Slashdot Mirror
Re-Vote Likely After E-Vote Data Mishandling
davecb writes "A California judge is likely to order a Berkeley city initiative back on the ballot because of local officials' mishandling of electronic voting machine data. A recount was not possible because the city failed to share necessary voting records, a violation of election laws. In a preliminary ruling Thursday, Judge Winifred Smith of the Alameda County Superior Court indicated she would nullify the defeat of a medical marijuana proposal in Berkeley in 2004 and order the measure put back on the ballot in a later election."
This should have been done in 2000
yes, I know it would have been expensive.
The Kruger Dunning explains most post on
They have infested Berkeley for the last 40 years. No, wait... those were hippies. So, all's not well in the most liberal suburb or the most liberal city in the US?
That's unpossible!
For God's Sake, Legalize it already.
But there were so MANY problems then. Where do you start?
Particularly when both parties seem to benefit from voting problems. If you lose, you claim that it was "stolen". If you have to cheat to win, well, you win don't you?
We need a third party.
The case points to the dangers of electronic voting systems, which make it harder to ensure fair elections, Luke said.
How about "make it relatively trivial to rig an election".
Great stuff, dude, but should not we count them votes first ?..
In Soviet Washington the swamp drains you.
> the city failed to share necessary voting records
Dude, quit bogarting all the voting records. Count, count, pass.
And always to the left.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 is the magic number.
A recount was not possible because the city failed to share necessary voting records, a violation of election laws.
Can the citizens of the city file a class-action lawsuit against the city for violating their right to vote?
What were they smoking?
I don't particularly buy the argument that electronic voting is somehow more or less difficult to tamper with than paper voting. Sure there is no guarantee that the hardware and software is protected and will truly offer a fair vote - but can you really say the same thing for paper? Remember those ballots have to go to a machine that counts them. That machine is not perfect - it is just as prone to error and manipulation as your electronic system. Of course with paper ballots you can resort to a manual recount but that is costly and time consuming. Moreover if you think electronic and mechanical counters are unreliable a human is a disaster.
I'm not saying that the current electronic voting schemes are good. There is clear evidence that the majority of them are flawed and should be replaced or at the very least fixed. I am saying however that making blanket comments that electronic voting is either more or less secure than traditional paper ballots is rather misguided. We're an electronic generation and so we are more attuned to make use of technology rather than more traditional methods. Along those same lines we are used to seeing all the flaws of technology and miss out on the more basic flaws in other systems. After all, hanging chads anyone? http://en.wikipedia.org/wiki/Hanging_chad/
Assuming 9/11 had still happened, etc. the world still would have been far better off with Gore as president, if for no other reason than that Gore wouldn't have been stupid/venal enough get us into the Iraq quagmire.
Since these machines were also used in the concurrent Presidential election of 2004, this pot lawsuit is nothing but a clever ploy by the Republicans to invalidate 2004-2008 presidential term and put George W. Bush candidacy up for re-election in 2008! Either that, or I am running out of tinfoil.
FOUR MORE YEARS!!! yeah baby
Obama likes poor people so much, he wants to make more of them.
Maybe the officials just, y'know, forgot where they put the voting record...I mean, it's really easy to do, what with that funny smelling haze always hanging over the city...
/me misses living in Berkeley...
This guy's the limit!
This has gone far enough. There is boat loads of evidence that our government no longer counts our votes. The chair of Diebold should have a bullet right in the FACE for treason against everything this country stands for, and most particularly DEMOCRACY.
If they continue down this path of not counting votes, there WILL be violence. Is that what the Republican and Democratic parties want? VIOLENT BLOODY REVOLUTION?!?
FUCKING ASSHOLES!
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
Say it with me: count twice, count by hand.
The democratic process relies on people who have more interest in how the candidate is chosen than who the candidate is; in other words, little old ladies. These are not the people who are asking for this technology.
How we know is more important than what we know.
Your mistake is an issue of scale. It's relatively easy to slip in one or two false paper ballots. It may not even be that hard to make the machine a little more picky when it comes to checking punchouts on the democrat side of the ballot. But there's backups, paper backups, that get checked and confirmed, even if at a small ratio. Someone watching the pile of ballots go through the machine can find it odd that mostly left-leaning candidates get kicked out as incomplete ballots. Little things can be snuck through easier.
But electronic... that's what you want when you want to do BIG lies. Just off the top of my head from the last 2 POTUS elections... cards coming preloaded with thousands of votes. Systems designed so that if you left a busy machine collecting votes and forgot to empty it out, it would kick over at 16384 to -16383 (funny how that happened in left-leaning counties, eh?). Funny "glitches" (I hate that word when it comes to elections) that lost entire counties of votes. Concerns that the system might be undercounting Demos and overcounting Repubs. Software that made it exceedingly easy to switch your entire ballot to republican on the last page, without really telling you it was. Or software that just preselected your candidates for you.
Add too all that... NO paper trail... NO hard copy in your hand to confirm... NO audit trail to be checked to ensure fairness and honesty. Just trust the magic box will tell the other, main, magic box, the correct vote, hope for the best, and ignore the man behind the curtain promising Ohio to Bush. Also, ignore those pesky pollsters and statisticians, they don't actually know what they're doing.
Really, the 2000 Florida situation was unique, because a swing of a few votes either way made a huge difference. But at least ya'll could go back and CHECK. In '04 all you got was "here's the number, if you don't like it too bad". I'd rather have a few weeks of checking to make sure everythings fair, rather than an instant biased result with no appeal.
The scale of the flaws of electronic voting far outweigh the flaws of mechanical voting. With mechanical, a few votes can get screwed up. With electronic, a whole election can.
If I knew the wedgies I gave you back in 6th grade would have resulted in this . . . I might have taken a moments pause.
so just how much of your democratic process will you give up to save a little money?
If you mod me down, I will become more powerful than you can imagine....
