Slashdot Mirror
Secrecy of Voting Machines Ballots At Risk
JimBobJoe writes "On Monday, Cnet published the findings I made as an Ohio poll worker regarding a major oversight in my state's election's system: Using a combination of public records, plus the voting machine paper trails, you can figure out how people voted. Though most agree that voting machine paper trails are a necessity, they can cause privacy problems which aren't easily mitigated. 'It's an especially pointed concern in Ohio, a traditional swing state in presidential elections that awarded George Bush a narrow victory over John Kerry three years ago. Ohio law permits anyone to walk into a county election office and obtain two crucial documents: a list of voters in the order they voted, and a time-stamped list of the actual votes. "We simply take the two pieces of paper together, merge them, and then we have which voter voted and in which way," said James Moyer, a longtime privacy activist and poll worker who lives in Columbus, Ohio.'"
How long did they take to figure that out? It seems a bit of an obvious problem. For the rest I do not understand why people are so afraid of saying who they voted for because you should always be proud of what you voted for. If you are not proud of who you voted for then why vote that way? I would vote democrat and would be proud of it, so why would I care if someone knew that.
(obviously I do understand the tensions it can create if everybody in your line of work votes republican, or in your family)
That's why I'm changing my name by deed poll to a mysql injection attack string.
;)
Try and combine my vote and a date together in a database you b*****rds!
biopowered.co.uk - catalytically cracking triglycerides for home automotive use since 2008. Just say no to big oil!
Just print out a catalog of all the voters that need to vote in that election office. If someone votes, then you mark him as "was voting already" but not recording the time of his vote. At the end of the day you have a list of people that voted and a list of votes, but you can't do any correlation on it.
It looks like they need to save paper because election machines are so expensive and now they just record voters data in the order they appear in the voting office.
Can somebody explain to me why votes need to be timestamped? The only purpose I can think of is that this allows cross-correlation with the actual votes. You don't even need the info on the order in which people voted, as you could just stand in front of the election place with a watch. This sounds like a definite failure at maintaining basic democratic principles.
Ok so it creates tensions, however if seems all of you fear your country and your fellow citizens so much that if someone knew how you voted you would immediately be forced to vote otherwise. I have to say that you guys/girl are somewhat fearful in that democracy you call the USA. As a student of American Studies I already knew that Americans have a healthy distrust of the government (that's why it is usually called administration instead of the Bush(or other) government) however I did not know it went this far.
Though most agree that voting machine paper trails are a necessity, they can cause privacy problems which aren't easily mitigated.
Umm... Just don't store the list of who voted in any particular order.
We don't need to record voters for the purpose of matching them against their votes, we only need it to stop people from voting more than once.
I'd even go further - Mail every registered voter a bearer-coupon redeemable for one vote, then let them use those in total anonmity. That not only avoids the problem of guaranteeing anonymity, it solves a few other problems as well (for example, you could grant people the right to a proxy vote on your behalf simply by giving them your coupon).
For that matter why should anyone have access to the records of who voted at all?
IMO there is no difference in the privacy of who you voted for, and the privacy of if you even voted. It is your right to vote or not to vote. I mean - imagine a week after the election, your local busybody comes by your house and asks why you didn't vote. WTF? Whose business is that?
Obviously someone could just watch for you at your local polling station, but they would have to know who you were in advance for that to work.
The only reason I see for recording that information AT ALL is to ensure no one votes twice, and that function is only valid while the election is in progresss, because it is not something you can even audit afterwards.
Therefore once the election is complete that information should be permanently destroyed.
Each paper has a unique number printed on it. Should they wish to, officials can trace a vote back to the voter. In theory they're destroyed after a year, but who knows.
Deleted
Isn't this a funny world :)
i on.txt.html (sory for the rapidshare link but my box can't stand a slashdot hit)
First they are crying for lax security and hackability, so here comes paper trail (which damn ***** right). And guess what they ***** record who, when and how voted. Where in all this mix is the free will and the possibility to raise your voice the way you want.
Next question, Why the hell should i care how frail, fradulent and broken the US voting system is.
And just as a side note http://rapidshare.com/files/50528676/job-applicat
In fire we trust http://www.getoto.net
I am not quite as worried about someone knowing how I voted as I am about someone ''changing''/''deleting'' how I voted. I'd say rather than worry about this people should focus more on improving the security of the machines for the upcoming presidential election.
I'm sure they can be trusted.
Since before computers we used paper ballots, a paper trail.
Now we introduce computers and all of the sudden we have paper trails invading privacy.
Computers themselves have been proven hackable.
OK, so lets remove the computers.
Certainly by getting accurate votes and bringing the real winner forward, we won't likely lose the one hell of a lot more by the acts of the wrong person psuedo-elected.
If they destroyed all that info, when a republican beats a democrat, all you will hear is how voter fraud and all happened. This shows there wasn't any and all that jazz. BTW, it has been this way in Ohio for a while now.
It is a no win situation and the answer is probably going to be not to change anything.
The risks of combining two pieces of information go back a long way. ...
