The Computer Scientist Who Prefers Voting With Paper (theatlantic.com)

Geoffrey.landis writes: The Atlantic profiles a computer scientist: Barbara Simons, who has been on the forefront of the pushback against electronic voting as a technology susceptible to fraud and hacking. When she first started writing articles about the dangers of electronic voting with no paper trail, the idea that software could be manipulated to rig elections was considered a fringe preoccupation; but Russia's efforts to influence the 2016 presidential election have reversed Simons's fortunes. According to the Department of Homeland Security, those efforts included attempts to meddle with the electoral process in 21 states; while a series of highly publicized hacks -- at Sony, Equifax, the U.S. Office of Personnel Management -- has driven home the reality that very few computerized systems are truly secure. Simons is a former President of the Association for Computing Machinery (ACM); and the group she helps run, Verified Voting, has been active in educating the public about the dangers of unverified voting since 2003.

Comments

This is the attitude of many security experts

[JoshuaZ]

Simons is one of the most prominent such, but definitely not the only one. This has been a vocal point being made by computer scientists and other security experts since at least the late 2000s.

Re: This is the attitude of many security experts

[religionofpeas]

It's way too easy for someone to sneak in an extra box of fake ballots to rig an election.

It's hard to rig an election with a single box of fake ballots. It's also hard to bring in thousands of boxes without anybody noticing.

Re: This is the attitude of many security experts

[Anonymous Coward]

Repeating the summary to try to grab the fp? Your post is redundant. Mod down. Slashdot doesn't need users like you. Begone.

Re:This is the attitude of many security experts

[Anonymous Coward]

This.
I think almost anyone with the slightest knowledge of embedded software and security practices would prefer paper over electronic.
If working in this industry has taught me anything it's that security is based mostly on hoping that no one will ever have access to your hardware for long enough to find flaws in it. Sure, there is some layer of security usually, but developing those properly is hard, and usually someone somewhere punches a hole in it so they can do practical things, like program the device with an initial firmware, or debug it.
Then we haven't even discussed all the flaws that just sneak in as coding errors.

Re: This is the attitude of many security experts

[Anonymous Coward]

Barbara Simons has been on the forefront of the pushback against electronic voting as a technology susceptible to fraud and hacking. When she first started writing articles about the dangers of electronic voting with no paper trail, the idea that software could be manipulated to rig elections was considered a fringe preoccupation; but Russia's efforts to influence the 2016 presidential election have reversed Simons's fortunes. According to the Department of Homeland Security, those efforts included attempts to meddle with the electoral process in 21 states; while a series of highly publicized hacks -- at Sony, Equifax, the U.S. Office of Personnel Management -- has driven home the reality that very few computerized systems are truly secure. Simons is a former President of the Association for Computing Machinery (ACM); and the group she helps run, Verified Voting, has been active in educating the public about the dangers of unverified voting since 2003.

Re: This is the attitude of many security experts

[Anonymous Coward]

You probably don't even know of the legal requirements of voting systems in certain countries. As such, what you are saying, is at best naive.

Re: This is the attitude of many security experts

[Anonymous Coward]

I prefer voting machines that rely on paper and electronic counting. The machines scan the paper and the paper is saved. I like being able to see vote on paper.

Re:This is the attitude of many security experts

[Ol Olsoc]

Simons is one of the most prominent such, but definitely not the only one. This has been a vocal point being made by computer scientists and other security experts since at least the late 2000s.

Why on earth is this modded at 1? The ease with which computerized voting systems can be compromised has been shown over and over again, that I wouldn't be terribly surprised if the access was planned.

Paper is not perfect, but at least it makes it a little harder to compromise.

Re: This is the attitude of many security experts

[Anonymous Coward]

There are plenty of instances of tampering with paper ballots. Can you provide a single instance of an electronic voting machine actually being tampered with during an election? Do you have any evidence that your scenarios are anything other than hypothetical?

Re:This is the attitude of many security experts

[Anonymous Coward]

Simons is one of the most prominent such, but definitely not the only one. This has been a vocal point being made by computer scientists and other security experts since at least the late 2000s.

There is a post following this one that argues that block chains are the way. I, however, disagree and support paper ballots. The threat is not a few boxes of ballots being faked, but the entire election. No electronic system that you do not control everything, end to end, can be provably secure. I'm talking the level of control to know exactly what is inside that silicon, and that there is no direct or indirect way to meddle. You also need provable security on the software. Military systems can now cost much more than consumer systems to even attempt that level of traceability.

