An Anonymous, Verifiable E-Voting Tech

Kilrah_il writes "After the recent news items about the obstacles facing E-voting systems, many of us feel it is not yet time for this technology. A recent TED talk by David Bismark unveiled a proposal for a new E-voting technology that is both anonymous and verifiable. I am not a cryptography expert, but it does seem interesting and possibly doable."

Comments

how much does it cost?

[alen]

and how much better is it than marking a circle with a pen and having someone scan the ballot into a machine? most of the issues with e-voting have been that people are too dumb to see what they are doing

Re:how much does it cost?

[jcrb]

Agreed, E-voting is the classic solution in search of a problem.

Re:how much does it cost?

[vlm]

and how much better is it than marking a circle with a pen and having someone scan the ballot into a machine?

That is an insightful comment. Could anyone explain the following quote

many of us feel it is not yet time for this technology.

That would imply some sort of roadmap or goal is in mind. What is it and why can it not be discussed?

There seems to be little point in it, other than making money by selling something new.

Re:how much does it cost?

[Anonymous Coward]

Problem: Politicians who desire the ability to freely pillage and back-stab the population have to worry about winning elections.
Solution: E-voting.

Re:how much does it cost?

[TheLink]

What many e-voting proponents overlook is:

0) A main requirement for voting systems is convincing the losing sides that they _lost_.

If not enough of the losers believe they lost, you may have riots or civil war.

Something simple like a decent paper ballot system where the votes are counted in front of observers (from the various parties, and 3rd party observers) can be quite convincing to the losers.

So even if this e-voting system is that good, it may be still too opaque/fancy for the losers and their supporters.

The main weakness I see with paper ballots (assuming they are done correctly) is postal votes, but e-voting stuff may still be just as vulnerable to rigging via postal votes.

Re:how much does it cost?

[Confuse Ed]

and how much better is it than marking a circle with a pen and having someone scan the ballot into a machine?

In an ideal system, anybody should be able to independantly verify the following (which currently can't be done in a simple paper based ballot)

• was _my_ vote counted correctly for the candidate I selected (or not counted if I chose not to participate)
• Are all the votes that have been counted attributable to real voters
• has each person voted either 0 or 1 times

Unfortunately I can't RTFA to see how many of these ideals the proposed system achieves, as it seems to be a video rather than a text based article.

Re:how much does it cost?

[Anonymous Coward]

and how much better is it than marking a circle with a pen and having someone scan the ballot into a machine?

Well, there have been issues with various paper voting systems before. The 2000 elections are a good example. And for scanning, what about write-ins? With an eVoting machine (well designed), it's fairly easy to tell immediately if you've not made a mistake. Also, eVoting can be helpful for people who have disabilities. That being said, without some verification system, it is probably more vulnerable to fraud too. That's why given current tech and some issues with a couple elections in my state, I stick to paper ballots. With something like this, I would use eVoting.

most of the issues with e-voting have been that people are too dumb to see what they are doing

Being a bit of a Nazi here, but vision is not a factor of intelligence... I suspect you meant 'know what they are doing'. Still, a person's ability to fill out a form correctly does not always correlate to their ability to understand the principles behind laws and politics, and people DO make mistakes. Last I checked, I've not met anyone perfect.

Re:how much does it cost?

[literaldeluxe]

Agreed, E-voting is the classic solution in search of a problem.

Unless you have a disability, in which case it is the classic "solution to a problem". GP: "marking a circle with a pen" is impossible for someone who is blind or has dexterity issues. Whether or not e-voting would currently benefit other people is irrelevant; it is needed, and that need is growing.

Re:how much does it cost?

[Imagix]

Have you ever been an election official? Marking a circle is a challenge to people as well.

Re:how much does it cost?

[KarrdeSW]

Problem: Election workers don't feel like counting paper ballots by hand or feeding them one at a time through a scanner.
Solution: E-voting. I'll just print off an Excel report.

FTFY

The people who write and distribute RFPs for electronic voting systems are generally not interested in the outcome of the election, they are just a worker drone trying to utilize technology to make their job a bit more glamorous than counting papers.

Re:how much does it cost?

[onionman]

Agreed, E-voting is the classic solution in search of a problem.

Unless you have a disability, in which case it is the classic "solution to a problem".

Where I went to vote, anyone who wished had the option of bringing an assistant. I recall doing this for my grandmother when her health was failing. She couldn't see well enough to read the ballot much less fill in a circle. So, I would read the ballot to her, and she would tell me what to mark.

I'm all for throwing money at math and CS (it keeps me employed), but I still think that E-voting is unnecessary. Just use paper. With paper, the ballots can be recounted in front of a group of representative for each side whenever there is a dispute. It's simple and crystal clear to the vast majority of voters. The only disadvantage is that it's slow, but so what? Voting is important, we can afford to slow down a little and do it carefully.

Re:how much does it cost?

[literaldeluxe]

Where I went to vote, anyone who wished had the option of bringing an assistant. I recall doing this for my grandmother when her health was failing. She couldn't see well enough to read the ballot much less fill in a circle. So, I would read the ballot to her, and she would tell me what to mark.

I'm all for throwing money at math and CS (it keeps me employed), but I still think that E-voting is unnecessary. Just use paper. With paper, the ballots can be recounted in front of a group of representative for each side whenever there is a dispute. It's simple and crystal clear to the vast majority of voters. The only disadvantage is that it's slow, but so what? Voting is important, we can afford to slow down a little and do it carefully.

So people with disabilities do not have the right to an anonymous vote, but you do? What about people who don't have a friend or relative to bring with them? Should they just trust whoever volunteers to help them, even though they have no way to verify whether or not they're voting correctly on their behalf?

Re:how much does it cost?

[Jeremy Erwin]

The only disadvantage is that it's slow, but so what? Voting is important, we can afford to slow down a little and do it carefully.

Somehow, Al Franken managed to be 7 or 8 months late on his first day of work, all because of delays in paperwork.

Re:how much does it cost?

[IB4Student]

I never received my mail-in ballot because they sent it to the wrong address. I didn't get to vote.

Re:how much does it cost?

[darkpixel2k]

Voting is important, we can afford to slow down a little and do it carefully.

It'd be awesome--like Futurama. "The robot polls are opening.....aaaand the votes are in. Mom wins."

Re:how much does it cost?

[beamin]

I worked yesterday at the polls in New York. We had ImageCast paper-ballot optical-scan machines from Sequoia with ballot-marking devices attached for disabled voters. These gave all voters the ability to mark ballots privately.

http://www.vote-ny.com/english/machine-sequoia.php

Re:how much does it cost?

[Anonymous Coward]

The only disadvantage is that it's slow, but so what? Voting is important, we can afford to slow down a little and do it carefully.

Somehow, Al Franken managed to be 7 or 8 months late on his first day of work, all because of delays in paperwork.

And with an electronic system, it would have taken even longer so that everyone had time to do code reviews on the software running on the voting machines. An election is only valid when the losing side is willing to believe the result.

Re:how much does it cost?

[Anonymous Coward]

It doesn't have to be a circle. Any sufficiently large and dark mark in the proper region will do. Some systems use lines/bars, instead.

And of course there will be alternatives provided for blind or motor-impaired users as well, just as there are today.

Re:how much does it cost?

[Anonymous Coward]

People doing the scanning can eat unliked ballots, make them invalid, add their own vote to empty ones etc etc.
That's why it has to be done by a multitude of people watching each other like hawks, in thousands of locations, it costs a fortune and needs forever to be completed.

Electronic votes have instant results.

Re:how much does it cost?

[Anonymous Coward]

full disclosure: I work on this project.

(what I think to be) the most prominent difference:
Case 1: mark circle, feed to scanner
Case 2: Pret a Voter (pav).

In case 1, the scanner knows how you voted. An evil scanner could thus alter your vote.
In case 2, there is a scanner as well. However, the scanner cannot tell how you voted. So it cannot meaningfully alter your vote.

Hugo.

Re:how much does it cost?

[davester666]

Um, when has this EVER been a problem for politicians?

Existing voting methods provide plenty of opportunity for voting irregularities, like using demographics to call people who are unlikely to vote for you and tell them the wrong day for the election, or that they need documents they don't have to vote, or get dead and/or almost dead people to vote...

Re:how much does it cost?

[drcheap]

Well, keep in mind that people are too #@$% lazy to go and vote. It costs time and gas money, and in some cases people legitimately have no time or means to go either.

So the "problem" that an electronic voting system could potentially solve is giving people the ability to vote from anywhere by making use of teh internets. But that is not something that any e-voting system has actually managed to solve yet.

Re:how much does it cost?

[hairyfeet]

Why does it have to be either/or? When I voted in the last presidential election (didn't bother with the midterm, here the race had been one sided for months) the machines they used here (sorry don't know the brand) seemed to me to be the perfect solution: It had a nice big easy to read screen, with a "You have picked this, is this what you want?" type of big box with two large yes/no buttons when you made a choice, just to make sure if you hit the wrong one you could go back and with every choice you could see your paper ballot being printed in a window which when you were finished they let you check before placing it in the box.

That way it is all machine readable, so no hanging chads or "voter intentions" bullshit, the electronic voting was used to give the media their early election results, and if anyone contested the paper ballots were right there. Seemed like the best solution to me, and waiting to vote went from 45 minutes down to less than 10. So why not have both?

Re:how much does it cost?

[icebike]

Al Franken was late because Minnesota voters could not make up their mind.

If the population is so ambivalent about a result, any election in a dead heat one month after, could just as well be decided on a coin toss.

The longer it takes the more chance for skullduggery and ballots found in the trunk of cars to emerge.

Re:how much does it cost?

[natehoy]

We have a "mark the circle and scan" system here, and while it might be possible to add new ones, it would be impossible for them to invalidate or remove ones they don't like.

As I enter the polling place, there's a greeter with a count-clicker (one of those little devices that you push a button and a number increments). They count the number of people entering the building.

A poll person checks my ID and checks me off a list (while being watched by a second person to make sure the name was not previously checked, and that the name on the ID matches the name just checked off), then the second person gives me my ballot pack and also keeps a count with their own count-clicker.

I take my paper ballots to a voting station and vote, then I have to put each of them face down in a separate scanning machine, where Person 1 verifies that I've put the white ballot in the white ballot scanner, Person 2 verifies that I've put the pink ballot in the pink ballot scanner, and Person 3 verifies that I've put the blue ballot in the blue ballot scanner. All three ballot scanners have a digital counter that increments as the ballots are inserted, and all three people have a count-clicker, but cannot see the digital readout of the ballot scanners.

The human verifiers are physically separated from the scanners and are not at any time allowed to touch my ballot or see my vote. There is a separate person walking around between the three scanner machines verifying that each ballot is scanned properly. They are allowed to touch ballots, but they are not keeping a count and they are watched by the three scanner verifiers and another two people standing on either side of the scanner area looking for ballot swaps. They also give you a replacement ballot if you mess yours up, but the invalidated ballot is put in a separate locked box.

Once your ballot is scanned, it's in a locked ballot box integrated into the scanner. As you leave through the one door you are allowed to use to exit, there's someone handing out "I voted" stickers and counting you with another count-clicker.

I presume the counters are there so, at the end of the day, each election worker has to hand theirs in and the numbers are all added up. It's a pretty simple formula - to within a reasonable margin of human error, the following numbers must match:

  - The total number of people entering the building.
  - The total number of people who have been "checked off" the list.
  - The total number of people receiving a "ballot pack"
  - The total number of people putting a ballot into the white ballot scanner as counted by the machine.
  - The total number of people putting a ballot into the white ballot scanner as counted by the human verifier.
  - The total number of physical white ballots in the white ballot scanner.
  (repeat the same three numbers above with Blue and Pink ballots)
  - The total number of people leaving the building.
  - The total number of ballots used (minus the ones that are in the bad ballot lockbox).

So, yeah, you're right. There's a lot of people involved, but I was in and out of there in under 5 minutes, but even if each and every person in that room was corrupt, at least 7 of them would have to be in collusion to introduce more than a small handful of votes. You could have someone come through the building multiple times, I suppose, but they'd have to have multiple valid-looking IDs of people they know have registered but have not voted, or they'd have to pre-arrange it with both people doing the

We have instant official results (at the end of the day election officials download the results from the scanner), and a paper backup in case a recount becomes necessary.

It's more expensive than an electronic ballot system, except of course that the ballot scanners have been paid for for years, and most of the poll workers are volunteers.

Our major expense is printing out the paper ballots each year, and election results are available at 8:05PM (the polls close at 8:00PM).

Re:how much does it cost?

[AigariusDebian]

Let's see:
* disabled people of all kinds,
* sick, old and just tired people who want to vote from home instead of driving for half an hour and then standing in line for an hour
* travelers who want to vote from wherever in the world they are
* young people who don't like boring old voting stuff

In almost all of these cases in the US e-voting favors Democrats - young, educated, lazy, traveling. That is the reason there is a subversive trend to undermine it by creating very, very badly misdesigned e-voting machines.

Now if your country does not have that problem, you might be like Estonia - every citizen gets an ID card with a proper PGP-ish electronic signature in it and he can vote on a web site using that signature either in a voting booth or at home and later verify his vote with a hash on a tally. And that has been fully working for two elections already with no problems.

Re:how much does it cost?

[Mathinker]

you might be like Estonia - every citizen gets an ID card with a proper PGP-ish electronic signature in it and he can vote on a web site using that signature either in a voting booth or at home and later verify his vote with a hash on a tally.

And therefore it is obvious that the Estonian voting system violates two security requirements for a US election:

• Your vote must be anonymous --- the government, or any other third party, should not be able to discover how you voted, except under very unusual circumstances (like an totally unanimous vote of a large number of people).
• Your vote must be plausibly deniable --- a third party T should not be able to coerce you to vote in a specific way by requiring you to verify that you voted in that way. This requirement also means that it is not viable to buy votes.

The main problem with evoting isn't technical. It's that Joe Sixpack is incapable of understanding the requirements themselves (try explaining "plausible deniability" to someone in a bar), never mind the contortions necessary to satisfy them (for remote voting, we're talking about advanced cryptography).

Re:how much does it cost?

[Mathinker]

you might be like Estonia - every citizen gets an ID card with a proper PGP-ish electronic signature in it and he can vote on a web site using that signature either in a voting booth or at home and later verify his vote with a hash on a tally.

And therefore it is obvious that the Estonian voting system violates two security requirements for a US election:

• Your vote must be anonymous --- the government, or any other third party, should not be able to discover how you voted, except under very unusual circumstances (like an totally unanimous vote of a large number of people).
• Your vote must be plausibly deniable --- a third party T should not be able to coerce you to vote in a specific way by requiring you to verify that you voted in that way. This requirement also means that it is not viable to buy votes.

The main problem with evoting isn't technical. It's that Joe Sixpack is incapable of understanding the requirements themselves (try explaining "plausible deniability" to someone in a bar), never mind the contortions necessary to satisfy them (advanced cryptography).

Root problem

[Toe, The]

Better voting systems still won't fix the root issue: the people who get elected into power are corrupted by that power.

Metagovernment isn't perfect, and it will take a long time to get up and running, but... how does it compare to what we have now, where votes are sold to the highest bidder, idiots are in charge, and our participation is limited to 30 seconds in a booth every two years?

Re:Root problem

[jcrb]

Even worse depending on your definition of "better" the voting systems may only server to make corruption worse.

With all the stories of machines starting pre-loaded with votes, or selecting different candidates that what the voter pressed, or machines that produce no hard copy of the results that will be subject to random sampling, is there any reason to believe that e-voting machines are anything but a mechanism that most politicians support because they hope to be able to use them to fraudulently record votes.?

Re:Root problem

[hrvatska]

The problem isn't the idiots in charge, it's the idiot voters who elect them in the first place. The government in the US is the result of the contradictory demands of a highly polarized and frequently badly misinformed electorate.