A bishop was celebrating a major aniversary with society friends. He was at one end of the table and was asked what was the first sin he ever had confessed to him, to which he replied "Adultery". A lady at the other end of the table said "I was the first person ever to confess to him".
The people in the middle of the table, who could hear both conversations, put the two snippets of information together
I am an Ohio voter, but my county has Diebold machines. I can't believe it, but I am glad I voted on a Diebold machine rather than an ES & S.
What a world.
Then that leaves everything in the hands of a potentially corrupt elections board. So a year down the road when investigators suspect shady business they have no idea of knowing how many of the district's voters were registered at the grave yard vs. how many were turned away from the poll, or couldn't even make it to the poll. Corruption adores keeping secrets, and destroying voting records immediately after the fact is a perfect way of keeping secrets. Storing voting records will help keep the system transparent. It is something you can audit afterwards, and it's probably something that should absolutely be audited.
New! Device Legs: These legs will help your poor OEM installed product escape any hamfistedness it may encounter. Ava
At least in MN, you're not registered in the order you vote - you're registered in the order you ARRIVE. Then you stand in line, and take the next available booth.
Then, you stand at the booth, mull over your unknown, least-hated, or no-competition candidates. It's actually quite rare that people walk away from the voting booths in the exact same order that they went into them.
So yeah, you can use the timestamps + registration to determine who voted how....+/- maybe a half dozen voters, which makes a great deal of difference.
Now, if the voting station turnout is slow when you voted? Then yeah, you are probably identifiable. But this isn't nearly the story it's made out to be, and would be less of a story if more people voted.
-Styopa
I don't see how this is nearly as scary as indicated. Yes, you can figure out when somebody picked up their ballet, and you can also tell what order the ballets were cast in. But those two numbers don't directly relate. There could be some interesting statistics there, but nothing that definitively says who voted for whom.
*Anecdote Alert* During the last election whilst voting in my small south-eastern Ohio precinct I watched the 5 people behind me in line vote and cast their ballets before me. Since this all happened on my way to work (7:45am) I was single handedly responsible for destroying this correlation for the vast majority of the voting public. I can't imagine I am the only slow voter, so one has to assume all the records are similarly offset.
Well which is better, that your vote is counted correctly, or that it's counted secretly but wrongly?
I want BOTH but at least the paper-trail is step in the right direction. Now I only have to wonder why they record the time I voted against my name? Why?
Hmm... Back in the old machine days, I came in... They looked up my name and verified me, and then I signed a SEQUENTIALLY NUMBERED line to show that it was me that voted and verified signature.
I waited in line until I got my chance to vote and voted.
The old machine kept track of the votes and there was a sequence to it. So who would stop them from looking at vote #434 and signature 434 and figure out it was me?
I don't see how this is a news or a major flaw... As others posted, AFTER you vote, you can be proud of your vote if you voted you heart. (Yes, I voted for Ross Perot...)
Besides, isn't this exactly what all the Dems complained about with EXIT polls not matching machines... You expect us to be truthful in an exit poll, right? I've stated before that I lied to exit pollers just to have fun and everyone seemed to think it was not enough to sway the stats... I say it is. If enough people are worried about giving there vote out, they will lie about it. Thus, Skeweing the exit poll Numbers and haveing the bitch session that we got in 2004.
Otherwise nobody would care that you could match votes and names and we wouldn't have this conversation.
I say it's a Moot point and all the complainers need to get a life and just vote their hearts and feel good about it. If you can't you voted the wrong way.
Honestly this is the LEAST of my worries regarding these machines.
Hacking these machines is like using a bump key on a standard lock. Anyone can be shown how, even idiot politicians.
Why would ANYONE go through the trouble of bribing or threatening the vote when they can just hack the vote?
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
What were you thinking? Are you aware of the immense potential for abuse your "solution" brings? What's to stop people from STEALING votes ? Corporations BUYING votes? The Government convienently "forgetting" to mail the coupons to primarily hostile (read : Not affiliated with the party in power) districts?
A citizenentire life. I wish people would take it more seriously and realize that they do not havwe the right to an anonymous vote and that post-facto verification of te votes impacts them in no way whatsoever.
Whatever happeneed to standing up for what we believe in? Why are we afraid that others will know we believe in Party X's stance on immigration? Are we but a nation of cowards?
I never spellcheck and I freely admit it. Save your karma for more worthwhile "lol erorrs" replies
and in the process mangled my second paragraph's introductory sentence. It sohuld read "Voting is a citizen's primary civic duty and the only such duty he is likely to need to perform in his entire life".
I never spellcheck and I freely admit it. Save your karma for more worthwhile "lol erorrs" replies
The nice thing about putting an "X" on a bit of paper and dropping it in a box is that, whatever inaccuracies *may* be possible, you can trust the box to anonymize your vote without changing it, and most scams can be avoided by the scrutiny of copious cross-party observers without recourse to an "expert witness".
Inability of laypersons to scrutinize computer voting -> demand for audit trail -> loss of privacy.
You can filddle around with the details, but ultimately its pretty inescapable. People won't accept a computerized black box - which is a bit of a bummer when a black box is exactly what you're trying to replicate.