I'm not referring to little old ladies; they're not the ones making comments like "The case points to the dangers of electronic voting systems, which make it harder to ensure fair elections." I'm speaking to people like Luke who make blanket comments that are honestly unfounded. We should be focusing on improving/repairing current voting systems and seriously look at removing the private sector from the equation completely. Unless you enjoy sharing something in common with the 17th century.
If by that you mean "money" which pays "lobbyists" then I will agree.
Otherwise, no. We have two parties and that makes it too easy for them to run negative campaigns against the other party. You might not have heard of me, but I disagree with everything about THAT candidate the YOU don't like.
The things he did that you didn't like? I didn't like them either. And when you elect me, I won't do them!
That is MUCH more difficult when you have to split the campaigning between 2 other parties. Now you have TWO people saying that they don't like the stuff you don't like that that other guy did.
1) "Voting" Machine that prints out a combination human/optically readable ballot. Human verifies the human part says what they want it to say. We don't want observers confirming this, that's why privacy sleeves have been used for years.
2) "Sorting" Machine that sorts the ballots based on the optically readable ballot. Human flips through the stacks and verifies all of the human parts say the same thing for that race. Observers can confirm.
3) A dumb "Counting" Machine that counts a stack of ballots (without needing to know whose ballots are in it). Human puts the resulting number in the tally under the human readable name on the stack. Observers can confirm. Totals of the entire stack before sorting and after counting each race to confirm that nobody misplaced a stack of ballots.
At each step of the process, a very simple machine (low cost, minimum requirements for certification, etc) performs a single task (and hopefully it will perform it well). And following every machine step comes a step where humans can verify that the step was performed correctly. Since the individual machines don't contain any state about the election at all, voting machine malfunction cannot lose votes, and any malfunctioning piece of equipment can be replaced by any other piece that works. If standards are defined for each step of the process, then multiple companies can compete, driving down prices, and in the event a company is unable to provide sufficient numbers of voting machines, the remainder can be bought from other companies.
Furthermore, many of the tampering problems with paper ballots (whether cast electronically or not) can be taken care of with forethought and work. Ballot stuffing with leftover ballots (or duplicates, or casting the ballots people turn in as incorrect) can be stopped by issuing numbered ballots and invalidating the remaining or wrong ballots. Likewise, lost ballots would be known based on the gaps in numbers. Preventing this from identifying the voter (based on, say, their position in line relative to a planted observer) can be done by packaging the ballots in blocks of 100 or so, pre-randomized within that block. This way at the end of the day, only the unused ballots of open packages have to be invalidated, the remainder can be invalidated block-by-block (bigger blocks: more random and more to invalidate from an open package at the end of the day. smaller blocks: less random but less cleanup at the end).
If I have been able to see further than others, it is because I bought a pair of binoculars.
But electronic... that's what you want when you want to do BIG lies. Just off the top of my head from the last 2 POTUS elections... cards coming preloaded with thousands of votes. Systems designed so that if you left a busy machine collecting votes and forgot to empty it out, it would kick over at 16384 to -16383 (funny how that happened in left-leaning counties, eh?). Funny "glitches" (I hate that word when it comes to elections) that lost entire counties of votes. Concerns that the system might be undercounting Demos and overcounting Repubs. Software that made it exceedingly easy to switch your entire ballot to republican on the last page, without really telling you it was. Or software that just preselected your candidates for you.
Add too all that... NO paper trail... NO hard copy in your hand to confirm... NO audit trail to be checked to ensure fairness and honesty. Just trust the magic box will tell the other, main, magic box, the correct vote, hope for the best, and ignore the man behind the curtain promising Ohio to Bush. Also, ignore those pesky pollsters and statisticians, they don't actually know what they're doing.
Yes I understand all that, but that doesn't change the fact that you can't ignore the flaws in previous systems and the possible advantages to this one. Any new system is full of bugs. This is why I always avoid the first few generations of a product just because I know there are issues that need to be worked out and I don't want to have to deal with that. This is no different except the implications and reprecussions are far more drastic (politics is a bit more important than say your car afterall). We shouldn't be trying to abolish it altogether, we should be trying to fix it to make it work. In my view the big fixes that need to be made are these:
That's a small list really but you get the idea. And again I think you should reconsider if paper votes could somehow not have a huge flaw. Deadmen voting? Hanging chads? Lost ballots? Miss-labaled voting cards? Furthermore you're not considering the political machinations behind those previous elections. While the voting was screwed up both times in both cases the polical machines behind both parties were just as flawed if not more so. Lets not forget the people barred from voting in Florida because they simply shared a name with a convicted felon. Paper ballots would not have saved you from that one.
I nver said who I felt shuot win.
My point was, it was so close,and so questionable, that there should have been a recount. The election should not have been left for a court to decide who is the president.
Yes, I would have prefered Gore because he is more technically savvy, and understand technology.
Yes, I would be saying there should have been a recount even if he became the president.
The Kruger Dunning explains most post on
Smells Like Republicans (the vote-rigging special!)
The good thing about electronic voting is it allows more voters, and over the internet voting would be a great step forward however, as electronic voting is in it's infancy, it is still easy to manipulate the outcome of an election (as we have seen recently). It's essential that electronic voting systems are hardened.
More citizens involved in the running of 1st world countries is essential, because it's not left vs right anymore, it's the masses vs the power elite (or plutocracy or ogliarch what ever you want to call it), vested interests and other smiley gladhands.
Maybe the vote held was manipulated, but with a higher rate of participation it may not have mattered. What it clearly illustrates is the higher the level of apathy towards a vote the easier it is for a determined set of individuals to affect the outcome. The bottom line is a country is only as free as the amount of 'citizens' participating in it's democracy.
My ism, it's full of beliefs.
A proper paper trail needs to be provided including a receipt for both the voter themself and the voting district in the event of a recount.
No receipt to the voter. Why? They were historically used by unscrupulous men with power over others to verify votes. IE If you worked for me, I could tell you who to vote for, demand to see the receipt showing your vote, and fire you if you didn't vote correctly.
