Software Bug Adds 5K Votes To Election

eldavojohn writes "You may be able to argue that a five-thousand-vote error is a small price to pay for a national election, but these errors are certainly inadmissible on a much smaller scale. According to the Rapid City Journal, a software glitch added 4,875 phantom ballots in a South Dakota election for a seat on the city council. It's not a hardware security problem this time; it's a software glitch. Although not unheard of in electronic voting, this bug was about to cause a runoff vote since the incumbent did not hold a high enough percentage of the vote. That is no longer the case after the numbers were corrected. Wired notes it's probably a complex bug as it is not just multiplying the vote count by two. Here's to hoping that AutoMark follows suit and releases the source code for others to scrutinize."

Comments

Uh oh...

[Anonymous Coward]

The software has achieved sentience and is trying to elect its robot overlords! Before anyone else... I for one welcome our democratically elected robot overlords.

Re:Uh oh...

[Jonas Buyl]

What? I thought Hillary didn't make it to president after all?

Re:Uh oh...

[Hasai]

I take it you've never really taken a good hard look at the crop of politicians currently in office. The 'droids have been running the show for quite some time now....

Re:Uh oh...

[Q-Hack!]

I take it you've never really taken a good hard look at the crop of politicians currently in office. The 'droids have been running the show for quite some time now....

The sad thing is, this works for either political party!

Re:Uh oh...

[Anonymous Coward]

Come on, people. How hard can it be for a machine to count stuff? Am I missing something?

foreach category {
candidates[] clist = getSelectedCandidates();
if not onecandidateselected() then continue;
foreach candidate {
numvotes(candidate) += 1
}
}

Re:Uh oh...

[morgauxo]

Ahhh! That explains The Governator! South Dakota must be following the example of California.

Re:Uh oh...

[Fozzyuw]

Obligatory Onion Video.

Re:Uh oh...

[Hubbell]

Fucking VB could do this job:
If VoteCast = ForCandidateA then CandidateA = CandidateA + 1 Else Votecast = ForcandidateB then CandidateB = CandidateB + 1 etc.

Re:Uh oh...

[sexconker]

The sad thing is, the droids have convinced you there are only two parties!

RON PAUL 2012!

Re:Uh oh...

[Anonymous Coward]

It's not who votes which counts, it's who counts the votes... (Stalin)

There is a solution to ALL election fraud - the Robinson Method.
Read about it here:

http://paul-robinson.us/index.php?blog=5&title=the_robinson_method_a_really_simple_way_&more=1&c=1&tb=1&pb=1

Instant results. No fraud. Huge savings in money and time. Ballot boxes in public view at ALL times, from the beginning of the election when they are empty, to the end of the election, when the winner will be clearly visible to all, the minute the final vote has been cast!

Yet another day and another vote fraud story. Surely you can come up with a method that works? The Robinson Method works and is fraud proof.

Re:Uh oh...

[jcochran]

The sad thing is, you think there's more than one party.

Re:Uh oh...

[neoform]

No no no, it's clearly a glitch. Counting numbers (e.g. 1+1) really isn't a computer's strong suit, so it's understandable that it would sometimes do this, 1+ 1 + 1 + 1 + 5000 + 1 + 1.

Re:Uh oh...

[sexconker]

Like I said: Droids and Ron Paul. That's 2.

Re:Uh oh...

[NotBorg]

I'd mod you funny but I've completely lost faith in electronic voting.

Re:Uh oh...

[omega_dk]

I read through the robinson method, and here's what I see: Loss of anonymity of votes. Therefore, it fails. Period. You may dismiss out of hand the potential for knowing someone who writes in a vote, but that is a loss of anonymity. It allows detection of voting patterns that may or may not directly identify a voter; how many people would vote (coin) (coin) (writein) (coin) (writein) (writein). Not to mention non-votes; am I required to vote for every race? And if I'm not required to vote for every race/proposition, then you get to see that I didn't vote because you see that I didn't put in a coin.

That's not even getting into the ease of purposefully adding errors to the counting process that could easily completely invalidate a vote count. Let's say a poll worker has the skills to shave 1/10th (or whatever the tolerance of the scale is) of the weight off of half the tokens, and add 1/10th the weight to the other half. Then, they systematically choose to give (say) black people the shaved tokens, and white people the unshaved tokens. All of a sudden, white people get a greater vote share equal to 2xW, where W is the tolerance of the scale.

Basically, stop being a whiny emokid and realize that every idea you have is not IPU's gift to mankind. You, sir, are indeed fallible.

Re:Uh oh...

[dkleinsc]

The Bob Dole and Mitt Romney models didn't work very well either.

Re:Uh oh...

[Anonymous Coward]

http://en.wikipedia.org/wiki/Political_positions_of_Ron_Paul

Ron Paul is a proto-fascist. Some of us are old enough to remember the so-called "States' Rights" movement of the 1960s.

Ron Paul is pro-life (odd, he has a lot in common with Coburn in that regard... I call it "right-wing male ob/gyn syndrome"), homophobic, nativist (the capital "L" Libertarian party has many direct connections to the white power movement), religious fundamentalist (see "We the People Act") of the "Christian Nation" variety; and on top of it all, a demagogue with no qualms with using impressionable youth who have no idea what they're actually supporting.

You've all been had.

Father forgive them, for they know not what they do.

How hard is it for a computer to do addition?

[pieterh]

Why is a voting system doing any kind of math at all? I voted yesterday in Belgium on a computer that puts my vote onto a card, which is then tallied separately. This same system has been working since at least 1995 with zero reports of fraud or failure (except normal "computer is broken" style failures).

How can a computer "add phantom ballots"? Software does not just "glitch", it breaks in ways that depend entirely on how it was built.

Re:How hard is it for a computer to do addition?

[rvw]

Why is a voting system doing any kind of math at all? I voted yesterday in Belgium on a computer that puts my vote onto a card, which is then tallied separately. This same system has been working since at least 1995 with zero reports of fraud or failure (except normal "computer is broken" style failures).

How can a computer "add phantom ballots"? Software does not just "glitch", it breaks in ways that depend entirely on how it was built.

How do you know this system is fraud free? Reading your comment doesn't convince me one bit. I voted too, in the Netherlands, and for the first time in years I had to use a pencil again. No guarantee that there are no counting errors, but they won't be systematic on a large scale.

Re:How hard is it for a computer to do addition?

[Darkness404]

While I'm as puzzled as you are on why its doing simple addition wrong, I can understand why you would want a computer to do the math though, as it should be more error-proof than humans.

Re:How hard is it for a computer to do addition?

[tangent3]

Additions just aren't so simple anymore in concurrent computing. The obvious way to do addition in gcc c would be:

totalVotes[candidate]++;

but this will totally screw up the vote count, whereas

__sync_add_and_fetch(&totalVotes[candidate], 1);

gets it right.

Re:How hard is it for a computer to do addition?

[RenHoek]

Well, there's the

    candidate[x]++;

that should be going on inside..

Other then then, no math..

Seems somebody is not following the K.I.S.S. method..

Re:How hard is it for a computer to do addition?

[jgtg32a]

I'm not a programmer but why would totalVotes[candidate]++; not work?

Is it a race condition, it pulls the number adds one and puts it back, and if the system is run parallel it will drop vote added at the same time?

Re:How hard is it for a computer to do addition?

[tangent3]

void vote(int candidate)
{
   switch (candidate)
   {
      case GEORGE_BUSH:
         totalVotes[GEORGE_BUSH] ++;

      case AL_GORE:
         totalVotes[AL_GORE] ++;
         break;
   }
}

Re:How hard is it for a computer to do addition?

[Tubal-Cain]

The obvious way to do addition in gcc c would be:

totalVotes[candidate]++;

but this will totally screw up the vote count.

Why will it screw up? A bug? gcc trying to force good coding practices? Ignorant minds want to know.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

Is that you, DemocratHacker?

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

That works fine in c# :-)

Re:How hard is it for a computer to do addition?

[pieterh]

Belgian politics are not always polite. There is endless infighting. There is no monopoly of power, every government is a coalition and always fragile.

This makes election fraud very hard to organise and probably impossible to keep a secret. One would need to buy too many people, for too long.

So not because I trust the Belgian political establishment, but because I trust their incompetence and greed, I'm pretty satisfied that every vote is counted, and accurately.

Re:How hard is it for a computer to do addition?

[C_Kode]

Real life appears to disagree with you! :D

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

Additions just aren't so simple anymore in concurrent computing.

Why would e-voting be a concurrent operation? Each voting machine should tally votes locally. Every hour (or at the end of the day, or at some other random interval), each machine would connect to a central server, upload its current tally, and reset its local info. This upload-and-reset should be done in a synchronous fashion, such that the server accepts only one tally at a time and the client resets only after it confirms the upload with the server. Surely existing database protocols such a two-phase commit would solve this problem satisfactorily.

Re:How hard is it for a computer to do addition?

[stickrnan]

i++; is essentially the same as the statement i=i+1;. If you have multiple threads running at the same time you can potentially lose data should more than one thread try to assign i the value of i+1 at the same time.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

Yes, it's a threading issue. If you have multiple threads trying to update the value, some of them won't count. You'd either need to use a lock (and probably mark the variables as volatile) or use some kind of atomic update (like a read-modify-write operation).

Still, you'd have to be an idiot to even try to count votes as they're coming in. A much better approach would be to use a database. Database servers are already really good at handling concurrency and scaling. When a vote is cast, simply add a record to the database. Once the election's over, do something like "SELECT COUNT(*), candidate_id FROM votes GROUP BY candidate_id", and the results will be calculated based on the records in the database.

Really, you could only screw this up if you insisted on developing the entire system from scratch, rather than going with existing, well-tested code.

Re:How hard is it for a computer to do addition?

[Rakshasa Taisab]

Exactly... why would it fail on a single-threaded program? The problem is much more that just simple race-conditions on instruction level. What do you do if the program crashes? You have no way of recovering if all you do is increment an array. It really should keep a cryptographically signed logs of each vote, on hardware designed to be read only using specialized key+hardware. The GUI app and the vote management app should be separate programs, with different user/privileges. This would avoid the more complicated UI code having memory corruption issues affecting the vote registration. Each vote would need to do a proper syn/ack message passing to confirm the vote was registered, and a separate sequence sent to the operators controlling the voting booth so they can see the voter successfully cast a vote and tell the vote server when it can accept another vote.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

Why is this modded insightful and not funny?

Gore is getting all of his votes + all of Bushes votes!

Re:How hard is it for a computer to do addition?

[Cixelsiduous]

eh...your first case statement is missing a break. As it currently stands, a vote for GEORGE_BUSH also adds a vote for AL_GORE. I dunno maybe you left it out on purpose to make a point? I guess the bigger question is: why do I care? The answer of course is because I have no friends.

Re:How hard is it for a computer to do addition?

[Maxo-Texas]

Seriously...

How hard is

If "A"
A = A + 1
elseif "B"
B = B + 1
elseif "C"
C = C + 1
endif

???

Re:How hard is it for a computer to do addition?

[FalcDot]

Or perhaps we can trust that they all cheat in roughly the same amount, cancelling each other out :-)

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

How do you know this system is fraud free?

No system is fraud free. But since we still work with a ballot box, it is just as hard to commit fraud as it is with paper ballots.
Software fraud is very hard, because the software is only installed just before the voting bureau opens.
Also, see parent.

No guarantee that there are no counting errors, but they won't be systematic on a large scale.

Because of the way the voting is organised, we know if and in which bureau the miscount happened.

Before the voting starts, the magnetic cards are counted. There is 1 card for everyone who has to vote in that bureau.
Every voter is crossed off on a list, and after the voting the number of remaining cards should be equal to the number of people that didn't vote. The number of cards in the ballot box is counted by a computer, and again, checked against the paper list.

Then, if the numbers for that ballot box don't add up, the phantom votes are discovered instantly.

The only miscount that could happen, is when a vote changes from one party to another. But then the system probably has checks regarding whom you voted for on that list (a vote for the CD&V party and for a candidate from NVA is impossible).

