An Anonymous, Verifiable E-Voting Tech

Kilrah_il writes "After the recent news items about the obstacles facing E-voting systems, many of us feel it is not yet time for this technology. A recent TED talk by David Bismark unveiled a proposal for a new E-voting technology that is both anonymous and verifiable. I am not a cryptography expert, but it does seem interesting and possibly doable."

Comments

how much does it cost?

[alen]

and how much better is it than marking a circle with a pen and having someone scan the ballot into a machine? most of the issues with e-voting have been that people are too dumb to see what they are doing

Re:how much does it cost?

[jcrb]

Agreed, E-voting is the classic solution in search of a problem.

Re:how much does it cost?

[Anonymous Coward]

Problem: Politicians who desire the ability to freely pillage and back-stab the population have to worry about winning elections.
Solution: E-voting.

Re:how much does it cost?

[Confuse Ed]

and how much better is it than marking a circle with a pen and having someone scan the ballot into a machine?

In an ideal system, anybody should be able to independantly verify the following (which currently can't be done in a simple paper based ballot)

• was _my_ vote counted correctly for the candidate I selected (or not counted if I chose not to participate)
• Are all the votes that have been counted attributable to real voters
• has each person voted either 0 or 1 times

Unfortunately I can't RTFA to see how many of these ideals the proposed system achieves, as it seems to be a video rather than a text based article.

Re:how much does it cost?

[Imagix]

Have you ever been an election official? Marking a circle is a challenge to people as well.

Re:how much does it cost?

[KarrdeSW]

Problem: Election workers don't feel like counting paper ballots by hand or feeding them one at a time through a scanner.
Solution: E-voting. I'll just print off an Excel report.

FTFY

The people who write and distribute RFPs for electronic voting systems are generally not interested in the outcome of the election, they are just a worker drone trying to utilize technology to make their job a bit more glamorous than counting papers.

Re:how much does it cost?

[onionman]

Agreed, E-voting is the classic solution in search of a problem.

Unless you have a disability, in which case it is the classic "solution to a problem".

Where I went to vote, anyone who wished had the option of bringing an assistant. I recall doing this for my grandmother when her health was failing. She couldn't see well enough to read the ballot much less fill in a circle. So, I would read the ballot to her, and she would tell me what to mark.

I'm all for throwing money at math and CS (it keeps me employed), but I still think that E-voting is unnecessary. Just use paper. With paper, the ballots can be recounted in front of a group of representative for each side whenever there is a dispute. It's simple and crystal clear to the vast majority of voters. The only disadvantage is that it's slow, but so what? Voting is important, we can afford to slow down a little and do it carefully.

Re:how much does it cost?

[Jeremy Erwin]

The only disadvantage is that it's slow, but so what? Voting is important, we can afford to slow down a little and do it carefully.

Somehow, Al Franken managed to be 7 or 8 months late on his first day of work, all because of delays in paperwork.

Re:how much does it cost?

[beamin]

I worked yesterday at the polls in New York. We had ImageCast paper-ballot optical-scan machines from Sequoia with ballot-marking devices attached for disabled voters. These gave all voters the ability to mark ballots privately.

http://www.vote-ny.com/english/machine-sequoia.php

Re:how much does it cost?

[AigariusDebian]

Let's see:
* disabled people of all kinds,
* sick, old and just tired people who want to vote from home instead of driving for half an hour and then standing in line for an hour
* travelers who want to vote from wherever in the world they are
* young people who don't like boring old voting stuff

In almost all of these cases in the US e-voting favors Democrats - young, educated, lazy, traveling. That is the reason there is a subversive trend to undermine it by creating very, very badly misdesigned e-voting machines.

Now if your country does not have that problem, you might be like Estonia - every citizen gets an ID card with a proper PGP-ish electronic signature in it and he can vote on a web site using that signature either in a voting booth or at home and later verify his vote with a hash on a tally. And that has been fully working for two elections already with no problems.

Root problem

[Toe, The]

Better voting systems still won't fix the root issue: the people who get elected into power are corrupted by that power.

Metagovernment isn't perfect, and it will take a long time to get up and running, but... how does it compare to what we have now, where votes are sold to the highest bidder, idiots are in charge, and our participation is limited to 30 seconds in a booth every two years?

Re:Root problem

[hrvatska]

The problem isn't the idiots in charge, it's the idiot voters who elect them in the first place. The government in the US is the result of the contradictory demands of a highly polarized and frequently badly misinformed electorate.