Re:Root problem

[DJ Jones]

The problem with this metagovernment system you reference is that the average person does not adequately understand our legal code well enough. This is the reason America is more of a republic. It was thought that electing "elite" officials who have our interests at heart but more direct knowledge of law would make better law makers.

If you live in state that allows referendums this concept becomes very apparent. I consider myself a well informed, educated individual. I've taken many business law classes and I write my own business contracts yet I still struggle to understand some of the legal code in the New Jersey referendums I've read. Even the dumbed-down translation they provide can be confusing to the average person.

Re:Root problem

[Toe, The]

Your critique is entirely correct, and is very much taken into account by the Metagovernment project.

"The voter doesn't understand the legal code."
1. People don't have to participate in every decision, just the ones they care about and understand.
2. Since Metagovernment is a ground-up re-do of governance, it is a re-do of legal code as well. It is not intended to replace the US federal government just yet, but rather small communities' governance. Over time, people will get a better understanding of how to participate in large-scale governance as the system evolves.

"It was thought that electing "elite" officials who have our interests at heart but more direct knowledge of law would make better law makers."
1. This amounts to saying that we need to be protected from ourselves by a superior class of overlords. Do you really want to admit that is the best we can ever do?
2. These elites demonstrate again and again that they are just as idiotic as everyone else.
3. People don't get involved in issues because in the end their voice is ineffectual. If people can actually make a direct difference, they will have an entirely different incentive to learn and delve into issues.

"If you live in state that allows referendums this concept becomes very apparent."
1. Referendums are majority-rule decisions, while collaborative governance usually works on a consensus model.
2. Referendums are only on a few hot-button topics, meaning they lead to demagoguery. Having a "referendum" on every topic all the time would be completely different.
3. The authors of referendums are individual politicians or more frequently lobbyists. They are often written to be confusing or overly-simplified. Collaborative governance inherently means people write the laws together. Further, it pushes the process toward synthesis. Check out the amazing innovation in Vilfredo, for example.

All of this and more is on the Metagovernment site. It just takes some thinkin' to wrap your head around it.

Re:Root problem

[TheLink]

Better voting systems still won't fix the root issue: the people who get elected into power are corrupted by that power.

votes are sold to the highest bidder, idiots are in charge

The root issue is not what you claim. If you're talking about the USA, are votes really sold to the highest bidder? I am assuming the elections are not badly Diebolded.

What makes you so confident "metagovernment" will work? Makes no sense to me.

1) So far from what I see, in the 2008 US Presidential election, more than 98% of the voters who voted, voted for either a Democrat or a Republican. You get similar figures for the 2004 elections and so on.

http://en.wikipedia.org/wiki/United_States_presidential_election,_2008#Nationwide_results
http://en.wikipedia.org/wiki/United_States_presidential_election,_2004#Grand_total
http://en.wikipedia.org/wiki/United_States_presidential_election,_2000#National_results

There is choice- the voters could have voted for someone else (e.g Nader) but less than 2% ever do so. So either the Two Parties are better choices than the rest, or the voters are idiots.

If the voters are idiots then metagovernment won't work, nor would a "small government + Big Corps" system work (how well are voters going to vote with their wallets if you think they're not getting "ballot box" right).

2) I don't tell a chef in detail how to cook my dinner. I'm not as good a cook as he is (if I was better, maybe I should be a chef instead). But I can taste the results for myself. If the results are satisfactory, I'll vote for him again. If they aren't to my taste, I'll vote for someone else.

Just because your party didn't win doesn't mean the system isn't working the way the majority of the voters want.

Then again you may be right, the idiots are in charge. But in nondiebolded elections, the voters are in charge :).

Re:Root problem

[Toe, The]

Sorry if I was unclear. By votes, in this sense I meant the votes of legislators. Yes, the people vote for the legislators fairly well. Then those legislators sell their policy votes to the highest bidder.

Concerning your statement, "Just because your party didn't win doesn't mean the system isn't working the way the majority of the voters want."
1. I do not support any party, since political parties inherently coopt politicians away from the interests of the people.
2. The majority of voters did not get what they want. Congressional Confidence has been below 40% since at least the 1970s. No matter what party is in charge, they are letting the people down.
http://www.gallup.com/poll/141512/congress-ranks-last-confidence-institutions.aspx

Re:Root problem

[Qzukk]

I don't tell a chef in detail how to cook my dinner. I'm not as good a cook as he is (if I was better, maybe I should be a chef instead). But I can taste the results for myself. If the results are satisfactory, I'll vote for him again. If they aren't to my taste, I'll vote for someone else.

So you go to an Italian restaurant and like the food. Next week you're going to go to the same cook and order sushi?

The exact same problem exists with the party system: the Republicans may have dragged our country into two wars, presided over a major recession, gave the banks a big fat bailout so they could pay their CEOs a big fat bonus... but at least they're (mostly) anti-abortion, and that's what really counts right?

Re:Root problem

[Toe, The]

See answer in thread below, from OP

Re:Root problem

[TheLink]

Yes, the people vote for the legislators fairly well. Then those legislators sell their policy votes to the highest bidder

And the voters reelect those legislators after that? Seems to me many US legislators have been around for years or even decades.

2. The majority of voters did not get what they want. Congressional Confidence has been below 40% since at least the 1970s. No matter what party is in charge, they are letting the people down.

Really? Then the voters should vote differently right? The last I checked the voters have been voting for the same two parties. There are more than two parties. I don't see why the Two Parties should be doing things differently when they keep getting 98% of the votes.

So the Two Parties are clearly doing their jobs pretty well. Whether the voters are doing their jobs well as voters is a different matter.

If the people have been voting for stuff they don't want for so long, why should your metagovernment thing be better?

Don't they already have a system in California where voters can vote on all sorts of stuff? Is that working well for California?

http://en.wikipedia.org/wiki/California_ballot_proposition
http://en.wikipedia.org/wiki/List_of_California_ballot_propositions_2000%E2%80%932009

Re:Root problem

[Amorymeltzer]

Our concept of electors really exists in a way to balance power amongst the states. As you (kind of) point out, a simple majority really doesn't work well on the national level. Sure, it sounds great, but we don't live in an even world. Nine states contain >50% of the population and 25 contain 16.67%. Dump cash into California, Texas, New York, and Florida and you'll be elected. That's why we have electors, so that yes, Rhode Island and Alaska voters have disproportionate power compared to Pennsylvania, but they are still states.

Consensus, as opposed to a majority, is a wonderful idea. Honestly, Wikipedia is probably the best model but, look at it. It's a very creaky process that breeds bureaucracy. There's simply now way we can get that applied on a national level. Hell, the Democrats can barely get consensus when they control two branches of government. Consensus is nice, and for small communities it works, but it cannot apply on the large scale.

Re:Root problem

[TheLink]

So you go to an Italian restaurant and like the food. Next week you're going to go to the same cook and order sushi?

Only if:
1) The restaurant serves good sushi
2) I feel like having their sushi

If there are enough people who want Italian restaurants that serve sushi, people would start restaurants that do so.

Such restaurants already exist.

The exact same problem exists with the party system: the Republicans may have dragged our country into two wars, presided over a major recession, gave the banks a big fat bailout so they could pay their CEOs a big fat bonus... but at least they're (mostly) anti-abortion, and that's what really counts right?

You should ask the voters. The Two Parties seem to be able to figure out what really counts for the voters. As a result, between the two, they've been getting about 98% of the votes. Which is not bad given the diversity of the USA.

If you think voters are voting for stuff just because of one item, without taking into consideration of other rather important factors, I don't see why such voters will do any different or better for "metagovernment" as the OP proposes.

If after 4 years voters can't even see the effects/results of their votes for themselves and still keep voting for the wrong bunch (and then blame the system, everyone, except themselves), then I don't see why letting them micromanage government is a good idea.

Of course if after 4 years the voters are voting for the same bunch because they actually like the results, hey Democracy is working as designed, even if you don't like it.

Lastly, war is where I agree that all voters should get a vote, since war is a major issue that affects everyone even people from other countries. My proposal for war is this: http://slashdot.org/journal/208853/How-to-reduce-unwanted-wars
In contrast, allowing voters to vote on "everything" is a pretty stupid idea. Like getting a million committee members to vote on a novel/legislation/computer program line by line.

Re:Root problem

[pietros]

Actually many politicians also don't understand the legal code. This is why often they first decide what the law should be, at a higher level, and then they employ people to translate this into legal jargon. Like when you want a program, you first discuss it, and then you employ coders. Most of metagovernment projects are at the higher level. And yes there is still space for corruption between the higher level and the legal level. It was there before and metagovernment does not solve that at all, so far. It is instead trying to integrate the opposing views.

Re:Root problem

[Toe, The]

And the voters reelect those legislators after that? Seems to me many US legislators have been around for years or even decades.

America is a winner-take-all system. This means that if there is a viable third party candidate who (for example) leans left, then the left-sided votes will be split between the two more-left candidates and the sole right-leaning candidate will always win. In all other instances, third party candidates are seen as "throwing one's vote away" since the two main parties are so thoroughly entrenched. (IIRC, it took the Civil War to break from the original Tory and Whig system.)

So the only choice Americans have is to every few elections vote out most of one party and vote in the other. Even though they know this isn't going to solve the root problems.

Otherwise, how do you explain the incredibly low Congressional confidence? I didn't make that up, it is a Gallop poll, and it shows that confidence remains preposterously low no matter which party is in control.

Don't they already have a system in California where voters can vote on all sorts of stuff? Is that working well for California?

That system is absolutely nothing like Metagovernment.
1. It is majority (really plurality) rule.
2. It is only on hot-button issues where special interests can get millions of signatures to get it on the ballot.
3. There are only singular votes every few years, not a continuous process.
4. The voters get no say on the wording of the bills nor the ballots.
All of these add up to a system that in no way has any resemblance to collaborative governance.

Re:Root problem

[Hatta]

The real problem is the plurality system which excludes any voices besides the two major parties. Until Americans can vote for a 3rd party without handing the country over to the other side as happened in 2000 our political problems will remain intractable. Of course that can't happen unless the Constitution is amended, which would require the two major parties to cooperate to undermine their own power.

Re:Root problem

[AltairDusk]

There is choice- the voters could have voted for someone else (e.g Nader) but less than 2% ever do so. So either the Two Parties are better choices than the rest, or the voters are idiots.

There is another possibility here. Voters don't like either choice from the two parties, but if asked will tell you they absolutely would rather have one of them than have to deal with the other. They may see a viable option among the 3rd parties and independents but a problem arises: They know most people will vote for one of the two major parties, they also know that because of this a vote for the major party they dislike less will create a stronger chance of the other guy losing than a vote for one of the other candidates. It then becomes a balance of "I like some of this person's ideas but there's no way they can win the majority and above all I do not want this [Democrat/Republican] over here in office."

Whether they really wanted to or not almost everyone votes for one of the two major parties because they feel voting for a 3rd party is effectively throwing their vote away. (Which only makes sense to think that way because everyone votes for the two major parties. It's a feedback loop but it's one we seem to be stuck in.)

Re:Root problem

[Qzukk]

Such restaurants already exist.

But are they the best at both Italian and Sushi? And what if the week after I want a side order of hummus with my tacos al carbon? Am I going to get the best possible Mexican food too?

Remember, I have to stick with this "cook" for 4 years, and I have to make the choice now. I can't starve for years waiting for the perfect cook.

Maybe what government needs is a "none of the above" option, and if it wins, nobody gets the job for 4 years.

I don't see why such voters will do any different or better for "metagovernment" as the OP proposes.

As the OP proposes, the ones who only care about abortion will only vote about abortion. Everything else will be left to people who care about them. I think it could even be extended to say "I trust _____ to represent me in matters of abortion, but I think that ____ better represents my views on matters of war."

Re:Root problem

[Martin Blank]

California's initiative process is plurality only when you compare the number of voters on the winning side to all eligible voters. It is still generally a majority rule. Most initiatives require 50%+1 to be passed; taxes (and as of last night some fees) require a two-thirds majority.

Further, the voters have had as many as 28 initiatives on a single ballot. Some of them are placed there by the Legislature, some by powerful groups, and some by grass-roots campaigners. Initiatives that do not come from the Legislature require 8% of the votes cast in the most recent gubernatorial election to qualify if they are constitutional amendments, or 5% for statute initiatives. This will mean that after yesterday's election, the requirements will be somewhere around 650,000 signatures for the former and 400,000 signatures for the latter, depending on what the final vote count will be.

The contents of the initiatives are up to whomever writes them. This can be the Legislature or an outside party. In the latter case, the summaries are subject to scrutiny for accuracy by the attorney general's office, and the AG also inspects Legislative initiatives to ensure that they stick to the single-subject rule here. The Legislative Analyst researches both for overall effects, publishing both summaries and detailed reports (some of these can be fairly lengthy).

As for scheduling, we usually vote on them when primary elections and general elections are held every two years, and also during special elections. Since 2000, there have been 16 elections in which initiatives were presented to the voters, including special elections in 2003, 2005, and 2008. It's not a continuous process, but neither is it as widely-spaced as you suggest.

Re:Root problem

[jfengel]

People don't have to participate in every decision, just the ones they care about and understand.

Unfortunately, "care about" and "understand" are orthogonal. In fact, in some cases they seem to point in precisely opposite directions: the less people know about a subject, the more vehemently they express their opinions (aka Dunning Kruger effect).

Not that this is an insuperable barrier to the program. The same problem exists with representative democracy. Representation is a hack designed to minimize it, and that hack is becoming both problematic and ineffective.

Re:Root problem

[mcgrew]

They say power corrupts, but I'm not too sure that's accurate. I'd say power attracts the already corrupted.

I'd like to see one more step in the political process: After the Congress/Parliment votes, and it's retified by the President/Prime Minister, then once a year the laws are all put to a popular vote, and it doesn't become law unless 2/3rds of the voters ratify it.

And have all laws time out; we don't really need those cotton subsidies from WWI any more, do we?

Re:Root problem

[Toe, The]

Consensus, as opposed to a majority, is a wonderful idea. Honestly, Wikipedia is probably the best model but, look at it. It's a very creaky process that breeds bureaucracy. There's simply now way we can get that applied on a national level. Hell, the Democrats can barely get consensus when they control two branches of government. Consensus is nice, and for small communities it works, but it cannot apply on the large scale.

This is very true in the status quo, but it does not necessarily have to remain that way.

The current system is radically opposed to consensus, because it is a two-party, politician-run system. There is no political benefit to consensus. From a politician's standpoint, agreeing with "the other side" means there is nothing to distinguish you as someone worth voting for. So our politicians focus on hot-button issues where they can create real division.

It is really rather amazing how well they can do this. If you think about a really polarized issue like abortion, the vast divide there is almost entirely politician-created. Hardly anyone wants wanton abortions as part of our society. And hardly anyone wants the government to have regulatory control over our reproductive systems. There are many ways we could build a consensus that would work for almost everyone. But instead, we have people actually resorting to violence in their vitriolic passion over this non-issue.

No, consensus cannot scale to a national level at this time, because we are like little children who haven't learned proper manners. But if collaborative governance gets a foothold in small communities and we get used to creating syntheses to build consensus, I do believe that we will find workable ways to do it on increasingly larger scales.

Re:Root problem

[mcgrew]

The idiot voters don't put politicians in office, corporations do. When Acme Tools gives five grand to the Republican, five grand to the Democrat, and Acme Media convinces Joe Public that a vote for a Green or Libertarian is wasted, it doesn't matter whho loses, Acme wins.

The system is rigged in favor of those with money. Idiots have little to do with it.

Re:Root problem

[mcgrew]

There is choice- the voters could have voted for someone else (e.g Nader) but less than 2% ever do so.