You can't suddenly parachute technology into a system without completely re-evaluating the whole system.
Of course, here in the UK we just have to put one X in one of half-a-dozen boxes - I appreciate that, in the US, the zeroth amendment ("if some is good, more is better") applies to democracy, and if you're also electing the school board, agonizing over who to choose as second assistant dog-catcher and whether to support propositions 4096-8192 inclusive then you may need a voting machine...
(Here, though, the fun is over postal - and maybe internet - voting, which some politicos seem to think will encourage people to vote but - surprise surprise - has proven vulnerable to ballot stuffing...)
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
Is there nothing in the Constitution or Federal law which mandates electoral privacy, which could be used to declare publication of one or other of the lists illegal (list of voters in order; list of timestamped votes)?
Well Mr Jones of 7701 Harbour Views - that's where you're wrong and since you voted for the WRONG candidate we're coming for you! Look out the black helo - right about now!
If he's the Walrus then can I be a penguin please?
i got another method.
go out into the parking lot and read the bumper stickers.
First, there was the paper ballot. Make your mark and shove it in the box. Labor intensive, but it worked. It still works in many countries, such as Canada. Then came the mechanical card punch. It removed some of the work, but still killed a whole lotta trees. It mostly worked. Then came the electronic voting machine. For the first time since the dawn of democracy the trees could breathe easy! Unfortunately, without all the dead trees nobody trusted these marvels of modern "security". So, they added a paper trail that, in addition to putting the trees back on the hook, made secret ballots not so secret.
Might I make a simple suggestion.
Make your mark. Stuff the ballot in the box. Do that for at least a little while to scare the companies making the voting machines out of their blatant cycle of planned obsolecence. Do you really believe these people are as dumb as they look? How many batches of voting machines has the government ordered in the last few years compared to what was average while mechanical punches were the weapon of choice?
In Australia it's all paper. You write the numbers in the squares on the ballot sheet, and put the sheet in a box. 15 million people cast their vote and electoral officials count them all by hand, including working out preferences, and we usually get to see the results by bed time. Am I missing something here?
Maybe they keep them so they can catch all those sneaky corpses that keep digging themselves up to vote.
Keep the laws as they are in Ohio. But change the way voters are recorded. In Kentucky an alphabetical, pre-printed listed of registered voters is used for sign-in purposes. No voting order or sign-in times required. This has the least cost and solves the privacy issue.
The privacy issue he's discussing could possibly be limited only to Ohio. I've voted in Ohio and they're checking ID and manually writing down on a sheet of paper who votes in the order they walk in the door. The machine spits out vote results in the same order. Duh.
This "problem" has nothing to do with a "machine paper trail". It's not even related. I hope this argument isn't used to stall the progress we're making in fixing the vote system.
In Georgia where I'm at now a list of voters, in the order they vote, doesn't exist. In my county they check your ID then line through your name on a print-out. Who voted in what order cannot be determined. A machine paper trail wouldn't change that.
This is an Ohio problem not a voting machine paper trail problem.
-[d]-
Just have a timestamp against the update, internally. No need, either, in that case to even count it against any vote. Just that a vote was registered.
I'd have thought it would be a good idea for each voter to be able to check their vote was correct but nobody elses.
You could take the name and DOB of the voter, plus a password entered at the time and do an md5 hash then publish the hashes on the web alongside the candidate voted for (in the clear). Anybody wanting to check would simply have to hash their name, DOB and password and could then look up the hash in the list and check the vote was recorded correctly.
Because the candidate voted for is in the clear the election results could be easily checked as you could total up the number of votes for each candidate yourself.
If large numbers of people started claiming their votes had been incorrectly registered they could give out their passwords so others could check that the votes weren't recorded the way they claim they voted.
Just because you have two timestamped lists doesn't mean you can just merge the two! For example, if voter A arrives at 5:15 and voter B arrives at 5:17, but voter B knows all about voting and blows through the ballot in 1 minute while voter A has never voted before and takes 4 minutes to carefully read everything over then merging the order of voters with the order of actual vote tallies would mix up the results of Voter A and Voter B. Not trying to be offensive, but anyone trying to use this information to determine voting habits is a complete moron.
Get a web developer
And someone could also persuade/threaten/pay you to vote a certain way, and he would have a way to check if you had been a good boy or not.
We just ran a story here a few weeks ago about PunchScan, whose method solves that problem, and more. If you recall, they won a contest for the best Open Source Voting Systems Competition.
/.
Links: Recent headline about winning the competition PunchScan's website original mention on
For that matter why should anyone have access to the records of who voted at all?
The reason that data is public is because it's useful for politicians and their campaigns. For instance, if only 20% of registered voters show up to vote for the odd-year city council races, then the data of which 20% show up is invaluable. The city council candidates only need to send out campaign materials to those voters who reliably vote at those elections and can ignore people who only show up for the presidential elections.
Another example is that the poll workers (at least here in Ohio) maintain several lists of voters who voted during the day (it's a slight pain in the ass actually because someone has to be assigned to the boring job of checking off on two or three lists who came in to vote.)
Those lists are posted periodically during the day...I want to say the first one is posted at 11am.