I'm an electrical engineer that does software for a living. Here is what I'd recommend.

1. Basic fill in the oval paper ballots, perhaps with a booklet with more information.
2. Vary the order of candidates and choices in paper ballots. The scanning machine can easily be programmed to handle this.
3. Remove party affiliation. A voter can bring in their own cheat sheet if they must, as long as they take it with them.

All ballots will be kept for the duration that the candidate is in office under a provable chain of custody.

Re:This is the attitude of many security experts

[JaredOfEuropa]

The sad part is that it's not only security experts who should be saying this. Voting should not only be accurate, but that accuracy needs to be verifiable by laymen, and they should be able to understand the end-of-end process to tally and verify the count. Voting by computer violates that principle on a fundamental level.

Re: This is the attitude of many security experts

[orlanz]

Yes paper can be destroyed, replaced, and added to, impacting the outcome. But the impact will be at most ONE small district. And you would need to do this at multiple voting centers. There are 435 districts in the US. Great path if you want to rig your very local election.

But going to major cities or state levels... the amount of money you would need to spend to significantly impact such elections would be a waste of funds and a high risk for capture through multiple attempts. It would be far more cost effective to spend that on ads to sway public opinion or a candidate directly.

At the federal level... easier to buy out the Electorial College. That may seem difficult but nothing compared to what you propose.

With electronics, you have a centralized, standardized, single target. But this target would have multiple stages to attack, any of which can yield control of the entire system.

It is possible to create a good enough electronic voting system but we just don't have anyone nearly competent enough to do so. Our current system of hundreds of thousands of cogs watching each other is more than good enough at the moment.

Re: This is the attitude of many security experts

[religionofpeas]

There are plenty of instances of tampering with paper ballots. Can you provide a single instance of an electronic voting machine actually being tampered with during an election?

You've summarized the problem. Electronic voting allows for undetectable manipulation.

Re: This is the attitude of many security experts

[Anonymous Coward]

It's way too easy for someone to sneak in an extra box of fake ballots to rig an election.

show us how to make paper invisible and then we can talk

electronic ballots are invisible and and can be created and destroyed with no evidence

We would be far better off using blockchains to store votes

you might feel this way if you are an ignorant fool who does not read the newspaper

Re: This is the attitude of many security experts

[Ol Olsoc]

Paper ballots can easily be destroyed, damaged, or faked. It's way too easy for someone to sneak in an extra box of fake ballots to rig an election. It's a shame that people like you who should know better are proposing to make it easier for criminals and foreign powers to rig elections. We would be far better off using blockchains to store votes and using that to ensure security. It's unfortunate that you and so many others are standing in the way of progress and better security.

Looks like we have prefect doing it's job as the enemy of good.

Besides, there is a world of difference between the effort it would take to coordinate a nationwide paper ballot hack. You would have to have a whole lot of people with physical access to the ballots, and a well coordinated ability to do the dirty work without detection, versus a few people sitting in a nice office somewhere altering the results.

Your blockchain idea is another example of how the next solution will be the secure one. Then the next one after that, then the one after that.

Nope, there is no way that we should allow voting to be yet another casualty of the Internet of Things debacle.

Re: This is the attitude of many security experts

[religionofpeas]

It is possible to create a good enough electronic voting system but we just don't have anyone nearly competent enough to do so.

We have to assume the worst, i.e. that the people in power to guarantee honesty and competence are the same people who don't want an honest election.

Re:This is the attitude of many security experts

[taiwanjohn]

Paper ballots are used here in Taiwan, and they are counted, by hand, in public view immediately after polls close. Results are usually complete within a few hours. Ironically, this system was instituted under the KMT single-party regime to facilitate vote buying.

The voting is done by putting a stamp in a square on the paper, rather than filling in a circle with a pen (or punching a hole, etc.). So, by stamping the ballot in a particular way -- say, in the upper left corner, slanted to the left -- you'd indicate to the vote buyer that you'd fulfilled your end of the bargain. Vote buying is now pretty much a thing of the past, but the legacy of this highly open and public system has served the country well in its transition to one of the more thriving democracies in the region.

But this is not unique to Taiwan, lots of countries use paper ballots. The USA is really "backward" in this regard.