Big Media has convinced people that a vote for a losing candidate is a wasted vote. I'd been trying to talk fellow potsmokers to vote for either the Green or Libertarian for Governor (both are in favor of legalization, the D and R against it) and in every single case, it's "but we can't let [Quinn have another 4 years]/[We can't let Brady win].

So long as the media convinces voters that voting for a losing candidate is somehow wasting your vote, ALL the votes are wasted, by perpetuating the myth that the voters can make any difference at all.

Re:Root problem

[Amorymeltzer]

I'm with you on the two-party system, but I think the best way to get by it is to start using IRV/STV. Even ignoring the benefits of being a more accurate and representative system, it definitely gives third and fourth parties a chance to actually make a real showing. If candidates truly have to make the most people the most happy, they can't sustain the level of polarized rhetoric we're seeing these days. More candidates + more reasonable opinions + better representations of your vote = better democracy.

Or maybe it's just one pie-in-the-sky idea versus another.

(Also, I've only had a chance to marginally read up on metagovernment so if this is in some way incorporated, awesome!)

Re:Root problem

[Anonymous Coward]

But you do understand that this will never happen, right? What you are suggesting takes power away from politicians, and yet it would require politicians to make it happen.

That's the beauty of Metagovernment. No politician input required.

Re:Root problem

[Toe, The]

The problem is that something like IRV can't happen from inside the system. It would require that the people in power pass a law to enable it, and they have a very strong disincentive for that. Solutions that lead to better democracy generally are not solutions supported by politicians. Makes sense, since currently democracy is merely an annoyance they have to pander to in order to maintain their power.

Metagovernment doesn't have anything to do with runoff voting because it does not have elections. Elections are for representatives; while Metagovernment is a new way of looking at direct democracy. Well, really it is numerous ways of looking at it, since the various member projects take different approaches.

If we have elections, we have empowered leaders, and we therefore have, well... here, this page sums it up pretty well:
http://metagovernment.org/wiki/Representative_democracy

Re:Root problem

[TheLink]

third party candidates are seen as "throwing one's vote away"

That's only if you don't look long term.

If a third party candidate gets significant number of votes, the other voters might vote for that candidate again in the next election. This is called "signalling".

Meanwhile the third party candidates only get 1% of the votes.

If you think the both parties are crap, then it's time to start voting for someone else. Rather than _waste_ your vote voting for crap, you might as well "waste" it to signal to the voters and candidates that you are also unhappy with the two parties and are trying for someone else.

Lastly is it really true that all political parties are so one dimensional that they can be summarized as "left" and "right"? I think it's more that people aren't bothering to look at the details.

Re:Root problem

[TheLink]

As the OP proposes, the ones who only care about abortion will only vote about abortion. Everything else will be left to people who care about them. I think it could even be extended to say "I trust _____ to represent me in matters of abortion, but I think that ____ better represents my views on matters of war."

OK what then would be considered enough votes to pass? If it's > 50% of all voters (even those who don't bother to vote) it could mean nothing ever gets done.

Re:Root problem

[TheLink]

Whether they really wanted to or not almost everyone votes for one of the two major parties because they feel voting for a 3rd party is effectively throwing their vote away. (Which only makes sense to think that way because everyone votes for the two major parties. It's a feedback loop but it's one we seem to be stuck in.)

It's not throwing your vote away if say some 3rd party gets 20% of the votes, and
1) The other voters notice (and might start voting accordingly in future)
2) The politicians notice and start changing their priorities

But I suppose you know that already.

Anyway if most voters really think this system sucks, perhaps someone should start a political party and their campaign promise would be to change the election system so that it's not first past the post, and their second promise would be to resign soon after to test out the system :).

Re:Root problem

[AltairDusk]

I agree with you but I'm not holding my breath till it happens (I like living).

Poor backwards Indiana

[CajunArson]

Here in Indiana... also known as "flyover country" to you sophisticated Coasties, we are just so primitive and backwards. All we have here are paper ballots that are easy to fill in and are then automatically optically scanned to register the vote electronically while still having a full paper record of the ballots. I wish we could be more sophisticated and have exotic electronic systems that employ security experts to both verify them and crack into them at the same time.. think of all the taxpayer money we could spend!

Re:Poor backwards Indiana

[jcrb]

Actually in the very coastie state I live in we have the same lovely optical scanners for our voting.

However we only scan ballots with machines we don't bother with anything as time wasting as say having the poll worker scan your ID with their eyes.

It wouldn't matter how great an e-voting system we installed if I can just go from polling site to polling site voting in the place of anyone I know is out of town, dead, planning to vote later in the day, etc

Re:Poor backwards Indiana

[fringd]

that sounds pretty good, but i think this crypto-thing would be better. people are working hard on the crypt to solve real problems

what you describe is pretty good, as it tries to fix problems with throwing the paper votes, but this improves on that a bit.

it's features include
* at the end i can check that my vote is in the published database of votes, which newspapers, etc can verify is added right.
* I cannot prove to anybody else who i voted for (so they can't strong-arm me)
* officials can not throw the votes in the trash, or a river, or bury them, or delete them... if the votes aren't in the published database people will see that their vote is missing.
* they can not scan the votes, keep them in the database, but add it up wrong and publish a wrong total, and then throw the records out. if they add it up wrong newspapers, universities, or any old slashdotter can do the adding themselves and call bullshit.

Re:Poor backwards Indiana

[vlm]

It wouldn't matter how great an e-voting system we installed if I can just go from polling site to polling site voting in the place of anyone I know is out of town, dead, planning to vote later in the day, etc

Why go to all the trouble? Due to popular "motor-voter" registration laws anyone living in your district with a legal license and/or legal vehicle is probably registered. So all you need to do is crack last years phone book for name/address pairs and start voting. Most years there is a well under 50% chance you'd even be noticed as so few vote. If by some miracle you're "busted" simply walk away, its not like the 90+ year old poll worker will capture you for the feds.

Reason #324823 to not bother voting, anyone with the slightest knowledge of how the system works can break it, therefore someone probably has probably already done so.

Re:Poor backwards Indiana

[Schadrach]

In WV we do something similar. They look you up in the register and tear off a stub with your number in the register on it, and write the ballot number on that, then hand you a paper scantron ballot in a plastic privacy folder. You go into a little booth that resembles a lectern with privacy screens to fill it out, then hand your stub and ballot (in the folder) to the scantron operator. He checks that the ballot you handed him matches the stub, places the folder against the input slot on the machine, and pushes the ballot in via a tab cut out of the other end of the folder for that purpose. If the ballot fails to scan, it is returned. If it scans successfully it is deposited by the machine in a locked storage box, and your stub is dropped in a separate locked box.

The net result is that we can do significant auditing, but we have a layer of indirection where you have to have the ballots, the register, and the stubs all three to know who voted for whom, and all three are simply not used together like that, since you can check for stuffed ballots, or illegitimate voters using only 2/3.

Re:Poor backwards Indiana

[Schadrach]

My biggest complaint with our ballots lies with the two things I feel shouldn't be on ballots whatsoever -- there shouldn't be a "fill in this bubble for a straight party ticket" option, and the parties of the candidates should not be mentioned on the ballot. It should be as difficult as possible for someone whose stance is "I have no real opinion, but I'm a , so I'll vote for their guy" to vote. You should at *least* have to know who "their guy" is.

Re:Poor backwards Indiana

[Anonymous Coward]

OMG, grow a brain.

If you can check if your vote was counted correctly, you can prove to 3rd party whom you've voted for and hence you can be strong-armed.

An electronic voting system has to be,

    * ANONYMOUS
    * VERIFIABLE

Unfortunately, there does not exist a system that does this while preventing ballot box stuffing or vote alteration. With paper ballot, you can't tamper with votes on massive scale easily. With electronic voting, you can!

Re:Poor backwards Indiana

[fringd]

you are either a troll or like 8 years old.

you raise one good point at the end though: ballot stuffing. it is a real problem.

one way this is handled is by collecting and publishing a list of eligible voters ahead of time, and only producing one ticket per voter, and provide a mechanism for a voter who has NOT voted to verify that their vote was not counted.

i'm not sure if the method talked about in this video addresses this issue well...

i think that this method has been around for a while though, maybe 5-10 years. i got very excited about it when i first read it, but it is hard to explain, and so i don't think it will ever be used...

condorcet voting would also be nice, but suffers the same problems

Re:Poor backwards Indiana

[ZorroXXX]

there shouldn't be a "fill in this bubble for a straight party ticket" option, and the parties of the candidates should not be mentioned on the ballot.

I see no problem with this, and actually I would consider it to be a big problem if this information was lacking. Your opinion seems to be "I want to check out all candidates and make my own individual selections, the way I think is best", and you welcome to have and practice this. However "I trust the parties to make a good enough selection of candidates" is also by all means also a valid opinion, and you should not try to forbid this just because you disagree with it.

Re:Poor backwards Indiana

[supersloshy]

I'm in Indiana too, and where I voted there were electronic voting systems; no paper. Maybe it's different near Chicago compared to the rest of the state.

Re:Poor backwards Indiana

[Schadrach]

"I trust the party enough that I don't even consider knowing who they put forward relevant, just that he's the Democrat/Republican/whatever" is quite frankly one of our biggest problems.

Re:Poor backwards Indiana

[ZorroXXX]

I do not understand what you think the problem is. Would you try to explain to me? Many times using a problem solving matrix is a useful tool to discuss problems and to find solutions with.

If you imagine a piece of paper with the following four coloums:

• What is the problem?
• What is the cause?
• What could be done to solve the problem?
• Who should do that?

What would you fill in in those? If I understand you correctly, you would fill inn "forbid the voters to get information about candidate party relation from the vote" in the solution coloumn, right? But what is it really you consider to be the problem and what is that caused by??

To any non-trivial problem there is more than one point to fill in for at least the two first coloums, so please do not stop at only the first thing that pops into your mind.

TIA

Problems with Verifiable Voting

[Rich0]

I read the article - all zero words of it - so perhaps the multimedia component of it addressed this concern, but I find it hard to imagine how:

If I can verify that my vote was counted, and can prove how I voted if there was a fraud to force a recount/etc, how does the system make it impossible for me to prove to my boss/spouse/friends/church/etc how I voted?

The problem with receipts is that if you can prove how you voted, then you can punish people for not voting the right way. All an abusive husband has to do is tell her wife to show up with a receipt showing the correct votes or they'll be beaten. You can make the receipt private, but an abusive husband/wife/parent/boss/etc will just tell people to turn them over or they'll be punished.

The effects of this kind of thing can be very subtle. People will change their voting patterns even if they think they MIGHT be asked to show that receipt. Maybe everybody in their union or church or whatever voluntarily posts their receipts as a show of solidarity, and who wants to then be the one person who doesn't join in?

If a voting system is well-designed it should not be possible for anybody to prove how they voted. Other controls should be used to ensure all votes are counted.

Re:Problems with Verifiable Voting

[DeKO]

You do know that TED Talks consist of people going in front of other people and cameras, and talking, right? So perhaps the substance is indeed in the video.

The guy actually presents a very simple way to verify your vote was correctly registered, without ever revealing who you voted for. The secret is to remove the candidate names (by shredding that part of the ballot), scanning your vote into the system, and taking home the receipt, which contains no names. Only the system knows which is which. You can later use your receipt's code to see if it registered your vote properly (because it will match your receipt), but there is no way to know which candidate actually received that vote. It actually solves the problem of verification without compromising privacy.

Re:Problems with Verifiable Voting

[Anonymous Coward]

I don't know about this particular system, but I read a paper on a similar system that claimed to be coercion-proof.

The idea was that voting would be done over the internet, rather than a central location. This obviously makes your concern even more important, as somebody could force you to vote at any time. The claim though, is that a voter can submit as many fake ballots as they want, and the fact that it is fake would be undetectable to anybody but the voter and the system collecting the votes. If that part works effectively then the only possibility of coercion is if the attacker is present with the voter during the entire time the polls are open -- if that time period is a month long, then we should have very little to worry about.

Crypto-magic can do surprisingly counterintuitive things.

Re:Problems with Verifiable Voting

[TheMeld]

The mechanism shown in the video actually does address this. The voting form layout is randomized, and the "key" portion (the bit matching checkboxes with candidates) is destroyed at the voting location. The receipt shows your marks, so you can verify that the marks counted match the marks you made, but it does not show what those marks mean. Even if someone forces you to give up your receipt, they have no way of knowing how you voted, only that the system recorded the vote correctly.

Re:Problems with Verifiable Voting

[vlm]

If I can verify that my vote was counted, and can prove how I voted if there was a fraud to force a recount/etc, how does the system make it impossible for me to prove to my boss/spouse/friends/church/etc how I voted?

Easy, allow multiple votes with only the last one being counted. The only people whom know which receipt is the last, valid receipt, is you, and the govt voting machine.

This fixes the casual problem as I can now "prove" to management at work that I voted "R" but still maintain hipster street cred while showing I voted straight communist party ticket. However someone in the govt or an electioneering volunteer could obtain the list of valid last votes. So you'd need some manner of verified destruction on a fixed date.

Re:Problems with Verifiable Voting

[Yvanhoe]

So you have a receipt showing that you vote for #3, you know who #3 is, but how can you check that the system counted your vote for #3 as a vote for the candidate you chose ?

Verifiability and anonymity are 2 things out of 3 necessary for a good voting system. The 3rd thing is independence from a third party. If you need to trust a third party to match information, to keep records anonymous or to correctly make a sum, this is not a good evoting machine.

All the current solutions require one of the three constraints to be dumped. That is why the only working occurrences of evoting happen in things like debian lists where anonymity can be dropped. It may not be impossible to cryptographically guarantee the 3 constraints, but this is an active research field of mathematics. Right now some solutions exist but they have really nasty constraints (all voters must participate, and their number must be known at key generation, or they must vote in a given order, etc...)

I believe a satisfying algorithm will finally come, but it is not here yet. So please, instead of funding companies that propose voting black boxes that have laughable security, just give funds to mathematicians and cryptography researchers.

Re:Problems with Verifiable Voting

[Anonymous Coward]

If a voting system is well-designed it should not be possible for anybody to prove how they voted. Other controls should be used to ensure all votes are counted.

Once a vote has been entered (or dropped in a box) it should be impossible to link that vote back to the voter. The voter should thus have no way of retrospectively confirming whether their vote was counted in the correct way.

The fundamental problem with electronic voting is that computers cannot be trusted. It simply isn't possible for a human to understand and verify that the machine they're using behaves as expected down to the gates on the silicon chips. With paper voting it is possible for every voter (no matter what level of intelligence) to follow their vote through the system and scrutinize the process to ensure votes are being tallied correctly. Obviously their vote needs to be mixed into a large pool prior to counting to ensure that they cannot find/verify their own vote. However they can keep their eyes and ears on the collective vote tallying process with little reason to distrust the process. With computer voting/tallying it is simply not possible to watch your vote move through the tallying process with even the smallest degree of confidence.

Electronic voting will never work. Ever. It's flawed by design. Even if there existed an approach to implementing a perfect electronic voting system, it's still completely flawed on the basis that voters won't understand how it works. Voting systems must allow all voters (*handicapped and impaired voters complicate this somewhat) to understand the process and see vote tallying be performed in the open at every step.

Re:Problems with Verifiable Voting

[BronsCon]

But... If only the system knows which option is for which candidate, all you can verify is that your paper and the database have the same option; you can NOT verify that the option listed belongs to the candidate you intended to vote for.

Re:Problems with Verifiable Voting

[Splab]

And this is why you should go watch the movie...

There is one problem with the system, since the order has been shreded, I can only tell that my vote has been counted in the order I voted, but I can't verify that the count goes towards the people I chose since the order is always random.