The design, production, and upkeep of electronic voting systems needs to be taken out of the the hands of the private sector and instead be taken care of by the government.
Doesn't guarantee non-partisan.
Lets not forget the people barred from voting in Florida because they simply shared a name with a convicted felon. Paper ballots would not have saved you from that one.
True, paper ballots or not, you have to pay attention to all aspects of the voting system. Personally, I like the fill in the bubble voting cards. They're both machine and human readable.
I don't read AC A human right
You are flat wrong.
Electronic voting (registration and/or counting) is based on two premises:
I have yet to hear anyone support the claim that it is possible to hold a fair election with an electronic voting machine.
If you (or anyone) really can write software which meets the above two standards, I have a software (nuclear power control) job just waiting for you, name your price.
The thing about things we don't know is we often don't know we don't know them.
You got it - nicely summarised: Electronic Cheating Scales, while Manual Cheating is Hard Work. Paper voting systems provide a backup counting option which removes the element(s) which make cheating in this environment possible, while electronic voting recounts are just as susceptible to cheating as the original count - the elements which make cheating possible in this environment, in the first place, are still there.
I cannot articulate the degree to which electronic voting scares the ker-snarf outta me. Electoral fraud in a paper-based system takes a *lot* of effort - you practically need a totalitarian state in place to do it large scale. Electoral fraud in an electronic system requires, in the best case, s single clever coder who provides the mechanisms, and some henchmen to do some dirty work - maybe.
All that being said, electronic voting systems are probably an inevitable change. So how do we mitigate the danger? Off the top of my head: 1) The source code must be visible to anyone who wants to see it 2) Incentives for finding issues/vulnerabilities must be made available (c.f 'Bill Gates Should Buy Your Buffer Overruns' from earlier today - maybe instead of MS the gov't should pay?) 3) The change-management process must be rigorous, to say the least 4) the creation of the binary and its distribution must be a public and incredibly tightly specified process (checksums, hashes, etc. out the wazoo ).
This is like radar detection, only with a lot more at stake. Leap-frogging occurs with radar detection, and the Bad Guys come out on top for a while. This cannot happen.
The road to stopping this from happening is paved by the GPL. Code must be freely available (as in beer and freedom - the code can go anywhere anyhow, and there can be no charge for retrieval). Millions of prying eyes must turn the stones of electronic voting source and brush them up and make sure they are indeed rocks and not something else.
Hell, electronic voting systems should be the wheel on which the flesh and skeleton of closed-source code is finally broken in the court of public opinion.
[17] Leary, T., White, C., Wood, P. R., Bhabha, W. D., and Wirth, N. Lambda calculus considered harmful. In Proceedings
You could always have some guys go over special made dies with microscopes, or maybe have someone write the code in hex.
The key part to any electronic voting system has to be the possibility of manual verification, not necessarily requiring it as part of the process. An equally effective system would use some sort of system of printed ballots (like the mixed system described by parent), but following a fully open and government-regulated specification. All voting districts would require two machines (per booth), from different manufacturers and independently certified in their accuracy, to count the votes. Each machine would be cheap (economy of scale if an effective federal ballot standard was designed) and immediately verified by an equivalent counterpart manufactured by a competing supplier.
Any discrepancies between the two, independent of their cause, would be immediately flagged. Regulations could require the two disagreeing units to be replaced, while a manual (human) recount of the paper ballots is conducted on the questioned ballots, and a sampling of previously verified ballots in the group. In close elections, or in the rare events of multiple failures (human disagreeing with both machines), a full recount of the ballots can be scheduled for the following day using machines from a neighboring district, in addition to human verification.
Independent verification is the key. Neither a single computer nor human can be trusted as both unbiased and incapable of errors, but a deterministic combination (one that can be repeated using a recorded trail in the event of a recount) ensures fairness.
The United States, Canada and most of Europe do not have to worry about overpopulation. In fact, with the baby-boom generation reaching retirement and death, under-population is a concern. Canada's (my country) population would be in decline where it not for immigration.
Imposing child population limits in the areas I have stated in the above paragraph is just silly.
The good thing about electronic voting is it allows more voters
Um, how do you imagine that might happen?
The reasons people don't vote include things like not wanting to be on Jury rolls, and the time it takes to get to the voting place.
How does having a touch screen instead of a punch card make a difference?
(no, "electronic voting" is not "internet voting"... the problems there are a whole different kettle of wardheelers)
I don't care who they are and I especially don't care what political party they are affiliated with, whoever broke the law here should be shit-canned, as should the Diebold voting machines. Didn't the state of California already bar them from elections for breaking election rules? I know they got caught applying an uncertified update just before at election.
This is simply unacceptable, and screw anyone who only gives a shit if a certain group of politicians is involved, or if you don't approve of the result. Unverifiable voting machines are breaking the foundation of Democracy.
The enemies of Democracy are
Why not have both? Paper is just double-checking the electronic, making it harder to hack in remotely, or change a motherboard or data-cartridge while no one is looking.
In general, polling sites have at least one over-seer from each party. If one of the other guys is trying to shuffle papers ballots around, it's going to be a bit trickier because ballots are big, and hard not to be noticed. They're big compared to a CF card. Big compared to remote known windows exploits.
--
Looking for a C/C++ job in Silicon Valley?
Qxe4
as a berkeley student and marijuana enthusiast, sweet.
Beware the Jubjub bird, and shun the frumious Bandersnatch.
Half the point of smoking weed is to show Uncle Sam the finger. Gets a bit pointless if it is legal!
Engineering is the art of compromise.
WHY the fark are we (Americans in this case) not using Internet based voting??? Seriously. "Ohh, that has too many flaws" or "Think of the hacking possibilities".
