Slashdot Mirror


Lessons From the Papal Conclave About Election Security

Hugh Pickens writes "The rules for papal elections are steeped in tradition. John Paul II last codified them in 1996, and Benedict XVI left the rules largely untouched. The 'Universi Dominici Gregis on the Vacancy of the Apostolic See and the Election of the Roman Pontiff' is surprisingly detailed. Now as the College of Cardinals prepares to elect a new pope, security people like Bruce Schneier wonder about the process. How does it work, and just how hard would it be to hack the vote? First, the system is entirely manual, making it immune to the sorts of technological attacks that make modern voting systems so risky. Second, the small group of voters — all of whom know each other — makes it impossible for an outsider to affect the voting in any way. The chapel is cleared and locked before voting. No one is going to dress up as a cardinal and sneak into the Sistine Chapel. In short, the voter verification process is about as good as you're ever going to find. A cardinal can't stuff ballots when he votes. Then the complicated paten-and-chalice ritual ensures that each cardinal votes once — his ballot is visible — and also keeps his hand out of the chalice holding the other votes. Ballots from previous votes are burned, which makes it harder to use one to stuff the ballot box. What are the lessons here? First, open systems conducted within a known group make voting fraud much harder. Every step of the election process is observed by everyone, and everyone knows everyone, which makes it harder for someone to get away with anything. Second, small and simple elections are easier to secure. This kind of process works to elect a pope or a club president, but quickly becomes unwieldy for a large-scale election. And third: When an election process is left to develop over the course of a couple of thousand years, you end up with something surprisingly good."

42 of 183 comments (clear)

  1. This is blindingly obvious by Chrisq · · Score: 5, Insightful

    Anyone who has had a group of friends vote on whether to eat Chinese or Italian knows that a group who all know each other can hold a secure vote immune from multiple votes or outsiders voting too. Its also obvious that this is not scalable beyond a group in which everyone does recognise everyone else

    1. Re:This is blindingly obvious by bondsbw · · Score: 4, Insightful

      Elections for high office should always be completely verifiable, and the identity of those who cast their ballot should be without doubt. In my opinion, the verification process for very important positions should be automatic and involve multiple competing groups.

      --
      All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
    2. Re:This is blindingly obvious by Anonymous Coward · · Score: 5, Insightful

      It is astounding how many people don't understand the simple paper ballot voting system as it is still applied in many countries and hopefully will for a long time to come. It is based on the same principles as the papal vote, or actually the other way around. The most important aspect is that of public observability of all but the single secret aspect that exists in a proper election, and that single aspect is still completely observable by the person currently voting.

      This scales up to millions of voters by distributing the process such that partial results and their propagation to higher levels are observed by local competing groups, and not only isn't electronic voting helping, it's actually destroying the very core of this protocol: The observability.

    3. Re:This is blindingly obvious by starworks5 · · Score: 4, Insightful

      If the pope is the representative of god on earth, I am assuming that the cardinals are all praying to god for guidance, therefore there shouldn't be any competing groups, assuming that we can verify that god exists.

    4. Re:This is blindingly obvious by jamesh · · Score: 4, Funny

      If the pope is the representative of god on earth, I am assuming that the cardinals are all praying to god for guidance, therefore there shouldn't be any competing groups, assuming that we can verify that god exists.

      I assume this is why they are all looking over each others shoulders too - you wouldn't want to be the odd cardinal out who votes the wrong way, letting on that God isn't in fact guiding him at all!

      To be honest though, I don't believe in God, but if one existed i'd fancy it would be the kind described on Futurama - only helping out when he's sure nobody is looking.

    5. Re:This is blindingly obvious by bondsbw · · Score: 4, Interesting

      True, and the nature of their electoral process makes it instantly verifiable by all parties. Large elections with anonymous voting and close results can be the target of sophisticated election fraud.

      In American presidential elections, I would like each vote to be anonymous but traceable. You randomly select a ballot that has a randomized code, and tear-off or write down the code. Then, no less than 3 groups should receive every vote (the official ballot counters and the two main parties, and any other groups who wants to tally the results). They would each post a website, or equivalent anonymous function, where you can enter your random code associated with your vote and check for yourself that your vote was transmitted properly (alerting each group when your vote appears incorrect). Then each group would individually tally the votes and confirm the election results.