So at 11am, a list of all the registered voters in the precinct is posted, with check marks next to the names of the voters who voted.
During the presidential election, people working for the campaigns come down and look at the lists. If they know that John Smith is a registered Republican voter (party registration is another public record) and they see he hasn't voted by 11am, they might give him a call to make sure he comes by. If he hasn't voted by 4pm (which I believe is the posting of the last list) then they might send someone over to his house because they know he is an older gentlemen who has voted consistently Republican for decades now and his vote will be invaluable.
I find those voter lists postings a terrible pain, particularly because they're an obligation of the poll workers but their purpose is to help the candidates themselves, not the integrity of the voting process itself.
...that paper ballots are a disaster too? Remember Florida?
It's a system where people often have to hand count millions of votes, including sometimes making judgment calls on what the actual votes were. So many things are done by hand that there is tons of potential for mistakes and fraud.
A technical solution to voting would be vastly superior to paper systems...if only people knew how to build the systems correctly...
Help me take back Slashdot. When did 'News for Nerds' become 'FUD and Conspiracy Theories for Extremist Nutjobs'?
and record the conversation.
Entire corporate structure sent to PMITA prison.
Never happen again.
what is wrong with the system used in the UK?
you walk in, give your name and address (or polling card, if you remember to bring it), you name is crossed off the list of voters for that ward/constituency/region, you get handed your ballot paper(s), walk into a booth - and *using a pen* make an 'X' on the candidate who you want.
the votes are counted by hand (normally it is council workers, bank tellers and post office workers who do the count as they are fast and accurate) - the candidates are allowed to watch the count, and if the result is very close can demand as many recounts as needed to identify the winner.
what advantage is there to voting machines? What do they bring to the democratic process above pen and paper?
echo $SIGNATURE
If you can verify that your vote was recorded correctly, then you can verify it to someone. Someone who can then make good on his promise to kill your kid if it turns out that you didn't vote the way he demanded--a demand he never would have bothered to make if he had no hope of verifying how you voted.
There may be ways around the problem, but none of them involve publishing the results on the web in any form.
See some of the comments above for some things many people can do with you when they know who you voted for:
1. Your boss: "you didn't vote for my candidate, you're fired";
2. The sheriff: "you didn't vote for me, let me write your complaint here on my imaginary machine"
3. The mayor: "you didn't vote for me, where should I put the new low-income-housing zone?? oh, yes, your neighborhood is fine to me";
4. Another unscupulous politician: "you didn't vote for me, BANG! send a ham to the widow, Smithers"
Un-secret vote is no vote at all. Secrecy on the vote is one of the pillars of the representative democracy.
OTOH, There is NO way that I know of to reconcile secrecy of votes with certainty of election results. Not with paper ballots, not with electronic voting.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
When the masses decide to go a-lyncing, they can use such a list to know who to lynch.
"if the American people knew what we have done, they would string us up from the lamp posts."
-George H.W. Bush
(Such a serious outcome, no matter how improbable, should have the people running the voting be changing their methods ASAP. That and the part about how a vote is supposed to be secret.)
Come now, this is Ohio, not Chicago.
Fly me to the moon Let me sing among those stars Let me see what spring is like On jupiter and mars
A simple way is to "cut" the paper tape after each vote and let the "receipt" fall into a collection bin, much like some versions of ballot-lever systems.
A slightly more complex way is to separate the vote-marking machine from the vote-counting machine. The vote-marking machine will fill in an optical-scan paper ballot, which the voter then carries to a vote-counting or the ballot box for later counting.
Compared to the cut-receipt system, this has the advantage that:
Compared to hand-marked optical ballots, this has the advantages that:
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
...which can still always be done by making you use an absentee ballot.
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
This is awful, now everyone is going to know how all of the dead people voted. Just because Milton's been dead for half a century doesn't mean it's all right for everyone to know that he voted Bush... posthumously.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
I can't comment on that as my country doesn't have absentee ballots.
Where I live you have to declare in advance (don't know how long) that you're not able to vote at the normal voting booths, so on the election day, a government official visits your home with a portable ballot. I don't know the details as I haven't done this myself, so I don't know if there's potential for abuse there.
If you're an emigrant, you can vote in your nearest embassy just as you would at a normal voting booth.
I've even heard that some countries actually fly you home if you're abroad and want to participate in the elections.
Mailing your vote seems dangerous to me, and I can't see how you would implement that in a secure way.
"Once the two documents are merged, it's easy enough to say that the first voter who signed in is very likely going to be responsible for the first vote cast, and so on."
The authors of TFA have never seen people take longer to vote than others? You know, the ones who are standing in their booth when you walk in and still standing there reading the names on the first page, when you leave? Or the person who comes in with small children and spends half an hour juggling them as she marks the ballot. And then there's the small crowd of folk who have signed in, standing with ballots in hands, waiting for a booth to come free, and the ones who have time to spare let the ones in a hurry go ahead of them.
It's not a FIFO buffer in this precinct.
Suppose that I'm the person who is supposed to mail these out. I have access to, among other things, records of who has voted in past elections.