Paypal. Banking. Credit card transactions. Shareholders voting on public company things. The security implemented in all of these things far surpasses the security given to real-world Democratic voting. Today I actually printed the voter registration sheet, filled it out, and mailed it off. I will get a voter card in about 35-40 days, mailed to me. Which could be stolen from my mailbox (I think some kids already do this around my house). Couple that with a fake ID and you just voted as someone else. What is that fortune in Linux? "Chicago: Where the dead still vote... early and often!". Just ticks me off. It'd be so easy. Your real voter card comes with a security code on it, like a CVV2 code on credit cards. You go to a state or federal voting website, let's use vote.gov, and put in that info. You log in with your security code and drivers license and vote. What the hell is the problem. Just don't let Diebold be in charge of it.
e-voting has about 0 to do with the Internet. E-voting uses sneakernet to takes votes from ATM-like machines to a central counting machine. At most the machine might make a POTS call to the counting machine.
If they did use the Internet they'd probably be like "zOMG hackers!!!" and actually implement some encryption algo's that could potentially make voting more secure then ever before. As it is, they just put some un-signed numbers on memory cards that are then basically feed into an Excel spread sheet.
If you guys didnt know, the EFF helped with this case. http://www.eff.org/news/
Moderation Totals: Flamebait=2, Troll=1, Redundant=1, Insightful=6, Overrated=1, Underrated=1, Total=12. (not mine)
This happened last week and was first reported here. Gawd slashdot editors are slow... :-|
http://yro.slashdot.org/comments.pl?sid=252289&cid =19909291
No receipt to the voter. Why? They were historically used by unscrupulous men with power over others to verify votes. IE If you worked for me, I could tell you who to vote for, demand to see the receipt showing your vote, and fire you if you didn't vote correctly.
We have laws protecting people against this already - if someone actually did this you can land them with one helluva suit.
Receipt is pointless and worthless.
I fail to see how a paper receipt which would allow voters to verify who they voted for worthless. Moreover I fail to see how the paper receipt the machine keeps is any more worthless than the paper ballot you would prefer to turn in. Same damn thing. Paper is paper.
Doesn't guarantee non-partisan.
Since we all know that the government is the epiphany of proper management and lack of abuse. I mean politicians would never do things to further their own careers at the cost of the public.
Nothing guarantees non-partisanship. Nothing. Do you hear me? The people at the place where they print the ballots can screw with it just as badly as Diebold and again I bring up the case of voter being barred in Florida. Moving to the public sector however changes it from a profit driven business to a public service where (while still quite possible) corruption is less likely. How is moving to public a bad thing when Diebold flat out admits they want one side to win? Also for the record just because it is government doesn't mean that a politician runs it personally. This way all the politicians would be vying for control keeping closer to balance than a private company whom only a few investors control.
True, paper ballots or not, you have to pay attention to all aspects of the voting system. Personally, I like the fill in the bubble voting cards. They're both machine and human readable.
The receipts the machine keeps would be human readable. Hell you could even make it punch in cards that the voter can visually verify after they're done voting.
So you want to add massive increases in costs (I do mean massive) for what comes out to a false sense of security. Likely since it will have less overview than existing OSes the new one will be massively LESS secure thus opening up tons of abuse possibilities. Like say having non-trivial to detect code tightly integrated into it that allows for even worse abuse.
So you yet again want to add massive increases in costs (I do mean massive) for what comes out to a false sense of security. Since we all know that no one will ever be able to make a reader/writer using either reverse engineering or publicly available descriptions. Not to mention that a new interface will likely have bugs and less overview than USB does.
No security is perfect. With enough determination and skill you can get into anything, ANYTHING. The point of security is not really to be an impenetrable wall, but rather a wall so damn high you don't bother climbing over it. Also this would be an initial cost, one which would likely be returned in savings over not having quite as many mechanical break downs in the future. There's a reason electronic systems are better than mechanical ones - moving parts break.
Electronic voting (registration and/or counting) is based on two premises:
Bullshit! It's a voting machine, for crying out loud! All it does is count! My pocket calculator has a fancier OS than a voting machine needs!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
We have laws protecting people against this already - if someone actually did this you can land them with one helluva suit.
There were laws about it back then as well, it still happened. Then there's always the opposite approach - vote purchase. With a receipt showing your votes you'd be able to prove how you voted to a paymaster.
Quite a fanciful remark there since it is impossible to make a perfect system without at the very least extensive redundancy. Are you telling me that your paper ballots are 100% perfectly reliable? If so a thing called "hanging chad" would like to differ.
Most people who want a paper ballot aren't talking about punch cards. Personally, I'm partial to scanotron fill in the bubble sheets. People today are familiar with them from school, they're aware of what counts as a good vote and what doesn't via printed instructions or even training by poll workers.
The whole point of paper ballots is that you enable a good audit trail. Paper ballets can be counted by hand if necessary, designed right they can be fed through multiple vendor's machines, etc...
In a good system you'd recount, hand count at least a few districts chosen by random each year to make sure the machines are doing their job.
It also helps that the machine readable portion is the same as the human readable portion. A barcode doesn't cut it in my mind, it'd be difficult to tell whether the barcode means 'candidate A' which I voted for, which is printed on the ballet, or 'candidate B' if scanned by a machine.
I work on computers, and have a background in programming and security. I really don't like what I've heard about current generation computer voting systems. Too easy for a single individual or group to jigger the elections their way, to be able to set vote totals to whatever they want.
You see, there's a strategy in computer security known as 'defense in depth'. Pure computer voting machines don't have it. I only have to compromise one system to completely jigger an election. With paper ballots - I'd have to worry about recounts, hand counts, multiple counting machines, etc...
Keeping extra ballots from being slipped in is a matter of physical security, which isn't even solved by current evote machines.
I don't read AC A human right
If we combine this article with the previous article and hook the E-Voting machine up with the new Online Random Number generator maybe we'd have a better luck a selecting "elected" officials. Lord knows it seems like the public can't do it right. Just a thought I had seeing the articles right next to each other.
:)
Or maybe that's how the E-Voting machines already work?
...I can has re-vote on Bush v. Kerry 2004, plz? Kthxbai.
