Slashdot Mirror
Dutch Voting Machines De-Certified
Peer writes "The Dutch government has officially decided that it will no longer use voting machines (Babel Fish Translation) for elections. So it's pencil and paper from now on. Activists have been campaigning against the use of voting machines for some time."
Will there ever be a day when electronic voting will be viewed with the same or greater level of credibility as paper voting?
Hey everybody, let's march on Amsterdam for machine sufferage! You too Hedonism Bot!
-Bender
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Krijg nou wat!
There's only two things I hate in this world: people who are intolerant of other people's cultures - and the Dutch.
More
Only when tampering with the machine will not make it possible to cheat the vote, and there are very few (although >0) designs that allow for that.
(rot13) rpbzbab@tznvy.pbz
I think electronic voting is excellent for surveys, no more than that. Where there is binary information that can't be physically viewed, there can be a flaw, a hack, a security hole. The only hole you will ever find in a paper is if you do it yourself with a punch.
For instance, one of these but with a human-readable bar code along the left side.
(rot13) rpbzbab@tznvy.pbz
Machines are good at two things:
Marking ballots.
Counting ballots.
But there must be ballots. These ballots must be human-readable at all stages between the marking of the ballot and the canvassing of the election. A human must confirm the ballot is what he intends to vote before actually casting it.
A machine that reads/speaks or writes/marks a paper ballot is invaluable to help the mobility or visually impaired and the illiterate and it can reduce costs in multi-precinct polling places or in polling places that use more than one language.
A separate vote-tally machine can greatly speed up the vote count.
However, you must have a human-readable piece of paper, plastic, or something else we call a ballot in case the vote need to be recounted by hand, and this ballot must be examinable by the voter before he makes his vote official.
Likewise, the ballots must be stored in a location that is protected from tampering until after the election results are final.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Google Translate gives a better translation than Babelfish:
http://www.google.com/translate?u=http%3A%2F%2Fwww.minbzk.nl%2Factueel%2F112441%2Fnieuw&hl=en&ie=UTF8&sl=nl&tl=en
As long as there is an operating system created by a company as inherently "evil" as monopolysoft.
One cannot, in all conscience, trust them to "Do the right thing"
If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
Punch cards.
We need to reinvent punchcards.
Make the ballot display on a computer screen and let the user select the options he wants. When you are done, I punches a human readable card with the results.
Those results are placed into another box by hand after the voter looks over the results. You do the precount from the computer booth, then you feed the cards into a card punch reading machine for the official vote.
recount all you want. you will also have a paper trail. problem solved.
Im a gamer, not a grammer major. This post is full of spelling and grammer mistakes.
To summarize the article, hopefully more readable than the Babelfish translation:
The Dutch government sees too little added value in using voting machines, and claims that developing new voting machines will be expensive, and won't solve the problem of the possibility of eavesdropping.
"Money is a sign of poverty." - Iain Banks
Or rather; when the possibility and scale of fraud possible with voting machines becomes equal or less than that of paper votes.
Let's not kid ourselves here; paper voting isn't perfect either.
Paper is easier to commit fraud with, but voting machines allow for much larger scale of fraud if they are hacked.
When we find a way to guarentee a limit to this scale, voting machines will become more reliable than paper.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Two Words:
Hanging Chads
You may be able to make a machine that it's possible to verify the votes for, but how do you make a machine that nobody could tamper with. You could probably replace the entire internals of most voting machines without anybody noticing.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Well you only missed it by 8 minutes. Nice try, please play again tomorrow.
It seems a bit ironic that all this fuss is made about the secrecy and accountability of those voting machines, while the parties that we (the Dutch) elect with these machines are so expressedly in favour of recording every bit of information about the citizens.
Next week a law proposal will be accepted that forces telcos and ISPs to keep records of all communications by all of their subscribers, not just those for which some tap warrant has been issued, and store them for 18 months or maybe more.
And of course we already are the number-1 country for taps on telephony and internet traffic.
The next proposal, to require everyone using an internet cafe or buying a mobile phone to present an ID (and presumably all those sessions and phones to be registered with that ID) was brought forward this week.
All this for the sake of easing the finding of criminals. It seems strange that it is not required to register each citizens vote as well, as that could provide as much of a clue as what sites he is visiting.
Vaporize those chads using lasers for punching.
Yeah, that's it. Lasers. Mounted on Sharks.
You forgot: "4 Day Cube disproves 1 Day God"
We can't do this in the US, because that means disenfranchisement of those people who are illiterate.
I'm sorry, but if you can't figure out how to vote, then maybe, just maybe you don't really need to vote.