Also, he talks about hand verification, I can't see how that can happen without the 256bit encryption key being supplied to those unscrambling the data (you need to know the sequence to hand count it)) - that means criminals can get hold of the key and that means criminals can check your vote and system has been broken.

Re:Problems with Verifiable Voting

[questionsaddict]

I think that there's no way to prove WHO you voted for, just that the vote registered isn't the same as yours.
For each image, there corresponds a unique ordering of the candidates, so the only way to cheat would be that the votes appear in a diferent order as in your ballot

But if the algorithm that counts the votes, which should be freely available, works individually on each ballot, then it would be possible to decipher your vote just by looking at the count before and after summing your ballot. I really don't know if there's a way to make the algorithm fail for a single ballot.

Re:Problems with Verifiable Voting

[DeKO]

You always depend on a 3rd party to verify it. The entity responsible for the counting can be dishonest even with paper ballots.

Sure, they can count every vote for #3 as a vote for #2. But the system must then be designed to count the votes incorrectly. This is easy to verify later (take one of each ballot type, feed the votes into the system, see if it is counted properly).

Or they could just not give a shit, and ignore the counted votes, and using some arbitrary number instead. Because if you are not trusting the system to count the votes correctly, why would you trust a person to write down the totals to the proper candidate?

Re:Problems with Verifiable Voting

[vlm]

Easy, allow multiple votes with only the last one being counted.

I hate to post a followup to myself but another great idea I had comes from some statistical crypto work I looked into for anonymous cash.

My idea is give everyone ten ballots and you may only receive a receipt for one of your ballots. So, if you expect intimidation, submit one "R" and get a receipt, and nine "D" and you're safe. The system has no record of which receipts you keep and which you toss in a bonfire or shredder, but a human makes sure you only leave the building with precisely one or zero fully documented paper receipts.

A public list of serial numbers of all ballots cast for them is published for each candidate.

Voter intimidation seems pointless because any voter in the country can throw away 10% of their vote to fake any response. Furthermore the intimidators know it, so it seems pointless to either purchase receipts or beat.

Lets say fraud occurs. They have no idea which receipts were kept and which were burned so there is a 1 in 10 chance that they could be caught. Lets say only one in ten people bother to look up their published voting record to make sure it was not tampered with or deleted. Ballot #17 is listed under the R column on the website. I check to make sure my receipt appears on the site. Just my luck that I had a 1 in 10 chance of holding the paper receipt that says ballot #17 voted D. Big trouble ensues.

That would indicate you can only tamper with an election to the order of a hundred votes without getting caught.

Re:Problems with Verifiable Voting

[David Jao]

If I can verify that my vote was counted, and can prove how I voted if there was a fraud to force a recount/etc, how does the system make it impossible for me to prove to my boss/spouse/friends/church/etc how I voted?

It's the magic of mathematics. Modern cryptography is amazing in many ways, and one of the amazing things is that we know how to do seemingly impossible things like "allow voters to prove their vote counted, without allowing them to prove how they voted."

There are many ways to achieve what you ask, even if it seems impossible to you. One way is to use undeniable signatures. The idea is that the verification process is interactive, and you (meaning the system designer, not necessarily the voter) can choose the set of people (e.g. election authorities) for which valid proofs of votes are possible. For anyone outside of the designated set, you can (undetectably) forge proofs that you voted for someone that you didn't actually vote for. The way it works is that the election authorities have special secret cryptographic keys that, in combination with the interactive proof, allow them to do more than the average voter.

Off-the-record messaging is another similar example of a cryptography protocol achieving the "impossible". In this case, OTR messaging allows you to prove your identity to other parties in the conversation, but only to those other parties. For any third party not in the conversation, it is possible to (undetectably) forge the proof of identity for anyone (and the OTR software even includes a tool for producing such forgeries).

Re:Problems with Verifiable Voting

[Yvanhoe]

You always depend on a 3rd party to verify it. The entity responsible for the counting can be dishonest even with paper ballots.

I don't know the US system but in France the counting session is public and fraud attempts have to be done under the public's eye. A few attempts have been uncovered that way.

Sure, they can count every vote for #3 as a vote for #2. But the system must then be designed to count the votes incorrectly. This is easy to verify later (take one of each ballot type, feed the votes into the system, see if it is counted properly).

No, that is not easy. The system you propose for instance does not detect votes switching and if it has a way to detect testing session, it can easily have a different behaviour then.

Because if you are not trusting the system to count the votes correctly, why would you trust a person to write down the totals to the proper candidate?

I surely wouldn't trust one people to count the votes correctly without public scrutiny. I mean, if I were in that person's shoes, I would be very tempted to cheat votes, no ? especially if no checks are made afterwards.

Re:Problems with Verifiable Voting

[DeKO]

Sure, they could switch candidates A and B. Then you can get some of the unused ballots and feed into the same system and check that every permutation is being counted properly.

Re:Problems with Verifiable Voting

[Omnifarious]

I saw something like this presented at a hacker conference. Basically, you can do math on encrypted values and decrypt the result without decrypting the original values. This, in combination with a couple of other techniques indeed gives you hard anonymity and verifiability at the same time. Aside from the fact that it doesn't handle write-in candidates very well, it's currently actually even better than paper voting.

Re:Problems with Verifiable Voting

[Rich0]

For each image, there corresponds a unique ordering of the candidates

I'm not really sure what images have to do with voting. Again, the article contained no words so I have no idea what the actual proposal is.

It sounds like they encrypt the receipt, and you can verify that the encrypted receipt was displayed on some website. If so, how do you know whether the receipt actually matches your vote, unless you can decrypt it? And if you can decrypt it, why can't your boss?

Re:Problems with Verifiable Voting

[Rich0]

And this is why you should go watch the movie...

You say "and this is why," and you don't say what the "this" is... By all means feel free to summarize the approach, but it sounds like you don't actually think it will work.

From your description it seems that they don't actually give you enough information to verify the vote, which means that it isn't actually a verifiable system. Of course, a system that isn't verifiable doesn't suffer from the downsides of a verifiable system... :)

Re:Problems with Verifiable Voting

[Rich0]

So, what does this get you that the current system doesn't get you. All activities associated with the current election system are supposedly done in a public manner, and I can't check if my vote was counted correctly. It sounds like the proposal is a system that also depends on oversight, and it too doesn't let me check that my vote was counted correctly. It only protects against a particular type of fraud, which probably isn't how actual fraud is carried out.

Re:Problems with Verifiable Voting

[Rich0]

However, it sounds like you can't confirm that the vote got counted for the right person, and an arbitrary 3rd party can't verify that the correspondence between votes and ballot positions wasn't tampered with after voting.

So, this preserves some anonymity by giving up some verifiability. That doesn't sound like anything new to me.

Re:Problems with Verifiable Voting

[Rich0]

That isn't a bad concept. You could probably accomplish the same thing by having everybody just vote like they normally do, and print out a receipt randomly a small percentage of the time (maybe 10% - maybe less). The booth would be designed to make receipt printout undetectable to those in the vicinity (very quiet, or with masking noise/etc).

Then when your boss asks for a receipt you just say that you didn't get one. However, if you don't know which votes have receipts you don't know which ones you can safely change.

Re:Problems with Verifiable Voting

[Anonymous Coward]

That is impossible from an information theoretical point of view. If you can prove that your vote was counted incorrectly (which is the least thing you need to be able to do to show that there was fraud), then you can prove who you voted for, which you must not be able to do. (Not to mention that knowing that you own vote was counted correctly is not sufficient protection against election fraud...)

The requirements for voting systems are well known and IMHO the omissions and mistakes in all proposed electronic voting systems are necessarily and glaringly obvious that I consider people who propose electronic voting schemes to be antidemocratic.

Next up: TED talk reveals perpetual motion machine. IPO next Tuesday. Open your wallets.

Re:Problems with Verifiable Voting

[NateTG]

Easy, allow multiple votes with only the last one being counted.

As soon as you can produce misleading receipts, you can't make verifiable claims about non-counting.

I remember thinking about this sort of problem, and the basic answer is that if you want to have verifiable voting, you'll need a trusted party to hold the votervote relationship. Though you can split it between multiple places and so on.

Re:Problems with Verifiable Voting

[Anonymous Coward]

You need to watch the video. The order of candidates is random on the ballet form, and is torn off. The result is that you can then check your vote has been counted correctly, but no one can know who you voted for.

Re:Problems with Verifiable Voting

[Rich0]

If that is the case, you also can't tell if your vote was counted correctly, which means that this is not a verifiable system. If it isn't verifiable, then the problems with verifiable systems don't need to apply...

Re:Problems with Verifiable Voting

[mcgrew]

You do know that TED Talks consist of people going in front of other people and cameras, and talking, right?

There are these things called "transcripts" that one can read. I never get anything at all from recorded talks, the written word is far better. If I'm being pointed to an ARTICLE I expect to be able to read it. If I want to watch a talking head, I'll turn CNN on.

Re:Problems with Verifiable Voting

[mcgrew]

This fixes the casual problem as I can now "prove" to management at work that I voted "R"

No, that INTRODUCES the serious problem that if you voted R and your work for Disney, they know it. Under the present system nobody can shoot you for voting Libertarian, becuse your vote is SECRET as it's been since the republic was formed.

Re:Problems with Verifiable Voting

[TheMeld]

What I couldn't find was an explanation of what the "crypto" stuff in that 2D barcode is. I think I've seen something about some other similar systems where there's some mathematical voodoo that goes on that lets you use that data to tally a group of votes without being able to know the details of the individual votes.

Regardless of the details, I think that the data in that barcode has stuff that allows anyone to verify that a) it is an authentic ballot and b) given the full set of ballots, recompute the tally on their own and compare that to the published results.

Wish I could remember where I saw that or how it worked though.

Re:Problems with Verifiable Voting

[andrewagill]

I don't know about this system, but there was another very similar system system (punchscan) that explained how it worked. Essentially, you generate something like 100 times the number of ballots you need. The ballots are chosen randomly, and you can audit both the receipts of the ballots cast and the receipt/candidate list pairs of the other 99% of the uncast ballots. Since you don't know which ballots will be cast, you'd have to manipulate all (or at least a lot) of ballots, and if they turned out to be manipulated, you'd know something was up.

Thoughts

[DaMattster]

Given the recent corruption in all government levels, I don't feel I can entirely trust manual systems, let alone e-voting. I might warm up to the idea a little bit more if basic things, such as - gasp - an audit trail is added to the e-voting. I never understood how an electronic voting machine would not include auditing facilities.

The problems are the same as always

[dx40sh]

How do you get over the idiocracy, though ? There's always going to be someone who protests the system purely because they do not understand how it works. And as recent elections have proved, you need not be right to be heard by many, all you need to be is loud.

another requirement

[a2wflc]

You must NOT be able to prove your vote was counted correctly for a specific candidate. That leads to bribes/threats (i.e. your boss can ask to see the proof. if you want to assume that's illegal, think of all the other people who may "ask" to see it or offer something if you volunteer)

There are ways to do this and meet your requirements, but there is more to it than the 3 you listed.

Re:another requirement

[fringd]

the system in question allows me to verify that my vote was correctly cast, without being able to prove it. assuming the ballots are made right, you will get the information about who each checkbox refers to, this secret is encoded in the 2d bar code, but encrypted, so that strong-arming can't work. when you rip off the names and shred them, this makes it very hard to prove to someone else who you voted for. YOU might know that checkbox #3 had ron paul next to it, you remember that, but when the thugs look at the ballot, they have no way of knowing...

now that said, the thugs could force you to wear a little camera and video everything you do in the booth, or some other contrivance... but it's still a stiff improvement... and that is not a new risk introduced by this tech.

another possible attack against this system is bad ballots. you have SPECIAL ballots that switch the democratic and republican candidates, and you check to see if the person has dreadlocks or a crew cut before you decide to hand them the good ballots or the bad ones. ideally the cryptography is such that only a small group of people can make valid ballots, and so you can centralize the fraud detection. this attack would require a good amount of collusion though, and any system fails if the entire world is conspiring against you (THEY ARE!!!!)

Re:another requirement

[jemenake]

You must NOT be able to prove your vote was counted correctly for a specific candidate.

Exactly! Although I figure that he has done this, he doesn't explain how. Now, you can tell, at the beginning of his talk that he's addressing a more "newbie" audience, so it doesn't surprise me that he doesn't go into this... but I'd still like to know.

Until then, I'll stick with punchscan/scantegrity, which is the only system I've seen which seems to be iron-clad. However, in order for it to work like it is designed, it requires that the voting public know what to do (like destructively verifying some sacrificial ballots before/during/after voting time) and that they know what anomalies are cause for raising the alarm.

Re:another requirement

[fringd]

i understand your confuse. but i also understand the explanation.

alright watch the video... see after he tears the names off the ballot? now your ballot doesn't say who each checkbox means... not in plaintext anyways, the meanings are encoded in lotsa crypto gobeldygook on the right there... you take your ballot home with you, and verify it's in the database, exactly as you see it in your hand.

now... goon has to take your word that checkbox #1 is for the guy he wanted you to vote for, he has no way of knowing, and you don't have any way to prove it, even if you want to!

Re:another requirement

[cacba]

The above post is correct. You can only prove that your ballot was correctly included in the counting process, not how that ballot voted. The counting process is complicated so that anonymity and verifiability occur. Read first, comment later.

Re:another requirement

[AndyG314]

It would be cryptographically possible to ensure your vote was correctly counted without reviling who you voted for. With a one way function you could generate a hash of your vote, which would be compared with a second hash generated at counting time.

Re:another requirement

[Yaur]

the problem with this is that the amount of data to be hashed is small enough that brute force is possible, especially if the voter has an incentive to assist the attackers.

Re:another requirement

[Anonymous Coward]

"...without reviling who you voted for." ?!?!

Re:another requirement

[dwandy]

That leads to bribes/threats

I was in agreement with this, but I'm no longer as convinced this is a problem that needs to be solved.
With my cell-phone camera I can already take a picture of my vote for proof to someone else so the problem (if there is one) would already exist today; or would be becoming an issue as more and more people have the ability.
If it does become a problem then we would simply needs to alter the proof function to allow for the user to ask for one of three responses w/o anyone else knowing which way they asked the question:
1. The vote they actually cast
2. Always Yes
3. Always No

Re:another requirement

[Anonymous Coward]

Why not? Bribery IRL will be way easier to detect than systematic injection or miscounting of votes in a machine. You think even in a group of 2000 people not one would talk if they had been bribed? No way.
 

Re:another requirement

[careykohl]

That would let you verify that you cast a ballot and it was indeed counted. How do you verify that the selections you made were the ones actually recorded on the ballot?

Re:another requirement

[Radtoo]

And you will believe your vote was counted correctly, rather than just you having gotten a hash anyone can produce as long as they have your ballot?

I think it will require more if done this way. Multiple counting instances, multiple instances that verify voter eligibility.

Re:another requirement

[Confuse Ed]

You must NOT be able to prove your vote was counted correctly for a specific candidate. That leads to bribes/threats ...

Here you've highlighted probably the biggest problem to overcome : how to allow voters to verify that their own vote has been correctly counted (and be able to prove that the vote was rigged if not), but in an anonymous and deniable way (to avoid coercion) : it may not be possible to have both at the same time (but I'm not an expert on the subject : maybe the unreadable-article has an answer).

OTOH if we live in a society where you may later be threatened in to proving how you voted (showing your hash-receipt, revealing your private crypto-key or password, revealing what secret mark / signature you put on your ballot paper etc. depending on how any such verification system is implemented), democracy would seem to have failed us anyway and the actual results of any such sham election probably irrelevant.

There are ways to do this and meet your requirements, but there is more to it than the 3 you listed.