Knowledge is power. Knowledge shared is power multiplied.
"I'd rather have a few weeks of checking to make sure everythings fair, rather than an instant biased result with no appeal."
In Australia, with hand-counted ballots (closely observed the whole time by scrutineers of all parties), we have the results by the same evening. Or the next day if it is very, very close. And we have preferential voting to contend with (i.e. we must not only count the primary vote, but also measure the effect of the other preferences, where relevant). In many electorates, we have a result within a few hours. Almost always one of the political leaders can declare victory (and they always wait for the loser to concede).
So manual counting *can* be fair and efficient. Our only concern would be the possibility of "double voting" and "dead people voting" - i.e. the lack of identity checks on voters when they turn up at a polling booth.
And voting in Australia is compulsory, so we cope with a manual count even though it covers about 95% of the eligible voters.
If your government tells you they cannot afford it, I'd say they are not trying hard enough.
I am anarch of all I survey.
Sorry, I meant to say "can declare victory *on the evening* of election day."
I am anarch of all I survey.
You've just described two forms of electronic voting. If a machine is doing the reading then it is electronic voting, even if there is paper involved.
A paper ballot designed to be read by humans is by far a superior option, it scales well, is easy to check and leaves a verifiable trail.
No machines at all are involved, and regardless of what you say a human brain is a great deal more accurate when it comes to reading a piece of paper.
Votes have always been hand counted in my country, and it is very difficult to game the system on a massive scale. Electronic voting machines are a scam.
I continue to be astonished that so many /.ers will defend electronic voting machines. If we dumb them down to merely counting what the voter inputs, we get a glorified scanner. Just use the scanners that paper fill-in-the-bubble ballots use. You get both an electronic count to satisfy the media's craving for instantaneous results and our thirst for 'news', and a countable paper ballot we can argue over. Sheesh.
But any kind of electronic system without at least a paper receipt I can go back with and ask to see my vote and how it was counted is preposterous. No, wait. It's criminal. Using these things that Diebold and others are making is criminal.
Just so you know, I'm a life-long Republican. Spare me the Florida/Ohio flames. I've voted most of my adult life in precincts run by Democrats, from the Ward Clerk to the wonderful old ladies as poll workers. I've monitored polling places, been removed from the rolls for failure to respond to a postcard that was not stamped by the city clerk, (one of 3,500 or so, amusing) and been run from one polling place to another to figure out where the heck I vote. After all that, I just want my vote counted. I can live with the honest results. If you think Republicans have just started election fraud, you must not have lived in Chicago. And I direct your gaze towards the topic, Berkeley. Not a Republican stronghold last time I checked, but it's been a while...
Remember, also, we are also a Republic, and the states elect our President and Vice-President. It will be up to the states to do elections. If the Federal Government gets much more involved, I'll be asking my representatives to stop it. It's bad enough to have Miami and Dade County running elections, for which they are demonstrably incompetent to do, but to trust the Feds? Ha. I like thousands of small-ish screwups better than one massive 'Gee, it doesn't seem to be working' Charlie Foxtrot.
You people who want electronic voting, you have no idea the trouble you are asking for. You'll get one of these outcomes:
- Something like Windows, so insecure and compromised you can't tell the 'real' apps from the viruses. As if I need to provide examples. THIS we trust?
- Something like Ubuntu, so promising until you actually use it. Test me on this. Ask around. Ubuntu installation is nightmare on your street. Actually, Debian is a better example. Upgrading Debian is like smoking a grenade. No, wait, Linux in general is the example. It pretty much works great. Until it doesn't. Then God Help You. The user community will mostly proclaim you incompetent, and recommend you get an expert in. Might as well use Windows. (Oh dear, her come the flames....)
- Something like OS X, wonderful until you find out that you really have to trust the provider, and in the end it can be pwned like all the rest of them.
Lord Above, please give me a piece of paper I can mark. And people to take a look at the machines and test them.
Save us from the poor blighters seeking some Grail of -=Electronic Voting=-, as if this is a panacea for ANYTHING.
Stop them.
PS- Imagine this scenario:
- Machines built, softwware open-sourced, studied by thousands, and declared 'excellent'
- Election held, results whacko, machines checked.
- Software found to be tampered with
- Officials agree, no paper receipts, no way to tell what happened.
- Hilarity Ensues.
Berkeley on a state-wide scale? I think this is bad. Just don't.
deleting the extra space after periods so i can stay relevant, yeah.
Oh yeah, and the States *really* needs to take the management of elections (drawing riding/county/whatever borders, manning the polling stations, etc.) out of the hands of partisans and create an arms-length institution to run the show. Stuff like gerrymandering just shouldn't be happening.
No receipt to the voter. Why? They were historically used by unscrupulous men with power over others to verify votes. IE If you worked for me, I could tell you who to vote for, demand to see the receipt showing your vote, and fire you if you didn't vote correctly.
Simple solution: don't print identifying info on the ballots. Just the votes, time (to the closest minute) and which machine the vote was made on. Then IF (and it's a pretty big if) a company demanded to see a voting receipt, they would have no way to prove it was the emplyee's actual receipt. They employee could have traded it with someone, or picked it out of the garbage.
As for the specifics of how the voring machine would work- ever see an older cash register? It has a 2-ply roll of receipt paper- one ply stayed in the printer as a journal, the other gets spit out, cut, and handed to the customer as a receipt. Just use something like that. The 'journal' tape can be seen under glass, allowing the paranoid voter to compare with the 'receipt' copy. If a re-count is needed, the 'journal' spool is fed thru a counting machine, which counts the votes again. (Votes are in human-readable AND machine readable (ie: barcode) format). If there are questions on whether the barcodes match the human-readable votes, then the journal spool can be run past human eyes, and the tallys compared. In the worst-case scanario, the voters could be asked to return with their receipt copies, and those could be scanned. As long as a statistically significant percentage come in, the votes can be verified with pretty good accuracy.