Re:How hard is it for a computer to do addition?

[Bluesman]

I doubt this is how the machines work, but to answer your question, assume thread A and B are voting machines trying to update a single vote count.

The three steps in doing that are:

1) Read the current value
2) Increment the current value
3) Store the result back in the memory location

If thread A and B read the current value at the same time, they will both increment that same value and both try to restore the new incremented-by-one value. So if current votes is 55, thread A and B will both simultaneously read that value, increment 55 to 56 and store that result. The end result is that a vote is dropped.

This problem can be solved any number of ways, and only the most boneheaded programmer would get bitten by such an obvious bug. I seriously doubt the problem with the voting machines is as simple as this.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

Ob-SImpsons

"Math is hard! Let's go shopping."

Re:How hard is it for a computer to do addition?

[The Moof]

That was the whole point of the code. He was answering the GP's question "How can a computer 'add phantom ballots'?"

Or at least I hope that was his intention.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

Umm... I fail to see how this is insightful rather then +5 funny. Switch the two cases and then I would understand.

Re:How hard is it for a computer to do addition?

[JustOK]

...with the government's money!

Re:How hard is it for a computer to do addition?

[nine-times]

Right. Ask a computer to count 1 million records and stop exactly on the millionth, and then ask a person to count 1 million cards and stop on the millionth. If you had to bet your life on it, who would you think would be more precise? Obviously computers have value.

On the other hand, I'm a firm believer in the idea that the source code should be available for review to make sure there are no weird bugs that could multiply votes, and there should be a paper trail so that the computer can be checked for voter fraud. Computers are more efficient, but not only are they more efficient at doing the right thing, and they're more efficient at doing the wrong thing. If the code tells them to count votes incorrectly (whether it's fraud or an inadvertent bug) they will very efficiently count the votes incorrectly.

Re:How hard is it for a computer to do addition?

[rickb928]

I am not a programmer, nor an election official, but that process is as dumb as a blade of grass.

Why upload during the day? We are only interested in the whole day's total.

Why reset the local count? Like the server is infallible?

Why transmit ANYTHING? Like I trust even a modem call to a dedicated line. There is not much easier than diverting a landline. All you need are cutters and spare wire. My modem is just like your modem. MY server will be like your server. I can tap in and listen to a few connections and work out the details, of not for this election than for the next. Pwnage.

Really, if the concern for sending hourly updates is reliability, then reconsider the system. If the concern for sending updates is physical security and lost votes, you are doomed, get better poll monitors. If the concern is software problems, reconsider the system.

There is no need for interim results. If you want to audit the system during the day, have a team come in, stop the voting for a moment, take the tally card as would be done at the end of the day, document it and give the pool watchers a receipt, insert a new card, and voting recommences.

But paper is the simplest and surest way. Sorry, but it is.

Re:How hard is it for a computer to do addition?

[johnek]

This is the silliest thing I have ever heard. People are adding code snippets with vote++, etc. That's absurd. It's a vote collection system, not a calculator. Wouldn't the votes be saved in a transactional, network capable, data collection system? Maybe a Database. Then on the back end the Election officials can run reports, etc. Then tie those reports to reports run at polling centers. There would be no overcounts, lost votes, etc. And since it's transactional you can verify things down to the vote level. I've never actually worked on a system like this, but it sounds like maybe I should. Damn.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

default:
                cout >> "What are you doing?!?!?!?"

Re:How hard is it for a computer to do addition?

[BitZtream]

Sure, go ahead and add a field to the table and you've got a record of who voted for who, which is awesome!

The problem for slashdotters is that there is more to a voting system than JUST counting the votes properly.

You have to count the votes properly, provide proper auditing to validate that everyones vote got counted for who they voted for, all the while making sure that you don't actually know who specifically voted for who, even though you may need to prove that their vote was counted for a specific candidate later.

If all they had to do was count votes, they would have gotten it right cause even the $0.50/hour programmers from India can get that part right.

It does blow my mind however that we still get errors in electronic voting due to bugs, these companies are utterly failing and should be banned from making software such as these as soon as a bug like this is detected. It is not acceptable to have not tested your software properly before hand to detect this crap.

Re:How hard is it for a computer to do addition?

[BitZtream]

No it doesn't.

C# case statements aren't allowed to full through to the next case statement, which is your point I'm sure.

The problem is that it doesn't 'work fine', it will refuse to compile unless you're compiler is broken and doesn't follow the spec

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

No, no, no, NO!

These programs are on machine code level, an I have an idea what has gone wrong here. They just forgot the key-debouncing-routine on one of the key-press routines. That case you can get any number pressing that particular key because of mechanical bouncing of the contacts. This can add up fairly quickly.

Just plain simple...

Re:How hard is it for a computer to do addition?

[Paaskonijn]

How do you know this system is fraud free?

Because the biggest proponents of electronic voting (OpenVLD) have lost the elections. :p

Re:How hard is it for a computer to do addition?

[buchner.johannes]

Ah delicious ... Democracy, the system that works despite faulty humans.

Re:How hard is it for a computer to do addition?

[spathi-wa]

It's quite simple really.

Voting machine shows UI requesting the user's (voter's) vote. User chooses candidate. Voting machine registers an additional vote for user's candidate into the votes table. This vote is assigned a unique identifier. This identifier is printed onto a paper receipt which is provided to the voter. This can be later used to confirm that user's vote for candidate A was indeed registered for candidate A.

Just how hard is that?

Re:How hard is it for a computer to do addition?

[Enigma0498]

How do you know this system is fraud free? Reading your comment doesn't convince me one bit. I voted too, in the Netherlands, and for the first time in years I had to use a pencil again. No guarantee that there are no counting errors, but they won't be systematic on a large scale.

The Belgian government publishes the source code of the voting software the moment the bureaus close. The software of yesterday's election can be found here: http://www.ibz.rrn.fgov.be/index.php?id=1152&L=1

Re:How hard is it for a computer to do addition?

[2obvious4u]

Better yet store them as flat files that are available for download by the entire population.

VOTER_ID, CANDIDATE_ID

Then have the files named: precinctID_ballotID.csv Have the files available for download from the precinct website as well as the district and region websites for comparison to make sure there is no tampering.

The only issue with this system is keeping voter id's private, but it would allow for the most open and auditable elections ever.

Re:How hard is it for a computer to do addition?

[buchner.johannes]

I'm not a programmer but why would totalVotes[candidate]++; not work?

Is it a race condition, it pulls the number adds one and puts it back, and if the system is run parallel it will drop vote added at the same time?

Because totalVotes[candidate]++ really is
totalVotes[candidate] = totalVotes[candidate] + 1
which is
temp = totalVotes[candidate];
totalVotes[candidate] = temp + 1
and with 2 threads this might look like this:

Thread1: tempA = totalVotes[candidate];
Thread1: totalVotes[candidate] = tempA + 1
Thread2: tempB = totalVotes[candidate];
Thread2: totalVotes[candidate] = tempB + 1

Or like this:

Thread1: tempA = totalVotes[candidate];
Thread2: tempB = totalVotes[candidate];
Thread1: totalVotes[candidate] = tempA + 1
Thread2: totalVotes[candidate] = tempB + 1

The issue is that the ++ command (increment) is not necessarily atomic. Either you make it atomic (operating system or hardware), or you need some read-write concurrency strategy (a synchronisation strategy like locks).

Also see Readers-writers_problem

Re:How hard is it for a computer to do addition?

[Cornelius the Great]

I doubt this is how the machines work, but to answer your question, assume thread A and B are voting machines trying to update a single vote count.

The three steps in doing that are:

1) Read the current value 2) Increment the current value 3) Store the result back in the memory location

If thread A and B read the current value at the same time, they will both increment that same value and both try to restore the new incremented-by-one value. So if current votes is 55, thread A and B will both simultaneously read that value, increment 55 to 56 and store that result.

God, I hope not- that's a horrible algorithm.

Client threads should never query the server for the current tally. They simply need to post a single event that carries the argument(s) identifying the vote for the candidate/issue, and a unique ID (ie- an MD5 generated from the current user's voting ID) to prevent multiple votes. The only communication that the client should receive from the server is a confirmation that the vote has been received.

Re:How hard is it for a computer to do addition?

[EkriirkE]

I think you meant to have Gore first, then Bush...

Re:How hard is it for a computer to do addition?

[slyn]

Seriously, if they want an electronic voting platform that is bug free they can just tell everyone to bring in their #2 pencils and drag in the scantron machines from the local public schools.

When was the last time you heard about a student getting a 5000/100 because the scantron had a bug in the software. Pure incompetence (or worse) on the part of the voting machine companies.

Re:How hard is it for a computer to do addition?

[cellurl]

I think voting in the US is like the taxcode, deliberately fluid and hackable.
All slashdotters know that any online bank or Pricewaterhouse could implement a convenient, accountable online voting system. Here I just created a group to see if anyone agrees.
http://www.facebook.com/group.php?gid=84902568935
I think I am going to boycott voting until this Diabold or NorthDakota voting crap ceases.
-jim

Re:How hard is it for a computer to do addition?

[TurboNed]

That is insufficiently secure because someone could be forced to give up their paper with their unique identifier in order to prove that he voted in accordance with the wishes of someone criminally coercing him. To be properly secure and anonymous, there needs to be absolutely no way to associate me with my vote - whether the desire for the association is legitimate or not.

Re:How hard is it for a computer to do addition?

[TurboNed]

The only issue with HDDVD encryption was keeping 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 secret. Oh, crap. There it is.

Re:How hard is it for a computer to do addition?

[CarpetShark]

Why is a voting system doing any kind of math at all?

It's pretty tough to make a digital system that does no math.

Re:How hard is it for a computer to do addition?

[H0p313ss]

The answer of course is because I have no friends.

/hug Cixelsiduous

Re:How hard is it for a computer to do addition?

[spathi-wa]

As stated by the GP, the "desire" for association is an auditing requirement and not really a personal request of the voter.

If you had access to the vote db such that you could take my unique identifier and associate it with my vote, would any kind of system be able to stop you from doing that? Your point has merit, but it is far from the current discussion.

Re:How hard is it for a computer to do addition?

[Khashishi]

Actually, software CAN glitch, due to memory corruption from cosmic rays and such. But more often the problem is in the programming.

Re:How hard is it for a computer to do addition?

[wfstanle]

The real question is why is there a need for parallel processing? This is a voting machine, even a simple single core processor without any threads should be sufficient. As a matter of fact, I would try to make the software as simple as possible. When it is short and simple, there is less chance of hidden bugs or for a malicious programmer to hide something in the code. Also, any obfuscated code should not be allowed.

Re:How hard is it for a computer to do addition?

[Leafheart]

Yes, it's a threading issue. If you have multiple threads trying to update the value, some of them won't count. You'd either need to use a lock (and probably mark the variables as volatile) or use some kind of atomic update (like a read-modify-write operation).

Now, why the hell are you using threads on a simple program as that. Just keep an array of all possible candidates, give them an unique number id, people type this id on the screen, show them the name and face and add one to the integer, that is them flushed on disk. There is no reason to have multiple threads, nor Internet communication nor any of those things. Isolate each machine, and afterwards dump the results of it and sum. that is not difficult at all.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

Also, in Florida you would have to munge the case variables so that the expected one for Gore would really be the one for Buchanan. Now that I think of it, munging case values could be called Butterfly Code.

Re:How hard is it for a computer to do addition?

[The Archon V2.0]

Seriously...

How hard is

If "A" A = A + 1 elseif "B" B = B + 1 elseif "C" C = C + 1 endif

???

I can see you've never read http://thedailywtf.com/ For some so-called programmers, it's impossible.

Re:How hard is it for a computer to do addition?

[Vintermann]

...and by corollary, the system that works.

Re:How hard is it for a computer to do addition?

[Plekto]

i++; is essentially the same as the statement i=i+1;. If you have multiple threads running at the same time you can potentially lose data should more than one thread try to assign i the value of i+1 at the same time.