Once upon a time people had to care about who they were voting for, enough to learn how to participate in the process. If you don't care enough to learn, why should we tailor a system that caters to your illiteracy?
If that is what people want, why not put pictures on the ballots like all the other illiterate countries do?
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
All for the low low price of only $1000 per voter. Seriously. Paper is cheap, and has served us well for many years. How much is too much for something that only does as good as paper. For the cost of electronic voting machines to be worth it, it has to be many times more reliable and accountable than paper. What is the true cost of purchasing, operating, and maintaining voting machines that we can guarantee are significantly better than paper. And even then, is going from 99.9% accuracy on the vote to 99.99% accuracy on the vote really worth spending billions of dollars on voting machines?
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
I don't understand how hanging chads ever became so much of a problem. If I was voting in a place that punched holes in pieces of paper, and my ballot didn't end up properly punched, I'd ask for a replacement, and do it again until it looked right. How did so many people turn in invalid looking ballots that it made such a problem in counting?
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
When I have mod points, I mod down any comment involving both lasers and sharks (such as this one) down with a -1, Troll.
I cast my e-vote last year through the internet here from the US.
The system seemed to work fine(apparently it was an experiment) and reasonably secure: you had to send a form to your consulate for confirmation of eligibility and in return you got a secure code to cast your vote.
It even had a paper trail if you wanted. I hope they will keep that system at least.
Sure, but he is proposing that the holes are punched by machines, not by near sighted and tired old people.
:)
So A perfect production.
Hot needles melting holes in thin plastic strips. Wont decompose for another 100.000 years, unless someone burns them
Complexity is a measure of our ignorance...
The only way to verify that voting fraud is not committed is to get rid of anonymity, until then all voting systems can be compromised.
Knowledge = Power
P= W/t
t=Money
Money = Work/Knowledge so the less you know the more you make
are the way to go, just you say. The resulting ballots are then readable by both humans and machines, while the voting machine remains stateless.
This gives you the advantages of the machine (UI, automated counting of the ballots), without sacrificing privacy (since the voting machine doesn't keep track of vote totals) and security (as long as the voter checks the generated ballot, no tampering with the voting machine will help; as long as machine-generated counts are hand-checked at random precints, tampering with the counting machines can also be detected).Naturally we need spinning cutting ring presses to mark the holes. ELIMINATE THE CHADS!
(No, not the African Chads, you racist. But you can eliminate people named Chad if you like.)
"You can either have software quality or you can have pointer arithmetic, but you cannot have both at the same time."
Chad is INNOCENT!
If you can read this, I forgot to post anonymously.
Just the one usually, as soon as my missus opens her eyes in the morning :-)
My long baited line failed to hook you t'would seem.
If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
I don't know about averages, but in some polling places thousands of people vote.
Also, in some US states, votes are counted in a central location rather than at the polling place. This can be hundreds of thousands of votes being tallied in a single county election headquarters.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Paper certainly is cheap, and it's been around a long time--a much longer time than exit polls, on-the-spot reporters, and cable news. We've now grown to expect that a winner will be declared in State X fifteen minutes after the polls close there. Used to was, people waited days to know the election results. The famous (or infamous) DEWEY BEATS TRUMAN newspaper headline from the U.S. presidential election in 1948 is certainly an example of premature "certainty" in election results. After television arrived, people could stay up all night "watching the election returns" and retire to bed, exhausted, still not knowing the outcome. It takes a little longer to count paper ballots, but it's certainly worthwhile considering some of the alternatives. We just have to get over our desire for almost-instant gratification.
"Here's what's happening. You're starting to drive like your Dad..." - Red Green
I can't see why these companies don't come up with a decent design for electronic voting. It could be easy, traceable and could be much better then paper voting.
For each person voting generate a unique person id. Then for every item voted on generate another unique vote id. Print a receipt to every person showing there person id and vote ids. Make this database of vote ids and what was voted for publicly accessible on the internet. This way I can determine if my vote counted and this can easily be audited by everyone! Next have a private database that links every vote to the person id. You could even have a third database of person id to identifiable information. This can now be audited internally to fight off multiple votes from the same person.
Problem solved! Voting that is accurate and traceable.
More importantly, why did we get so worried about disenfranchising someone who wasn't smart enough to recognize these invalid looking ballots?