Indeed, it is a tricky problem - I was trying to keep it simple and just answer the parent's post about what such a system might offer over and above today's sytems : I was hoping it was implied that it would also include existing features such as anonymity (and telling you how many votes each candidate / option received)

Re:another requirement

[sakshale]

Which is why I am constantly arguing against the current move to get everyone to vote by mail.

Re:another requirement

[AigariusDebian]

Sure it is possible: after the voter has voted, he gets a receipt with a random number X on it, after the elections there is a tally sheet with a list of votes which basically says 'number X voted for candidate A'. From that tally anyone can count how many votes A got and check that their own vote was counted correctly. For plausible deniability after his vote, the voter can ask the ballot machine to print another hash receipt - a random hash receipt that would show up on the tally as voting for the candidate B (that the voter was payed to vote for) so that he can show that receipt to briber. Naturally before starting an election there would need to be a pool of hashes for all candidates - a set of fake initial votes, equal for all candidates so that there is a set of hashes to choose from if the first voter asks for a fake hash printout.

Re:another requirement

[Anonymous Coward]

You must NOT be able to prove your vote was counted correctly for a specific candidate. That leads to bribes/threats (i.e. your boss can ask to see the proof. if you want to assume that's illegal, think of all the other people who may "ask" to see it or offer something if you volunteer)

Fuck you pussy. First, voter intimidation is illegal. Second, the benefit gained by intimidating a voter is dwarfed by the near certainty of getting caught if there is any magnitude to this behavior. Third, if you weren't such a pussy, you could tell your boss or whoever to fuck off. If you are just a little bit of a pussy (not you, the giant vagina, but someone else) you can lie. Forth, the receipt tied to the proof could be easily disposed by any pussy like yourself and breaking the link to proof of how you voted. Hell, they could even assume you are a pussy and make getting this receipt opt-in rather than opt-out. FIFTH, there is no constitutional or immutable reason for having secret ballot when exercising a vote. I don't want my government to have secret ballots on legislation and I don't need my pussy neighbors hiding their votes. Fucking pussies! Don't you hate them?

captcha: uncouth - oh captcha god, you know me so well

One of the reasons - fragile democracies

[presidenteloco]

A fragile democracy is one where, among other things,
  no-one trusts the current paper-ballot voting system,
because it is highly manipulated and corrupted.

Many countries fall into this category.
Iran is a notable recent case.

They could use a well-principled Internet voting system
administered by a UN agency.

You could run the election for a month to prevent
voter intimidation. You could have the computer,
rather than the dictator's cronies, count the votes.

There would be no more 10% to 20% discrepencies in
the claimed voting results.

Re:One of the reasons - fragile democracies

[Amouth]

what we need is a way of making the ones who don't vote - who don't give a shit - who have zero political affiliation - the ones that handle and count the votes..

Sorry but i do have issues when the people who count the votes have a political affiliation.

Re:One of the reasons - fragile democracies

[Albanach]

Will it stop someone carrying an AK-47 forcing their way into a home and directing the occupants to vote in a particular way while watching them do so?

Re:One of the reasons - fragile democracies

[nedlohs]

Are you willing to hand your voting over to a UN agency? Other than just handing over the country is there a way to lose more sovereignty than that?

Re:One of the reasons - fragile democracies

[nedlohs]

Surely Scrutineers work just as well - http://www.aec.gov.au/Voting/scrutineers.htm

Of course the election is run by an independant of the parties organisation in that case as well.

I will *never* understand the way elections are run in the US. From having them on a weekday, to not just hand counting votes (there's no preference flows, it's so simple to put them in piles...), to political parties running the show, to having elections every two years so that campaigning never stops,

Re:One of the reasons - fragile democracies

[Amouth]

I will *never* understand the way elections are run in the US.

best i can tell it is so the people in power can stay in power.. and keep the money rolling in for them and their friends.

Re:One of the reasons - fragile democracies

[Anonymous Coward]

No, you're approaching the problem from the wrong side. You should not increase the trust in the people. You should make trusting the people unnecessary. That's what paper ballot voting is all about: You, not just some official person, can see with your own eyes that the election is done correctly. You have the right to see the empty ballot box before it's sealed and all the time until it's opened. You have the right to observe the counting of the votes. You don't have to trust anyone. You can put your trust in others to observe all that, but if you don't trust them, do it yourself. That's why electronic voting is an a priori failure: You can't observe the processes that produce the election result.

Forget cost - what is the POINT?

[beh]

Please tell me - do we get ANYTHING out of e-voting apart from a time saving between closing the polling stations and declaring the result?

For elections regarding terms of more than 4 years - forget it. The potential lack of trust in e-voting (as opposed to regular paper voting), because conspiracy theorists will immediately claim any election was stolen, which is a lot harder to do if there are actual people counting the votes publicly...

Just think about how much time is still being wasted discussing whether Obama is a muslim, or whether he is a naturally born US citizen -- think about how much time will be wasted afterwards in endless discussions brought by conspiracy theorists of the 'losing side' in ANY poll....

It's not worth it.

Re:Forget cost - what is the POINT?

[Quantus347]

Do the words "Hanging Chad" mean anything to you? Paper voting has as many problems as E-voting, and as much potential for massive screw-ups. If there were a system that was actually secure, e-voting would be great. Unfortunately, the systems out there are all closed system "black box" deals where the manufacturer refuses to reveal any of the internal workings. Because of that the only people who actually know are the hackers using them to fix elections. If they were open, and thus subjected to rigorous enough testing to consider secure and reliable, we'd be golden.

Besides, you shouldn't really assume that the machine that electronically reads your paper ballad and transmits the results are any more secure/reliable as the purely electronic solution.

Re:Forget cost - what is the POINT?

[Albanach]

Do the words "Hanging Chad" mean anything to you? Paper voting has as many problems as E-voting, and as much potential for massive screw-ups.

Correct me if I'm wrong, but were the hanging chads not created by machines?

Re:Forget cost - what is the POINT?

[ArcherB]

Do the words "Hanging Chad" mean anything to you? Paper voting has as many problems as E-voting, and as much potential for massive screw-ups. If there were a system that was actually secure, e-voting would be great. Unfortunately, the systems out there are all closed system "black box" deals where the manufacturer refuses to reveal any of the internal workings. Because of that the only people who actually know are the hackers using them to fix elections. If they were open, and thus subjected to rigorous enough testing to consider secure and reliable, we'd be golden.

Besides, you shouldn't really assume that the machine that electronically reads your paper ballad and transmits the results are any more secure/reliable as the purely electronic solution.

Why not have both. You place your vote electronically (electronic voting), it prints a receipt clearly listing your choices with a barcode linking that receipt to your voting session. After reviewing your vote receipt, you place your receipt in a box (paper voting). If you have a problem with your vote (receipt doesn't match your choices), the poll worker can scan the barcode to remove your vote, allowing you to vote again. All voided votes should be kept in a separate box for verification.

Results would be instant as they would kept electronically. If there is an issue, you can use the paper ballots (receipts) for a recount. Ballot stuffing would be kept to a minimum as the number of votes could be electronically verified. Any electronic tinkering could be nullified by the paper ballots. Anonymity would be kept as there is nothing on the receipt or the electronic ballot that would tie your vote to you. As an added bonus, the voter can actually confirm their vote by reading the printed receipt.

What's wrong with this system?

Re:Forget cost - what is the POINT?

[Anonymous Coward]

Please tell me - do we get ANYTHING out of e-voting apart from a time saving between closing the polling stations and declaring the result?

1. Saved paper.
2. Less cost of shipping paper ballots across counties which might allow resources to be used for more polling places.
3. Less cost of warehousing equipment and space for paper ballots.
4. Savings on the cost of counting paper ballots.
5. Depending on implementation, the potential for MORE security than paper ballots.

That's all I can think of off the top of my head.

Re:Forget cost - what is the POINT?

[patjhal]

I would like to add that elections are very expensive endeavours. E-voting does have some cost cutting potential if we can find something that is reliable, standard, open source, tamperproof, etc. I actually do not understand why primaries are paid for with public funds (outside of the occasional non party picking thing added to it like amendments or filling a vacancy).

Re:Forget cost - what is the POINT?

[literaldeluxe]

Please tell me - do we get ANYTHING out of e-voting apart from a time saving between closing the polling stations and declaring the result?

People with disabilities can vote privately and securely, like everyone else.

Re:Forget cost - what is the POINT?

[MadCow42]

Vote buying. That's what's wrong with it.

ANYTHING that gives the voter the opportunity to walk out with confirmation of HOW they voted is a huge problem. In the system you describe, the voter could decide to not put their paper slip into the box, or to drop in a fake substitute (and no, you couldn't verify it was a real slip without making their vote non-anonymous in the process).

So, they walk out the door, show their slip to "Guido", and poof - their vote has been bought.

The only time their vote gets screwed up is if a manual recount is done at that station, which in terms of % is low (by design - with an electronic system).

You need a solution where the original vote is cast on paper, and is scanned in (and retained) by the system... and the voter verifies their vote electronically on screen before walking off empty-handed.

MadCow.

Re:Forget cost - what is the POINT?

[gumbi west]

There are important benefits. One that I would think the slashdot would like is the possibility of instant runoff balloting.

In this scheme

1. every person ranks all of the candidates;
2. everyone's vote is counted as a vote for their top ranked candidate (their favorite person for the spot);
3. the lowest vote candidate is removed;
4. for people for whom this was their top ranked candidate, their top ranked candidate is changed no their next highest ranked candidate

This possibility has huge upside for third party candidates who can now get a vote that is not, "thrown away".

But in the end, this is at odds with how I think DRE should work, in an object oriented fashion. one machine marks the ballot for you, another counts the ballot. So long as the marked ballot can be verified by eye, this is just another way (other than a pencil) of marking a paper ballot, so it has no more downside but can help blind people vote in private. It also reduces the possibility of hacking the voting machine since it can be constantly validated on election day.

Re:Forget cost - what is the POINT?

[ArcherB]

ANYTHING that gives the voter the opportunity to walk out with confirmation of HOW they voted is a huge problem. In the system you describe, the voter could decide to not put their paper slip into the box, or to drop in a fake substitute (and no, you couldn't verify it was a real slip without making their vote non-anonymous in the process).

The paper "receipt" is the paper ballot. The voter does not take it with them. It goes into the ballot box after the voter verifies that it is correct.

If you are concerned that a voter might place a fake ballot in the box, you could put a system in place that scans the barcode as or before the ballot is dropped in to verify its authenticity. You could even set it up so that the vote is not officially counted until it's scanned and placed into the box.

You bring up a good issue, but not one that isn't easily resolved.

The problem I see with it is a corrupt poll worker could open the ballot box and void several "receipts" to change the votes. This would probably be detected, however, as the number of voided ballots would be quite high. Also, there could be a time limit set on how long a vote can be voided. You could even set it up so that if a vote is not scanned and placed in the box within a certain amount of time, it is voided.

Still, if a polling place is so corrupt that a poll worker can unlock and access ballot box to change votes, no amount of security measures could ensure a fair election.

Re:Forget cost - what is the POINT?

[gtbritishskull]

Or we could just put in an STV system and have actual proportional representation.

Re:Forget cost - what is the POINT?

[RareButSeriousSideEf]

So how about each polling place and printing machine have a mini digital signature. Polling place setup involves loading hashes of the printer signatures into each scanner at the location.

The receipt (that the voter takes with) has a code, and the ballot has a hash of that code. Voters scan the receipt code to "open" the scanner, *then* they can scan the corresponding ballot if the hash matches.

The ballot includes a barcoded signature block using the location key, printer key, creation timestamp and hash of the ballot code. Except when keys are cracked, this restricts the scanners / counters to accepting only ballots created at that location, that day (or hour), by a printer registered to that location.

You could probably also publish logs of all ballots printed, all ballots scanned, and all ballots voided. Polling places with irregularities > n standard deviations off the mean get sent to bed without any dessert.

Re:Forget cost - what is the POINT?

[Anonymous Coward]

Let's see... Unless you have the source, the bar code could leak information that could be used to identify you, such as the time, place, and voting machine number. Even if you have the source, you would have to somehow know that the program working on the machine is based on the source and hasn't been altered.

If you're out to discredit the system, you could also produce fake paper ballots. You take one of them with you, vote for someone, discard the printed ballot and put your fake ballot in the box. Upon a recount, your ballot might be picked, but it won't have any electronic record and so shows a failure of the system. The counters could get around that by digitally signing the session number, but then evil code could decide both not to sign the paper ballot and to not submit the electronic ballot if it's for a candidate the designers don't like - the paper ballot will be discarded as fake, but the voter has no ability to check that the digital signature is indeed wrong.

I'd prefer this variant: the voting machine is a (not Turing complete) machine that prints a custom paper ballot - in essence a special purpose printer. The voter marks the candidate/s he wants to vote for, the machine prints the ballot, the voter looks at it and puts it in the box. Once the polls have closed, the ballots are OCR-ed (which would be very easy given the standardized format of the ballot) under oversight. Some low percentage of ballots are at random checked by party members before passed through the OCR so as to check that the counting machine isn't crooked.

Re:Forget cost - what is the POINT?

[Anonymous Coward]

What is the official ballot? how do you do a recount?
The real problem is that you have combined the disadvantages of both paper and electronic systems.

Re:Forget cost - what is the POINT?

[dkleinsc]

Do the words "Hanging Chad" mean anything to you?

Yes, it does. Also the Minnesota senate election in 2008. In both cases, because there was a physical record of each vote, there were clear ways of determining exactly what the vast majority of voters intended to do, even those who didn't do exactly what the counting machines expected. The problems in both those elections were because partisan jackasses were coming up with excuses for why votes for the other guy shouldn't count, or why something that may or may not have indicated a clear intent should count for their guy. Oh, and also the partisan jackasses who were charged with the solemn duty of running fair elections, who found ways to run it so that their guy would have a better chance of winning. Electronic votes wouldn't be immune to this sort of thing.

Here's the way to make things work if we're looking for free and fair elections:
1. Create a physical record of each vote that cannot be traced to the individual voter (which, btw, eliminates all concepts of a voting "receipt" that often crop up around here).
2. Make darn sure that the officials running the election are not partisan and have extremely high integrity. An excellent example of the sort of person we'd want in this role is Bill Gardner, who has been running elections in New Hampshire since 1976 and has the support of Democrats and Republicans.
3. Engage in random unannounced audits of voting results in particular precincts by outside organizations, such as news media, foreign election observers, or nonprofit watchdogs.

Re:Forget cost - what is the POINT?

[HungryHobo]

And paper voting?

Vote buying. That's what's wrong with it.

ANYTHING that gives the voter the opportunity to walk out with confirmation of HOW they voted is a huge problem. In the paper system , the voter could decide to pull out their camera phone, take a photo of their market ballot.

So, they walk out the door, show their photo to "Guido", and poof - their vote has been bought.

and even with a manual re-count it doesn't show up.

but people are hopeless romantics about paper.
everything is better on paper.

Re:Forget cost - what is the POINT?

[dgatwood]

I would prefer a system that actually has a prayer of working: independent counting. The system works like this:

• They hand you a magstripe card.
• You enter the voting machine and cast your vote.
• The voting machine keeps a record of the votes cast, assigning each vote a UUID.
• The voting machine cryptographically signs the ballot card.
• It spits out the card.
• You carry it to the vote counting machine.
• It shows you the vote.
• If it is wrong, you invalidate the ballot and carry it back to a voting machine.
• That voting machine invalidates its copy of the ballot and you revote.
• If it is right, the vote counting machine wipes the ballot card and releases it to the user.
• The user carries the card back to the polling people, and they scan it a third time and verify that it is blank (preventing invalidation of votes by giving someone an already-used card).