      --
      All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
    6. Re:This is blindingly obvious by Minupla · · Score: 5, Insightful

      The problem with this and most similar schemes is it allows you to sell your vote.

      The thing that protects against vote selling is the difficulty of proving that you were faithful in your execution of the agreement. If I pay you 10$ to vote for the great flying spaghetti monster, I want to know you did in fact vote as instructed, and not for the lazy ravioli monster.

      The inability to verify a secret ballot is a feature, not a bug.

      Min

      --
      On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
    7. Re:This is blindingly obvious by rvw · · Score: 4, Funny

      If I pay you 10$ to vote for the great flying spaghetti monster, I want to know you did in fact vote as instructed, and not for the lazy ravioli monster.

      Yeah that ravioli monster should be canned!

    8. Re:This is blindingly obvious by Kjella · · Score: 2

      And coercion for example from friends and family. Claiming to not have the code can in itself be grounds for negative reactions or be taken as an admission that they didn't vote for somebody else.

      --
      Live today, because you never know what tomorrow brings
    9. Re:This is blindingly obvious by khallow · · Score: 4, Interesting

      The inability to verify a secret ballot is a feature, not a bug.

      Until, your vote is not counted as you intend. Then it becomes a bug.

      How about this approach? You case a vote. At that time, a cryptographically strong hash of your vote is made and printed out as a receipt. The raw data of your vote remains with a special ID generated at the time of the vote and tied to that receipt.

      You can query against the data base to generate your hash. If that hash changes, then possibly your vote changed as well. Or a vote tabulator can query against the data base to get how many votes for each candidate.

      But the act of tying a particular vote to particular voters, would require both the receipt and access to the raw data of the database. Similarly, changing the vote tabulation without being caught would require either creating phantom voters or getting hold of those receipts and then changing the vote associated with the receipts you obtain. Neither is impossible, but beyond the reach of much of the would-be vote manipulators out there.

    10. Re:This is blindingly obvious by trout007 · · Score: 3, Interesting

      So it's OK for the politician to buy your vote by promising to give you tax payers money but not someone buying your vote using their own money?

      --
      I love Jesus, except for his foreign policy.
    11. Re:This is blindingly obvious by baKanale · · Score: 4, Informative

      It's less the "someone buying your vote using their own money" and more the "someone buying your vote by promising not to break your kneecaps with a baseball bat" that you should be worried about.

    12. Re:This is blindingly obvious by Minupla · · Score: 2

      As others have already pointed out in the thread, I was providing one realtively benign example of "selling your vote".

      Other examples of transactions involving your vote might include (stolen from above in some cases):
      "Vote this way, and I won't break your fingers"
      "Vote this way and you can keep your job"
      "Hey honey, can I see who you voted for? Uncle Fred didn't win...."

      Vote selling happens in many subtle ways. The lack of a way to prove they got what they paid for prevents it. You can offer to buy someone a beer if they vote for Fred, but you can never know conclusively if they voted for Fred.

      Min

      --
      On the whole, I find that I prefer Slashdot posts to twitter ones because I don't get limited to 140 chars before
    13. Re:This is blindingly obvious by sFurbo · · Score: 2

      I have heard of a better, though more complicated solution: You fill out three ballots, so that the selections you want is marked on two, and the selection you don't want is marked on one (a computer is probably needed to check this). Each ballot have a unique serial number. You hand in all three, and get a copy of one of them (it isn't noted which one). The ballots are counted, and 1/3 of the number of ballots is subtracted from all total. All ballots are made public. Everyone can check the count, and throwing away ballots comes with the risk that someone have saved one of those ballots. However, you cannot prove what you have voted, as you only have one of your ballots, and all three is needed to tell what you voted. This means that you cannot be forced to vote in a certain way.

  2. Doesn't Scale by mbone · · Score: 2

    As Mr. Schneier points out, this doesn't scale. There is no way you could do a US Presidential election this way.