Find coupons in Greeley
I can't see why these companies don't come up with a decent design for electronic voting. It could be easy, traceable and could be much better then paper voting. For each person voting generate a unique person id. Then for every item voted on generate another unique vote id. Print a receipt to every person showing there person id and vote ids. Make this database of vote ids and what was voted for publicly accessible on the internet. This way I can determine if my vote counted and this can easily be audited by everyone! Next have a private database that links every vote to the person id. You could even have a third database of person id to identifiable information. This can now be audited internally to fight off multiple votes from the same person. Problem solved! Voting that is accurate and traceable.
suddenoutbreakofpithytags
here in brazil you use voting machines since what...1994? Don't know why you guys are so worried about.
Is it the Chad?
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Design it so that the only way to open it is from the front, and put a big, yellow, tamper-proof "If this seal is broken, do not use this machine" seal across the gap that changes to say "VOID" if you try to peel it off. Teach people to look for the seal.
Check out my sci-fi/humor trilogy at PatriotsBooks.
And what happens when the difference between two candidates is only 0.05% after the votes are counted, and the loser demands a recount? Suddenly that difference between 99.9% and 99.99% accuracy matters very much.
In the U.S., the entire fuss over electronic voting machines began because the 2000 presidential election hinged on determining a majority that was within the error margin of spoiled ballots. The problem is that paper voting will always produce spoiled ballots. It doesn't matter how simple you make the process (e.g. "Just put in an X in one of these two boxes"), a certain percentage of the electorate (e.g. the mentally ill, the illiterate, the very elderly, the mentally handicapped) will screw it up.
So in typical fashion, U.S. politicians went overboard and tried to "fix" the spoiled ballot problem with electronic voting machines. The problem with that method is that you'll never get people to have 100% trust in computerized voting. Someone, somewhere, will always make accusations of vote fixing, even if you create a paper trail. So now the pendulum is swinging back to paper ballots.
I'm just hoping I won't see another presidential election so close in my lifetime, because no matter what voting technique you use, the loser will cry foul in a very close race. Fortunately it only seems to happen every 40 years or so (Kennedy's election being the previous example), which provides enough time for the fuss to die down.
That me be what the article says, but a better summary is as follows:
Voting machine technology has been under attack for a while now, and the machines used over here, have taken so many hits they look like swiss cheese. The keys used to secure them, could be ordered over the internet by anyone. At one point, a voting machine was hacked to play chess on. Another time, it was shown that a simple radio scanner was enough to tell which party people voted for. Hardware design and software leaked to the internet. There was a big fire at the manufacturer (Nedap), which destroyed hundreds of voting machines (destined for Germany, IIRC). The list goes on.
While this was going on, negative reports came in about voting machine problems abroad. Questions where asked in parliament, and few satisfactory answers received. And then there where mayor elections in Amsterdam, where the city counsil chose to revert to pencil and paper.
Basically, the position of 'voting machines work fine and secure' became impossible to maintain. Research into possible replacements has been started, but results from that are years away. So the Dutch government was simply forced to 'go back to the old ways' for the time being.
Once you get rid of anonymity, then only the people can be compromised!
...into brand new Dutch Ovens.
"Quote me as saying I was mis-quoted." -Groucho Marx
Secret ballots are used in all (that I know of) democracies of the world for a reason.
What if someone threatened to kill you or do other harm to you or your family if you didn't show them a receipt showing that you did in fact vote as they wanted.
Having a receipt of who you voted for also opens the door to selling votes to the highest bidder. As it stands, there would be no way for the buyer to verify that they did vote as they wanted.
In a sane election system that difference would not matter anyway as both sides would end up with the same power. It's just insane to declare a single winner based on such a tiny difference, it leaves half the nation unrepresented.
Justice is the sheep getting arrested while an impartial judge declares the vote void.
I've had an ATM machine tell me that I had thousands more in my account than what I knew I had. I had pulled a few jacksons for running around cash and the receipt showing the balance made my eyes pop! Yowza, jackpot! heh heh heh. Checked a few hours later and it was gone. (No, I made no attempt to go withdraw it) I've always wondered what sort of shenanigans were going on, if it was a real mistake or some sort of involved high level money laundering deal going on.
Your problem, not ours, and entirely self-inflicted. The size of U.S. ballots is the problem. How the votes are tallied is beside the point.
In the last Federal election I was the first person to vote in my area (on my way to work), so I was the one who looked in the ballot box, certified to the Returning Officer that it was empty, and taped it shut. How much more democracy do you want?
In our last provincial election we also had a referendum on adopting a single-transferrable vote system for our elections. I voted yes, but not enough people did, and the referendum failed. We would have stuck with paper ballots (a paper trail is non-negotiable, IMHO), but most versions of STV require computers to tabulate the results in a timely manner.
...laura, proudly Canadian
Wait, yahoo owns babelfish?! Since when?!!? It's always been altavista since...since...it was digital.com!!!!
