified while there. Given enough watchers including some "disinterested" election officials and security guards and some representatives of the candidates, vote-changing on any significant scale is basically impossible. And the nature of the process ensures that as the votes are collected the more votes there are in one place the more people are around watching.

I design and construct secure computing systems for a living, and I'm a big fan of cryptography and the nifty things that you can do with it. However, one of the things that a few years in this business pounds into your head (even if it's as thick as mine) is that electronic security is always much, much harder to achieve than you'd expect and in fact it's nearly impossible except in the most stringently-controlled circumstances.

I'm not claiming that secure electronic voting is impossible, but it sure as hell isn't easy, and we *don't* know how to do it yet.

IMO, the real challenge with creating a secure electronic voting system isn't figuring out how to secure it, because we should just accept that that's impossible. Technology can't do it no matter how sophisticated, and any electronic system is inherently "opaque" to observers (unlike paper). The challenge, then, is to figure out how to build a system that is both fully auditable *and* fully anonymous. Those requirements are nearly contradictory, but not quite.

By fully auditable I mean it must be possible to verify the authenticity of every vote counted, tracing it back to the polling station it came from and verifying that it was cast by a legitimately-registered voter. Further, it must also be possible to verify that no votes get lost. Selectively discarding a small random selection of ballots from particular districts would be a beautiful way of electronically gerrymandering an election. By fully anonymous I mean it should be impossible to identify any ballot with a particular voter, even with the voter's full cooperation. (Note that any Internet voting approach fails this requirement, as do mail-in votes. You need a voting booth for anonymity.

Does that mean that only "perfect" security is "good enough" security? No. Security can often be far less than perfect, but still do the job. The problem here is that the value of rigging an election is so high, the security also has to be extremely high. There are two obvious ways of achieving "good enough" security in a scenario like this: Perfect security (yeah, right), and compartmentalized security. The latter means that although the cost/difficulty of breaking the security is within reach of the attacker, the benefit of doing so is too small because it affects such a small part of the election. In other words, the security system needs to be structured such that attacks on it are not scalable and not efficient.

But the whole point of electronic voting systems is scalability and efficiency. Compartmentalizing the security while retaining the overall scalability and efficiency is not easy. The typical way to do it is to use a consistent overall infrastructure but to break the system into non-interoperable chunks through key diversity, but that creates a key management nightmare that in turn requires a key management system which becomes an exploitable weakness.

Secure, efficient and cost-effectiv

Re:Verification

[rhakka]

I largely agree, but I think you are glossing over voting fraud. Sure, once it's on paper, it's hard to screw with it.

Of course, that piece of paper could be generated by fake people, or "dead" people, or what have you. Fraud is not only possible but happening in every election cycle. How big is it? Hard to say.

Frankly I think the time is coming where we are going to have to choose between anonymous voting and secure voting.

Re:Verification

[swillden]

Of course, that piece of paper could be generated by fake people, or "dead" people, or what have you. Fraud is not only possible but happening in every election cycle. How big is it? Hard to say.

Yes, elections are also manipulated through voter registration fraud.

But how is that relevant? Electronic voting won't solve that problem -- won't even affect it. Just because the system can be manipulated in one way doesn't mean it's a good idea to make it manipulable in other ways. Particularly since registration fraud is a form of fraud that is inherently small-scale.

Frankly I think the time is coming where we are going to have to choose between anonymous voting and secure voting.

Why? What do you think will force this? Our foolish adoption of electronic voting systems. Well how about we just *refuse* to accept them?

Anonymity isn't just a "nice to have" thing, either. Unless you think vote-buying and vote coercion are compatible with democracy.

Re:Verification

[KingAdrock]

Do current electronic voting machines do this? I mean doesn't it just make sense to print out a receipt after the voting is done, and have it dropped into a box as the voter leaves the booth? Hell why not print out two and let the voter take one home. It would be almost like going down to OTB and playing the ponies!

Re:Verification

[darkwing_bmf]

And use a pencil so we can correct your mistakes.

Paper Trail

[Anonymous Coward]

"When you can walk the rice paper without tearing it, then your steps will not be heard."

--Master Kan

this DOESN'T make the front page?!

[Anonymous Coward]

A REAL tech article dealing with REAL tech issues!?

I mean, c'mon it's an IEEE article, how much more does it need?!

Re:Verification-Ball's side up.

[rhakka]

we have dead people voting in every election, and you're telling me it's hard to influence an election?

maybe. I'm not so convinced.

Electronic vote hacking is NOT the only danger!