    I also think it relies some on the autonomy of the Cardinals, which wouldn't necessarily map well to a civil election. Suppose that 100 people got together to elect (say) a town mayor using this protocol, and one of them was the employer of most of the rest. Would this be sufficient to prevent him from influencing or even coercing his employees to vote his way?

    1. Re:Doesn't Scale by starworks5 · · Score: 2

      In some ways the "circle of trust" can be used, and has been used before in elections, but there have to be multiple circles obviously, and many of them are overlapping.

      Its simple as this you live if you in a small city, each person announces their name and vote, members can say "thats not really john smith", and members also keep tallies.
       

  3. Absurdity at its best by cellocgw · · Score: 3, Insightful

    OK, step back. Take a deep breath. The pope is sort-of oughtta be elected on the basis of what the Catholic god (or maybe Jesus, it ain't clear) tells the cardinals is the right choice. So how the fuck could a vote that's determined by the Almighty(s) possibly be rigged by mere mortals?

    --
    https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
    1. Re:Absurdity at its best by Anonymous Coward · · Score: 4, Insightful

      Same reason the Popemobile involves bulletproof glass.

    2. Re:Absurdity at its best by Turminder+Xuss · · Score: 4, Insightful

      Or church steeples have lightning rods.

      --
      You seem to regard science as some kind of dodge... or hustle.
    3. Re:Absurdity at its best by findoutmoretoday · · Score: 2

      One more Jansenist to burn

    4. Re:Absurdity at its best by Zecheus · · Score: 2

      The pope is sort-of oughtta be elected on the basis of what the Catholic god (or maybe Jesus, it ain't clear) tells the cardinals is the right choice.

      Sorry, that is not accurate. Here is an explanation: http://www.thesacredpage.com/2013/02/no-holy-spirit-doesnt-choose-pope.html

  4. Lobbying, Bribery, Extortion, Persuasion. by mrthoughtful · · Score: 5, Insightful

    Why focus on the voting mechanism? It's like testing the quality of a democracy by looking at the voting procedure in the house of commons. The weakness, as is always the case, is human accountability. This is just as true within a theocratic oligarchy as it is within a representative democracy.

    Anyone who thinks that powerful interests have no sway in the election of a pontiff is uneducated in history and blissfully naive.

    --
    This comment was written with the intention to opt out of advertising.
  5. No surprises here by mean+pun · · Score: 5, Interesting

    Considering that this voting process has evolved in the face of thousands of years of intrigue and backstabbing that makes even politicians look like choirboys, why is this a surprise? The evolutionary pressure was most certainly there.

    And of course this analysis overlooks the most reliable way of rigging an election, and one that is most certainly practiced here: hand-picking the electorate. Who appointed those cardinals in the first place, eh?

  6. You're looking in the wrong place by Arancaytar · · Score: 5, Insightful

    Elections like this don't get manipulated during the ballot-casting, because they're not decided during the ballot-casting. Just like the decisions of a legislative body, the vote itself is merely the result of a ton of secret politics leading up to it.

    1. Re:You're looking in the wrong place by Sloppy · · Score: 2

      When you win a battle, celebrate that you moved the front. Don't fret that you didn't win the war yet. It is good to lock a door and make a burglar noisily kick it in, even if he still gets in.

      The process changed the place. The reason elections are won by pre-election dealing, is that we have (mostly) succeeded at making it sufficiently hard to win by ballot box hacks. Pre-election deals are relatively expensive compared to ballot box hacks.

      Sure, we're looking in the wrong place, but only because it was the right place. It's not stupid to work on this stuff.

      --
      As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
  7. Not unusual [Re:Doesn't Scale] by Geoffrey.landis · · Score: 4, Insightful

    As Mr. Schneier points out, this doesn't scale. There is no way you could do a US Presidential election this way.

    This is not unique, not even very unusual. What we are seeing here is members of a parliament voting for a prime minister. That happens in a hundred places across the world. Why doesn't Schneier analyze whether you can "hack the vote" in the House of Lords?

    If you do want to compare it to the US, this compares to a vote in the Senate, and is somewhat much smaller than a vote in the House of Representatives.