***
Quick and maybe obvious question:
How feasible would it be for someone to make such a thread purposely run all the time to screw with the number of votes. ie - you don't flip votes so much as cause them to be dropped internally without any real "switch vote A to B" formula or obvious hack in the code itself?

Say, when it gets the screen where you vote for a certain candidate and it then goes to the confirm choices screen. If you chose the "bad" candidate, its running a new thread suddenly that's about half likely to bounce the data...

Re:How hard is it for a computer to do addition?

[Fulcrum of Evil]

why would you have multiple threads running on a tally?

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

Pretty sure that this is the joke.

Re:How hard is it for a computer to do addition?

[Schadrach]

Multistep process.

1. User is shown UI, chooses candidates.
2. Vote is assigned a unique identifier and stored in database table.
3. A paper ballot is then printed out, prefilled with black marks and only the names voted for printed, as a scantron-type sheet and provided to the voter.
4. A separate manufacturer provides the scantron machine, which on scan checks against the database from step 2.
5. If the results of the scan and initial entry match, all is well. If not, throw a red flag.
6. If the results matched, flag the ballot as having been scanned with a timestamp.
7. Have the scanner printout the ballot serial number and timestamp on a roll printer (think a receipt printer) in a continuous feed.
8. The printed ballot is stored in a ballot box, and later counted at leisrue to verify the total.
9. The list from #7 is verified against a list printed from the database after the election to watch for tampering.
10. If there are no signs of fraud or error, the counts from #8 and #9 may be done at leisure, as there's no good reason to assume tampering is present. If the results do not match up, recount and verify the new official count.
Did I miss anything?

Re:How hard is it for a computer to do addition?

[Vintermann]

Very cute!

Brief impressions: The author is Steria. Steria aren't so bad. I know they employ some top-tier formal verification experts, and they have a tool ("Atelier B") which implements the famous B method for constructing verifiable programs. They also make software for bank terminals (which I've had the pleasure of interfacing with in my old job), so they should be qualified for this sort of stuff (something you can't always assume when governments put out tenders)

Yet... this appears to be a C++ application running in DOS. And some of the copyright notices refer to Bull - that would have to be written 6 years ago at the latest. Strange that the notices haven't been updated.

In its defense, it appears to be a very small, neat application. Only 7000 source lines of code according to SLOCCount.

Re:How hard is it for a computer to do addition?

[arndawg]

Why not have seperate tables? 1 table with a list of UID, personal password hash, and VoteStatus. 1 table with votes. Yes or No or whatever. That way when you add your vote check if there has been any votes on that UID / password and give access to vote if not. Send out peoples UID and password in the mail in two seperate letters. Now the only information is if you voted or not. I don't see a huge problem with that. But that's probably because i'm a sysadmin, not a developer or DBA.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

I think you meant to have Gore first, then Bush...

Only on the PC version.

Re:How hard is it for a computer to do addition?

[TurboNed]

The generally accepted stance on voter security (as I understand it from reading Bruce Schneier's blog and Ed Felten's blog is that what is important is that a vote get recorded accurately, that a user can verify (at the time of casting but not after) that the vote they're casting is the vote they intended to cast, and that we be able to ensure a one-to-one correspondence between votes and voters. That doesn't mean that we can map votes to voters later. Such a capability may be useful, but the security concerns (voter coercion, mostly) would outweigh the auditing benefits.

Think of the paper ballot example. Assuming users actually use the ballots correctly (obviously a huge assumption and one that doesn't play out in practice, but work with me here), you have an accurate, auditable record (a recount is meaningful because it has the potential to discover mistakes of the original count) of the voter's decision. At the time of casting the ballot, the voter can verify (if they so choose) that the ballot accurately reflects their choices. We have one-to-one correspondence because other measures were taken to ensure that each voter received one ballot. When the voter casts their ballot, their vote is recorded, but there will never be any way to trace back the choices that the voter made back to the voter. The voter isn't subject to coercion from, say, a shady employer who threatens to fire any employee who doesn't vote for Candidate A. Employees can lie to their employer about who they voted for and (this is important) nobody has the ability to retrieve the voter's vote to prove/disprove the voter's claim.

As I see it (though IANAExpert), the proper way to do an electronic vote is to tally votes electronically in a moderately secure environment ("absolute" security would be counter productive, IMO), but to print out a physical record of votes recorded by a machine which is verified by the user and dropped in a ballot box. If there's dispute with the machine tally, you have an auditable record to check the dispute against. If you ask a machine to do a recount of the 4,328,512 votes that it took (which seems like a strange number of votes to record in a precinct with 715,386 eligible voters), it's going to give you the same numbers. Sure, you may know fraud happened - but there's nothing you can do about it.

Re:How hard is it for a computer to do addition?

[Dhalka226]

Receiving, keeping, locating and using a random username/password is going to be entirely too difficult for average Joe, sad as that may be.

That said, why does the computer need to know if you've voted at all? When we vote here--regardless of how we do so--we present an ID or voter ID card to an election worker at the desk in the front. That person has a list of names and simply crosses one off before handing you your paper ballot or the little card for the computer voting, depending on your preference (for one or the other or "first available"). There's absolutely no connection of any sort between the crossing off a voter step and the actual voting step. In fact if you really wanted to, I don't see any reason you couldn't get your name crossed off the list and then walk out the door without ever voting.

Most secure system ever? Nah. But solutions like yours are going to cause more problems than they prevent and something easier and more secure--say, tying it to your state ID/drivers license number--have their own concerns in terms of privacy and access to voting.

Re:How hard is it for a computer to do addition?

[Rary]

I've never been able to figure this out myself.

I'm a software developer. I've worked on software ranging from extremely simple to extremely complex. It seems to me that this kind of software would fall under the "extremely simple" category. In fact, I'd say the entire business logic of the application should look something like this:

votes[selection] ++;

How, exactly, do you fuck that up?

Re:How hard is it for a computer to do addition?

[sjames]

Right. Ask a computer to count 1 million records and stop exactly on the millionth, and then ask a person to count 1 million cards and stop on the millionth. If you had to bet your life on it, who would you think would be more precise? Obviously computers have value.

That's just it. The source must be incredibly bad in order to get a computer system to create 5000 votes out of thin air! Electronic voting CAN work, but first the source needs to be freely auditable by any interested party, the binaries must be auditable to make sure they actually correspond with the source and the hardware must be auditable to make sure it faithfully executes the binary. Otherwise, the data itself must be available in human readable form at each step so that the results can be audited (and the results MUST be audited). So far, at least in the U.S. all we have seen is proprietary systems where absolutely nothing is auditable. It's like buying a used car from the guy in a cheap suit because he smiles big and says "you can trust ME!".

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

I thought it went like this:

void vote(int candidate) { switch (candidate) { case RALPH_NADER: totalVotes[RALPH_NADER] ++; case GEORGE_BUSH: totalVotes[GEORGE_BUSH] ++; break; case AL_GORE: totalVotes[AL_GORE] ++; break; } }

Re:How hard is it for a computer to do addition?

[Nyall]

Do they also give you jtag access to the HW the minute the polls close to download its programming? So that you can disassemble it and compare it to the binary of the compiled source.

Re:How hard is it for a computer to do addition?

[sjames]

Because if someone runs a batch twice, it will be counted twice and if a batch doesn't get run at all, the error won't be noticed.

If you try to do the whole thing online (bad idea, especially given that the networking at a polling place may be thrown together temporarily just prior to election day), you still have to make sure there's no collision.

i++ translates to:

1. Fetch value of I into a register
2. Add one to the register
3. Store the value back into memory

If two processes try to do that at the same time, one will be lost.

Because of reliability issues, you really need proper transactions with journaling. It would be a shame to have to re-do an entire election because someone tripped over a power cord.

Re:How hard is it for a computer to do addition?

[Quantumstate]

Because when a computer has to count 10000 votes (assuming each machine counts and then sends the total) it would just put too much pressure on a single thread. Isn't it obvious?

Re:How hard is it for a computer to do addition?

[2obvious4u]

http://news.cnet.com/E-voting-predicament-Not-so-secret-ballots/2100-1014_3-6203323.html

You could hash a voter_id onto a ticket type receipt where the voter keeps a record of their vote and the election official keeps the other half of the tab. Then you go to the website and look for your hash. If your hash doesn't match what is published you can complain to your local election officials. There is then a paper trail that can be tallied against voter registration without giving away voter ids.

The scam in this situation is that you could issue the same hash to people that vote the same way but then count their vote differently, however the election officials could see in the tally of their copies of the hash that there are multiple instances of the same hash.

So instead of VOTER_ID, CANDIDATE_ID you would have RECEIPT_ID, ISSUE_ID that could then be tabulated by anyone and the receipts could be tabulated by election officials in the event of a dispute.

Re:How hard is it for a computer to do addition?

[natoochtoniket]

Ask a computer programmer to "rig" an election, to make it come out with exactly a six-percent margin, in a closed-source proprietary system. And then ask a person to "rig" an election the same way, except that the person has to count the votes in front of dozens of witnesses, and show each ballot to each witness. If you had to stake your freedom on catching the election rigging, which one do you think would be more likely to get caught?

It isn't the accuracy of "counting" that matters. It is the ease of "rigging".

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

It might be possible to do. It seems as though you would have to start a thread that said i=i because it would fetch the value and then set the value to the old one.

This reminds me of my favorite newbie bug: i=i++
It never changes the value of i, because (i++) evaluates to the original value of i, not the incremented value.

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

I hope that was sarcasm...

Each of the voting machines only has to count one vote every twenty seconds or so, at the fastest.

Re:How hard is it for a computer to do addition?

[sorak]

You forgot your constants:
const PAT_BUCHANAN="AL_GORE";
const AL_GORE="Ralph Nader";
const GEORGE_BUSH=null;

const DB_ACCESS_PATH="c:\documents and settings\owner\my database.mdb";

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

whoosh ...

Re:How hard is it for a computer to do addition?

[Anonymous Coward]

OMFG WHY IS NOBODY EVER READING THE SUMMARY!?!?

Votes were not dropped! They were added...

There obviously was not an error that involved dropping votes due to threads...because votes were not dropped.

5000 votes appeared out of nowhere. How that happened, I have no idea...

Re:How hard is it for a computer to do addition?

[TurboNed]

Problems with this system you have described are discussed at least tangentially in another thread on this story's comments here.

Re:How hard is it for a computer to do addition?

[VoltageX]

That's pretty nice code, well commented (in English too, as far as I can see). Do you know who developed it?

Re:How hard is it for a computer to do addition?

[MoogMan]

The real kicker is that GEORGE_BUSH == AL_GORE

Re:How hard is it for a computer to do addition?

[fgouget]

Where is the proof that it is this code that was running on the voting computer you used last sunday?
Is all the proof you have 'They said so'?

Re:How hard is it for a computer to do addition?

[fgouget]

Electronic voting CAN work, but first the source needs to be freely auditable by any interested party, the binaries must be auditable to make sure they actually correspond with the source and the hardware must be auditable to make sure it faithfully executes the binary.

Electronic voting CAN work? Really?
So you get in front of the voting computer on election day. How are you going to verify that this computer is running the exact same code that you audited the previous day?
If you cannot perform this basic task on election day, then what's the point of public source and public binaries published on some official website?

It's like buying a used car from the guy in a cheap suit because he smiles big and says "you can trust ME!".

To continue the car analogy, auditing the electronic voting source code is like auditing the car's paperwork, but not being allowed to check it actually corresponds to the car you're being sold.

Re:How hard is it for a computer to do addition?

[fgouget]

This same system has been working since at least 1995 with zero reports of fraud or failure (except normal "computer is broken" style failures).

You mean that this did not happen?

• Cosmic ray hits Brussels election -- really?
• Le Ministre DEWAEL reconnait la faillibilite du vote electronique grace à un rayon cosmique complice !

Do you really think the cosmic ray is a believable explanation?