Re:This is the attitude of many security experts

[Ol Olsoc]

This. I think almost anyone with the slightest knowledge of embedded software and security practices would prefer paper over electronic. If working in this industry has taught me anything it's that security is based mostly on hoping that no one will ever have access to your hardware for long enough to find flaws in it. Sure, there is some layer of security usually, but developing those properly is hard, and usually someone somewhere punches a hole in it so they can do practical things, like program the device with an initial firmware, or debug it. Then we haven't even discussed all the flaws that just sneak in as coding errors.

You need to add human nature to the mix. Think of money. Think of gerrymandering. Humans will go to extraordinary lengths to ensure that their side wins, including making it difficult for the other side to win.

A very hypothetical but plausible situation:

Joe Blow voting machines incorporated has a bit of an inclination toward one party or another. Well, one party or another would like to make certain that their party wins. So maybe 20 million dollars changes hands and is stored in some offshore bank.

JBVM simply adds backdoors that will slightly alter the results, weighted in favor of the group that gave him the money. I think it was Carnegie-Mellon U who originally came up with a hard to detect vote alteration method during one of their hacks of voting machines.

The ease with which electronic machines can be hacked makes it hard to believe that it hasn't occurred already.

Re: This is the attitude of many security experts

[Anonymous Coward]

" prefect doing it's job as the enemy of good. "

Yes, I'll call the prefect, maybe he can teach you the difference between its and it's.

Re:This is the attitude of many security experts

[drinkypoo]

Voting should not only be accurate, but that accuracy needs to be verifiable by laymen, and they should be able to understand the end-of-end process to tally and verify the count. Voting by computer violates that principle on a fundamental level.

As long as there's some form of paper record which can be verified later, it doesn't actually matter if a person can understand the process by which the vote is tallied. You should always do a certain percentage of randomly-selected verification to check that your method is working, no matter what it is — even if it is paper ballots. And as long as the piece of paper is allocated and/or designed such that it can't be used for vote buying, it doesn't cause new problems. Just let the voter see the paper to verify their votes before it gets stored, and print out a piece of paper with a hash code on it and give it to them so they can match up to their ballot later without being able to show how they voted.

Re: This is the attitude of many security experts

[Anonymous Coward]

Bullshit. It requires a massive logistical effort to achieve the same effect.

Re:This is the attitude of many security experts

[JaredOfEuropa]

To some extent. The problem is that a lot depends on how and where you keep your paper records. The more they are moved, aggregated and the longer they are stored, the more opportunity there is to tamper with them, and on a larger scale.

Re:This is the attitude of many security experts

[Anonymous Coward]

Remove party affiliation.

Who does this help?

Re:This is the attitude of many security experts

[Anonymous Coward]

Maybe understanding it isn't important, but it is important that any reasonable person who doesn't trust you or any experts, ... can be convinced that the election result is valid.
Do you believe you can convince a random person on the street that this "certain percentage of randomly-selected verification" is sufficient to ensure the election is legitimate? Would most people when you say "we verified a randomly selected 1%" not respond with: "what? why? only? That leaves 99% that might be wrong!!"
As has been said by many people (but forgotten by most proponents of alternative voting systems): elections are at least as much about convincing the losers that they have legitimately lost as they are about electing someone.
I have yet to see an electronic voting system that would pose any significant resistance to someone trying to discredit it. And this point also means that without HUGE advances in general education there CANNOT be any mathematical solution to this problem.

Re:This is the attitude of many security experts

[Anonymous Coward]

Remove party affiliation.

Who does this help?

I'd say it helps third parties the most. People can bring in cheat sheet if they must. They just can't leave them behind.

Re:This is the attitude of many security experts

[Wycliffe]

No electronic system that you do not control everything, end to end, can be provably secure. I'm talking the level of control to know exactly what is inside that silicon, and that there is no direct or indirect way to meddle. You also need provable security on the software. Military systems can now cost much more than consumer systems to even attempt that level of traceability.

Yes, that's the first part, you need to control everything to prove it secure but there is a second part as well. You also need to have someone you can trust doing the controlling. For the most part, in the military, everyone is on the same side. In an election, by definition, there are two competing sides. So you need an uncorruptible neutral third party who has control of everything. Even if you find this mythical beast, you now have a single point of failure and a single attack vector. Every power hungry maniac will be trying to secretly get their guy into that position.