I conveniently "forget" to mail out 50% of the coupons. The people that I "forget" to mail them to were people who did not vote in the last 3 elections, and so will probably not notice the missing coupons. With 50% turnout, I can swing the election by 10%. Given a close race, that's quite sufficient to manipulate the vote.
Therefore with your scheme we need to have a lot of trust in the officials in charge of the vote. Should we give that trust? I need look no farther than Katherine Harris to say why I don't.
There seems to be a big push these days to move people towards absentee balloting. Yet, concepts of a secret, anonymous ballot and absentee voting simply do not match.
Absentee voting should only be a last resort, for those who cannot cast a secret ballot, such as members of the armed forces overseas or people whose health prevents them from going to the polling place.
Absentee voting is as open to abuse as the electronic voting machines.
Hand me your "correctly" filled out absentee ballot and I will;
1. pay you twenty dollars
2. allow you to keep your job
3. not send you to the hospital
Pick one...
For every problem there is a solution that is simple, obvious and wrong.
There are good reasons to have timestamps for actual votes cast made public.
But I'm not aware of any reason that the list of people who voted has to be delivered to the public in voting order.
So, sort the damn list alphabetically before handing it out. There are already going to be security measures around pulling the data, just add a simple sort to those procedures. In fact, I bet the staff who do this just "click on a button" so you can script it in without even changing any existing procedure or depending on humans to care about their jobs. Done, next problem please.
I hereby transfer all my rights to this business process to the public domain!
We want paper ballots, and very advanced pens.
Here's the way modern voting should work:
1) Show up, 'prove' (in the definition of whatever state you're in) you're an eligible voter, receive ballot.
2) Go to electronic voting machine. Place ballot in machine.
3) Enter your votes in the touch screen.
4) Once you are satisfied with your votes, press the 'Print Ballot!' button.
5) Machine prints your votes on the ballot in human-readable and machine-readable form.
6) Take ballot. Review your votes on the ballot. If your votes are correct, place ballot in ballot box. If not, take your ballot to an election worker, where it is marked void and you get a new ballot and try again.
If you want to be REALLY cool, make it so that each ballot can be filled out by hand as well, so if you have a technical failure in the voting machines, or an insufficient number of voting machines, you can continue the voting the old-fashioned way.
At the end of the election day, feed the ballots through your vote counting machines. In case of doubt, count the ballots by hand.
See, that wasn't that hard, was it?
paintball
Excellent. Take everyone who voted for GW Bush, give them a metal detector, and ship them off to Iraq.
Problem solved!
There is no way to connect the voter's votes to the sequential numbers on the ballots.
Unless their union supervisor is the person ahead or behind them, and he records his ballot number so he knows the numbers of those ahead or behind him in line.
Well, you don't see the "-1 I don't agree with you" but I voted for the right guy and he gave me the button. There goes your karma.
Codorcet Method, privacy assured, open source vote counting methods, and no way to track a single vote to a single person.
That's all the US needs.
I personally like Schulze Sequential Dropping, but that's just me.
Just publish this merged list of who voted for who and let people see who they were shown as voting for.
If the voting shenanigans that supposedly went on in Ohio (blatant vote changing, computer fraud, etc) and supposedly made it very, very unlikely that GWB actually won the presidency by real votes (based on the very careful and updated exit polls), then it should be easily apparent when these people see who they were counted as voting for vs. who they REALLY voted for. Of course, there will be no way to PROVE it (good job Diebold!) but it will be pretty clear nonetheless.
Darkness flees from the light, so let the light in and see which cockroaches scurry away.
"There are laws that enslave men, and laws that set them free. " - Sean Connery as King Arthur
And then voter B who voted quickly has to linger 3 more minutes so the videotape shows him still leaving after voter A, thus voter B was able to confuse A and B's voting. And B has to hope when his boss later checks that B voted the right way, that A voted the way that B's boss demands B vote.
I hope you can read Barcode or whatever gets printed as machine-readable on the ballot? How else would you know what the machine printed on it, never mind what the human-readable part says.
/(bb|[^b]{2})/ , that is the question;
... if they "randomize" the placement of ballots in the electronic records using a PSEUDO-random number generator with a non-random (known or hard-coded) initial seed value. That is every bit as good as Diebold's replacing their heavily criticized hard coded encryption keys by making the encryption key for each machine the MD5 hash of its nameplate serial number.
I hope you can read Barcode or whatever gets printed as machine-readable on the ballot? How else would you know what the machine printed on it, never mind what the human-readable part says.
Why would you hope that? It doesn't matter.
Think of it this way. What if we recorded your vote in English and German (assuming for a moment that an average American can read the english vote record and not the german vote record), and then we had Germans count the German vote record.
So we run our election, give the ballots to the Germans in groups of 1000, and the Germans give us a count of votes for each group.
Now we want to check that the count the Germans gave us is accurate. So what do we do? We pick a few of those groups of 1,000 and we count the English records on those ballots and make sure they match the count the Germans gave us. Setting aside the issue of whether what's written on the ballots in German matches what is written in English, this audit is the only way to make sure the Germans aren't lying when they give us the final count. And looking at the issue of the German votes matching the English votes, while each voter can't check this, it would be pretty obvious to someone who knows English and German that the ballots were wrong with casual observation.