Re:How hard is it for a computer to do addition?

[sjames]

I personally could not do so on the spur of the moment, just like I personally cannot follow my paper ballot from beginning to end to make sure it shows up in the final tally.

I could, however potentially form a political organization (not necessarily a party running a candidate, just a citizen's group) and take part in the process of auditing, including watching the code being flashed into the voting machines and spot checking the final loaded code. Even disassembling the binary and verifying that it corresponds to the source.

The machine CAN print out 2 copies of my ballot in human readable form, one submitted for tallying and one for me to do with as I wish.

It would be quite dangerous to try rigging an election when all the opposition party has to do is round up one more receipts showing a vote for them than the official tally in just one district (or even 1 polling place) to show fraud.

Re:How hard is it for a computer to do addition?

[fgouget]

I personally could not do so on the spur of the moment,

You would not be allowed to check the code of the voting computer on election day anyway. And with good reason.

just like I personally cannot follow my paper ballot from beginning to end to make sure it shows up in the final tally.

In France you can. That the whole point of not moving the ballots around before tallying. So all you need to do is stay in the same room as the ballot box until they start counting the ballots.

I could, however potentially form a political organization (not necessarily a party running a candidate, just a citizen's group) and take part in the process of auditing, including watching the code being flashed into the voting machines and spot checking the final loaded code. Even disassembling the binary and verifying that it corresponds to the source.

Can political parties really freely access the voting computers in Belgium? In France they are not allowed to. And in any case, if the voting computers were to leave our sight for more than a few minutes, e.g. because you went home at night (silly you), then you would have to start over from scratch (see hacking a Nedap in 60 seconds).

The machine CAN print out 2 copies of my ballot in human readable form, one submitted for tallying and one for me to do with as I wish.

Wrong! In most countries, and I'm pretty sure Belgium is one of them, machines are forbidden by law from giving you a ballot to do with as you wish. For good reason: so you cannot either be coerced or rewarded to vote a given way.

Re:How hard is it for a computer to do addition?

[sjames]

I don't live in Belgium and don't know Belgian law, so I can't directly comment on that.

It is a good point that we can't allow an easy way to prove a particular vote. There are ways around that, though. One method would be that a hash number is printed on the top of a ballot. Anyone is allowed to make up a different recieptr as they wish before leaving (naturally that one won't count!). The only difference from a real ballot would be the hash. Or just encourage people to feel free to trade receipts.

Or, make the penalty for coercing votes be life in prison. Make that apply personally to anyone involved.

Re:How hard is it for a computer to do addition?

[fgouget]

It is a good point that we can't allow an easy way to prove a particular vote. There are ways around that, though. One method would be that a hash number is printed on the top of a ballot. Anyone is allowed to make up a different receipt as they wish before leaving (naturally that one won't count!).

So you want to give a receipt to the people so they can prove how they voted to combat fraud, but at the same time you want to only give them a hash so they cannot prove how they voted? See the contradiction?

Re:How hard is it for a computer to do addition?

[sjames]

Nope, you give them the whole thing, and another that says what they wanted. The former can combat fraud simply by validating the hash. The latter can be used as they wish, including "proving" they voted the way their crooked employer wanted. but the hash won't validate so they can't falsely claim election fraud.

Re:How hard is it for a computer to do addition?

[fgouget]

Nope, you give them the whole thing, and another that says what they wanted. The former can combat fraud simply by validating the hash. The latter can be used as they wish, including "proving" they voted the way their crooked employer wanted. but the hash won't validate so they can't falsely claim election fraud.

So you give your false ticket to your boss. He then goes check that 'his' vote was registered right. There they tell him he brought the wrong ticket because the hash won't validate. So he goes back and breaks your kneecaps.

Either that or when you go check your vote with the false ticket they tell you it's been registered all right so you don't really know if the one they took into account is your real vote or your faked vote.

Re:How hard is it for a computer to do addition?

[sjames]

No, when the boss goes to check the ticket, they tell him nothing at all because that would be a crime. He is risking life in prison.

The only purpose of the hash is for a case where the Silly Party protests that the official tally shows 5 votes for them, but here's 100 ballots with votes for them right here. The hash will separate the 'novelty' ballots from the real.

Re:How hard is it for a computer to do addition?

[fgouget]

No, when the boss goes to check the ticket, they tell him nothing at all because that would be a crime. He is risking life in prison.

What crime? How would the officials know the ballot is not his? Do you again want to record both the voter's identity and how he voted on the ballot? Even so, why would it be a crime to help your unfortunate neighbor who does not have the time to check his ballot has been correctly recorded himself?

The only purpose of the hash is for a case where the Silly Party protests that the official tally shows 5 votes for them, but here's 100 ballots with votes for them right here.

Why would anyone hack an election in such a stupid way? Let's take an election booth with 1000 voters (typical size) and assume a 50% turnout. Let's say party A gets 35% of the votes and party B 30%. You want party B to win so you arrange for it to have 33% and party A 32%. Now with your scheme party A would need to gather 161 ballots for party A to prove the fraud. That's 91% of the existing ballots for party A for that election booth! Good luck with that. Of course you would not hack the ballot count of negligible parties like the Silly Party.

Re:How hard is it for a computer to do addition?

[sjames]

What crime? How would the officials know the ballot is not his? Do you again want to record both the voter's identity and how he voted on the ballot? Even so, why would it be a crime to help your unfortunate neighbor who does not have the time to check his ballot has been correctly recorded himself?

You assume way too much. The hash is not to be used to verify a vote was counted. ONLY is singular, the hash may O*N*L*Y* be used in the way that I outlined. The ballots may only be used in aggregate to demonstrate a problem with the election. It would be MADE a crime to verify a hash for an individual precisely because the boss could use that to decide if he needs to kneecap you or not.

Why would anyone hack an election in such a stupid way?

The numbers would, naturally be larger, but the principle wouldn't change. You apparently haven't seen the lengths that a political party will go to to prove that there was fraud when they lose. Collecting every ballot from their loyal members in a district wouldn't be that extreme. Keep in mind, the losing party need only prove a single tally ANYWHERE is wrong to cast a dark cloud over their opposition for years to come. The big prize, of course would be jailbird photos of the opposition to use in the next campaign.

Keep in mind that I have also proposed making any sort of vote tampering a manditory life imprisonment.

And, of course, I chose Silly Party as a stand in name for any major party of your choice (they're all silly, after all).

It's not really feasible to BOTH maintain completely secret ballots AND make it easy to prove fraud. The best that can be managed is to maintain secrecy, make proof of fraud possible, and make the penalty for that fraud big enough that even a small risk is too much.

Re:How hard is it for a computer to do addition?

[fgouget]

You assume way too much.

Well, I think you should fill in the details then because as it is, there's a lot of blanks and that can only lead one to make some assumptions.

The hash is not to be used to verify a vote was counted. ONLY is singular, the hash may O*N*L*Y* be used in the way that I outlined.

Ok, so apprently only registered parties can bring in ballots to the officials and only in bulk. So, to take my previous example, they bring in 161 ballots, thus showing that they have one more than the claimed 32%. The officials then tell them that 1 of these (not saying which one) is a fake and so yes, party A really only has 32% of the votes. How do you prove the officials are lying or that the ballot counting machine has been tampered with? You're back to square one.

You apparently haven't seen the lengths that a political party will go to to prove that there was fraud when they lose. Collecting every ballot from their loyal members in a district wouldn't be that extreme.

As I said you'd need to gather on the order of 90% of the votes for your party. That's impossible. First you don't even know who voted for you. Second, even if you went asked every registered party member in the district you still wouldn't be able to reach the non-registered people who voted for you. So it's a virtual impossibility.

Keep in mind, the losing party need only prove a single tally ANYWHERE is wrong to cast a dark cloud over their opposition for years to come.

You're so naively optimistic here. There voting irregularities on a regular basis. In France it's been proven that some towns used voting machines that did not comply with the standard set by the government. Did the election get canceled? No, because the courts considered that it was not sufficient proof that the election got tampered with. So proving that there's a 1 vote discrepancy somewhere will lead you absolutely nowhere.

Keep in mind that I have also proposed making any sort of vote tampering a mandatory life imprisonment.

Lots of things are illegal: hold ups, murder, rape. And yet they still happen regularly for what looks like ridiculously small gains. Lesson: making something illegal, creating harsh sentences does not magically stop thieves, crooks, etc.

How hard can it be?

[Nursie]

I mean really, I'm pretty sure I could write a program with a couple of buttons and a counter for each.

What's going on here?

Re:How hard can it be?

[Anonymous Coward]

Somebody is so fast he was able to press the voting button five thousands times in the lapse of time it takes others to press the button once.

Re:How hard can it be?

[noundi]

What's going on here?

That, my friend, we will never find out. We would if these highly complex applications were OSS, but then again the complexity of these are so immense that 9/10 experienced programmers had their heads spontaneously explode upon viewing the first line of code. That or someone is bullshitting you.

Re:How hard can it be?

[Nursie]

Ah, "Shaky" Jim was off his meds again.

Re:How hard can it be?

[Tubal-Cain]

As someone that's never bothered to do much more than a while loop, I am pretty sure I could belt out an "count the number of times I press 'a' and the number of times I press 'b'" in less than 10 minutes.

Re:How hard can it be?

[0xABADC0DA]

What's going on here?

What's going on here is that the vast majority of computer software is crap. And if the programmers think that nobody is ever going to see the source and that it will be impossible to verify the results then the software they write is even crappier. And even if it were traced back to the incompetent programmers there'd be no liability for them... worst cases they get fired and go to work at some other company that doesn't know better than to hire them.

Of course there's also the purposely rigged voting software... but that's not going to add 5k votes, it's just going to change them.

Re:How hard can it be?

[scamper_22]

It is precisely that attitude that causes these kinds of problems.

It is not just a counter. It might start off that way. Then someone wants to centralize the counting for all the machines.
Someone wants centralized report generation. Someone wants the data encrypted or stored in a certain format.
Then you throw in networking, threading, database... issues and it can very easily turn a simple 'counting' problem into something much more difficult.

Re:How hard can it be?

[Anonymous Coward]

What's going on here?

Incompetence or incompetent cheating.

Re:How hard can it be?

[Anonymous Coward]

With Pentagon missing 2.3 trillion since 9/10 on 2001, and US govt. giving away 9.3 trillion to banking cartels, you need to ask? You are way late into the game, my friend. Way late.

How.....

[Darkness404]

It still amazes me how "hard" it is to write a simple program. First have something to scan the ID, check that its unique then move to the voting. Have a few radio buttons that you click, then hit submit, each radio button corresponds to a candidate or a choice, they are added up and give you the results. How the crap do you screw that up?

Re:How.....

[Anonymous Coward]

How does a local election provider define the ballot? How do you ensure that the ballot programming is accessible to politicos and not computer programmers? How do you QA the ballot program? How do you verify that nobody has tampered with the ballot program after it has been QAed?

For QA, how do you do it without using official ballots that don't end up in the valid votes pile? Do you use a different form? Then the official ballot might be different from the test ballot and result in badly counted votes. What happens if the scanner (for optical scanners) gets miscalibrated, or the ballot printer was miscalibrated when it printed them, so that alignments aren't off? What if the initial votes and ballots are correct but later ones are not because of changes in calibration or alignment? Think about multiple ballot runs off a printer in a high-volume election.

What about different election types? "Most-of", "at-large", "one-of", "instant-runoff", etc.? What about the interactions between these election types and other election types on a single ballot? What about multiple ballots in small regional areas? Who programs them and verifies the programs?

Re:How.....

[Shakrai]

It still amazes me how "hard" it is to write a simple program. First have something to scan the ID, check that its unique then move to the voting. Have a few radio buttons that you click, then hit submit, each radio button corresponds to a candidate or a choice, they are added up and give you the results. How the crap do you screw that up?