As for the voting machines themselves, it is trivial to make a secure server that sits in the corner of the room. It boots off a DVD, with another DVD for the canadate information. The terminals are just micro-atx boards in a locked box mounted to the back of a touch-screen LCD on a pedestal , with the printer sitting next to them. They all boot over the network off the server, and run a simple program. After all, all you need to do is show the canadate's names and allow the user to choose on or the other. Votes are kept on the server, multiple drives, etc. When polls close, the server calls the 'local' result server and sends the results. It's only a few dozen names and totals, so it's a short call, even with heavy encryption. The 'local' results servers call the 'regional', and they call the 'national'. Viola!!! Results from a nation-wide vote in minutes!
.
Are there issues/problems/exploits with the above idea? Yes. But it's a hell of a lot better than Diebold machines that can be disassembled and have their drives removed, etc.
UPDATE Votes
SET voteCount = voteCount - 10000000 WHERE candidateName = 'Sane-Alternative';There is no need to thank me.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
While I was for quite some time a proponent for e-voting with printed receipts I've become more and more reluctant to praise its benefits. The problem is that as soon as there are irregularities or "glitches" the whole system shows its fragility: there could have been 'preloaded' votes, certain votes might have been wrongly counted (while printing out the correct receipt), a voting machine have even been rigged by the manufacturer himself etc etc. All this resulting questioning and arguing about what might or might not have happened is extremely detrimental to the people's believe in democracy.
Many developed countries such as Australia mentioned in the parent post but also e.g. Germany or France still use the ballot box because it simply is the most fail-safe, transparent and direct way of counting votes (although unfortunately there are trends toward e-voting). You don't have to be a computer expert to know how exactly the votes are counted. People walk into the booth make a mark on the paper (illustrated by an example) walk out and put it into the box. It might take a while to count, but to protect the integrity of the voting process the country should spare no expenses to ensure that every vote is counted once and only once. And even so the costs/overhead should be negligible.
If the counting takes a bit longer, then for Christ sakes let it take longer! It's not that the whole country hangs in limbo or some sort of anarchic chaos between election day and the day the new government is sworn in. Let it take two months let it take three months - as long as the votes are counted correctly that's all that matters! (Btw - in the case of the 2000 elections there was still ample time to the count ballots, the inauguration day was several weeks away. The media is to blame for creating an atmosphere of crisis or utter urgency - until the supreme court stepped in and everyone just rolled over and sighed "Finally!" when they should have all cried out "WTF??")
And when you gaze long enough into the code, the code will also gaze into you.
So ? If you have a paper trail, you can at least prove that there was something wrong with the election, or the counting process (if you recount and arrive at a substantially different number of votes). Then you can initiate corrective action (for example, a really, really meticulous recount), followed by making sure that it doesn't happen again (like sticking whoever tried to rig the election in jail).
Electronic voting without a paper trail ? Sure, here are your results. Doubt them ? Sucks to be you. The machine is infalliable and you have no way to prove anything else.
For a problem of the complexity of electronic voting, it would be a lot cheaper to run paper ballots for the next hundred years or so than it would be to write provably correct distributed voting software (and hardware; there's no point verifying the software if you haven't verified the hardware it's running on, network protocols it's using to communicate, etc).
I am TheRaven on Soylent News
The pro-marijuana, open-source hippies, are just upset that they forgot to show up for the ballot for some reason, once again, so they hacked the system...
Love many, trust a few, do harm to none.
Um, thanks, but we have CITIES that have larger population than your COUNTRY.
Okay, no we don't. But New York City is over a third, almost half the pop of your entire country. We definately have STATES that have larger populations than your COUNTRY.
So, why is it so hard for the 'professionals' to make a simple, secure E-voting method???
With all due respect, no, it isn't. I recommend the RISKs forum as essential reading for anyone working in technology.
I agree on the paper ballots point, but when trying to understand a complex system, one must see how the system is behaving and not be distracted by how the system should be behaving.
I find it very curious that despite the simplicity of 'paper ballot' voting and the known problems with electronic voting, the system (our democratically elected government) still insists on favoring DRE's over paper ballots. Clearly there is a systemic behavior here we are failing to account for.
Which explains, if I can be forgiven, why I tend to jump hard on anyone who suggests that electronic balloting is good, or is feasible, or can be made feasible, or amounts to anything other than a distraction from the truth.
It's not about cheap, or convenient, or promoting economic concerns, or little-old-ladies fumbling with technology they can't understand. Electronic balloting has the potential to interfere with our ability to self-govern. And for that reason alone it should be beyond consideration.
It interferes with our number one objective: we must retake the cockpit.
The thing about things we don't know is we often don't know we don't know them.
Maybe, one day, you too will become a professional, and then perhaps you too will understand.
For now, perhaps the things you don't understand are the things you should be learning about.
The thing about things we don't know is we often don't know we don't know them.
Receipt is pointless and worthless.
Then you are an idiot. You may not like them. You may find many reasons why they are "bad." But they are not pointless. Digitally sign every vote and you'll have a way for every individual person to ensure their vote was counted in the manner they wanted. Much of the complaint about Florida in 2000 was trying to guess the "intent" of the voter. Well, if you have a recipt matching to a vote, you will know if the vote was counted in accordance with your intent. Since I have come up with a single "point" of "worth" that means your curt dismissal is wrong. Please feel free to argue against receipts, but at least use valid arguments.
Learn to love Alaska
Ooh, nice ad hominem. Imply I'm stupid, instead of answering the question.
If this is what passes for logic in today's schools, I'm not surprised they turn out such poor programmers.
Simple solution: don't print identifying info on the ballots. Just the votes, time (to the closest minute) and which machine the vote was made on. Then IF (and it's a pretty big if) a company demanded to see a voting receipt, they would have no way to prove it was the emplyee's actual receipt. They employee could have traded it with someone, or picked it out of the garbage.