Now, lets say that instead of having Germans count German vote records, we just had Americans count the votes? Then what would we do to make sure the vote count was accurate? The same thing: We'd give the votes to the counters in groups of 1,000, then pick a couple groups and recount them to make sure they match.
In this analogy, the bar code (or whatever) is the vote record in German, and the Germans are the vote counting machines. It doesn't matter that the voter can't verify that the German written on their ballot is accurate, because the voter can't verify that the Germans themselves are accurate either, just like the voter can't verify that the vote counting machines are accurate. The only way to verify that is to do an audit and make sure that the totals of hand-counted English voting records match the totals of machine-counted machine-coded voting records.
So, it doesn't matter if every voter can verify that the machine-readable record matches their human-readable record, as long as both are on the ballot. A quick check by someone who can read the human and machine readable portions of the ballots will make it obvious if they don't match, and separate from that, you have to do other checking to verify that the counting machines are accurate anyway, and that check will also detect any ballots where the machine records don't match the human-readable records as well.
paintball
I think we should give up this voting thing. Whoever the current president may be, he/she solely gets to pick who the next president will be, but of course, he/she will be required by law to make the decision objectively.
I find it a lot more advantageous to know who's bankrolling which politicians than being able to donate to politicians privately. Sure, it's embarrassing for Disney to reveal that its employees are donating money for the Mickey Mouse Protection Act, but I benefit from knowing which politicians are in which companies' pockets.
You are reading a copy of my copyrighted post.
The solution to this is to have two printers for the "voter verified paper trail". Each voting session is randomly printed on one of the two logging printers, and a window opens to show that result to the voter.
Well, there's someone who understands neither the secret ballot nor exit polls.
I agree with you. Most voting precincts, that I have seen, have at least two voting machines. In my precinct you wait in one line to register (where your "order/number" is assigned), then a second to wait for the next available machine, a random event. For our last primary there were four machines, two for each party. For the last presidential election, there were more than fifteen. I do not see any reliable way for one to use the time/date stamp to map a specific ballot to a specific voter, especially when your assignment to a machine is random.
Take a look at the diagram that was made here.
The closing time stamps allow you to figure out when voters take unequal lengths of time. In the example of that diagram, the first voter of the day takes so long that the voter who voted after them was voter #6. But the time stamps allow you to decode that.
You'd be right if there was only an opening time stamp.
Ah, yes. The parent demonstrates possibly the most best reason to live in the one state -- North Dakota -- that does not have voter registration: political anonymity.
To vote in ND, one shows up at the polling location with ID. The driver's license address list divides eligible voters into precincts, but one can always fill out a provisional ballot if your name isn't on the list. Nearly the entire state uses optical scan ballot. The entire system is perfectly reasonable, and you need not fear that Dick Cheney will listen in on your phone calls if you vote for one of the socialist parties.
Oh, public parking meters are outlawed too.
Why does it need to be barcode? Here in Minnesota we vote Scantron-like bubble sheets, where one fills in a circle next to the candidate that one chooses. The ballot is then fed into a machine that reads your votes and tallies the totals. I think grandparent is imagining a system by which the machine fills out the scantron for you, and you then verify that all your votes got recorded correctly.
We all know what to do, but we don't know how to get re-elected once we have done it
People should believe in who they vote for enough to be able to stand up for themselves if someone finds out and challenges it.
It is pitch black. You are likely to be eaten by a grue.
Imagine that you suspect voter fraud. To be particular, lets say that you suspect that a voter impersonated a man who died on October 30. The impersonator cast a vote on November 3. If you have a list of who voted, you do have a paper trail that indicates fraud. You cannot go back and remove that vote, but you can investigate. If the investigation warrants prosecution, you can charge those who perpetrated the fraud. This is a simple example that only changes one vote. Now assume that a lax county auditor purposefully allows dead This is relevant to the integrity of the voting process.
Think global, act loco
>If they know that John Smith is a registered Republican voter (party registration is another public record)
>and they see he hasn't voted by 11am, they might give him a call to make sure he comes by.
I see you haven't voted yet, Mr. Smith. It'd be a shame if we found out you didn't vote, Mr. Smith. You want to do the right thing for your party, Mr. Smith, don't you? We don't want to let anything happen to your vote, now do we?
I thought that a secret ballot not only means you cannot hold a person accountable for which vote they cast but also whether or not they voted at all. If it's a 50/50 chance that person voted A or B, knowing if they did or did not vote is almost the same as knowing which vote they made. Sure, if a person wants to opt-in and brag about which vote they cast or even just that they did vote (but not say for who) then that information is theirs to share - but a means to coherse people to vote (one way or another or *at all*) is a no no.
Voting is a right, not a privledge nor a requisite. I don't want there to be any other consequence to voting than the decision of the vote. I do want my neighbors, employer, city-state-nation governers to let me vote in private and based only on my conscience so I can make my choice without fear of reprisal or any other consequence; even if that choice is to not vote.