[JimMarch(equalccw)]

San Francisco recently had a scandal in which city employees were herded through the absentee voting system and browbeaten by supervisors who watched over their shoulder to make sure they "voted properly".

To solve this problem and numerous others, the idea of private voting at local polling places where this sort of thing can be monitored developed. When done right, polling-place voting leads to the LOWEST level of overall fraud.

Right now, Black Box Voting and other advocacy/reform groups are talking about using absentee voting to create a paper trail when polling places lack them. BUT we know about this issue! Our stance is a condemnation of the worst of the elecronic voting systems, NOT a condemnation of polling place voting.

Internet voting is worse than absentee, for several reasons:

1) A small script could record exactly how you voted, allowing you to sell your vote. Concerns over mechanical voting systems in New York and other urban areas led to an experiment with "paper reciepts" about 70 - 80 years ago and it turned into a vote-buying bonanza for crooked unions. (That's why Voter Verified Paper Trail plans today involve leaving the paper in a secure ballot box at the polling place.)

2) There's still a sizeable non-Internet-connected population out there, esp. at retirement homes and blue-collar unions. "Free Internet Voting Terminals!" at union halls and nursing homes would be a hotbed of "browbeat fraud" similar to the San Francisco case above...in the case of unions, people who didn't vote at the union hall (where the networked PCs are monitored with a remote view application) would be exposed to considerable pressure for not voting "the right way".

-----------

Note that these issues are present EVEN IF THE SYSTEM IS TECHNOLOGICALLY PERFECT(!), written in Open Source with strong crypto by /.ers.

Upshot: Internet Voting cannot be made to work right, due to "human hacking" even if "computer hacking" is somehow made impossible (which is pretty damn doubtful).

Jim March
Member, Board of Directors, Black Box Voting (www.blackboxvoting.org)

Re:Electronic vote hacking is NOT the only danger!

[BCW2]

Any election can be rigged or bought. Just look at 90% of the elections held in Chicago in the last 80+ years. Capone, then the "Dailey machine", seems like a never ending story with another Dailey in the Mayors office now.

Re:Electronic vote hacking is NOT the only danger!

[AuMatar]

Are they? Lets look at the facts- CHicago is a largely democratic town, most of the officials are democrats. As for mayor Daley- he's a good mayor, ofr the most part. The city works- streets are kept relatively clean, roads are plowed, schools stay open, etc. He keeps winning because he has yet to screw up, and probably will hold office til he decides to leave it. The republicans haven't sent him a real challenger since his first election.

Re:Electronic vote hacking is NOT the only danger!

[BCW2]

And his daddy delivered Illinois to JFK on a silver platter in '60. Helped by Giancana and friends. Just like LBJ did with Texas. If those two state had been recounted, Nixon would have won then.

I wonder how history would be different?

Correction

[InternetVoting]

I can only make these corrections so many times...
This is not the world's first legally binding internet vote
This is the first Swiss legally binding internet vote.
The first legally binding internet vote:
"The US, which held the first legally binding internet election, the 2000 Arizona Democratic Primary, is treading more carefully. While the government is spending $2.6bn on modernising voting systems following the 2000 fiasco in Florida, the only Americans able to cast remote internet votes next year will be 100,000 service personnel posted overseas."
http://politics.guardian.co.uk/egovernment/story/0 ,12767,994790,00.html
I would expect a little better from and IEEE member. IEEE used the company that ran the world's first legally binding internet vote to run their internal elections online for some time.

The overseas votes the story references are none other than that of the recent SERVE project that was cancelled recently. A similar story was posted on /. riddled with undue criticisms
I ask you /. community, please be more careful in your statements. Internet voting is the future of the electoral process. We the tech community, of all people, must understand this or at least have a well researched response as to why not.

Re:Correction

[IEEEmember]

The article and my summary clearly said, "binding Internet vote in a national referendum".

This is as significant as the first solo flight over the Atlantic versus the first solo flight. Both are significant milestones, but they represent different levels of adoption of technology.

Perhaps more important in this story is the reason that electronic voting is being adopted, lack of voter turnout. The adoption of Internet voting has the great potential to shift the voting demographic in the US away from the normally disenfranchized poor and elderly who currently vote to those able to afford computers and Internet connections.

Also important for US voters is the insight into other electoral processes. The contrast between the Swiss popular democracy versus the US representitive democracy as embodied by our electoral college is obviously a topic of interest to many Slashdot readers.