Rivest has worked out a halfway-decent system to do both: give you a reciept that you can use to prove that your vote was counted (correctly, to a high statistical likelyhood) without being bake to prove who you voted for. Unfortunately it's just so geeky that it's unlikely to go anywhere.
Socialism: a lie told by totalitarians and believed by fools.
and the fact the the winners brother was the governor of the contested state that swung the election. The US electoral system reeks of fraud.
As a naive Brit who's only ever voted on paper..
If the only way an electronic count will be trusted is by a paper audit trail, then presumably those paper printouts will still have to be counted by hand to verify that they get a result acceptably close to the result the computer gives. In which case, what have we gained in using computers to do the count?
If a manual count of the computer-printouts is not carried out, then how does a printed copy give me the voter any reassurance at all? It would reassure me that I'd not accidentally voted for the wrong person, but could not prove to me that my vote has been counted.
I can understand the argument that if the source code to the program is open then I could inspect it, but most voters are unlikely to have the expertise to do that.
> And what happens when the difference between two candidates is only 0.05% after the votes are counted, and the loser demands a recount? Suddenly that difference between 99.9% and 99.99% accuracy matters very much.
And therein lies another problem with our voting procedures: Current voting laws assume "precisely 50%+1" of the vote wins. And everyone goes along with it, because "it is obvious that more people want Candidate X than Candidate Y".
The reality is that we've been using precision - and the courts when precision fails - as a coin toss. I think we'd have a lot less acrimony if we simply HAD a coin toss if the difference in votes was less than an easily identifiable percentage of the vote. Or a re-vote.
It's not like either candidate has "a mandate from the voters...". 50% of the people, more or less, are going to be disappointed either way.
It doesn't matter how simple you make the process (e.g. "Just put in an X in one of these two boxes"), a certain percentage of the electorate (e.g. the mentally ill, the illiterate, the very elderly, the mentally handicapped) will screw it up.
I think the mental acuity to put a mark in the box beside the candidate you are voting for is an acceptable minimum competency level for someone's vote to count. I would actually like to see a more purposeful minimum competency/knowledge requirement for voter eligibility, but I supposed that makes me elitist for thinking people should have to demonstrate accurate knowledge before making an important decision.
We are all just people.
When we find a way to guarentee a limit to this scale, voting machines will become more reliable than paper. I disagree. Here's how to make paper safer than any machine will ever be:
Mark the paper with a pencil, put it in a box. All day long, party representatives are welcome to keep their eye on the boxes. At the end of the day, election officials do the counting, in the same place where to votes were cast so there is no possibility of switching in transit. The party representatives are there looking over their shoulder and doing their own count. If there is a dispute, there's an awful lot of witnesses.
Because the number of voters per precinct will be relatively low, the undisputed result will be known in a couple of hours at the most and because there were party representatives at every precinct, they know what the national total should add up to, so no chance for any shenanigans by the central authority there either.
This is how the Canadians do it, by the way. Nobody ever disputes an election in Canada.
No machine will ever beat that. The more sophisticated your encryption and tamper proofing, the more sophisticated the fraud - it's an arms race you can't win.
Brazil has been using voting machines for at least a decade. The good thing is we can follow the "counting" of the votes on the internet and the result comes in about 12 hours. Pretty impressive for a country the size of Brazil where some votes come from places like villages in the middle of the amazon. http://en.wikipedia.org/wiki/Elections_in_Brazil
That's probably a really good idea, although you know who I'd ask for help in this area?
The Technology Division of the Nevada Gaming Commission. Can you think of any organization with more experience working with precisely this sort of thing?
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Can somebody tell me what is so god damn difficult about implementing reliable electronic voting? It is 2008, for christ's sake! How hard can it be to take a vote, log it to a central database, and print a freakin reciept!? This is like 40 year old technology, people. We've been trusting ATM's to do much more complex things for decades. WTF?
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
That is untrue.
All you need to do is 1) verify that each particular person is allowed to vote, and 2) each verified voter was able to use one and only one ballot.
There are at least a few robust voting protocols for meeting these two conditions without needing to match up each ballot with each voter.
The big problem is, most of the election officials seem either ignorant of, or unwilling to implement, those protocols.
That must have been interesting in many ways, but the idea has some merit, certainly better than some $random politico tag along being first in line for the job...
The idea is that you'd only bother with a manual count if one of the candidates demands it. Which would mostly happen on close elections, or when the electronic vote count was at odds with what exit polls showed (or some other reason for suspicion existed). I suppose there'd still be the opportunity to fix only elections where an upset occurred, since no one would bother to contest them. So ideally a random sampling of elections should re-counted to keep everyone honest. Presidential elections would almost always have to be checked since the stakes are so high.