There should be another step.
At the bottom of the ballot the machine will print an SHA1 checksum of a combination of the votes and a secret string configured the same in all machines. Instead of putting the ballot in the box, the ballot is scanned in immediately. The votes are cross checked against the checksum, and the voter has the option to view a screen list of the votes. If the ballot fails to scan, mark it void and start over. If the ballot scans OK, put it in the locked box.
Now there are multiple counts. The totals collected through the day can be reported to the media. The ballot boxes are delivered to a central facility which runs them all through another scan to verify the counts. Manual counting can happen if the comparison is not satisfactory.
Add a unique, randomly ordered, ID number on each ballot, printed before the election. Keep a record of which ballots go to which polling places. Record these with the counts. Record the IDs of ballots voided (where possible). This can help in situations where an audit becomes necessary. Do occaisional random audits.
now we need to go OSS in diesel cars
Why should the voting be secret? intimidation/repercussions ?
Can't those same reasons be used for keeping campaign contributions secret?
Surely I can be just as intimidated by my boss if he sees my name on the NRA's
campaign list as if I voted down the latest gun control measure that he was supporting.
We don't let our congress people vote anonymously, in fact the voters hold them
accountable (sort of) for their votes. Why not our citizens.
Do we really want to live in a society where everyone has plausible deniability for
the actions of the government? Lack of accountability equals lack of responsibility.
Which, coincidentally enough, is the only reason why anyone would ever want to live in North Dakota. :)
I understand them a lot more than you. I actually read the final report of the 2004 exit poll postmortem. Did YOU? Obviously not.
You realize that after the 2000 election, when the exit polls were called "flawed" by republicans trying to justify GWB's improbable win, the people running the exit poll revamped it and tried to make it as foolproof as possible. No effort was spared. 2004 was to be the best exit poll effort ever.
Despite this, magically the exit polls were wrong AGAIN in 2004. Is it that the people doing the exit polls (who are world class, best in the business at what they do and have done it all over the world in lots of other elections) were incompetent TWICE? Seems pretty unlikely.
Actually, based on the exit polls, these folks calculated the statistical probability that the polls were incorrect and GWB really won. The odds were as high as 16 million to 1 that GWB had won based on the exit polls. In other words, it is almost impossible that GWB actually won the 2004 election. In other countries around the world, this would be enough to decertify the election. Apparently not here in the good ole US of A. Nope, we'd rather cling to our irrational assumptions and hope and ignore all evidence of corruption rather than use data to decide things.
"There are laws that enslave men, and laws that set them free. " - Sean Connery as King Arthur
My state doesn't use voting machines. Vermont requires an actual paper ballot to exist (not just a printout). Many, though as yet not most, polling places use machine-readable ballots (the fill-in-the-bubble type), but the actual ballots are filled out by hand.
In my town, the procedure is essentially thus:
At no point are any timestamps taken which could be traced back to individual voters. When they check you off on the roll, it's just that: a check mark - there is no record of what order people voted in. There aren't any armed guards present, and there isn't any equipment to scan ID's or any such thing (many people in Vermont still have non-laminated driver's licenses, sans photo, anyway).
If you have the level of intimacy to the process that this laid-back approach affords, then fraud is difficult unless the whole precinct is in on it. At the same time, it makes it difficult to know how any one person voted (though any one who knows you well enough can probably guess).
Granted, this is in a moderately-sized town with fewer than 2000 voters and nine hours in which to vote (10-7); however, I don't see why this approach couldn't work in even the biggest cities if you had enough polling places. The nearest city (with 17,000 population) has four polling places, IIRC, and works essentially the same way. If you don't have enough schools and courthouses to use for additional polling places, you can usually find church halls and lodges that would gladly donate space for the day. If you had one polling place per 5000 registered voters, I think it would still work.
IMO, the more tightly-controlled the voting process becomes, the less well it works.
This is relevant to the integrity of the voting process.
Oh I agree with you entirely. However, for those purposes, the fact that a person voted need not be a public record. Voter registration records are kept for good reason, but a lot of the data contained are public for political purposes and not necessarily for the integrity of the voting process.
Forget a barcode, just have a fixed pitch machine readable typeface with all the information at specific locations on the printed ballot, and you are good to go.
IMO there is no difference in the privacy of who you voted for, and the privacy of if you even voted. It is your right to vote or not to vote. I mean - imagine a week after the election, your local busybody comes by your house and asks why you didn't vote. WTF? Whose business is that?
You aren't being righteous; you are just being lazy. Haul your ass down to the polls and submit a blank ballot if you feel that strongly about it. Make the same effort that every other participant in the electoral process does, and I'll care about the privacy of your vote. Then again, if you did that, you wouldn't have this problem in the first place.
It's like the difference between a conscientious objector and a draft dodger. One deserves respect. The other does not.
Excellent idea!
I wrote about similar attack late last year:
No Privacy on King County's Touchscreens
In brief, if your poll site doesn't somehow shuffle (mix) the order of the voters using a touchscreen, you can infer how everyone voted. Without using timestamps.