    --
    http://www.geoffreylandis.com
  8. Re:Exciting news by Eunuchswear · · Score: 3, Insightful

    Well, about a billion actualy.

    But you're only a few orders of magnitude out.

    --
    Watch this Heartland Institute video
  9. Re:Its racist by Anonymous Coward · · Score: 2, Interesting

    You know, if you're going to go off on republicans and election fraud, need I remind you that in the 2012 election, EVERY SINGLE SWING STATE went democrat. You'd think for certain that at least one of them would have gone republican. That's the definition of swing state, you don't know which way they're going to go, and when you have what was it, 10 of them, odds are one of them should have gone republican, but no. Surely at least Wisconsin should have gone red, but it didn't. So if you're going to throw out your conspiracy theories, just let that one sit on your mind while you're doing it.

  10. Oh really? by wonkey_monkey · · Score: 4, Funny

    No one is going to dress up as a cardinal and sneak into the Sistine Chapel.

    Challenge accepted!

    --
    systemd is Roko's Basilisk.
    1. Re:Oh really? by PolygamousRanchKid+ · · Score: 4, Funny

      Dress up as The Spanish Inquisition . . . they won't be expecting that . . .

      --
      Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
    2. Re:Oh really? by JubilantShank · · Score: 2

      No one expects the Spanish Inquisition...

  11. Re:Its racist by Anonymous Coward · · Score: 2, Insightful

    Nice try. When you can come up with an intellectually honest answer as to why voter ID laws always seem to specify types of IDs that non-Republican voters tend on average to be lacking in greater quantities I might even buy it. A citation for Mother Jones saying that this "never actually happens" wouldn't hurt either. The position on the less right wing side in this country, which has always lacked a definable left wing by world standards, is that voter fraud is so statistically rare as to defy the amount of resources right-wingers seem to want to use to fight it. There is no credible evidence which refutes this.

    There is an avalanche of evidence and CONVICTIONS for multiple votings, fraudulent registrations, and the like. ACORN registered Mickey Mouse, and voting records showed that he voted.

    Mother Jones' assertion that it costs hundreds of dollars to get ID is bullshit. I have done it recently, it is nowhere near the expensive. MJ is cherry picking by getting the most expensive documents in the most expensive states. You will have a BC/COLB unless your parents were retarded and threw it out or you were unlucky and lost it in a fire/flood/whatever. Replacements are non-free but they are cheap as BCs never expire so it is a once in a lifetime fee ($45 here). BC gets SS card. BC + SSN gets state ID ($25). If you can't come up with $25 once every 5 years you're street homeless and have bigger issues than not being able to vote.

  12. Re:Its racist by pla · · Score: 4, Insightful

    When you can come up with an intellectually honest answer as to why voter ID laws always seem to specify types of IDs that non-Republican voters tend on average to be lacking in greater quantities I might even buy it.

    You mean, something so rare as a "Driver's license"? Or a free (to the poor and elderly) state-issued ID card as an alternative? Yep. Clearly racist, right there. Everyone knows minorities don't drive, fly, buy cigarettes, buy alcohol, use credit cards, use checks, or visit certain federal buildings.

    Seriously, how does anyone (retirees aside, but they had to have made it through the rest of their life to get that status) manage to live in the modern world without a license or ID?

  13. Every step of the election process is observed by Tim+Ward · · Score: 4, Interesting

    That's the key, and makes for clean elections - I've observed elections in the UK, Kosovo and Ukraine.

    This tends to mean manual counting of physical pieces of paper that have been marked by the voter by hand, as that's vastly easier for lay people to observe and verify than hidden things going on inside computers or other machines. (I'm not saying that proper independent observation by lay people of what goes on inside a machine isn't possible, just that nobody has worked out how to do it yet.) If I'd observed an election involving machines I would have had to write in my report that I had no confidence in the outcome of the election because I had no visibility of what was going on inside the machines.

    The big problem with the cleanliness of the UK voting system is postal votes - and this is in my view precisely because this is a part of the process which is *not* independently observed - you don't know for sure who applied for the postal ballots, who acquired them, or who filled them in under what pressure.