Decentralized paper ballots at the county level, on the other hand, are much harder to manipulate than even the mythical "perfect benevolent dictator". Unlike individual secret ballots, county totals are public record. Each county keeps track of their totals and makes sure that their total is the total reflected in the national election. So in order to change the results of a national election, you would have to have at least one agent physically present at every single county that you wanted to manipulate. We are likely talking thousands of agents across the country of which you have to make sure that none of them decide to expose your plot. Most local election volunteers I've seen are also pillars of the community where everyone knows everyone else. It's just not practical to coordinate an attack on the national election at the local level if we use paper ballots.

Re:This is the attitude of many security experts

[Wycliffe]

To some extent. The problem is that a lot depends on how and where you keep your paper records. The more they are moved, aggregated and the longer they are stored, the more opportunity there is to tamper with them, and on a larger scale.

Paper records should never be moved or aggregated. Preferably, each polling station would have an individual safe where they are placed until the next election. The main advantages of paper ballots is the decentralization,the accountability and the ability to do a recount. You lose all that if they are aggregated. The polling stations should send their totals to the county where they become public record and those totals are sent to the state and then to the federal where again the aggregate totals are public. You can easily see that your polling station's 531 votes are recorded at the county and the total of all the polling stations equals the total sent on to the state. If there is any question, it is easy enough to recount at the specific polling station where there is a problem because you are only talking about a small number of ballots. It's also easy enough to count by hand because, again, you are talking about a small number of ballots. Even security becomes less of an issue because the ballots are physically located all across the county and altering or destroying them becomes a logistic nightmare.

Re:This is the attitude of many security experts

[whoever57]

In the USA, the problem with hand counted paper ballots is that, on election day, we frequently have about 20-30 different positions and referenda to vote on.

Where I vote, they have paper ballots, but they are machine counted. There is a record that can be checked for accuracy.

Re: This is the attitude of many security experts

[swillden]

It's way too easy for someone to sneak in an extra box of fake ballots to rig an election.

It's hard to rig an election with a single box of fake ballots. It's also hard to bring in thousands of boxes without anybody noticing.

In addition, cryptographic security researchers have constructed a cost-effective, scalable, paper ballot system which makes this sort of fraud (and others) detectable.

Paper, backstopped with math, is unquestionably the most fraud-resistant way to conduct elections. Pure electronic voting systems are perhaps the best way to enable fraud.

There is a valid argument for the use of electronic voting machines for accessibility. Large touch screens are easier to use, especially for people with disabilities, but they should merely be an interface to collect information for printing on a human-readable paper ballot.

I'm both a computer scientist and a computer security expert. I think you'd be hard-pressed to find anyone who understands computer security who would honestly support direct recording electronic voting.

Re:This is the attitude of many security experts

[HGG]

Way before the late 2000's. In the early 2000's several of us were trying to explain these issues to the county auditor (who controls election mechanisms), and used this site to collect talking points:
http://www.seanet.com/~hgg9140/politics/evote/index.html

When we were researching, we found the main issues were already old news by then.

Even then we were advocating paper ballots and manual processing of those ballots. That it is still not solved nationwide is due to well-funded politics, not technical incompetence: "You can wake a man who is sleeping. You cannot wake a man who is pretending to be alseep."

Re:This is the attitude of many security experts

[currently_awake]

Democracy is the most stable form of government because anyone who has the money and support to overthrow the government has the money and support to win an election, so take the safer route and win at the ballot box. That only works if they trust the voting system, and that requires understanding the voting system. Even if you can make a secure electronic voting system, you'll never be able to prove that to the average voter, so you lose the main advantage of Democracy.

Re:This is the attitude of many security experts

[Wootery]

Yup, it's a bullshit title. Non-technologists seem to expect technologists to want to see high-tech solutions to everything, but serious technologists know that isn't always wise.

Bruce Schneier has been saying for over a decade that US elections shouldn't be made fully electronic.

Re: This is the attitude of many security experts

[Anonymous Coward]

Yeah ALL those problems happen in Canada every election because our elections are controlled by Big Paper & Pencil.

You deserve your shithole cuntry.

Re: This is the attitude of many security experts

[Anonymous Coward]

America is special & stupidly so: the post.

Yeah NO ONE ELSE eeeeever has ballot iniatives.

pleb.

Re:This is the attitude of many security experts

[Anonymous Coward]

Was going to ask what computer scientist *recommends* voting on computers...

Let alone all the programmers, system administrators, software engineers, etc. Except for the CEOs and employees of voting machine companies, and their paid-for politicians and lobbyists (whose opinions should all be discounted due to their conflicts of interest), is there anyone in a computing endeavor in favor of not voting directly on paper to even argue against?