This is relatively secure so long as the following conditions are true:

• The three systems (the voting booths, the vote counters, and the wiped card verifier) must be manufactured by different companies that share no parent company and share no code.
• The voting booths are networked only to each other (for mutual vote invalidation), not to any other systems.
• The vote counting computer network has a restricted OS and boot firmware that is resistant to tampering.
• The vote counting computer stores a signed copy of the ballot database on a USB flash stick upon insertion.
• The vote UUID and vote lists from the voting computers and the vote counting computers are compared, and if there is a discrepancy, an audit occurs prior to certification of the vote.
• The UUID contains data that is sufficiently hashed so that determining a time/date stamp from it is infeasible.
• The UUID is used as the database primary key and the database table's backing store is such that order of row insertion cannot be determined after the fact.
• The UUID algorithm is properly scrutinized for its inability to reveal interesting information.
• All of the data formats are fully specified, and any deviation from that format results in an appropriate exception getting logged, which results in an immediate audit.

Not all of these are easy to achieve, but it is possible. The problem with random checks is that when a problem is found (and there are frequently errors with any OCR system), you then have to determine whether the odds of the results being wrong are likely to result in a change in the outcome. In a close race, there's a decent chance that subtle fraud won't be detected at all because the machine might throw away one Democrat vote in a hundred, for example.

With electronic ballots, if done properly, you can guarantee with a relatively high degree of certainty that all of the ballots have been counted correctly, which is much better than simply stating that there's a statistically good probability that they have all been counted correctly.

Re:Forget cost - what is the POINT?

[cmiller173]

OK, you are in fact wrong. A human (aka voter) punches the hole in the ballot with a stylus. http://en.wikipedia.org/wiki/File:Votomatic.jpg

Re:Forget cost - what is the POINT?

[jc79]

Hanging chads are not a problem with paper voting. They are a problem with inappropriate technology. Why punch a bit of paper when you could simply use a pen to make an X in a box?

Re:Forget cost - what is the POINT?

[sakshale]

And this is different from today's massive push for voting by mail in what way?

1) Request Vote By Mail ballot
2) Hand signed VBM paperwork to evil boss
3) After review it is mailed in to be counted
* * *
4) Evil boss profits

Re:Forget cost - what is the POINT?

[Anonymous Coward]

"Hanging Chad" means poorly engineered voting solution to me. My state uses paper ballots. I fill in an oval next to who I want to vote for. A machine scans it in and instantly tallys the vote. I'm not sure why this system isn't used in favor of these "e-voting" or punchcard machines.

Re:Forget cost - what is the POINT?

[MadCow42]

Yep - and in today's day and age, I guess there's nothing preventing you using your phone camera to snap a screen shot of your digital vote casting (or video, I guess) either.

There's no such thing as a "perfect" system, I guess... :(

Re:Forget cost - what is the POINT?

[TempeTerra]

Guido doesn't know the photo you took is of the ballot you put in the box. Sure, if Guido wants to buy my vote I'll take his money and vote how I like.

Re:Forget cost - what is the POINT?

[Anonymous Coward]

Your receipt does not show who you voted for. It shows where you checked the boxes. The voter does not come out with confirmation of how they voted, so `Guido' won't get any proof that they voted for his candidate.

Re:Forget cost - what is the POINT?

[DougF]

We weren't allowed to bring in cell phones to our polling place. One of the poll workers asked if we brought one in and also made us open up coats/handbags to prove it.

Re:Forget cost - what is the POINT?

[Anonymous Coward]

What if someone puts an X in two boxes? Which one counts?
What is someone puts a Y in a box? Does that count?
What if someone puts and X in a box and then blacks it out?
What if someone uses a pencil?

THOSE are the 'hanging chads' of 'just mark an X in a box'.

Re:Forget cost - what is the POINT?

[gumbi west]

So, you want to rewrite the whole constitution so that members of congress are elected nationally. yeah, good luck with that. Why not start with allowing everyone to have a first choice.

Re:Forget cost - what is the POINT?

[Anonymous Coward]

We've been doing instant-runoff voting on paper in Australia for over a century now.

Re:Forget cost - what is the POINT?

[jc79]

In the UK, all of the above cases (except for using a pencil, which is fine) count as a spoiled ballot, and are not counted as votes. If you do accidentally spoil your ballot (like putting an X in the wrong box), then you simply take your ballot paper to the polling officer, who destroys it and hands you a fresh one.

The problem with hanging chads is that a voter may punch the correct part of the paper, but the punch is incomplete - often through no fault of their own. With pen(cil) and paper, it's easy to tell if you made a mistake. With a punch, it may not be so obvious.

Re:Forget cost - what is the POINT?

[HungryHobo]

Guido doesn't know the paper you handed him is the real receipt you switched for the fake.
Sure, if Guido wants to buy my vote I'll take his money and vote how I like.

you're complaining about a problem that is no worse with the electronic voting system though potentially could be done better.

Re:Forget cost - what is the POINT?

[Anonymous Coward]

Ever heard of Cell Phones with cameras? Let me pirate your argument and destroy you faith in the old traditional system, because there is something wrong with it too...

Vote buying. That's what's wrong with it.
So, they (take a pic of their vote on that old traditional ballot,) walk out the door, show their *snapshot* to "Guido", and poof - their vote has been bought.

Now, STOP with that useless argument already!!!

Re:Forget cost - what is the POINT?

[gtbritishskull]

Actually, my preference would be (I believe) to only change the state constitutions so that the members of the House of Representatives are elected using STV. Then we would not have all the problems that we do with Gerrymandering. But, you could hold all of the elections this way, even if you don't want to elect multiple candidates to one position, so you wouldn't have the third party problem (e.g. Ralph Nader in the 2000 election).

This system would allow you to actually vote your first choice (even if it were Libertarian, Green, ect. who are unlikely to win) and not have your vote be wasted.

Re:Forget cost - what is the POINT?

[gumbi west]

Oh, I see. Yeah, I think just one federal law, or if there is no federal law, one state law would allow that. But it probably wouldn't matter much for states with 1 house member, right?

Re:Forget cost - what is the POINT?

[gtbritishskull]

You would still have the advantage of a third party not stealing votes from another party. For example, if you assume that a person voting for the Green party would always vote Democrat if not given the option of voting Green, then if you have 49%R, 48%D, 3%G the Democrat should win because without the 3%G you would have 51%D. But, with our current election system, you only look at the 49%R as being the greatest so the Republican would win. But, with STV, the people voting Green could specify a Democrat as their second choice so that once the Green party is determined not to have enough votes, the votes transfer to their second choice. The same thing could happen if Republicans and Libertarians are running for the same office. This way, a third party vote would not be a useless vote, so we would be MORE LIKELY to elect a third party candidate.

More information

[Anonymous Coward]

http://www.pretavoter.com/faq.php

His idea seemed bad to me

[gurps_npc]

It was simply a variation of the paper receipt to prove that you vote. Or maybe he just explained it poorly. As far as I can tell from his description, you can prove tell that you voted, but you can't tell WHO your vote was for.

Besides, it's not that hard to create a paper ballot system that is secret and fair, but uses computers to speed the creation and counting.

Step 1. Have a printer kiosk that lets you select who you vote for electronically. It also shows 3 colors/icons/etc. You select a color/icon when you vote.

Step 2. The kiosk then prints out TWO identical bar coded paper receipts that does not have anything but numbers on it.

Step 3. Take bar coded paper receipt to second machine, called a reader.

Step 4. Feed one (either one) into the reader. That reader displays who you voted for, you can confirm or deny. Assuming you confirm, it keeps the one recepit and you keep your own. If you deny, it spits out the bad receipt, and you are legally required to shred both before you try again.

Step 5. To confirm your vote, you log on to a database, look for your recepit number and enter the color/icon you remembered. If you enter the wrong one, it displays a false vote without reveleaing that you entered the wrong color/icon.

Net result is that you and only you know who you voted for, and you can verify that your vote was counted.

Re:His idea seemed bad to me

[lras]

Net result is that you and only you know who you voted for, and you can verify that your vote was counted.

Sorry for being dense, but how does that verify that my vote is affecting the the announced result of the election? Couldn't they just announce "X got 60% of the votes" anyway? (By jamming in a lot of false ballots, or by just lying?)

Re:His idea seemed bad to me

[gurps_npc]

Some of what you are describing is already checked for by standard methods, plus the fact that the votes are all in an open database.

Specifically, when counting votes, you don't just do a full count, you also break it down into X votes from Y district, and even by voting machine, which is verified independently by the voter registration rolls. So each machine has a list of the people that voted using it, the total vote count for each candidate, and the ability to check if the vote was counted.

A bunch of false ballots would pump up the total votes done and the numbers would not match.

Each independent voting machine would list the totals for each candidate and you could verify their own votes there.

Note, there is no way totally prevent fraud, but the method I describe here would require fraudulent vote counters at each and every district machine, all of whom keep quiet.

In addition, the voting record itself is public, and the software is public. This would let people prevent the lying.

Re:His idea seemed bad to me

[Schadrach]

Prove to me that the false vote will be the one the guy intimidating/paying me wants to see, and not the "wrong" false vote.

Re:His idea seemed bad to me

[jeff4747]

Step 6: Collect $100 from the partisan who watches you confirm your vote, since your system makes vote buying practical.

Re:His idea seemed bad to me

[Anonymous Coward]

You are missing a few points:

The ballot that you submit should have both the bar-code and the text of the people voted for. The ballot you keep (if this is needed, we don't get anything like this now) should have only a random number that matches the real ballot.

This allows you to view the ballot in text and confirm that it is right. This also allows those watching the counters to verify that the information scanned matches the information printed on the ballot. Additionally the text would allow for manual counting to back-up the fast scan results.

Re:His idea seemed bad to me

[curril]

This does not guarantee both anonymity and security. The public database must reveal the true vote of each receipt, otherwise there is no way for third parties to verify that the public vote totals match the ballots. In that case, there is no need for icons or colors or encryption. Just give each voter a certified copy of their uniquely numbered ballot and publish a copy of all ballots after the election. Third parties can verify vote totals, voters can verify that their votes were counted, and anyone wanting to remain anonymous can shred their copy at the voting booth, losing the ability to verify their vote.

Re:His idea seemed bad to me

[cifey]

This really links the voter to the ballot too strongly. Why not just print out a copy of the results. The paper copy can be reviewed/canceled by the voter. The voter must agree to the paper copy before submitting any vote. The paper copy is mechanically inserted into a vote bin.(viewed but not touched by humans) The paper votes and electronic counts should match exactly. paper votes can be counted electronically. If there is some bug suspected they can also be counted manually. If there is any mechanical failure (out of ink or paper?) the vote must be redone/reprinted before it will count.

Re:His idea seemed bad to me

[Schadrach]

Presumably you'd show him the "fake" result if you weren't really going to vote for his guy -- again though, how do I know the "fake" result will be the result the guy who is paying/threatening me wants to see?

Re:His idea seemed bad to me

[jeff4747]

Well, either step 5 is moronic, in that there's no indication that your vote was recorded properly, or it's going to have an indication which the partisan will demand to see.

Re:His idea seemed bad to me

[Anonymous Coward]

Back to vote buying and coersion. Bad idea.

In my state, everything at the polling place is done with a bipartisan team. If a voter requests a paper ballot, he's given one and he puts it in the ballot box. That box is under the control of the bipartisan team. At the end of the night, the box is delivered to the elections board that also functions with reps from both major parties. The ballots are never under control of just one party.

Machine voting is somewhat different. While the memory cards are handled in a bipartisan fashion, the underlying programming is under control of one company that has very definite partisan preferences. To me that suggests that machines should be impermissible.

How is this hard?

[mikael_j]

I'm assuming that not everyone is as obsessed with the "paper trail" as some fanatics are (really, data is data whether it's on a paper or stored digitally, if your vote is anonymous it can still be tampered with).

Why not a basic e-ID system (we have several here in Sweden although the most popular is simply called BankID) which is used to login to the voting website/voting machine. When logged in you get to create a new username and password for the actual voting. Your real identity gets marked as "has an id" and the new account is completely disconnected from your regular identity, you can now use the new username+password to cast your vote. This system even opens up the possibility to change your vote before the end of the election period.

For all I know this could be the solution suggested in this video, I just couldn't be bothered watching a video right now, does anyone have a good transcript?

Re:How is this hard?

[CrimsonAvenger]

Why not a basic e-ID system (we have several here in Sweden although the most popular is simply called BankID) which is used to login to the voting website/voting machine. When logged in you get to create a new username and password for the actual voting. Your real identity gets marked as "has an id" and the new account is completely disconnected from your regular identity, you can now use the new username+password to cast your vote. This system even opens up the possibility to change your vote before the end of the election period.

And you can be coerced into providing said userid/password combo to someone who wants to either verify or change your vote to suit himself.

Re:How is this hard?

[mikael_j]

Well then, if that's a worry how about a similar system but only allow voting on-site?

Re:How is this hard?

[miserere nobis]

It isn't fanaticism at all. You overlook the fact that some data can be tampered with easily, and other data can be tampered with only through some difficulty. Consider a paper ballot, examined and deposited by the voter, locked in a box, and watched by various representatives of different interests. Compare that to an electronic ballot which may never even have been written to disk properly, or may have been erased and rewritten arbitrarily. The big key here is that one happens inside a black box where tampering is invisible to observers, the other happens in a way that is much more readily observable.

Good ideas but doesn't address ballot stuffing

[DomNF15]

I like all of the ideas he mentioned, from the uniqueness of each ballot, to the tear off receipt, to the shredding of the plaintext ballot "key". These are great for maintaining anonymity, but what about ballot stuffing? How do you prevent someone that's been dead for a couple months from "voting"? My polling place didn't ask for ID, just my name, I imagine that probably happens quite a bit...

Re:Good ideas but doesn't address ballot stuffing

[AltairDusk]

Mine didn't even look at my ID although I had it out and ready to hand to them. The actual voting process was very disappointing and somewhat disheartening to be honest.

Not completely 'secret'

[pirodude]

If you're removing the candidate list from the side you keep, that means that the barcode somehow has your specific ordering of candidates stored. While this may be encrypted, the computer has a way of knowing for that specific ballot, what each option is for, which means that someone, somewhere, has access to that key to be able to determine how to get the per ballot candidate ordering.

That key will be much easier to get access to than people think, and once you do, you've compromised the secrecy of the entire election. Walk into your local election clerk's office and see if they're the type of person who could safely store and maintain a vital electronic key.

Re:Not completely 'secret'

[roothog]

That key will be much easier to get access to than people think, and once you do, you've compromised the secrecy of the entire election. Walk into your local election clerk's office and see if they're the type of person who could safely store and maintain a vital electronic key.

If its implemented anything like existing systems, the key will be hardcoded into the application as a static data value.

Does the system use

[Compaqt]

md5 hashes and cookies?

Just askin...

Re:Does the system use

[Anonymous Coward]

I imagine it uses something such as DSA / FIPS 186-3

I don't trust it

[Anonymous Coward]

Fundemental flaw: you still have to trust the computer program is what it claims to be when it matches the ballots with the receipts.

Election fraud risk (in a mature democracy) is measured by the minimum number of people who are required to act in a corrupt way in order to get away with a mutation of the result. Paper ballots with scrutineers from opposing parties requires a massive degree of conspiracy in order to affect enough polling stations to swing the result. As soon as you trust a computer with the audit trail, you need only one corrupt person: a programmer who installs one program on the machines while providing a different version of the program to auditers. Even if you could trust the auditors get an untampered version of the machine to dismantle and are able to do so perfectly, you are still trusting that small audit team to be honest and never be replaced with a front group.

Re:I don't trust it

[electrostatic]

He said that the raw data from all ballots would be public along with the software. Any third party can verify the totals. And each voter can check that his/her vote is in the data. But I don't know how ballot stuffing is detected.