Re:Root problem

[DJ Jones]

The problem with this metagovernment system you reference is that the average person does not adequately understand our legal code well enough. This is the reason America is more of a republic. It was thought that electing "elite" officials who have our interests at heart but more direct knowledge of law would make better law makers.

If you live in state that allows referendums this concept becomes very apparent. I consider myself a well informed, educated individual. I've taken many business law classes and I write my own business contracts yet I still struggle to understand some of the legal code in the New Jersey referendums I've read. Even the dumbed-down translation they provide can be confusing to the average person.

Re:Root problem

[Toe, The]

Your critique is entirely correct, and is very much taken into account by the Metagovernment project.

"The voter doesn't understand the legal code."
1. People don't have to participate in every decision, just the ones they care about and understand.
2. Since Metagovernment is a ground-up re-do of governance, it is a re-do of legal code as well. It is not intended to replace the US federal government just yet, but rather small communities' governance. Over time, people will get a better understanding of how to participate in large-scale governance as the system evolves.

"It was thought that electing "elite" officials who have our interests at heart but more direct knowledge of law would make better law makers."
1. This amounts to saying that we need to be protected from ourselves by a superior class of overlords. Do you really want to admit that is the best we can ever do?
2. These elites demonstrate again and again that they are just as idiotic as everyone else.
3. People don't get involved in issues because in the end their voice is ineffectual. If people can actually make a direct difference, they will have an entirely different incentive to learn and delve into issues.

"If you live in state that allows referendums this concept becomes very apparent."
1. Referendums are majority-rule decisions, while collaborative governance usually works on a consensus model.
2. Referendums are only on a few hot-button topics, meaning they lead to demagoguery. Having a "referendum" on every topic all the time would be completely different.
3. The authors of referendums are individual politicians or more frequently lobbyists. They are often written to be confusing or overly-simplified. Collaborative governance inherently means people write the laws together. Further, it pushes the process toward synthesis. Check out the amazing innovation in Vilfredo, for example.

All of this and more is on the Metagovernment site. It just takes some thinkin' to wrap your head around it.

Problems with Verifiable Voting

[Rich0]

I read the article - all zero words of it - so perhaps the multimedia component of it addressed this concern, but I find it hard to imagine how:

If I can verify that my vote was counted, and can prove how I voted if there was a fraud to force a recount/etc, how does the system make it impossible for me to prove to my boss/spouse/friends/church/etc how I voted?

The problem with receipts is that if you can prove how you voted, then you can punish people for not voting the right way. All an abusive husband has to do is tell her wife to show up with a receipt showing the correct votes or they'll be beaten. You can make the receipt private, but an abusive husband/wife/parent/boss/etc will just tell people to turn them over or they'll be punished.

The effects of this kind of thing can be very subtle. People will change their voting patterns even if they think they MIGHT be asked to show that receipt. Maybe everybody in their union or church or whatever voluntarily posts their receipts as a show of solidarity, and who wants to then be the one person who doesn't join in?

If a voting system is well-designed it should not be possible for anybody to prove how they voted. Other controls should be used to ensure all votes are counted.

Re:Problems with Verifiable Voting

[DeKO]

You do know that TED Talks consist of people going in front of other people and cameras, and talking, right? So perhaps the substance is indeed in the video.

The guy actually presents a very simple way to verify your vote was correctly registered, without ever revealing who you voted for. The secret is to remove the candidate names (by shredding that part of the ballot), scanning your vote into the system, and taking home the receipt, which contains no names. Only the system knows which is which. You can later use your receipt's code to see if it registered your vote properly (because it will match your receipt), but there is no way to know which candidate actually received that vote. It actually solves the problem of verification without compromising privacy.

another requirement

[a2wflc]

You must NOT be able to prove your vote was counted correctly for a specific candidate. That leads to bribes/threats (i.e. your boss can ask to see the proof. if you want to assume that's illegal, think of all the other people who may "ask" to see it or offer something if you volunteer)

There are ways to do this and meet your requirements, but there is more to it than the 3 you listed.

Re:another requirement

[AigariusDebian]

Sure it is possible: after the voter has voted, he gets a receipt with a random number X on it, after the elections there is a tally sheet with a list of votes which basically says 'number X voted for candidate A'. From that tally anyone can count how many votes A got and check that their own vote was counted correctly. For plausible deniability after his vote, the voter can ask the ballot machine to print another hash receipt - a random hash receipt that would show up on the tally as voting for the candidate B (that the voter was payed to vote for) so that he can show that receipt to briber. Naturally before starting an election there would need to be a pool of hashes for all candidates - a set of fake initial votes, equal for all candidates so that there is a set of hashes to choose from if the first voter asks for a fake hash printout.