What about the 'vote inspector' is waiting just outside the voting center? It still wrecks the anoniminity of the vote. Unless you provide a receipt forger right in the voting area, in which case the inspector wonders why you took so long... As I mentioned in the other response, you not only have to worry about extortion type attempts, but bribes as well($100 bonus for voting right!).
(Votes are in human-readable AND machine readable (ie: barcode) format).
Barcodes aren't very human readable. For the amount of data needed, bubblesheets work just as well or better, and the SAME information is easily readable by both humans and machines.
As for the voting machines themselves, it is trivial to make a secure server that sits in the corner of the room. It boots off a DVD, with another DVD for the canadate information. The terminals are just micro-atx boards in a locked box mounted to the back of a touch-screen LCD on a pedestal , with the printer sitting next to them.
How do you make sure the secure server isn't jiggered with? How to you prevent somebody from disconnecting the jack from one of your 'simple' voting PCs and using sofware on a PDA or micro-laptop to interface and jigger votes? How do we make sure that some dude in the election software office doesn't slip a worm into the system? Reflash the PC?
Personally, I think that I'd hire the people from the Nevada gaming board who drafted up the rules concerning slot machine certification. Now THERE were some security minded people.
I don't read AC A human right
Do you realize that a computer program will only produce consistent results as long as the hardware can be trusted, and that hardware cannot be verified as trustable? Have some fun browsing the RISKs forum if you want real-life examples of well funded, well meaning world-class professionals trying (and failing) to create reliable systems for such things as nuclear reactor control systems, missile guidance systems, flight control software, etc. And these people aren't, as a rule, facing well-funded and motivated human opponents trying to subvert their code. These are mostly stories about how Mother Nature outsmarts us without even trying.
The thing about things we don't know is we often don't know we don't know them.
What about the 'vote inspector' is waiting just outside the voting center? It still wrecks the anoniminity of the vote.
:-)
Um, tampering with ellections, threatening people to make them vote a certain way, and paying for votes are all illegal. If someone tries to 'inspect' your vote, point them out to the cops and/or media.
Unless you provide a receipt forger right in the voting area, in which case the inspector wonders why you took so long... As I mentioned in the other response, you not only have to worry about extortion type attempts, but bribes as well($100 bonus for voting right!).
There will always be people who throw their receipts away. Simply pick up one of those out of the garbage on the out the door.
Or just don't tell your company when you are voting.
Barcodes aren't very human readable.
Um, that's why I said "human-readable AND machine readable". As in BOTH. For instance, it would say "Candidate A" in text, then the barcode for Candidate A. There are well-known and much-used barcode formats for encoding text. Use one of those, and anyone with a barcode scanner can verify that the barcode reads the same as the text.
Or use your 'bubblesheets'. Whatever. The point is, it allows for quick, automated recounts (feed the journal roll(s) into a counting machine), while still allowing for manual (human eyes) recounts if the machines are questioned.
How do you make sure the secure server isn't jiggered with?
"Jiggered with' how?? Have an armed guard standing over it, making sure only authorized people approach it.
How to you prevent somebody from disconnecting the jack from one of your 'simple' voting PCs and using sofware on a PDA or micro-laptop to interface and jigger votes?
The network cable is attached to the MB, which is inside a LOCKED BOX attached to the back of the monitor. I think the voting officials would notice if someone dropped to their knees and started picking the lock. Anyway, the communication be encrypted. Unless the 'PDA or Micro-Laptop' had the right encryption keys, the server would throw a fit, and the cops would throw you in jail.
How do we make sure that some dude in the election software office doesn't slip a worm into the system? Reflash the PC?
How would a 'worm' be introduced? The networks are strictly local, except for a dial-up modem that is 'dial-out' only, and only used after polls close. As for fiddling with the results thru other means- that's why you need the journals and receipts. A random sampling of voting districts are automatically re-counted by running the 'journals' thru a tallying machine. It's a trivial machine that simply reads barcodes and adds 1 to the appropriate candidate's count. Nothing to fiddle with. In addition, a certain percentage of THOSE districts get a 'manual' recount (Human eyes read the name on the journal, human hands make a mark on paper. Humans add the marks up).
I mean, really- these are all implementation-stage issues. I beleive the idea itself is sound.
Do you realize the output from sample interpreted code you provided cannot be trusted if the interpreter cannot be trusted? Compiled code is similarly only as trustable as the compiler.
... nuclear reactor control systems, missile guidance systems, flight control software, etc.
Too bad there isn't open-source software that can be used to compile code. Then people can simple LOOK at the code that goes into the compiler, and see if it is trustworthy. Oh, well, maybe someday....
Do you realize that a computer program will only produce consistent results as long as the hardware can be trusted, and that hardware cannot be verified as trustable?
I can buy a Dell, an IBM and an E-Machines PC, run that code on all of them, and get the same results. I don't quite get your point. Off-the-shelf hardware is a comodity item these days. It doesn't matter who I buy the PC (or the parts!) from- if it runs, it should run the code identically.
These are all very, very complex systems. A machine that adds votes is the exact opposite- a very SIMPLE system. I simple refuse to beleive that it is soooooo hard to make a 'trusted' system that adds 1+1 and gets 2.
One of the things "professionals" know is that being able to see the source buys you nothing unless you have complete confidence in the person who wrote it. Let me once again recommend you read through Ken Thompson's classic Reflections on Trusting Trust to gain a better understanding of your faulty assumption.
Let's presume, for the sake of this argument, that you meant to mention a collection of hardware which did not require different kernel-level drivers; in other words, hardware where you really could "run the same code on all of them". Let's further presume that you have found a way to create code which is provably 'correct'. Your argument fails because your requirements are incorrect.
The goal of such an electronic voting system would not be to be able to run the same code on all of them but rather to prevent code which is not the same from running on them.
We can create a test case which says something to the effect "If Candidate A is selected twice and Candidate B is selected 3 times, then the software result should be a win for Candidate B with a total of five votes cast, three for Candidate B and two for Candidate A.