Implementations suck

[roothog]

Does it run Windows and save its votes in an Access database? Ideas are great, but even the best ideas are defeated by typical commercial implementations. Nobody in government cares enough about voting processes to allocate the money needed for anything better than lowest-bid development.

We need more than 2 or 3 choices

[digitaldc]

The problem isn't necessarily the voting machines, it is the choices of the candidates.
Why are we always forced to choose from the lesser of two evils under a broken electoral system in a broken government?
We need multiple candidates on a multiple choice ballot ranking your first, second and third choices using a secure system. This is needed due to recent voting scandals that arose at the very last minute.

Re:We need more than 2 or 3 choices

[theghost]

The problem with that is that we would have to rely on our two-party system to revamp the election process so that it weakened the two-party system.

If there's one thing both Democrats and Republicans can agree on it's that they don't want to make it easier for people other than Ds and Rs to get elected.

encode the results

[Shivetya]

My license has one of those complex bar codes on the back. Why not produce a receipt encoded with this value, the allow the voter in votes that are contested by the candidates to be able to return to a polling place and swipe the results to see that their vote was accepted? If like my voting place, no one but the voter is allowed at the booth except under very special circumstances. This of course would require making sure that the poll watchers only permit the owner of the strip to use it.

Even with such a system you can engineer abuses. I find that many stamping their feet over e-voting are those who stand a better chance of manipulating results if a paper system is used. Regardless of system employed, we also need a simple means to ensure people are who they say they are and they only vote once per election.

Still its good to see many people concerned with the privacy of their vote. Just remember your friends in union shops as some in Congress want to take away the secret ballot in union votes just for the purpose of intimidation.

Problem is voter intent

[PotatoHead]

When we use media, we capture the voter intent perfectly. There is a chain of trust between the voter intent, and the record of the vote, because that record only passes through the voter.

Making a mark on a piece of paper, voting by mail like we do in Oregon, is cost effective, and verifiable, and trustworthy. Recounts are possible too.

I know my intent was correctly recorded, and if there is a issue with the counting, we can all go into a room, and visibly verify every vote, getting a correct tally.

With a machine, it's a vote by proxy. We fail to record the voter intent, because the electronics only record what the machine thought the intent was, not the intent itself.

Because of this, no electronic system makes sense. I like counting them electronically, with scanners and such. We can audit that, verify, recount.

I don't like a touch screen, because we fail to actually capture the intent, only the machine record of what it thought the intent was.

Re:Problem is voter intent

[roothog]

When we use media, we capture the voter intent perfectly. There is a chain of trust between the voter intent, and the record of the vote, because that record only passes through the voter.

Making a mark on a piece of paper, voting by mail like we do in Oregon, is cost effective, and verifiable, and trustworthy. Recounts are possible too.

So your chain of trust includes the United States Postal Service? That's quite a leap of faith.

Re:Problem is voter intent

[Nkwe]

So your chain of trust includes the United States Postal Service? That's quite a leap of faith.

USPS dependence is not required. After I fill out my (Oregon) ballot, I drop it off at the elections office instead of mailing it. There are lots of official drop off locations - some of which are even "drive through" on election day. I do this not because I don't trust the postal service, I do it because I am I am opposed to the concept of paying (with a stamp) to vote. If you trust the USPS and you don't care about paying for a stamp, you can use the mail. It is your choice.

When you fill out you your paper ballot (which is a "fill in the bubble" machine readable thing), you put it in a "secrecy" envelope. The secrecy envelope is placed inside the "mailing" envelope that has your voter id and a signature line on it.

When the elections office receives your ballot they look up your voter id, visually verify your signature with your registration, and note that you have voted. Next they put the secrecy envelope containing your ballot into a ballot box for counting. Someone else who has not seen the outer envelope with your name on it, opens up the secrecy envelopes, extracts the ballots, and feeds them into the ballot scanner.

This system validate voters by signature, makes sure people don't vote more then once, provides anonymous voting, and supports recounts - both automated and manual. If you want to verify that your ballot was processed you can ask the elections office.

Re:Problem is voter intent

[Omnifarious]

You don't understand the technology. This is a technology that allows you better verification than any paper ballot can offer while still preserving anonymity. It's not vote by proxy. You get a receipt that you can use to prove to anybody that you voted, but can't be used to prove who you voted for. That proof comes in the pollbooth and while you can be confident enough in what happens there to know your vote was recorded correctly, the proof cannot be exported to outside the pollbooth to prove it to third parties.

It's a very neat system, and I was quite impressed when I participated in a demonstration. The only problem is that it does not handle write-in candidates very well.

Re:Problem is voter intent

[sycorob]

I like this explanation - it basically sums up why I like paper voting, not electronic voting. I'm a software developer with 10 years of experience, and I have no way of verifying what the voting machine is doing internally. With my paper ballot we can, in theory, recount the whole thing manually in front of cameras, and know what happened. I can explain this process to my grandmother, and she can understand it and participate in it. Using technology that is only comprehensible to a small number of people in society seems like the wrong approach.

I think a good compromise, since people seem so hell-bent on doing this, is a mixture of computer and paper. You can have computer kiosks, which have a lot of different languages, help for the sight-impaired, etc. You make your choices, and then it prints out a ballot for you. You take that ballot and drop it in the box. The machine can tally up votes quickly, but you can still audit specific machines, or do a full recount, etc.

Diebold gets paid - isn't that really the whole point?

Re:Problem is voter intent

[david_thornley]

Voting by mail breaks the privacy chain at the root.

What guarantees are there, in Oregon, that churches don't have prayer-and-ballot meetings, or that employers don't have a mass ballot break, or anything like that?

Here in Minnesota, I fill out my optically-read ballot in privacy. Nobody is allowed to watch over my shoulder. Then I feed it into the machine, and my vote gets counted. The neat thing is that, if a recount is needed (and state law prescribes one if the election is too close), the paper ballots are still there and can be counted.

Re:Problem is voter intent

[Anonymous Coward]

You're right, mail in systems are very good but no system is foolproof. Since you are distributing a lot of paper over a long period of time there are numerous opportunities to alter or intercept the ballots.Furthermore marks on paper can be ambiguous and subject to interpretation as in the Franken Minnesota Senate race. While this might sound impractical note that it is only close elections that are subject to tampering and unfortunately close elections only require a few votes to be misdirected or lost. On a positive note you can argue that either winning candidate in a close election was the choice of nearly half the voters. So instead of doing expensive recounts and investigations of close contests we should just flip a coin for essentially the same outcome. To put it another way we should treat statistically tied elections as if they were actually exactly tied.

Re:Problem is voter intent

[Radtoo]

You are right to be suspicious, but it boils down to this: Diebold and friends ignorantly or willfully manufacture bad machines. Properly being able to state voting intents and/or having an computer assisted (or -based) vote is not an innately unachievable thing - in fact we already knew how to do better than Diebold and friends for 25+ years now. That is because there has been a lot of published academic research into that specific problem...

We also know paper-based voting is not very good anymore in terms of anonymity / privacy, protection against injection or miscounting of votes, protection against the forging or issuing of false/additional eligibility tokens etc.

Basically, what we need is an open source e-voting system that is up to par with the 25+ years of serious academic research that has been going on internationally, then we will most definitely have a system that is better than paper-based voting. We cannot, however, accept anything less than that, it will indeed be less secure than paper-based voting.

Re:Problem is voter intent

[nedlohs]

It's not perfect, people do occassionaly check the wrong box or unintentionally invalidate their ballot. But I suspect at a lower rate than people make similar mistakes with touch screens or that mechanical hole punchers fail to punch the hole...

Plus we can just label those people "idiots" whereas when a machine is involved the problem might be on its end.

I see no no need to electronic counting either... Counting ballots is not exactly difficult. But I'm obviously a luddite.

Re:Problem is voter intent

[sakshale]

And what is to prevent Big Daddy from sitting on your head, while reviewing your votes, to ensure that you give all the right answers. After all, Big Daddy doesn't want you to hurt yourself by voting for the wrong people. He'll even escort you to the polling place, to ensure that no one bothers you. Big Daddy cares deeply for you ... and your vote.

Re:Problem is voter intent

[PotatoHead]

Doesn't happen.

If that's the worst problem we have, I'll take it. Oregon and Washington doesn't have that issue at all.

What is worse is clogged lines, reboots, challengers, intimidation, and movement of polling places, too few polling places, and I could go on and on.

VBM is efficient, high turn out, voters can help one another, there is time to consider the issues, and the "election" happens over a period of about two weeks, distributing all that activity nicely in time and space.

It's very hard to abuse, largely because it's very well distributed.

Re:Problem is voter intent

[PotatoHead]

You have no idea how seriously they take that job.

Also, any voter can return their ballot to a supervised drop site, and or return it directly to the elections division in their county.

They can also ask to know their vote was received as well.

Re:Problem is voter intent

[PotatoHead]

I would manually count as well, but we've got a good split in VBM.

Optical scan + statistical audits + mandatory hand counts when it's close.

There is a lot of time to do a ballot. Almost two weeks! People can get help, double check their ballot, etc...

Re:Problem is voter intent

[PotatoHead]

And it is not needed.

"neat" is a lot of fun, and cool, and geeky, but this is basic civics. We don't need electronics to vote efficiently, and in a trust worthy way.

Where is the value add? Have more fun voting? Increase turnout?

Well, VBM does that, and it's cheap, it's auditable, and most importantly, the record of the vote can be verified against the intent of the vote by the voter, with no enabling technology required.

That is provably not true for any electronic system, because it must interpret the intent of the voter, and as such, is a active participant that forces the voter to trust it.

We don't need that burden in the system to get our civics done.

Re:Problem is voter intent

[Omnifarious]

I have absolutely no trust whatsoever that my mail in ballot is ever counted. Nobody can prove to me that it is. I think paper is untrustworthy.

Re:Problem is voter intent

[PotatoHead]

Well, you live in a place where that trust is denied to you. That's not a technical problem. It is a social / civics problem you've got there.

Where I live, we value voting, and we've taken steps to insure that all the core attributes of a trustworthy election are in place and operating, and that the public can be secure in how it all works.

Lots of people share your concern, and on the current electronics, that's a very healthy concern. Same for States that have very aggressive caging operations going on, challenges, etc...

Selling / building technology to address social and legal problems is a double edge sword. Where I live, we dealt with the civics, and have few to no issues, and can fully recount visually, with peer review, if necessary.

I like that solution, because it keeps the people in control of things, and it doesn't advance the "code as law" idea in a material way.

Doing things like this electronically does. What happens when the law varies, and the machines do not, or more importantly, the machines being pervasive challenges the law, or simply ignore it, doing their own thing?

Can happen with things other than votes you know. Do we really want that?

I don't.

Re:Problem is voter intent

[Anonymous Coward]

No, the problem is you don't like technology and would rather vote by rubbing two sticks together.

When we use media, we capture the voter intent perfectly"

Completely false. Just look at the physical ballots where voters were supposed to draw a line between two boxes that corresponded to the candidate they wanted. The boxes were too close together so some people connected the boxes to the side of their candidate and others connected the boxes below their candidate. The media is only as good as the system that it is designed around it which would also be true about any electronic voting system.

I know my intent was correctly recorded

How do you know? How do you know your vote wasn't lost in the mail or put in a box and stuffed in a corner and never counted? Were you there when your vote was added to the official tally? Did you personally do the recount?

we can all go into a room and visibly verify every vote

That's a pretty big room to fit all of the registered voters in the state of Oregon.

... we fail to actually capture the intent, only the machine record of what it thought the intent was

So machine record of intent is no good for voting but is fine for signing legal documents, buying/selling investments, paying bills, registering your car, etc?

All you are doing is comparing the virtues of paper ballots with the disadvantages of electronic voting.

You cannot sell your vote

[ElitistWhiner]

Transparency ensures that a voter can prove his vote, thus sell it!

As an aside...

[tygerstripes]

Wouldn't it be nice if people WERE encouraged to post their vote-receipts to prove that they've voted? Not if it shows who their chosen candidate was, of course, but just a token to demonstrate that they've taken part in the electoral process and thus bucked the trend of political apathy.

Seems to me that harnessing that peer-pressure to encourage people to take an active interest would be very beneficial to the democratic process.

As long as we can trust it, of course...

Re:As an aside...

[Rich0]

Frankly, my feeling is that the only thing worse than people too apathetic to vote are people who are too apathetic to research issues and then they vote anyway.

If somebody can't be bothered to vote, then then last thing I want is for them to pull some lever just to be more popular.

Erhhh.......

[Anonymous Coward]

So this brilliant system allows me to go online and verify that I voted for "option number 3" Which could be anything, since I cannot verify what my candidate list order was. So to manipulate the votes the counteres simply rearrange the candidate listings of all voters to make Sara Palin the president, and there is no way of proving it, since noone other then the counters have access to the candidate list orders.

There is no way to make it verifiable that you voted X, while making it impossible to prove you voted X. We simply can't have it both ways. I would sooner trust that the counting of the votes was done correctly then trust every single american didn't sell their vote to the highest bidder.

Shredding candidate list

[ewanm89]

What is the point of detaching and shredding the list of candidates part of the form in his method? Surely the 2D barcode must have this information of what box is what candidate. Just means counting by hand would now be impossible as one would have to decode the 2D barcode. I guess it's so the ballot worker doing the scanning doesn't see it. But the scanner is a computer and can decode the barcode by definition.

No candidate list, no proof of vote

[alexwcovington]

Removing the candidate list seems like an dangerous complication to the system. The system can verify that a ballot was collected, but there is no possibility to correct a ballot that was miscounted.

Once removed, voters cannot verify for themselves who they marked their ballot for. On the counting side, it allows for fraud simply by changing the correspondences.

Also, if someone cracks the servers, they could replace or delete every ballot in the country, causing detectable but widespread chaos as every ballot would have to be rescanned.

seems a lot like punchscan/scantegrity

[hopeless case]

This sounds a lot like the punchscan voting system. I am at work and not able to see the video right now, but I googled bismark and found this article, which has some details.

Punchscan and its variants do allow you to be able to prove to yourself (with a 50% probability) that your vote was counted as you intended. That might not sound like much comfort (only 50%?), but if the election authority tries to change 2 votes, their probability of getting away with it falls to 1/4, then to 1/8 with 3 votes, and so on. So stealing more than one or two votes becomes infesible pretty quickly.

However, I do believe that in all such schemes, the possibility of large scale vote buying becomes a real threat that has to be managed carefully, since the election authority has the keys that allows the all the ballots to be decoded. So if the Election Authority shares the keys with, say, the autoworkers union, or with GM, then those orgs would be in a position to decrypt the votes and thus coerce their voters. Of course, large scale intimidation of that type would be hard to hide from investigators. For this and other reasons, I think the threat of large scale vote buying is managable, and well worth the accuracy and accountability these systems provide.

The 2 key ideas that makes these schemes work are "cryptographic commitment" and the "cut and choose" protocol. If you are insterested, I've written up a detailed explanation of these concepts, and how punchscan like systems work, here.

Interesting, but flawed

[Chelloveck]

I think the method presented in the video is fundamentally flawed. The presenter claims that, given just your receipt, no one can determine how you voted. But that's obviously false -- SOMEONE, somewhere, must have the cryptographic key that can correlate an 'X' in the third box down on your individual ballot as a vote for John Smith. Otherwise there's no way for your vote to be counted.

The presenter goes on to claim that third-parties (news media, international observers, etc.) can take the scanned ballots and count them independently. To do so, they must have access to the crypto key, just like the official ballot-counters. Now you have potentially many people with access to the key. The key will undoubtedly be leaked. Once it's out there, anyone with physical access to my receipt can see how I voted.