His idea seemed bad to me

[gurps_npc]

It was simply a variation of the paper receipt to prove that you vote. Or maybe he just explained it poorly. As far as I can tell from his description, you can prove tell that you voted, but you can't tell WHO your vote was for.

Besides, it's not that hard to create a paper ballot system that is secret and fair, but uses computers to speed the creation and counting.

Step 1. Have a printer kiosk that lets you select who you vote for electronically. It also shows 3 colors/icons/etc. You select a color/icon when you vote.

Step 2. The kiosk then prints out TWO identical bar coded paper receipts that does not have anything but numbers on it.

Step 3. Take bar coded paper receipt to second machine, called a reader.

Step 4. Feed one (either one) into the reader. That reader displays who you voted for, you can confirm or deny. Assuming you confirm, it keeps the one recepit and you keep your own. If you deny, it spits out the bad receipt, and you are legally required to shred both before you try again.

Step 5. To confirm your vote, you log on to a database, look for your recepit number and enter the color/icon you remembered. If you enter the wrong one, it displays a false vote without reveleaing that you entered the wrong color/icon.

Net result is that you and only you know who you voted for, and you can verify that your vote was counted.

Re:His idea seemed bad to me

[lras]

Net result is that you and only you know who you voted for, and you can verify that your vote was counted.

Sorry for being dense, but how does that verify that my vote is affecting the the announced result of the election? Couldn't they just announce "X got 60% of the votes" anyway? (By jamming in a lot of false ballots, or by just lying?)

Re:Poor backwards Indiana

[fringd]

that sounds pretty good, but i think this crypto-thing would be better. people are working hard on the crypt to solve real problems

what you describe is pretty good, as it tries to fix problems with throwing the paper votes, but this improves on that a bit.

it's features include
* at the end i can check that my vote is in the published database of votes, which newspapers, etc can verify is added right.
* I cannot prove to anybody else who i voted for (so they can't strong-arm me)
* officials can not throw the votes in the trash, or a river, or bury them, or delete them... if the votes aren't in the published database people will see that their vote is missing.
* they can not scan the votes, keep them in the database, but add it up wrong and publish a wrong total, and then throw the records out. if they add it up wrong newspapers, universities, or any old slashdotter can do the adding themselves and call bullshit.

Re:Forget cost - what is the POINT?

[Quantus347]

Do the words "Hanging Chad" mean anything to you? Paper voting has as many problems as E-voting, and as much potential for massive screw-ups. If there were a system that was actually secure, e-voting would be great. Unfortunately, the systems out there are all closed system "black box" deals where the manufacturer refuses to reveal any of the internal workings. Because of that the only people who actually know are the hackers using them to fix elections. If they were open, and thus subjected to rigorous enough testing to consider secure and reliable, we'd be golden.

Besides, you shouldn't really assume that the machine that electronically reads your paper ballad and transmits the results are any more secure/reliable as the purely electronic solution.

Re:One of the reasons - fragile democracies

[Amouth]

what we need is a way of making the ones who don't vote - who don't give a shit - who have zero political affiliation - the ones that handle and count the votes..

Sorry but i do have issues when the people who count the votes have a political affiliation.

Problem is voter intent

[PotatoHead]

When we use media, we capture the voter intent perfectly. There is a chain of trust between the voter intent, and the record of the vote, because that record only passes through the voter.

Making a mark on a piece of paper, voting by mail like we do in Oregon, is cost effective, and verifiable, and trustworthy. Recounts are possible too.

I know my intent was correctly recorded, and if there is a issue with the counting, we can all go into a room, and visibly verify every vote, getting a correct tally.

With a machine, it's a vote by proxy. We fail to record the voter intent, because the electronics only record what the machine thought the intent was, not the intent itself.

Because of this, no electronic system makes sense. I like counting them electronically, with scanners and such. We can audit that, verify, recount.

I don't like a touch screen, because we fail to actually capture the intent, only the machine record of what it thought the intent was.

Re:Forget cost - what is the POINT?

[MadCow42]

Vote buying. That's what's wrong with it.