That is to say, you're adding the an auditing ability, so the basic rules of auditing apply. As for electronic voting systems without any voter-verifiable paper trail, that's just insanity.
Well, one would also think that ATM companies like Diebold would have experience at this sort of thing.... Of course, when you realize the implications of this ineptitude on the banking industry, you suddenly get the distinct feeling you would be safer keeping your money in a box under your mattress. :-D
Check out my sci-fi/humor trilogy at PatriotsBooks.
Please mention the "real" URL: http://www.minbzk.nl/actueel/112441/nieuw and provide the link for the translation behind in parentheses. Even though Dutch is a language spoken by a relatively small number of world citizens, there are some who prefer the Dutch language.
I myself prefer to read English unless Dutch is the original language.
I've seen your sig a couple of times now. Isn't it time to correct the typos now?
When the policeman of the tie, rule you violate, hello punishment of the kitty?
You don't have to get rid of anonymity to protect against fraud. Getting rid of anonymity creates new fraud opportunities (i.e. politicians retaliating against communities that voted against them, buying & selling votes is much easier, since now you can easily verify the vote seller went out and cast the desired vote)
It's not necessary that the ballots cast be connected to a person. Only that the ballot cast corresponded to a voting session, and the votes on the ballot match the votes counted.
Verifying that it was legitimate for voting session #xxxxxyyyyzzz to occur does not require the voting machine having the identifying info for the voter. It only requires knowing that there was a unique voter.
It is a mistake to rely on only one system for verification. Good design of a security system is to involve multiple independent systems in the vote recording and counting processes. These systems should be isolated: I.E. no network connection between them. And all information stored committed as timestamped entries to read-only media _as soon_ as it is to be stored, to ensure that history manipulation is impossible.
Consider a design like this:
There is the possibility of using public key crypto, where the private key ids you as the voter, and the public key identifies the voting session (and gets printed on the ballot).
When you register to vote, you generate a private/public key pair. The public key is printed in a machine-readable way on your voter id, say a blue card.
The private key gets printed on a second voter id, say a red card.
Neither key is ever stored in any database or file by the government, only the public key fingerprint and private key fingerprint. And you can generate your own keys, provided you provide the fingerprint of the private key, and the public key itself for verification at the time the voter id is being issued.
Now, when you go to vote, you first have to be authorized.
You go to a tamper-proof "vote authorization server" which is separate from the actual voting station.
You insert your blue card.
The first machine verifies that the public key on your id matches the key fingerprint for your public key, then issues you an "authorization ticket", say an orange card, while storing that info in a database, that contains an authorization id and message encrypted with your public key.
Before you will be allowed to access the voting machines, you will present your orange card and picture id to an election official. The official will verify you are the person shown on your picture id, initial your orange card, insert it into a second, independent authorization server, the election official will insert their own red card, and place their finger on a fingerprint reader/enter a PIN#, entering the orange card as "proven" -- this will be timestamped and stored in a second database), and the card will now be signed with a second public key, they now give you the card and you can go cast exactly 1 ballot which will be associated with that orange card id.
You go to the voting machine; insert your orange card to start voting. The voting machine will verify the authenticity of the orange card -- public keys for the two authorization servers and voting official that signed the card will be verified against an internal database.
When your ballot is complete, you insert the red card and enter your secret PIN# to decrypt your private key and sign the ballot.
The signed ballot will include the contents of the orange card.
But the bit that identifies the voter is only readable by the voter
The banking machine industry thought that right up till their programmers pointed out that there is a big difference between a clear paper trail (required for banking), and anonymous use (required for voting).
Alas, by that time, they had the contracts already signed, and visions of BEEEELIONS and BEEEEELIONS of dollars dancing in their heads.
"I do not agree with what you say, but I will defend to the death your right to say it"
The hanging chad problem came about from the punch cards being unreadable to humans, so people wouldn't bother to check and see if the ballot had any chads hanging. With the parent's suggestion of a readable ballot, people would be encouraged to look at the holes, and would be more likely to see a renegade chad.
I think the main problem with the parent's suggestion is the possibility of losing some voter anonymity. If someone (say a ballot worker who's been looking at the ballots all day) can see the ballot in your hand, and recognize that a certain hole in a certain spot means you voted for so-and-so, the secret ballot principle has been compromised. That isn't to say there could not be some sort of work-around (an envelope to put your ballot in, for example).
That is, of course, solved with some rather elementary changes to the system.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"