We could then run this test case against software running on your selected hardware and verify the correct result. I think this is what you are meaning when you say "get the same results".
But how would you write a test case to verify something like "if the date is November 2nd and the time is between 8:30 AM and 4:30 PM and at least 2000 ballots have already been cast on this machine and the voter selects Candidate A, clears it, enters Candidate A again, clears it, enters Candidate B, clears it, taps the lower right hand corner of the touch screen 3 times within one second.....then the result should not reflect a transfer of 50% of all Candidate A votes over to Candidate B." A scenario like this is completely within the technical capability of anyone with moderate software skills to create, but beyond the capability of even the most advanced tester to verify.
In a nutshell, it is easy to verify it counts correctly, but impossible to verify that it doesn't count incorrectly.
And it's that "counting incorrectly" part that is unacceptable in a voting system.
"There is none so blind...." If you should decide that perhaps relaity is more important than you own personal beliefs, then feel free to rejoin the rational, scientific discussion parts of humanity are trying to have. Until then, though, I really haven't got the time to waste.
The thing about things we don't know is we often don't know we don't know them.
One of the things "professionals" know is that being able to see the source buys you nothing unless you have complete confidence in the person who wrote it.
... beyond the capability of even the most advanced tester to verify.
:-), but the underlying software SHOULD be simple:
If you can SEE the code, you can verify what it says. It doesn't matter who wrote it.
something like "if the date is November 2nd and the time is between 8:30 AM and 4:30 PM and at least 2000 ballots have already been cast on this machine and the voter selects Candidate A, clears it, enters Candidate A again, clears it, enters Candidate B, clears it, taps the lower right hand corner of the touch screen 3 times within one second.....then the result should not reflect a transfer of 50% of all Candidate A votes over to Candidate B."
LOOK AT THE CODE. If it contains a series of complex 'if...then' statements, then trace them out and see what they do. But it shouldn't contain anything like that anyway. All the code needs is "if Candidate A selected, then add 1 to Candidate A's total". Period, that's IT. Any thing more complex than that is automatically suspect, and needs to be looked at.
A scenario like this is
Wrong. Especially if the code is open to review.
For example, look at the 'qbasic' code I wrote above. It's trivial to follow the flow, and see what happens. Would you agree that it doesn't have any statements that allow for the changing of votes in a surreptious manner? Would you agree there are no 'if the date is Nov 2...', or 'if the following sequence if followed...' statements?
There, you just reviewed my code, and verified it. You did good, considering that's "beyond the capability of even the most advanced tester".
And, before you point out that this is 'just an trivial example', let me say that ALL voting software can be this simple. Okay, you probably don't want to use Qbasic
1) Get input from user
2) add 1 to the appropriate totals
3) Print
4) Goto 1
Yes, there are details I'm not mentioning. People should be able to select a candidate, and later de-select them and re-selecte another, right up to the point they comfirm their vote. There are multiple races, multiple referendums, voting the party line, etc. But these DETAILS are all easily handled. I'm talking about the 'big picture', not the details.
You didn't even read the Ken Thompson link, did you? My patience with your unwillingness to learn is wearing thin.
Your first qbasic statement, "cls" means "clear-the-screen".
Are there any other statements in qbasic which mean "clear-the-screen"? Probably no other documented statements, but what about undocumented ones? Could the statement "A0000001" also mean "clear-the-screen"? What about A0000002? What about A0000001 followed by A0000002? Have you got time to test them all?
The gist of Thompson's paper is that a compiler/interpreter can be written to interpret any input as having any meaning. That's what they do. Which means one could be written to interpret A0000001 as meaning "clear-the-screen", and the source code which creates the compiler would not necessarily have to contain code statements which say "interpret A0000001 to mean 'clear-the-screen'". Instead, the compiler could interpret a statement like "interpret CLS to mean: clear-the-screen" as meaning "interpret CLS to mean: include code which interprets A0000001 followed by A0000002 as meaning clear-the-screen, and also include code to allow stealing of elections, and while you're at it, also interpret CLS to mean clear-the-screen, just so no one gets suspicious."
The upshot is that you can't even trust a compiler you wrote yourself if it was compiled to binary by someone elses compiler.
This is one of the things "professionals" know, and one of the reasons why "professionals" know it's so hard to make a simple, secure E-voting method.
I'm going to hazard a guess that you have not spent the better part of a 20 year career performing software assurance testing on high availability systems. Your assertion that all code behavior can be discerned from a review of the source is incorrect. However, it's clear you are unwilling to accept that coming from me, and unwilling to accept the views of other "professionals", so I really have no choice but to leave you in your delusion.
One final freebie from years of experience. Whenever you find yourself using the word should you might want to think twice. "Should" essentially means "if reality acted like I want it to act". It is representative of wishful thinking, and it is less often an indication that the system is performing in a way contrary to how it was designed to respond and more often an indication that the system is performing in a way contrary to how you think it was designed to respond.
The thing about things we don't know is we often don't know we don't know them.
The upshot is that you can't even trust a compiler you wrote yourself if it was compiled to binary by someone elses compiler.
The problem to that situation is that the person who coded the compiler you use to compile your compiler would have to know when they coded it that you would eventually use it to compile your compiler, and would need to know how your compiler was coded (again, long before you actually coded it) in order to back-door their compiler to back-door your compiler to back-door your code.
Sounds ridiculous, doesn't it? Sure it does, because it IS ridiculous. And if you're still worried about it, write your own damn compiler from scratch.
Sheesh.
Your assertion that all code behavior can be discerned from a review of the source is incorrect.
Code is instructions. The computer follows those instructions. A human can also follow those instructions.
10 Print "hello"
20 end
There- I can easily see that this code wil print the word 'hello' and then end. I can compile the code (or run it thru an interperator) and see the results are... the printed word 'hello', and the program ending.
Again, we are NOT talking about huge, complex programs here. We're talking about code that asks "Candidate 'A' or Candidate 'B'?" and adds one to the appropriate variable. That's IT.