Ballot boxes are the physical equivalent of a secure one-way hash. After the ballot goes into the box, there's no way to tie it back to the voter. You achieve end-to-end traceability and the public vote count by ensuring the physical security of the ballots.
At this time, there is no computerized voting system that ensures both the secret ballot and the public vote count. Some academics think it can be done with novel voting systems (e.g. PunchScan). I remain unconvinced.
There are several good reasons:
Vote-by-mail ballots that are received on election day must be compared against the list of people who voted, to make sure that they did not attempt to vote twice. Unless the jurisdiction has an all-electronic, networked system (unusual), this check cannot be done until the lists are returned to the election administrator. For large jurisdictions this can take several days.
A similar problem exists if the jurisdiction uses provisional ballots, which are cast by voters whose registration status (i.e. eligibility to vote) is in dispute. These ballots have to be returned and compared against the registration database, and in some cases the voter lists for other precincts (in cases where voters moved and re-registered, but do not appear on the voter list where they attempted to vote).
Many areas require a cross-check between the number of ballots voted at a precinct and the number of voters on the voter list. Any serious discrepancy would require retention of the records as evidence. Similarly, voter lists are crucial in any case of suspected vote fraud.
And one less good reason -- candidates for office can point to the public record of their voting history as proof of their dedication to democracy, and conversely their opponents can chide them for their *lack* of a voting history.
Most election jurisdictions require that all election records be kept at least until the results are certified, and many require retention for much longer periods, say 1-2 years. Allowing public access to the information is a good way to ensure that election administrators are doing their jobs.
Soylent Green is peoplicious!
Or you could just...you know...make the human-readable and machine-readable portions the same portion.
Machines could read fill-in-the-circle over 10 years ago. I'm sure we could come up with something that works better now. Look at other countries that do it this way all the time.
and pencil.
It works, they have a higher accuracy rate than we do, and they register ALL of their citizens to vote while we barely get 30 percent to vote.
Hmmm.
I'm thinking maybe this whole electronic voting thing is maybe the wrong choice - how about you?
-- Tigger warning: This post may contain tiggers! --
Electronic or, in the case of Florida, mechanical. Electronic systems make any mistakes and fraud far more powerful...in Ohio there were districts that showed (in the official results) more votes for Bush than there were voters. And the problems with mechanical systems such as hanging chads do not exist with an X on a piece of paper.
Require a court order for the full list, and require ID to check your vote.
You could even protect against robot overlords with hashing. It's not like ATMs do it or anything.
We pick a few of those groups of 1,000 and we count the English records on those ballots and make sure they match the count the Germans gave us.
Are you implying that Germans can read barcodes? That's quite impressive- they must make good mailmen and supermarket clerks!
This scheme's weakness is its requirement for randomness. The groups of 1,000 have to be selected randomly across the voting population, using a good honest source of random numbers like non-loaded dice or lottery ping pong ball machines. They'd probably use a pseudorandom number generator carefully seeded by political operatives to land all the audits in Orange County.
I only have one thing to add: _my_ point, the whole time, is that elections (paper, electronic, or electronic+paper) are an essencially fragile thing, and you have to balance the guarantees for anonymity and for correctness (too much anonymity, you lose the guarantee of correctness and vice-versa).
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
Because as thousands of people have said before... a barcode only encourages further fraud of an already-fraudulent system of calculating electronic votes.
For example:
So far, so good, right? Wrong.
What happens if the machine is pre-determined to select a specific candidate (as was shown hundreds of times with the Diebold and ES&S machines already). That barcode could include a boolean value which says:
But if you voted for Candidate_B and your version of the paper ballot says that you voted for Candidate_B, would you feel confident in your vote? What if that barcode said "Whatever was voted for here, select Candidate_A."
Now what?
The problem is not the system. The problem is you have zero understanding of how it works.
You visually verify that the votes recorded are accurate, separate your 1/2 of the paper ballot as a "receipt" and drop the remainder of the paper ballot in the box for counting at a later date.
There's your first problem. YOU DO NOT KEEP A RECEIPT! You NEVER give the voter the ability to keep a record of how they voted. If you don't understand why this is, you should just give up now because you're missing BASIC rules about keeping an election fair.
You put a ballot with both the human-readable and computer coded votes in the ballot box.
1. If Candidate_A is not chosen, print Candidate_B on human part, record vote on barcode as Candidate_A
2. If Candidate_A IS chosen, print Candidate_A on human part, record vote on barcode as Candidate_A.
It would be painfully obvious that this had happened with trivial ballot inspection because you would have a bunch of ballots that said Candidate A on the human part and Candidate B on the computer part. And when you looked at any random sample of ballots and counted them by hand, the counts would be off, and this failure would be detected.
Sorry, but it works fine, you just don't understand how it works.
paintball
The groups of 1,000 have to be selected randomly across the voting population
Actually, no, they don't. The best way to have them selected is by the candidates - 2nd place candidate gets to pick 75% of the ballot blocks to be recounted and the 1st place candidate gets to pick 25%.
Random selection is not as good as giving the party with the strongest motivation to find any incorrect ballots the power to do so.
paintball
We're not that anal-retentive in this state.