ANYTHING that gives the voter the opportunity to walk out with confirmation of HOW they voted is a huge problem. In the system you describe, the voter could decide to not put their paper slip into the box, or to drop in a fake substitute (and no, you couldn't verify it was a real slip without making their vote non-anonymous in the process).

So, they walk out the door, show their slip to "Guido", and poof - their vote has been bought.

The only time their vote gets screwed up is if a manual recount is done at that station, which in terms of % is low (by design - with an electronic system).

You need a solution where the original vote is cast on paper, and is scanned in (and retained) by the system... and the voter verifies their vote electronically on screen before walking off empty-handed.

MadCow.

Re:Forget cost - what is the POINT?

[gumbi west]

There are important benefits. One that I would think the slashdot would like is the possibility of instant runoff balloting.

In this scheme

1. every person ranks all of the candidates;
2. everyone's vote is counted as a vote for their top ranked candidate (their favorite person for the spot);
3. the lowest vote candidate is removed;
4. for people for whom this was their top ranked candidate, their top ranked candidate is changed no their next highest ranked candidate

This possibility has huge upside for third party candidates who can now get a vote that is not, "thrown away".

But in the end, this is at odds with how I think DRE should work, in an object oriented fashion. one machine marks the ballot for you, another counts the ballot. So long as the marked ballot can be verified by eye, this is just another way (other than a pencil) of marking a paper ballot, so it has no more downside but can help blind people vote in private. It also reduces the possibility of hacking the voting machine since it can be constantly validated on election day.

Re:Forget cost - what is the POINT?

[dkleinsc]

Do the words "Hanging Chad" mean anything to you?

Yes, it does. Also the Minnesota senate election in 2008. In both cases, because there was a physical record of each vote, there were clear ways of determining exactly what the vast majority of voters intended to do, even those who didn't do exactly what the counting machines expected. The problems in both those elections were because partisan jackasses were coming up with excuses for why votes for the other guy shouldn't count, or why something that may or may not have indicated a clear intent should count for their guy. Oh, and also the partisan jackasses who were charged with the solemn duty of running fair elections, who found ways to run it so that their guy would have a better chance of winning. Electronic votes wouldn't be immune to this sort of thing.

Here's the way to make things work if we're looking for free and fair elections:
1. Create a physical record of each vote that cannot be traced to the individual voter (which, btw, eliminates all concepts of a voting "receipt" that often crop up around here).
2. Make darn sure that the officials running the election are not partisan and have extremely high integrity. An excellent example of the sort of person we'd want in this role is Bill Gardner, who has been running elections in New Hampshire since 1976 and has the support of Democrats and Republicans.
3. Engage in random unannounced audits of voting results in particular precincts by outside organizations, such as news media, foreign election observers, or nonprofit watchdogs.

Foolish

[bussdriver]

Voting systems need to be understandable by the voter. This means KEEP IT SIMPLE, STUPID. A computer expert should not be involved.
A counting machine based on PAPER can be physically verified and observed by anybody who can COUNT including the interested parties so all are confident of the result. Even a closed corrupt count could come to light if the paper record is preserved. A counting machine can be ignored during a recount; if there is nothing to count then there is no recount and even less deterrent since one can't validate the results. One can't even know if the machine is hacked while a counting machine can be compared against a paper count.

You have to be ignorant OR foolish to think that ANY computer system is better than a paper one under the same conditions. A totally open computer system can be hacked and all traces removed - you do realize that linux still gets patched for security holes right? A hacked compiler or linker can produce bad programs despite clean code. Foreign made hardware components are also suspect (doesn't he NSA have a chip fab plant of their own?) It would take multiple experts just to verify machine at 1 point in time; even then could easily miss a clever attack or a serious security hole. That is barring any tampering after 100% verification (which would only be in theory because you can't get to 100% just like you can't ever be 100% sure a program is bug free.)

The hanging chad problem was over hyped but it is a great example of a solution for a non-problem that complicated the paper system thereby creating a security flaw. It should be obvious that a simple system everybody could see was flawed took so long to be killed off was a problem and now we have people asking about a much much much more complex system and one which only a specialized few could identify flaws?? It defies reason.

Of course, its a somewhat moot issue since the system favors 2 parties which are for sale so any games between the zealots are just a distraction from the larger gaming of the public by the powerful.

Re:Forget cost - what is the POINT?

[jc79]

Hanging chads are not a problem with paper voting. They are a problem with inappropriate technology. Why punch a bit of paper when you could simply use a pen to make an X in a box?