Well, in the case of New York State, our fearless leaders in Albany changed the requirements no less than 15 times after signing a contract with the vendor for new voting machines. Then after they finally agreed on a set of requirements they decided that they needed voting machines for 62 counties right now so they'd have them in time for the election. Then after the machines arrived they changed the requirements again and needed the new software for them right now.

Doing business with the Government is not an easy undertaking. The only good thing that came out of it is our fearless leaders weren't stupid enough to go with a DRE (direct electronic recording) system. We still have paper ballots that can be counted by any human being if the computer system fails. All the computer does is tabulate them and provide an interface for those voters (the blind/handicapped) whom can't fill out paper ballots themselves.

Re:How.....

[Darkness404]

How does a local election provider define the ballot?

Depends, have a list of candidates, choose the candidate, submit it. For a yes or no issue have two buttons, one yes the other no.

How do you ensure that the ballot programming is accessible to politicos and not computer programmers?

Either have a GUI or hire a programmer, I'm sure that the cost of one programmer and one or two other people is a lot less than hiring a team to hand-count votes.

How do you QA the ballot program? How do you verify that nobody has tampered with the ballot program after it has been QAed?

Sign it. Have the program check the signature, good signature it lets it go, bad signature it rejects it and throws up an error message.

For QA, how do you do it without using official ballots that don't end up in the valid votes pile?

Reimage the machine after use.

What happens if the scanner (for optical scanners) gets miscalibrated, or the ballot printer was miscalibrated when it printed them, so that alignments aren't off? What if the initial votes and ballots are correct but later ones are not because of changes in calibration or alignment? Think about multiple ballot runs off a printer in a high-volume election.

Simple, don't use scanners. Simply have it be all digital with a paper printout that may be used if the electronic voting failed due to errors, etc. The paper printouts could be hand-counted if there was a major failure.

What about different election types? "Most-of", "at-large", "one-of", "instant-runoff", etc.? What about the interactions between these election types and other election types on a single ballot? What about multiple ballots in small regional areas? Who programs them and verifies the programs?

Programmers and the town. Have an open meeting where anyone can discuss them, fix them, etc. You only need to hire one competent programmer to program a ballot. Multiple ballots are simply more XML files, trivial to make.

Re:How.....

[Anonymous Coward]

so you keep saying. do you care to elaborate on the reasoning behind that or are you just going to keep pasting the same response throughout this article?

Re:How.....

[DontBlameCanada]

How the crap do you screw that up?

This *is* a government operation, remember.

Re:How.....

[S77IM]

We still have paper ballots that can be counted by any human being if the computer system fails. All the computer does is tabulate them and provide an interface for those voters (the blind/handicapped) whom can't fill out paper ballots themselves.

This is how all electronic voting systems should work. No automated result should be legally admissible for anything unless a human can double-check that result. It's like those robot radar guns that snap a photo of your license plate and then mail you a ticket. There's no defense against it or way to double check it -- there's no human to put on the stand and testify against you. (I'm sure there are legal ways around this that let places use this technology but I disagree with them.) It's the same with voting machines, and killing machines. Fallible though humans may be, I don't want my rights or future decided by computers.

  -- 77IM

Re:How.....

[Shakrai]

Hey, you are preaching to the choir here. I became a NYS Elections Inspector primarily so I could see how the machines and procedures work behind the scenes. I'm convinced that we have a good system.

The new machines we use have two main components. The ballot scanner and ballot marking device (BMD). The BMD is only used by handicapped voters. It consists of different interfaces (a control pad, a sip/puff device, foot pedals, LCD screen and headphones) designed for people with various disabilities. It takes their votes and prints out a ballot that is then scanned by the ballot scanner. Regular voters get a paper ballot where they fill in the squares and drop it into the ballot scanner. The ballot scanner will catch under/over-votes and give you a chance to get a new ballot if you want.

All paper ballots are retained and can be referred back to in the event of a close/disputed election. The scanner is also smart enough to catch write-in votes and divert those to a different ballot box for easier tabulation. When it scans a ballot it also retains an image of the actual ballot on a memory card. At the end of the day we remove that memory card and transport it to the Board of Elections with the unused ballots and rest of our supplies. This memory card is primarily intended as a backup in the event that something (i.e: building the machine is in burns down) happens to the paper ballots.

Our system is pretty good. It took NYS years to adopt it but at least that gave us the chance to learn from the mistakes that other states made. I've seen the DRE machines in action (worked as a poll watcher during the Presidential Primaries in Ohio last year) and they scare the hell out of me. A single hardware failure and you lose every vote cast on that machine during the day. What idiot decided that was a good idea?

Re:How.....

[Matheus]

Actually... I worked at NCS/VUE (Now Pearson/VUE) and making truly customizable digital testing can get really screwy. Often our bigger business was the months of developing the tests more than the years of delivering them. That being said: A company like VUE that has been doing this for many, many years should be able to utilize their "testing" infrastructure to create voting stations. A ballot is just a series of questions.. the only difference is that with a vote technically every answer is correct so you just store the results without bias. Their software allows for the question types you need (select multiple, rank top 3, pick 1, etc). We even did statistics on how people tended to answer certain questions SO getting your vote result would just be a snap shot stats grab.

After that it's all logistics and hardware development.. VUE runs on COTS hardware and a locked down Windows (or at least did when I worked there)

All of this talk of multi-threading is missing one point.. why would this system need to be multi-threaded? You don't do something just because you can. This system could easily be developed with each station doing it's own tally. Then those tallies are brought together for the site then up the chain city/county/district/state/country. Using US number The 2000 census had just over 25K "places" in the US. If I estimated average 1000 voting stations per place (remember there are "places" that would only have one voting site and maybe even only one or two machines) A total of 25M tallies to count in one thread is not out of reach but that is irrelevant as given the hierarchy at the top you should only actually be merging 50 counts at central. Your biggest lists to tally would be farther down the branches for say a large city summing all of their voting stations. Still numbers that are quite easy to handle with minimal hardware.

The only reason for this to be massively parallel is if you have a small number of centralized machines running the election web-app style and frankly with all of the problems we've had with voting machines we're a LONG ways from taking that leap.

Hmm..

Re:How.....

[filesiteguy]

At least here in LA County it is extremely complicated.

Given that the law requires us to have a maximum of 1,000 residents per precinct and that ballots must not show the same candidates in the same order on any subsequent precincts, there are a ton of complications. Keep in mind, we have well over 8M potential voters in LA County and 5,000 precincts. (Let's not even get into the fact that we print ballots in eight languages by Federal law.)

In the November election, we counted well over 4,000,000 ballots between about 8:30 PM and 2:00 AM. We have 24 tally machines which each read ballot cards. The tally machines used to be setup to read punch cards, but after the screw up in Florida 2000, they were converted to optical scan. They must be continually calibrated. Since we do not use a vendor for the tally software, I can tell you the programming is quite complex.

The programs are all written in assembler. The tally machines know nothing of the votes, just which bubble (these are IBM cards similar to the ones used in mainframes back in teh '60s and '70s.) is filled in. Each machine must be loaded with the hundreds of possible ballot group layouts so that - when the bubbles are read - it can feed the information to the collector computer. (Which is connected via Token Ring by the way, so it is not on our ethernet network.) The collector computer then simply feeds this information - ballot group, numbers filled in, presents reporting - to the mainframe. This computer then assembles all that and comes out with a running total in any given vote.

So how?

Here's how. One piece of software allows the contests to be generated. (Presidential, city council, county supervisors, Board of education, senatorial, state assembly, state Senate, congressional, propositions, water board....) Then the contests are consolidated as necessary. The precincts (given a TRA - Tax Rate Area) are setup and another software starts doing ballot layout for each of the ballot groups. (We had around 300 ballot groups in November combined with the 5,000 precincts.) The printer prints all this and the ballots are sent via truck to the polling locations on the day before the election. On election day, people come in and vote. (Let's not forget the 700,000 absentee voters in LA County who sent in their votes prior to the election and still ahd to be sorted and counted on election evening - by precinct and ballot group.)

After 8:00 PM, the ballots boxes are brought in (via Sheriff), unsealed, opened, scanned in (to a ballot tracking software) and then sorted by ballot group within a precinct. They are fed into the tally machines and counted.

Just to make sure the tally machines are calibrated, the team runs a "logic and accuracy" test prior to and after the actual counting. The machines' counts are set to zero, a group of ballots are run through and the expected counts should be totaled up.

If any of this process goes wrong, you'll have an error.

Too bad the election terrorists made sure electronic voting was disallowed.

Re:How.....

[PRMan]

Because, some programmers, like those above, would multithread such a simple operation and then do it wrong. KISS.

Re:How.....

[BitZtream]

He is describing whats know to programmers as a race condition.

If, at nearly identical points in time two people vote for the same canidate then what happens in the computer is that the system goes and gets the value of totalVotes[canidate] and stores it in a register or cache or whatever, then it adds 1 to that, and then puts it back into the memory location for totalVotes[canidate]. If there is only one person doing that at any given time, no harm no foul, everything is fine.

When you get 2 people who press the button at nearly identical times, and thanks to the beauty of preemptive multitasking, what CAN (doesn't have to, but it might) is this:

Voter A's process finds totalVotes[canidate] in memory and gets the value out, the value for this example is 10. Then it adds 1 to that, making it eleven, BUT before it can save it back, voter A runs out of his timeslice, and voter B gets hers. Now voter B goes and gets totalVotes[canidate] and sees it is still 10, and adds 1 to it, and goes ahead and writes 11 back to totalVotes[canidate]. Now its done so voter A gets more time, all it needs to do is write out its temporary value that it still has stored, 11. Note: We've just lost a vote. We started at 10, two people voted for the same canidate, but as the two threads 'RACED' to do their work, they trampled all over each other and in this very very very simple example, a single vote is lost.

That is an EXTREMELY simple race condition, which can be solved exactly as shown previously, simply adding some syncronization on the variable to prevent it from getting trampled, no more race condition, no more lost votes.

Note in this case the example race condition lost votes not gained them. In reality though, most race conditions are not these simple types of race conditions, they are generally race conditions caused by many variables getting trampled or unexpected variables that don't seem to be related to the operation at hand such as loop counters, reference counts, mulitpliers and such.

And keep in mind that race conditions can do really weird shit when dealing with large numbers that are not atomic in nature at the processor level. In our basic example with small numbers we're just going to lose a vote, however if you're dealing with say a 64 bit number on a 32 bit system where it takes multiple processor instructions to update the 64bit number as stored in ram, or to read it from ram to registers than you can get really weird crap happening when one thread is updating the number, gets only half of it written and then another thread jumps in and reads it. Instead of getting one off errors, you now start getting numbers that appear to come out of no where as they have never actually been used by the system, they are just the bytes of different numbers thrown together in unexpected ways.

This can cause things like simple race conditions that should in theory just result in missing a few well timed votes, turn into random results that are completely unexpected and appear to be completely random and obviously wrong (if you're lucky, if you're unlucky they look believable and you don't notice them in your auditing).

Re:How.....

[JasterBobaMereel]

Sound like a good system .... mark a paper ballot, scan it, keep it in case of disputes

The Computer only counts votes, it is just doing the job of a counter only quicker

The paper votes system is transparent and hard to fix, the only downside is the slow counting

The marker could be used for all people to stop spoiled papers .....

Re:How.....

[hamburgler007]

It still amazes me how a far more complicated system (ATMs) have been used for decades with near perfect accounting. A system used year round, 24/7, and worldwide. I guess the difference is between when you have private institutions with everything on the line and when you have a government that looks at its citizenry as an ATM.

Re:How.....

[BitZtream]

Please pardon my ignorance, although I live in a tech savvy area (RTP, NC) I have yet to actually use an electronic method, all of our votes are still on paper it seems. Which for the time being, I'm okay with :)

So if some of these statements are obviously wrong or stupid in context, again, sorry.

Depends, have a list of candidates, choose the candidate, submit it. For a yes or no issue have two buttons, one yes the other no.