  14. Re:Its racist by CatWrangler · · Score: 4, Informative

    Show the documentation that Mickey Mouse voted. This is false. The Mickey Mouse thing is legitimate. It's been distorted like the McDonalds coffee case. If you hand somebody a registration form, and they put Mickey Mouse on it, BY LAW, you are not allowed to discard it. You MUST turn it in. What most groups like ACORN did was segregate these suspicious registrations before turning them in. Legally they had no choice. It has become a right wing talking point that they were all eager to register Mickey Mouse. This is false. Quit believing email forwards from your grandparents.

    --

    ---
    When you come to a fork in the road, take it! --Yogi Berra--

  15. Re:Its racist by Stormin · · Score: 3, Interesting

    Simple, they can't get one. They came from a place where the records were destroyed, or never existed in the first place. This is not as rare as many people might like to think - it's been a fact of recent civil wars in my lifetime, that one side systematically destroyed all birth records of the other.

    There are people who can't afford to fly, who buy their cigs and alcahol off a younger family member, have no credit cards or bank accounts (using just the check cashing place and paying an exorbitant fee there too boot), and yes, can't visit certain federal buildings. Their lives are already greatly limited and with the aggressive work of republican groups screaming about vote fraud, we can ensure that they lose even the right to vote in our lifetime, since they certainly would have voted democrat anyway.

  16. Re:Its racist by swalve · · Score: 2

    Swing states are a historical thing, not a per-election thing. Some years they go one way, some years they go the other. This election, despite the media's attempts at creating a nose-to-nose horse race, was predicted very early and very accurately.

  17. Re:Its racist by pla · · Score: 4, Insightful

    This is not as rare as many people might like to think - it's been a fact of recent civil wars in my lifetime, that one side systematically destroyed all birth records of the other.

    We, uh, haven't had a whole lot of civil wars in the US since the birth of anyone currently living here. Yes, we've all heard about the sisters from middle-of-nowhere Appalachia who never left their home valley for their first 40 years of life and now can't prove themselves as US citizens. And yes, I'd still have to call that pretty damned rare.


    Their lives are already greatly limited and with the aggressive work of republican groups screaming about vote fraud, we can ensure that they lose even the right to vote in our lifetime, since they certainly would have voted democrat anyway.

    Does that bother you? I mean, that people (on both sides of the aisle) automatically assume voter ID laws disproportionately affects Democrats? It basically shouts to the world, "We have such a strong association as the party of complete losers, of illegals, of 3rd gen welfare dynasties, that we just assume all the human trash in our society will vote blue".


    And FWIW, I don't vote red. You can't just assume that everyone belongs to the GOP who happens to believe we should verify citizenship before allowing people to exercise the core right of that citizenship. That everyone who believes in fiscal responsibility sides with the misogynistic religious whackjobs on the right. That "I disagree with you" automatically makes me a member of "the enemy".

  18. Re:Exciting news by swalve · · Score: 2

    The pope doesn't oppress anyone. He has no control over anyone excepts maybe the inhabitants of Vatican City.

  19. Re:Its racist by bondsbw · · Score: 2

    You act as though ACORN has no blame, when a quick Google (no really... I didn't know anything about this until now) reveals that several dozen ACORN employees and ACORN itself have been convicted of crimes related to voter registration fraud.

    Just like any crime, it's not how many we catch that worries me, it's how many have gotten away with it.

    --
    All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
  20. To see the process in action.... by mendax · · Score: 2

    ... rent (or own as I do) the movie "The Shoes of the Fisherman" from 1968. It shows in detail the process of a fictional papal conclave including the steps the cardinals take to ensure fairness. Quite revealing.

    On a completely different subject, for those movie geeks of you out there who love "2001: A Space Odyssey" as I do, this film is where Alex North recycled some of his rejected score for 2001.

    --
    It's really quite a simple choice: Life, Death, or Los Angeles.
  21. Re:Exciting news by Eunuchswear · · Score: 2

    No, you misunderstand. Maybe about a billion _think_ it's important, but frankly it's all much the same to them:

    You know, if someone thinks something is important to them maybe you should accept that it is important to them. Who are you to insist you know better than they do?

    --
    Watch this Heartland Institute video