Internet Voting - No thanks

[salesgeek]

In 2002 I helped a relative run for office in a county in east-central indiana. What I learned there is that any system that you don't have to show up and identify yourself before you vote is very easy to defraud. That's why internet voting is scary. It's also why absentee ballots are scary.

Parties would look for nursing homes, hospitals and homebound senior citizens and help people there get absentee ballots. Sounds great until step two: Operatives would then come back and help them fill in the absentee ballots. Amazing how many straight ticket R or D ballots came in. In this particular year, the D's won the foot race to get more ballots.

Re:Internet Voting - No thanks

[Neil Blender]

What I learned there is that any system that you don't have to show up and identify yourself before you vote is very easy to defraud...It's also why absentee ballots are scary.

I agree internet voting would be harder to protect against fraud, but:

In Washington state, you identify yourself by no other means than your signature.

At the polls, you sign your name on the voter registry, get a ballot and vote.

With absentee ballots, you put your ballot in a 'security envelope', then in another envelope which you sign. They verify you by an existing copy of your signature. You do not have to show ID at any point.

I don't know...

[ImaLamer]

I'm sure this will be seen as "off topic" but I'm afraid the world will implode this election.

I'm afraid that both sides of these elections will try to cheat so much that the world won't be able to take it and the election itself will cause a war.

(Then again, if I lived in Florida and was turned away at the polls or something I would have picked up a firearm and returned...)

Re:I don't know...

[nullportal]

Relax.

Re:I don't know...

[ImaLamer]

okay

Re:Florida a potential disaster

[nullportal]

The US constitutional right to vote is governed by the various state's rules of who is a qualified voter. The main constitutional rule is that qualified voters must be classified as such or disqualified as such upon lines of "equal protection" of the laws of that state. "Equal protection" means that the way people are classified has at least a rational basis, and if it involves a very important matter, involves an important or compelling government interest. A few special rules for specifically federal elections also apply - no state can deny voting in a FEDERAL election to a person on the basis of age if that person is at least 18, for instance, but voting is a political right mostly determined by what state one has chosen to live in. The US theory of the electorate is that by spreading ultimate power over decision making over a broad enough set of people, they will more likely accurately perceive the public welfare and how to best attain it, whereas restricting such decisions to too few people much involves their own innate biases and human limitations and is less likely to accurately perceive the what the public welfare requires. The US Constition only demands and assures "a republican form of government" in each state, and further that a common scheme applying to all equally be used to determine political participation (aka "equal protection"). It is mostly up to the various states to set up a scheme of political participation of its citizens, though the states have largely copied each other closely in this. Many US states determine that convicted felons (felony - a serious offense, usually classified by possible incarceration for a term longer than 1 year) are not qualified to vote, unless the governor approves a petition which restores full civil rights to the felon. Some US states do NOT determine that convicted felons are unqualified to vote once discharged from custody. I don't know of any state that disqualifies a voter for conviction of a misdemeanor or mere infraction, though they are criminal offenses. Most US states suspend voting for a person during a period under which they are under court ordered protection because of severe mental impairment. This grows out of traditional voter qualifications for "competency". People too young or too feeble minded are excluded from voting because they are not thought "competent" to responsibly exercise this power. Felons are similarly regarded as not competent to discharge an important governmental function, that of deciding upon laws and officers of government, because of demonstrated moral turpetide and callous indifference to the welfare of society by their felonious acts. It isn't rational to deny voting on the basis of color or creed or a lot of other characteristics which do not rationally indicate ability to decide a matter of public welfare, but it is thought rational and very important to deny voting to people without traits of mental power sufficient to comprehend the issues or with a character demonstrating antisocial and vicious tendencies. Why should the vote of a pedophile be equal to the vote of another on the question of whether sexual exploitation of children should be illegal? What commitment to public welfare, rather than personal depravity, is expected from the pedophile on this question? Why should a vote on a question of public health and safety have equal contributions from citizen A who will contemplate the matter according to his or her experience and vote, and citizen B who has already demonstrated that health and safety interfer with killing people when you are mad enough at them to want to kill them? (And in Chicago and other strongholds of the Democratic machine, whether you are qualified to vote via Democratic party apparatchiks casting your ballot for you after you are dead depends on how long you've been dead, according to popular myth.)

Re:Florida a potential disaster - PING CowboyNeal

[nullportal]

Regretably I posted to this thread and then the story this is on-topic for popped up after all when I finished posting. Hey Sys Dude CoyboyNeal, how about a little help in moving this thread to the Carter story threads? Or am I stuck here?