Excuse me? You mean this ISN'T the way it works? Fundemental flaw in the software, throw it out. The only change I can see to that simple gui is adding a 'I'm an idiot who votes all for XXX party' option. If its more than that, something is wrong. If the designers didn't see that they are not qualified to write voting software, period, no second chances on this shit, my life depends on these votes both directly and indirectly, stop fucking letting people without a clue do the job cause they bid lowest.

Either have a GUI or hire a programmer, I'm sure that the cost of one programmer and one or two other people is a lot less than hiring a team to hand-count votes.

For anything of importance such as goverment ballots I see absolutely no reason why anyone other than a trained person should be allowed to enter the ballot info. It shouldn't be hard, but when were talking about voting for people who effectively control our lives I can not possibly imagine that the extra cash it takes to hire qualified personal is not worth it. This is not something I want handled by a secretary, and doing so is entirely unacceptable. Especially, as you said the cost for that person is not going to be anywhere near the cost of counting paper ballots.

Sign it. Have the program check the signature, good signature it lets it go, bad signature it rejects it and throws up an error message.

Well, this is practically worthless by itself. A program validating itself is a flawed method. If you can modify the program to make it do something its not supposed to, you can certainly modify it to accept the new digital signature, or ignore the signature completely. The only way digital signatures work on software is if something else that can not be tampered with can verify the signature. PKI requires trusted third parties to validate, no one can validate themselves, people or software. If you make the machine only run binaries signed by the manufacture (or some acceptable third party) and you make that impossible to change EVER, then you get something, until the private key is leaked or broken somehow, but its better than nothing to start with.

Reimage the machine after use.

Well, in my perfect world the machine doesn't have a writable device in it, so no one can possibly tamper with it. It talks to a server (could be in the same building, or at a central office) that does the actual recording of votes. You do QA in a controlled way meaning something like on any day but the official election day, all votes go to a separate repository. Only on election day to votes get counted and because of that on election day you do not allow any sort of QA activity (like allowing duplicate votes by a single person or whatever that might be used to cheat).

QA is not something that should be done by any end user at a voting office, ever. Officials come in, connect the hardware, validate it, make it as ready, and it doesn't do shit until authenticated and authorized by the CO that it can count votes.

Simple, don't use scanners. Simply have it be all digital with a paper printout that may be used if the electronic voting failed due to errors, etc. The paper printouts could be hand-counted if there was a major failure.

DING DING DING DING! We have a winner! Ignore the damn retarded analog hole! Why on earth would you go through the effort of making it digital so you

Re:How.....

[BitZtream]

I guess no one thought standing up and saying 'no, we can't do that, sorry' was the right thing to do.

Far easier to just take the money and bullshit your way through it ... ahhh, the American way.

Re:How.....

[Anonymous Coward]

All good starting answers, but all with their flaws. The point wasn't that the problems are insoluble. The point is that voting is more than just about counting.

More questions: Whose public key do you use for the signature? How do you control key generation and use within a particular political arena? How do you prevent corrupt election officials from signing maliciously programmed ballots? How much training do poll workers need to fix problems when the machine points them out?

What happens if a poll worker reimages the machine during use?

What are the procedures for handling disputed paper ballots? What if the printer runs out of ink? What if the programmer maliciously programs the printer to print the correct ballot but record an incorrect electronic ballot? How will this be detected?

Are you seriously suggesting having a programmer present for every election? I believe that voting procedures must be transparent and accessible to the people voting, not just programmers. XML files are not legible by my grandfather, who signed up for his first email account last night. And who defines what a "competent programmer" is?

The voting process must be protected from mistakes and fraud, must be resilient to humans, and must anticipate manipulation and error.

Re:How.....

[fgouget]

It still amazes me how "hard" it is to write a simple program. First have something to scan the ID, check that its unique then move to the voting.

Whoops, you did not write a single line of your program yet, and it's already afflicted by a huge design flaw!

Votes are supposed to be anonymous, remember?

So how smart is it to have a single program check the identity of the voter and then record his vote? Sure it may not keep the two correlated but if it ever gets subverted in any way it will be trivial to keep track of who voted for whom. Furthermore, how would you feel as a voter about having to insert you id card in the computer before you are allowed to vote? Would you really trust the computer to not record who you're voting for?

How...

[BlitzTech]

... could it possibly be so hard to write voting software? It just... I... but...

It's gotta be deliberate. Right?

I must be missing something...

[thekm]

...but I can't understand how a glorified logger can be this far off. With hand-shaking and all the rest of it, it just staggers me that something this simple is so hard. If our systems or audit logging were off by more than 5k, our nuts would be in a sling, and our projects sure as heck aren't as big as these puppies.

How difficult can it be

[guruevi]

We keep hearing about these mishaps. But really, how difficult can it be to build a functional counter? The current electronic voting systems are about as reliable as the average poll on a random website.

Blckboxvoting.org

[Red Flayer]

"You may be able to argue that a five thousand vote error is a small price to pay for a national election but these errors are certainly inadmissible on a much smaller scale.

A software error resulting in +/- 5000 votes cast is unacceptable on any level, even if it gets drowned out on the national level in the US.

There is absolutely no reason or excuse for software to miscount votes. It isn't rocket science.

I know I'm preaching to the choir here, but this shit just pisses me off. It's a matter of national and local integrity that our voting systems are transparent. Please support blackboxvoting.org if you don't have the time to get involved in a deeper fashion (calling/writing your legislators, etc).

Note: I'm not affiliated with blackboxvoting.org. I just appreciate their work.

Re:Blckboxvoting.org

[jschen]

Agreed that 5000 votes is completely unacceptable even on the largest scale elections. That's an order of magnitude higher than the margin between candidates in Florida in the US 2000 presidential election!

Re:Blckboxvoting.org

[nedlohs]

Yes, but it's hilarious when there were only 5600 actual votes cast. +/-100% error bars, is good enough for government work apparently.

Re:Blckboxvoting.org

[Anonymous Coward]

Agreed that 5000 votes is completely unacceptable even on the largest scale elections. That's an order of magnitude higher than the margin between candidates in Florida in the US 2000 presidential election!

In the EU elections last a few days ago in the UK, the British National Party beat the Green party to the last seat in the North West region by 5000 votes. I (along with a lot of other people) would be happy if it turned out that the results had this margin of error.

Re:Blckboxvoting.org

[wfstanle]

More to the point... Lets say many voting districts encounter the same problem. You could have a vote tally that is off by millions.

Re:Blckboxvoting.org

[BitZtream]

There is absolutely no reason or excuse for software to miscount votes. It isn't rocket science.

At first thought, I agree with your statement. But the last part struck me.

I know a fair amount about cryptography. I have followed references and written software implementations of the main symetrical cryptography algorithms in use now days, and verified they work correctly against known test sets. I have used other peoples implementations of asymetrical algorithms in applications and understand the principles and general theory as to how it works and how to use it properly. I'm not one of the guys who invents algorithms. I at best am just a copier/translator between human and code or code and code, but I know enough to make it actually work in code.

I know very little about rocket science, I know the very basic math, and I've launched my fair share of Estes model rockets. Other than that, I'd have to do a considerable amount of research to get a good idea of the internal workings of rocket engines and why everything is shaped like it is, the trajectories used and how to calculate all of them taking gravity of the various bodies you pass into account and all that junk. But all of this to me is probably just math. Perhaps complex math, but solid hard numbers that make sense when plugged into some formula that is already known (perhaps not by me).

It is possible that my lack of understanding of rocket science is part of the problem here however ...

Considering a lot of what voting machines do involves a far amount of cryptography, you have now given me a good excuse when I hear about this things being so ridculously wrong. With all the knowledge of cryptography I've gained, I think if my life was on the line and the only way I was going to live is if I understood rocket science or cryptogaphy, I'd take my chances on rocket science. The art of cryptography is just crazy. Yes yes, I know its all just math. But a lot of it is so theoretical that its more like a religion.

In religion:
'God exists because we believe it does, even though we can't prove it, it hasn't been disproved'.

In cryptography:
'Its secure because we believe it is, even though we can't prove it, it hasn't been disproved'.

Brings a whole new perspective to cryptography and religion doesn't it :/

Re:Blckboxvoting.org

[Red Flayer]

Considering a lot of what voting machines do involves a far amount of cryptography

Why would a well-designed voting machine require crypto?

Seriously, why should anything on the machine ever need to be encrypted?

Bug?

[david@ecsd.com]

It's not a bug, it's a feature.

Probably counting screen touches outside buttons

[h4x354x0r]

Wired thinks it's "probably a complex bug"? I think probably not, it's probably something blindingly simple, and stupid.

I had no idea

[oodaloop]

that adding involves multiplying by numbers greater than 1.

!bug

[Yvanhoe]

The probability of a software glitch not crashing the system, but causing a problem that changed the outcome of the election while still spouting out believable numbers is close to zero. You don't need software experts on this one, what you need is a criminal investigation.

Re:!bug

[skelterjohn]

yeah, cause the difference in saying something like "x+y/2" or "(x+y)/2" is obvious fraud, as it is a bug that wouldn't crash the system.

Re:!bug

[link-error]

It's probably more like they aren't rolling back some transaction on a network error or something. Network timeouts, etc, are probably doubling up the votes from that machine. It's probably an unusual error so it doesn't get caught in testing. Like busy networks on election night? It's not that hard to imagine.

Re:!bug

[todorb]

when this kind of "error" appears in elections software, be sure that it's not by accident.

Re:!bug

[Yvanhoe]

You mean, something that would be caught even by the most simplistic testing procedure ? Or, failing that, by the "certification experts" that were supposed to test the machine before validating its use for elections ?

Re:!bug

[Anonymous Coward]

Oh you silly billies... When you hear hoofbeats think horses not zebras. Errors of this type are usually caused by human errors like not clearing test votes from the totals or possibly counting some individual machine totals twice or more.

Note George Bush won the Florida presidential election because of poor ballot layout in Broward county not because of obscure software issues.
 

This is why we have validation.

[BlueKitties]

I'm pretty sure, somewhere in that code, was a server thread handle which states "if {vote=="thisGuy"){thisGuy++;}else{otherGuy++;}" - because validating your requests might require extra code.

Re:This is why we have validation.

[Quiet_Desperation]

The disturbing thing about your code is its mandate of only two parties.

Re:This is why we have validation.

[mini me]

Or he is assuming that the third party will receive 5000 votes.

Re:This is why we have validation.

[BlueKitties]

I guess this is why the alternative never seems to get any votes. Oh well, I'll add multiple candidates to my to-do-list, next to encryption, validation and thread safety.

Re:This is why we have validation.

[0xABADC0DA]

Probably more like:

int ok = validate_ballot();
if (ok);
    votes[candidate]++;
. . .
if (!ok)
    goto screen1; // gotta have a goto

Re:This is why we have validation.

[BlueKitties]

Your code fu is strong, but not strong enough! [tally[vote] for vote in voteBox.getVotes()]

Re:This is why we have validation.

[Anonymous Coward]

Maybe I should point out the semicolon in "if (ok);" causes "votes[candidtate]++" to run even on bad input... ;-P

tampering?

[Ltap]

TFA only tells me the numbers and the guy's plans, nothing about the actual bug. What was it? It seems awfully hard to screw up adding two numbers together to get a third number, which is basically what that software was doing. Has it occurred to anyone that it might have been tampering? It seems to me that, with the fairly large (tens of thousands) number of votes, adding or removing just enough to make it a runoff would be the perfect vote tampering scheme - too little to draw much attention, but enough to actually make a difference.

a complex bug

[viralMeme]

How difficulty is it to get a computer to count up in increments of one?

++count;

looking at the source code

[moon3]

vote = GetVote( );


if( vote = my_candidate )
{
my_candidate_votes = my_candidate_votes + 2;
} else {
other_candidate_votes = other_candidate_votes + 1;
}


In the source code as complex as this, you will probably need a PhD in computer science...

/s

Re:looking at the source code

[Anonymous Coward]

if( vote = my_candidate )

In the source code as complex as this, you will probably need a PhD in computer science...