Re:Interesting, but flawed

[1 a bee]

That would be a fundamental flaw, but I doubt it's like you describe it. I don't think you'd be able count the individual ballots yourself: you'd only be able to verify that the declared aggregate count is indeed correct.

Re:Interesting, but flawed

[Chelloveck]

But someone has to be able to count the vote. As described in the video, the only part of the ballot that's scanned at the polling place is the part that has the check boxes and the bar code. The bit with the names is shredded before scanning.

Therefore, the part with the check boxes and bar code must contain enough information (if you can decrypt the bar code) to identify the vote. As I pointed out earlier, the video said that third parties (news media, international observers, etc.) will be able to take the scanned ballots and do their own counts. If they're going to count them, it follows that they have to be able to decrypt them.

This leaves the crypto key wide open. Too many people have access to it. Someone will leak (or sell) the key. Now, your receipt is the paper ballot. The very same ballot that was scanned to be counted. Once the key is made public, then anyone can decrypt your vote. Your abusive spouse, the corrupt union leader, or the local mob boss. Your vote is verifiable, and you can be pressured or bribed into voting a certain way.

If there's a solution to this problem it certainly wasn't presented in the video. And I don't think it's even logically possible, given that you take the very same ballot that was scanned to be counted as your receipt. There's no way around it, that slip must contain enough information to determine your vote. After all, it is what was counted.

Re:Interesting, but flawed

[1 a bee]

Right. The video didn't explain how this cryptography works. I'm no expert in this area, but I imagine this might work something like this.

Suppose one can devise a crypto scheme in which you need all of the ballots to compute the sum of the choices cast (uncast ballots get a special null value). So to boil it down to the simplest possible example, if there are only 2 choices a and b, and only 2 ballots cast, then sum routine allows us to compute which of the following 3 outcomes occurred: (2, 0), (1, 1), or (0, 2). For the middle outcome (1, 1), we cannot tell which ballot cast which vote..

I can see holes in the strategy I describe, but I bet these cryptographers have devised something cleverer that stands up to the kinds of attack discussed here.

Great, but will it ever be used?

[FridayBob]

Over the years I've hear of various ways in which the democratic process can be improved. I saw this TED talk last night and it certainly looks interesting; if it can make the proceedings so much more transparent, let's set up a trial somewhere and see how it goes. Personally, I'd like to see it combined with instant-runoff voting; a system that has seen only limited implementation despite its advantages. Yet, I wonder if I will ever encounter these concepts in practice.

I find it disappointing that, all over the world, older democracies seem to be deeply conservative about their voting processes, resisting change even when the flaws in their systems are obvious and better solutions are available. We are quick to criticize the voting processes of emerging democracies, but resist doing anything when the problems are closer to home.

Poor voting practices at home also have a knock-on effect: why, for example, should the Afghans improve their voting system when we can't be bothered to improve ours? By saying one thing and doing another, we send the message that it's really not that important to be so respectful of the voting process. In such cases, we have no right to be so proud of our democracies.

Re:Great, but will it ever be used?

[miserere nobis]

The problem is that instant runoff voting actually has no advantages, it only appears to have them. We are better off with any of several other alternative voting systems. Right now I'm leaning toward range voting, for several reasons including the fact that it is extremely simple and can be tallied by hand easily.

Obligatory wikipedia link

[vojtech]

http://en.wikipedia.org/wiki/End-to-end_auditable_voting_systems I think the system described in the TED talk is the Prêt à Voter system.

actually, this is pret-a-voter

[hopeless case]

I found a link to David Bismark's home page here. He is explaining how Pret a Voter works. This is related to the punchscan system, although it works by randomizing the order of the candidate list instead of introducing an indirection symbol like punchscan does.

Odd that the wired article would not give credit where it is due and mention Pret-a-Voter.

BTW, everyone, this is not an electronic voting system, even though it is uses computers if various ways, it is an optical scan paper ballot system.

Epic fail

[dskoll]

Another epic fail. When will academics learn that e-voting simply makes fraud easier and less detectable, no matter how good the math is?

When will academics learn that a voting system the average voter can't understand is a system the average voter can't trust?

Cart before the horse

[goombah99]

The primary requirement for voting is that convinces the losers they lost fairly. Technology impedes that objective and Cryptography that no one understands denies it entirely. Transparent observation that people with high school educations can appreciate. Things that decentralize rather than centralize control are valuable too since it makes cheating a retail operation not a wholesale operation. cryptography centralizes things. someone controls the keys.

All other desired features pale in comparison to transparency and anonymity. Don't lard them on.

Thesis conference on the subject

[Anonymous Coward]

I recently went to a thesis conference upon this very subject (e-vote protocols).

Not that I really understood the entire speech, but I do remember the conclusion being that such mechanisms will never be absolutly secure.

Got a link for the few french-reading IT-security-unterstanding guys interested.

Ahh, voting...

[abnoctos]

Perhaps the most important element in maintaining relevant citizenship and participatory democracy; however, apparently not important enough to summon people to count votes (like jury duty) or even have "officials" manually count all votes with observation, oversight, and verification. I love techno gadgetry and innovative doodads - but when it comes to voting on what our government does and how it acts I go Luddite. I mean paper and pencil on a form simple - not even "scantron" bubbles. Illiterate or otherwise unable to cast a ballot with paper and pencil? Issue your votes to two election officials or come up with some better idea. Every vote ought to be manually counted in the presence of officials with double verification. People volunteer for this kind of thing - hell, even if it costs thousands of dollars for the full day of counting (likely less, done by precinct) it seems like a small price to pay to keep the potential for corruption out of our political institutions (or this area of them at least). Even computer scanned bubble ballots could be (relatively) easily manipulated in the posted results. Simply keep the margin out of the range that triggers manual recounts and there are not legal grounds for reviewing the archival hardcopies. Why risk it?

Re:Recount

[presidenteloco]

I'd just like to point out that "recount" is a procedure designed to correct for inaccuracies in human-counted
elections.

The concept of recount does not make sense for a computer-counted vote. A recount would get the same
result every time, or something is REALLY wrong.

The equivalent of "recount" (purpose-wise) for a computerized election is:
        Code and process review + security(privacy & integrity) analysis + Random ballot receipt audit

Too many systems are compromised

[sco08y]

Maybe this is covered in the video, but it's a small miracle that I can get a connection out here at all...

But the reality is that most people's systems are compromised already. If we have online voting, the same guys that set up botnets with thousands of systems will have a field day stealing votes.

I don't see how you can do voting online as long as so many clients are hopelessly compromised.

Foolish

[bussdriver]

Voting systems need to be understandable by the voter. This means KEEP IT SIMPLE, STUPID. A computer expert should not be involved.
A counting machine based on PAPER can be physically verified and observed by anybody who can COUNT including the interested parties so all are confident of the result. Even a closed corrupt count could come to light if the paper record is preserved. A counting machine can be ignored during a recount; if there is nothing to count then there is no recount and even less deterrent since one can't validate the results. One can't even know if the machine is hacked while a counting machine can be compared against a paper count.

You have to be ignorant OR foolish to think that ANY computer system is better than a paper one under the same conditions. A totally open computer system can be hacked and all traces removed - you do realize that linux still gets patched for security holes right? A hacked compiler or linker can produce bad programs despite clean code. Foreign made hardware components are also suspect (doesn't he NSA have a chip fab plant of their own?) It would take multiple experts just to verify machine at 1 point in time; even then could easily miss a clever attack or a serious security hole. That is barring any tampering after 100% verification (which would only be in theory because you can't get to 100% just like you can't ever be 100% sure a program is bug free.)

The hanging chad problem was over hyped but it is a great example of a solution for a non-problem that complicated the paper system thereby creating a security flaw. It should be obvious that a simple system everybody could see was flawed took so long to be killed off was a problem and now we have people asking about a much much much more complex system and one which only a specialized few could identify flaws?? It defies reason.

Of course, its a somewhat moot issue since the system favors 2 parties which are for sale so any games between the zealots are just a distraction from the larger gaming of the public by the powerful.

problems inherent to the medium

[miserere nobis]

1. In order for democracy to be stable and people to maintain trust in their government, they must be able to see that their votes do count. Electronic voting unavoidably violates this very important principle, because it makes the mechanism of voting completely opaque to almost everybody. A person can see a piece of paper, and people can watch all the pieces go into a box, and verify the box was empty beforehand, and confirm the number of ballots equals the number of voters, and count every piece of paper in front of all interested citizens. A person cannot see electronic impulses or magnetic encodings, nor observe counting or validation algorithms in action (much less raw disk drivers, magnetic heads, error-correction algorithms, and so on). This means the machinery of democracy is enclosed in a black box.

This is opposite the principles of democracy, and it has nothing to do with procedure, nor with particular algorithms, it has to do with the entire idea of sticking the mechanisms of voting inside an unobservable space. Even with the best possible such system, the whole thing relies on the faith of the people that what is going on is in fact what they have been told. It takes voting disputes out of the realm of opening up locked boxes on camera in front of people from different parties, something all can watch and understand, and puts it in the realm of whether you believe the claims of a few reputed experts against the word of others who claim to also be experts. And even if you think you are one of those elite, stop and think about whether A) you have the means to prove whether there were forged microprocessors in the voting computer, or even that the software actually running was the software whose source code you might have examined; and B) the public trust in democracy being based on faith in the word of a few elite is ever a good idea.

2. A voting system which can be tampered with is bad for democracy. But a voting system where tampering across all districts can be centralized is horrible. To alter the outcome of a paper ballot election over a whole state, people would have to physically visit potentially hundreds or thousands of voting locations. That is a very risky action, and the greater the geographical extent of tampering, the greater the chances of detection. An electronic election, on the other hand, has multiple centralized attack points. Changing the source code, the processor supply, the central vote database (depending on how the system works), building in hidden back doors, all of these are actions that could be done by a single person in a single place. It is much better to risk more small-scale fraud, none of which can get very widespread without being likely to be detected, than to design things in such a way as to allow the entire system to be compromised all at once in a single incident that may or may not be detected.

Computers are wonderful tools. And we computer people use them like hammers, which is to say that we make everything look like a nail. But the beauty of some imaginably potential unbreakable, verifiable, cryptographically strong, instantly tallied system blinds us to the fact that the whole notion of hiding democracy inside computers is a bad idea in the first place. Computerizing voting is like using a microwave oven to warm up your baby. It is simply a tool that is incompatible with the task, regardless of whatever efficiency it may gain and effort it may save.

I'd like my receipt please.

[neo]

Voting needs to give you a receipt. That receipt would have a hash encoded number that you could then compare to a publicly available vote count and verify that your vote was counted correctly. As simple as a .gov website with SSL that allows me to either download the entire data count or to enter a hash key and see the resulting voting.

It seems ridiculously simple to me. You can verify your own vote and tally all the votes yourself to ensure that the totals are accurate.

Re:I'd like my receipt please.

[MyFirstNameIsPaul]

I have a similar idea, except I wouldn't allow people to look up how they voted individually. Maybe someone somewhere is tracking IP addresses and page views. Just put up like 500,000 block votes in simple text documents, which usually open up in-browser and do a find on page for your number. Obviously the page would have to be devoid of java key-loggers, or whatever those are called. The 'hash' could be as simple as randomly generated numbers on ballots, which here in California already don't have any names on them, and the ballots just have a simple perforated tear-off with the serial number on it.

Individual auditing I think would revolutionize voting, hence the near complete lack of public discourse on the topic.

atms?

[gbelteshazzar]

The absolute must of an e-voting machine is a hard copy version that can be latter verified. Essentially I would have thought that the voter enters their vote, the machine electronically records the vote and the paper vote is verified by the voter before being lodged along with teh electronic version. Voters dont need receipts, infact that can cause problems with coersion. A voter must go in with nothing and come out with nothing but be assured that their vote is recorded correctly. you can never fully trust an electronic e-voting system without a hard copy verification system. But at the end of the day the e-voting system just allows the votes to be tallied quickly, the hard copy would still need to be counted to provide a check and balance. I was thinking the other day that we already have a distributed system that people trust to record vital transactions, the banking Atm system. Why not turn ATM's into voting booths by giving all voters an anonymous voting "bank card".

KISS..

[Lanteran]

Seriously; what they need to do if they want to stop voter fraud and corruption (which they don't- its how they get into office, but this is if they did) they would just make the machines extremely simple single purpose hardware. What's it take to record a value (Say 0 for GOP, 1 for Dem, 2 for libertarian etc.) and send it in to be counted? Not much; barley anything. Hell, I could probably build one keeping the price in the double digits with parts from radioshack (though maybe I'm overestimating my abilities).
Reminds me of these xkcds a bit:http://xkcd.com/801/ http://xkcd.com/463/

I understand it perfectly.

[PotatoHead]

That system does not directly record voter intent.

When we make a physical record, we do record voter intent, because the chain of trust from the intent of the voter, through to the actual vote record is intact.

With a machine --any machine, it's not. There is absolutely no way for the voter to know their vote intent is reflected in the record of their vote. It is a vote by proxy.

Re:I understand it perfectly.

[Omnifarious]

In this system each person can go look at a big published list of all the votes and see that their vote is indeed on the list. The person can see that indeed all the votes add up to be a particular value. The person can ask one of a few authorities, each with opposing interests, to decrypt that value and show them the resulting vote totals.

I don't understand how you can get any more verifiable than that. In my opinion, this is even better than paper because with paper nobody can tell their vote was counted. It all goes in a big box, and a lot of things can happen to their piece of paper in that box before it ever sees the light of day again.

Re:I understand it perfectly.

[PotatoHead]

Doesn't all that checking significantly reduce the value proposition?

Seems to me, we are much better off using our people and simple tech to do our civics.

I don't see where this actually solves a problem.

Will people actually check?

Actually, with the paper system, we do know the votes are counted. We use simple audits to know the counting is correct, and if we do need to actually recount, or put those votes in a court of law, the actual action of the voter, and thus their intent is there, human readable, without the need for expensive enabling technology.

I do think it's a interesting solution, I just don't see where we've got a problem with the civics that requires it, or where it's value exceeds that of simple, common sense methods.

One thing about using paper to record the vote intent is civics scale. For any population, we've got enough elderly and unemployed people to perform that duty, and why not have them do it? It is, after all, their election, where everything should be transparent.

In fact, a trustworthy election needs to embody all four of these to the maximum extent possible:

Transparent -- The record of the vote can be seen and followed from record made by voter through to the tally. Where we have enabling technology, we have a loss of transparency. A lot of this solution is selling the position of forced trust we place on the voter, due to the record of the vote not being a enduring thing.

Oversight -- It must be possible for ordinary people to understand the entire process from vote cast to tally, and this depends on transparency. VBM is really easy. Computer assisted printed votes, can roll this way too.

Freedom -- One must be free to vote, or not, as we feel fit.

Anonymity -- The record of the vote must not be identified or linked to the voter. Good, robust paper systems, like VBM, allow authentication via signature, or something, then seperate that from the ballots so cast.

Interesting solution though. I think it's a comp-sci type challenge that's worth the effort, but I don't see the core value proposition of it being a net savings that is compelling enough to bother otherwise.

At some point, doing our civics requires a bit of time and effort, and that actually raises the value of the civics in a healthy way.

Much better, IMHO, to do that using people, and a simple, clear, enduring record of the voter intent, not requiring expensive enabling technology to vet, tally, and be present in a court of law.

This removes secrecy

[Anonymous Coward]

With traditional paper ballots, the vote is unencrypted but there is no easy way to track a ballot back to a voter. With this system, your ballot is linked to your ID. Your vote is encrypted but must be decryptable for the counting machine, and thus for government. Fail.

Scratch & Vote

[Anonymous Coward]

this looks a lot like a system proposed by Ben Adida in 2006 called Scratch & Vote.
http://www.youtube.com/watch?v=ZDnShu5V99s