If that's C (and many other languages), the value of variable 'vote' would be set as the value of 'my_candidate', and the IF statement would be always TRUE (due to variable attribution).

Well, looks like you are not a PhD in Computer Science :)

Nope, there were errors in Belgium in the past

[Anonymous Coward]

There have been reported errors in Belgian computerized votes. (2003, Schaerbeek, for instance)

Belgian Anonymous Coward, who should find some time to register on slashdot

Re:Nope, there were errors in Belgium in the past

[Anonymous Coward]

If you mean what is described here (dutch)
That is a complaint about the votes being counted by humans. The same story could be true with paper ballots.

If the story is true, it is about an incompetent (never attribute to malice...) judge, not about counting computers gone wrong.

Belgian AC, who wants no less than a 7-digit ID.

I agree.

[Anonymous Coward]

Incrementing a counter is not fucking rocket science.

Even doing it in a thread safe way is trivially easy these days (provided the developer has a basic level of competence at his job).

Re:I agree.

[Rakshasa Taisab]

The problem is probably that the developers of that voting software was probably exactly like the OP, thinking: I'm pretty sure I could write a program with a couple of buttons and a counter for each.

Really, the very first step you'd need to make, is separating the system into a GUI client, operator client and vote server. The vote server would be easier to verify due to very few libraries and unrelated code being used. The GUI client would not be able to mangle _all_ vote results in an instance due to memory corruption issues. And requiring the operator to clear the vote server for receiving the next vote would avoid 5000 votes being registered due to a bug of any kind.

The server and GUI client would be separate users with different privileges and cryptographically signed log to append-write only medium. Hell, the final confirmation to the user should be displayed on screen by program using a plain-text message sent by the server to a different client process, just to ensure the GUI is showing a different choice from what it registers with the vote server. And I'm sure there's plenty of other stuff that would need to be done to make a truly secure and reliable voting system.

It's simple

[Mad-Bassist]

Someone forgot to clear the chad bit!

Re:It's simple

[Anonymous Coward]

It's worse than that. Some of the bits were in an indeterminate "hanging bit" state which take much longer to process. Combine that with the fact that the bits were not actually located in their associated bytes, but were rather distributed in a "butterfly-byte" configuration and you see how difficult it is to arrive at an accurate total.

Re:It's simple

[jez9999]

And don't forget that if a butterfly byte flaps its wings in South Dakota, it can cause a tornado over the national elections.

Open source voting

[fulldecent]

I hear lots of people talking about how an open source voting solution would exceed the quality of commercially available solutions in use today. Also, I hear that such a solution would also be easy to implement.

Could someone please send me a link to the SVN where I can find this alleged OSS voting software?

Re:Open source voting

[TheLink]

It's called paper based voting.

There are plenty of good paper based systems around.

They scale. The more voters you have, the more volunteers and observers you should be able to get.

The counting of each ballot can be observed by party representatives and independent 3rd party observers/monitors. In my country, the counter holds up each ballot paper to show it to "everyone". It'll take a fair number of magicians to cheat in this and they would have to work a lot harder to cheat without getting caught.

As I've said before- Elections don't just have to be fair, they have to be SEEN as fair. If democracy is important, it doesn't matter if it costs a few hours to get it right.

The best thing about it is, even if it's a surprise result - because the various observers see that it's mostly fair, the losers will grudgingly accept the result. If the result is close a recount can be done with even more stringent monitoring.

Where the cheating probably happens in my country is from the postal votes. But the electronic systems will also be vulnerable to this problem, in addition to being vulnerable to very many other problems inherent with e-voting.

E-voting fails my "seen to be fair" requirement- because it's some blackbox that the normal folk don't understand, and the IT security people understand and thus don't trust. Even if you have the source code, it's so hard to prove that it's the same software that actually runs during the counting, or that the rest of the hardware isn't messed with.

With e-voting, only a few specialists can understand and check the system, and the rest of the public have to near blindly trust them.

Whereas with hand counting, it's easy to explain to most people how it's done - and their party representatives are there checking each ballot as it's counted as well.

Is it so hard in the USA to find people who can count? Tell me it can't be so bad as "Counting votes is hard, let's go shopping!" right?

Nobody trusts these machines

[Presto Vivace]

yet we continue to use them, both here and abroad. Curious.

Re:Nobody trusts these machines

[pembo13]

I think the ones programming them are the ones not to be trusted.

Re:Nobody trusts these machines

[rjstegbauer]

The only people that I know of that like these machines are politicians, voting officials, and voting machine manufacturers.

I don't know any *voters* that prefer them.

Randy -- justmyobservations

Doubles

[Paddo_Aus]

Was there a double B, double G, double L?

In related news...

[Xiver]

In related news its apparently very easy to convince the media that programming voting machines is hard. I seriously doubt this was an accident. Independent testing should have flushed this bug out very early.

Re:In related news...

[phantomfive]

I haven't seen the code, but if I were trying to debug it, the first thing I would check for is to make sure the votes were properly reset at the end of the previous election. They have roughly twice the votes? How much do you want to bet that the number of extra votes is exactly the number who voted in the last election?

my observation

[Tumbleweed]

I find it interesting that companies that make ATMs for systems that track things down to the penny are unable to track much smaller numbers with errors of plus or minus THOUSANDS.

Maybe we should just start voting at ATMs?

Oh wait, that's what the lobbyists do already.

Re:my observation

[tnk1]

I find it interesting that companies that make ATMs for systems that track things down to the penny are unable to track much smaller numbers with errors of plus or minus THOUSANDS.

Maybe we should just start voting at ATMs?

Oh wait, that's what the lobbyists do already.

No, that's merely where the lobbyists get their ballots... twenty of them on each sheet. It's sort of like absentee voting. They actually need to send them to various drop off points like the PR firm and the offices of a few dozen Congressmen to actually vote.

But you're right about one thing. One way or another, their votes are always counted correctly.

Re:my observation

[NeoSkandranon]

The thing is, if there's a screwup like that at an ATM, I'm pretty sure the bank sends a few guys around to those responsible to have a "chat" with a sockfull of quarters and maybe a power drill.

Re:my observation

[Acer500]

I find it interesting that companies that make ATMs for systems that track things down to the penny are unable to track much smaller numbers with errors of plus or minus THOUSANDS.

I had ATMs screw up four times in about 8 years. One of the four times, a Diebold machine refused to give me the money, gave me no receipt, just had a "failure" message on screen, but the withdrawal was somehow recorded. It was on a national holiday over here, so nobody could be reached for help, the maintainers of the ATM network refused to acknowledge the error, and instructed me to file a complaint to the bank the day after.

The bank refused to reimburse the money, that's why I won't do business with Banco Itau again (it was BankBoston - the Uruguay branch - at the time of the ATM failure, was since purchased by Itau, along with my ill will).

Second time (after switching banks), the transaction was "rolled back" with no more inconvenience.

Tthe third time was on a workday and I camped at the ATM for hours until a crew arrived to repair it (both my card and the money had become stuck inside the ATM !!!).

The fourth time the ATM refused to give me the money and recorded the withdrawal again, I was instructed to file a complaint, and this time the bank (ABN-AMRO at the time, now Banco Santander of Spain) did refund me the money.

Paper Trail

[WarwickRyan]

This case quite clearly highlights all the advantages of an paper trail.

Dispite a the software part of the IT system, we're capable of finding the true result of the election because we've still got the paper votes.

Result: the voting system works.

Compare and contract this to an system which didn't have paper ballots. It would be almost impossible to even see if there was a problem, let alone be able recover from it. You could possibly see that the numbers were wrong if they'd taken an register of who'd voted, or if they'd counted the number of voters manually. However there'd have been no fallback. No way to recover the votes.

So yeah, this case is an fantastic advert for electronic voting systems which have an paper trail.

Here's to hoping

[ourcraft]

Why is hoping the right response? I want source code period. Imagine a person coming into town and saying tell me your vote and Ill make sure it gets passed on. If the code is hidden there is no difference. You have no idea what the stranger will do with your vote, forget it, throw it out, change it to Paultard. Or maybe the code is remembering who voted for who. Or maybe... We have no idea, because we cant see the code!!! How does a nation that sent boys into bullets to protect Democracy let it be taken away so easily. We have seen massive voter suppression tactics by the Republicans, they and their media ilk have opined in various locations that voters are stupid and always vote wrong, they have a vested interest in stopping voting. Hello. Yes yes I know Democrats do it too, hehee, thats why you should support efforts to weed out nefarious Democrat tricks,. (Why are the graves in New Orleans always above ground? Its not the water table its easier for the dead to vote) Yeah "hope we get democracy again real soon."

Re:Here's to hoping

[Anonymous Coward]

more than just the code, every single detail of the process - schematics, hardware, shipping, security of the devices, process used for reporting and aggregating, all of it.

oh, fsck it... paper is easier

Just applying Hanlon's razor

[Anonymous Coward]

yeah, cause the difference in saying something like "x+y/2" or "(x+y)/2" is obvious fraud
If that bug survived product testing, stupidity is no longer an adequate explanation. We are forced to suspect malice.

We do not need electronic voting machines

[drDugan]

No one yet has provided me a compelling argument for why we need to use electronic voting.

It seems to be simply a combination of techno-fetish with an illogical push toward "the new thing" which someone has sold as "better".

Yes, it is hard to conduct an election. Making machines do the counting would reduce the human effort, but the cost way is too high. While I was open to the concept initially, the graft and fraud uncovered leaves me with no confidence any longer that the machines in an election booth will enable a fair election, and thus, a just political system.

Re:We do not need electronic voting machines

[BronsCon]

Even if the machines were free, you're right. When the cost is our nation and our freedom, the cost is just too high.

Biometrics did not match

[bbhack]

Let's hope the real reason this was found was that the voting machine's captured biometrics did not match anyone in the FBI's databases. The fingerprints, face and iris scans came up blank.

Pseudocode

[Jamamala]

I posted a question yesterday about what was wrong with a simple program. No-one seemed to know so here's my attempt at writing that simple program. Feel free to tear my ideas to pieces. Hint: I am not a programmer.

MAIN:
print("Please enter your Voter ID")
scan, store as voterID
if (voterID == any value in array of legal voters)
then run the vote program
else {
print("Error")
go back to main }

VOTE:
print("Enter your choice of candidate")
scan, store as candidate
if (candidate == A) {
then record vote for candidate A
remove voterID from array of legal voters
exit }

elif (candidate == B) {
then record vote for candidate B++
remove voterID from array of legal voters
exit }

else {
print("Error")
go back to vote }

Re:Pseudocode

[Firethorn]

You're missing a method to ensure the voter doesn't vote multiple times by using the IDNumber on multiple machines at the same time.

So:
scan, store as voterID
if CheckOut(voterID) 'Returns true if successful, if already checked out, returns false
  if (voterID == any value in array of legal voters)
  then run the vote program
end if

else {
print("Error")
go back to vote }

CheckIn(voterID)

The error coding to ensure that the voterID gets checked back in if a vote isn't cast in error and that the ID gets marked used if a vote is cast for a multi-user system would be a lot more complicated, but programmers work on more complex systems all the time.

I'm mostly a script writer at this point.

Re:Pseudocode

[Anonymous Coward]

Hint: I am not a programmer.

You see, that's the problem here. You totally miss to account for the stuff that makes these machines so complicated:
  - different voting system
  - more complex ballots
  - prevention of storing a link between voter and vote
  - logging / failure recovery
  - tallying of the actual total (across machines)

Also a big part is the user interface itself. So really, just reducing it to "increment one number each time" is by far not enough.

By the way as far as I am concerned, pen&paper voting is the only reasonably method.

Re:Pseudocode

[Anonymous Coward]

What happens when the user selects the wrong candidate (they have "fat fingers", shaky hands, or whatever)? They know very well who they wanted to pick but the touch screen just didn't work right.

Of course the user of a voting machine which used that algorithm wouldn't know who they accidentally voted for because there is no "print 'You voted for candidate'" line. It would be awfully nice to know which button the voting machine thinks I pressed...

Stop that!

[denzacar]

Copy/pasting the same answer over and over...
Makes me feel senile running into those. "I could have sworn I just read that comment a minute ago... Did I really?"

This is why it's hard...

[thijsh]

you forgot the first two lines:

const int GEORGE_BUSH=1;
const int AL_GORE=GEORGE_BUSH;

ballot browser

[mtrachtenberg]

There is a very simple, comparatively low-tech fix for broken elections that involve paper ballots.

As we do in Humboldt County, CA, run all ballots through an off-the-shelf scanner and run an independent count with independent, open source software. Ballot Browser (open source, Python, GPL from me) is available for tweaking and the basics are explained in April's Python Magazine. Or, it's really not that difficult to write your own bubble-reading software.

How hard is it to Add?

[JohnnyGTO]

Maybe they should replace the core of their system Open Office.

I'm missing something.

[dAzED1]

Ok, being serious here. I'm an eng for a software development company. Security is a very aspect of our software; we store patient records for DoD hospitals.

I'm honestly scratching my head here, completely confused as to how anyone...anyone...could take a concept as overwhelmingly farking simple as COUNTING and screw it up. Seriously. I'm pretty sure I could have a reliable, bug-free (oh yes, I made that claim), fully auditable system created in a few days. I really, really don't understand why the hell this whole concept is getting so incredibly overblown. At this point, I almost have to be sceptical that when "bugs" are reported in the machines of a funded commercial entity (diebold, etc) that they have to have been intentional for some reason.

Re:I'm missing something.

[TheLink]

Well a sufficiently high level of incompetence is indistinguishable from malice.

So maybe the people responsible should be punished as if they did it on purpose.

Because we're not actually talking about "just counting". We're talking about something far more important - voting.

The USA keeps making disparaging remarks about non democratic countries, spends hundreds of billions of dollars and thousands of lives to establish democracies/"regime change", but can't even count votes properly back home. Come on, we know the USA can do better than that.

If the USA can't, maybe they should outsource to India. India's a democracy and they have far more voters than the USA ;).

Re:I'm missing something.

[H0p313ss]

If the USA can't, maybe they should outsource to India. India's a democracy and they have far more voters than the USA ;).

Shades of "Stand on Zanzibar"

Its not about avoiding bugs

[joekrahn]

The important issue is not to create bug-free software. It is about designing redundancy and validation that avoids both software bugs and fraudulent data tampering. Before you leave the voting booth, your data should be transmitted to multiple locations, and you should be able to later
validate that your individual vote is correctly in the system with some form of hash or validation code.

Re:my observation [ATMs DO fail]

[gizmonic]

Nah, I've HAD the ATM screw up before, and record a deposit twice. The bank happily deducted it from my account later. I've also had an ATM record a withdrawal three times for the one transaction. Took me a couple weeks of back and forth for them to get it all straightened out. So, the ATMs *do* screw up, but the banks don't care because in the end they don't lose any money. The only one that suffers is the customer (by being out my $$ for two weeks).

Why it is not just a factor of 2

[140Mandak262Jamuna]

Some people's vote is double counted. For others, only 0.2 extra votes were added. (0.6 original vote and another 0.6 double counted vote). Looks like they followed the constitution a little too strictly and counted *some* people as only 3/5 people.

Re:Why it is not just a factor of 2

[Chlorine Trifluoride]

Yes, apparently that machine never got updated with Hotfix 14.

Exactly!

[Anonymous Coward]

There's a reason this quirk of C is hammered into students' heads.

Re:Exactly!

[Anonymous Coward]

In case they have no friends?

PuhLease

[wtbname]

Can't these idiots get anything right? This is so freaking easy to fix it boggles the mind.... votes = votes - 5000 ; There. Done.

whiners

[commodoresloat]

A software error resulting in +/- 5000 votes cast is unacceptable on any level, even if it gets drowned out on the national level in the US.

You know, some people are always complaining. First you complain that there's not enough people turning out to vote each election, that people are apathetic, etc. Finally someone develops some software that fixes that problem and now everyone complains about that!!

The real issue

[Subm]

The real issue isn't that the votes were miscounted in South Dakota.

It's that I bought them for South Carolina!

This Shit Again

[sexconker]

PAPER FUCKING VOTES
HAND FUCKING COUNTS
FUCK!

Filter error: Don't use so many caps. It's like YELLING. THAT'S BECAUSE I'M YELLING!

Verified Voting

[Presto Vivace]

Verified Voting also does great work.

Choice, Responsibility and Punishment

[bill_kress]

When you make the Choice to make something closed, especially something this important, you really should be taking on the responsibility for any errors, bugs, security flaws or back-doors that end up in the software.

If you're willing to take the responsibility, than any error should be considered criminal--as in jail time for the CEO and others who made the (now obviously wrong) decision to keep the information private.

If you don't want the responsibiliy, that's totally understandable--just open the software for peer review by anyone.

I'm getting kind of tired of CEOs and politicians with no competency doing jobs they obviously don't understand, taking authority and reward without responsibility. I realize they are hard jobs, but doesn't that make it even more important to hire someone intellictually and morally competent instead of some college drinking bud from the good ole' boy network?

I Bet

[Stoned Necromancer]

The Bug populations are getting bigger because of the Global Warming.

I've seen that link spammed here by AC for a while

[Anonymous Coward]

So I went and looked behind it. The first paragraph:

UPDATE: What really surprised me is the stunning lack of interest in this idea after I've posted it, and I've heard nothing about it, any place I've submitted it has basically rejected the idea out of hand and has made no comment on it. With all the comments I hear in so many places complaining about difficulties in developing a scalable election system that is auditable and fraud-resistant, to hear nothing tells me that nobody is really interested in a solution, they just want to complain.

So, as the first thing he does he tells us that he has submitted it to many places, all of which have rejected it. It hints that it might be a bad idea but not necessarily so I read the rest of the paragraph. The last sentences made it quite obvious that he is rather childish too so I'll just go with the assumption that reading rest of the long post would be a waste of time.

One more person to join those who have ignored the mighty Robinson method.

Robotically Elected Democratic Overloads

[Anonymous Coward]

Shouldn't that be "our robotically elected democratic overloads?" Either way I welcome them.

Hacking Democracy anyone?

[gubers33]

The documentary "Hacking Democracy" talks about bugs like this one as well as poorly written and easily exploited code used in these systems. It why one such system was banned from use in California. It is amazing how many government tools use extremely poor code not just voting machines, but breathalyzers and other vital hardware.

too perfect

[Khashishi]

The initial Tuesday night report said incumbent Ron Kroeger received 49.96 percent of the vote, short of the 50 percent plus 1 vote re-election requirement. The recount found he actually received 51.8 percent, more than enough to secure his seventh term over challengers John Roberts and Steve Rolinger.

Doesn't anyone think that 49.96%, short of 50% is too perfect for a random error? Most software errors will cause the numbers to explode, either to 0 or some gigantic number.

Hold them responsable

[SnarfQuest]

As part of the agreement for purchasing the voting machines, add a clause that subtracts $1.00 for each vote miscalculated.
This should make the voting machine creators be much more careful about the software they supply.

That's not a glitch!

[monkeyboythom]

That's a feature! And I paid a pretty penny for that feature. Uh, hmmm...nevermind! Just ignore what I just said.

Unity vote tabulation software

[defective_warthog]

eldavojohn please know that the AutoMark is a ballot marking device. It has nothing whatsoever to do with tabulating vote totals. Most likely this was a problem with the way the ES&S Unity software was configured.

That software (ES&S Unity) is what needs to have it's source code closely examined. From personal experience I can say that this software can be configured to count a given precincts votes multiple times. Imho this jurisdiction needs to improve some of its basic procedures; adding the total votes cast on each optical scan machine would have revealed the error by the vote tabulation software.

Re:Hold them responsible

[TrevorB]

Punishment for election fraud shouldn't be financial. How about an hour of jail or community service for every vote miscalculated?

How to count manual votes in the Netherlands

[broomer]

I was a voter in last weeks european elections, and stayed until the votes for the office were counted. (you are allowed to stay after the office closes)
Almost nothing can go wrong, and can always be detected and mostly corrected.

voters are counted, handed out votes are counted, incorrectly filled in votes are counted and marked 'invalid' and stored seperately.
received votes are counted as they are inserted in the box.
After closure, all counts are compared.
Then the box is opened, and all votes are counted and compared to previously counted.
Then votes are sorted and counted to the results and added back up to give vote count again.
All counts are written down on official paper, votes are sealed and paper and votes are brought to central counting office of city where they can be counted again the day after (first tallies are reported upstream.)

Counting is fair by having counters of several political parties and city officials at every voting office
a typical office has 5 people . 1 checking Identity, 2 counting voters/checking revoked identities, 3 counting and giving votes, 4 counting received votes, 5 extra for toilet-visits

Nobody's perfect

[Anonymous Coward]

That's why we have error checking.

You need checks that provide sums of votes across different categories, and vote totals that can be cross checked against manual tallies taken by voter registration attendants.

In a perfect world you'd have two independently written software programs on two heterogenous software configurations both tally the votes, and both provide two reports to the user.

If they're not the same, somebody fucked up.

3 things that would fix the US election system

[tjonnyc999]

1.) Action: change current system to runoff elections. If neither party gets a winning majority - remove all but top 2 contestants, and run it again.
Reason: under a runoff system, candidates must appeal to a broad range of voters; runoff voting discourages extreme partisanship, and prevents minor f[r]actions from upsetting the balance (example: 1992, Candidate #3 "steals" 3% of votes from Candidate #2, resulting in Candidate #3 [barely] getting the majority and royally pissing off voters supporting Candidate #2) Result: discordant elections (Bush-Gore, Bush-Clinton-Perot) are much less likely; winner has clear support and mandate from majority of voters.

2.) Action: prohibit political advertising. Debates, yes. Town hall meetings, sure. Q-and-A sessions, of course. Buying a Senate seat or the Presidency? Hell no.
Reason: political leadership should be elected on the basis of merits / values / track record, not on the basis of who's got a fatter wallet.
Result: no more travesties like (just an example, nothing personal) Jon Corzine deciding that he's made enough money, now it's time to play politics, wallpapering New Jersey with $ 63,000,000.00's worth of advertising, and winning a Senate seat.

3.) Action: allow ONLY open-source voting machines, audited by several independent sources.
Reason: voters must have proof that their vote was received and counted. The right to vote should not be canceled by a "glitch in the system", or a behind-the-scenes manipulation of the vote totals, without any possibility of an audit. (Hey, AutoMark / Diebold / ES&S, my CONSTITUTIONAL RIGHT to have my voice heard trumps your profit margin. Either make it work correctly, or GTFO the election.) Closed-source, un-auditable "black box" voting machines have a proven track record of miscounting votes. If it's a "black box", it doesn't get to play.
Result: no more "missing votes", "extra votes", "double-counted votes", or any other bullshit. If there's an issue, it's detected, fixed, and the election is run again.


Of course, this is all a dream. The 2-party duopoly will never allow #1. The media makes too much profit from political advertisement to allow #2. And the makers of voting machines make too much money to allow #3. Oh well.

Bull

[Anonymous Coward]

"Glitch", "Bug" = lousy programming

Voting with Money

[Anonymous Coward]

The financial networks that route our money between various accounts is entrusted with billions of dollars daily. Why not use it to make a secure voting platform?

For example, when a person visits a polling booth and signs in, they get a random debit card loaded with one dollar (to protect privacy). To vote, they transfer that dollar to the bank account of one of the candidates. At the end of the day, which ever candidate has the most money in their account wins. Simple, easy, and built upon a known system.

Of course, real dollars shouldn't be used. A fake currency would be needed, and that currency can't be bought and sold like other currencies, but the rest can piggy-back on the electronic monetary system already in place.

So

[man_the_king]

So... business as usual?

Too much obscenity on slashdot...

[AliasMarlowe]

Belgium

Please don't use that word in polite company!
And don't use it here either!