It's hard to make noise when there's so little disagreement.

Re:This is the attitude of many security experts

[Anonymous Coward]

I am not a scientist, but I do hold two AAS degrees in computer science, so I know that electronic voting is a bad idea. A human marked or mechanically marked paper ballot, being counted by teams of humans, with each making his own tally, and then comparing his/hers to others is the only way to go. This way voter fraud on a massive scale is much more difficult to do.

The electoral college is an anachronism, unnecessary, and undesirable. It has been used to steal elections from the popular vote winner several times in our country's history, and in 2016 the electoral college miserably failed in its duty to prevent an extremely unqualified candidate from being seated. The electoral college needs to be eliminated, and presidential elections need to be decided by the popular vote.

Also, candidates for seats in the House or Senate, as well as for president should have to undergo both physical and psychological evaluations by teams of doctors and psychiatrists before being allowed to run for election.

Re:This is the attitude of many security experts

[Anonymous Coward]

It's naive to believe that it hasn't occurred already. But it's not a defect. It's by design. The defect is in the peoples' consent to their use. If nobody rises up, don't expect things to get any better.

Re:This is the attitude of many security experts

[Aighearach]

My State votes on paper in human-readable form and then uses computers to tabulate it. It works really well, you can have people from both parties standing there watching the ballots feed in and watching the counters go up! And you can re-count by hand. Best of both worlds.

Re: This is the attitude of many security experts

[dougdonovan]

theres always at least 1 bad apple.

Re: This is the attitude of many security experts

[Anonymous Coward]

The difference is, it's its.

Re:This is the attitude of many security experts

[MichaelSmith]

Vary the order of candidates and choices in paper ballot

But thats your vulnerability. The top candidate gets the most votes so if you bias the order on the ballot, you bias the outcome.

Re:This is the attitude of many security experts

[Ol Olsoc]

It's naive to believe that it hasn't occurred already. But it's not a defect. It's by design. The defect is in the peoples' consent to their use. If nobody rises up, don't expect things to get any better.

I suspect there is a bit of an uprising going on at the moment.

Re:This is the attitude of many security experts

[Anonymous Coward]

Vary the order of candidates and choices in paper ballot

But thats your vulnerability. The top candidate gets the most votes so if you bias the order on the ballot, you bias the outcome.

Perhaps I was unclear, if you vary the order such that every candidate has the top spot in equal number (and every other spot), then that should be negated. Again, the scan machine must identify the ballot variation and deal with it, but that is trivial.

Re: This is the attitude of many security experts

[reboot246]

It's even harder than you're portraying. Yes, there are 435 Congressional Districts, but each of those districts has multiple voting precincts. For example, I vote in precinct 4110 in my district. It's almost impossible to add extra ballots in so many voting places.

We vote using a paper ballot that is then fed into a machine that reads the ballot so there can be a running total. The paper ballots are there to compare the machine total to the paper total.

The real fraud occurs in absentee voting.

Re:This is the attitude of many security experts

[Anonymous Coward]

Not really, just the usual swing of the pendulum. The song, and the players remain the same.

Re: This is the attitude of many security experts

[Anonymous Coward]

Well, Conde Naste won't be around much longer, wonder if Slashdot will be. Tired of the fake news.

Re:This is the attitude of many security experts

[dryeo]

Perhaps that should be changed. Here in Canada, we have a Federal system with a country made up of sovereign Provinces (and non-sovereign territories). We have an election for the Federal government and we have a different election for our respective Provincial government, each Province being in charge of their elections. Then municipal elections happen on a different day.
When I vote federally, I pick one name from a short list of usually 6-12 names. Likewise when I vote provincially. Municipal are more complicated, but only affect a small area.
Advantages include that each election is clearly for one government. The federal one is fought over federal issues, likewise with the provincial and municipal. We actually often have different parties at the federal and provincial levels and don't even have parties at most municipalities, at least here in BC.
You guys are just overwhelmed at election time. How many people really think about all the positions they're voting on? Seems your Presidential election over shadows everything else. Decide to vote one way for President, might as well vote the same way across the ticket while the dog catcher should obviously not be that guy who has the same party affiliation.

Re:This is the attitude of many security experts

[dryeo]

Around here, the polling places are usually school gyms or churches. Don't know if it would be practical to store the ballots permanently there. Of course our elections are simple enough that the common man can hang out all day and witness the voting and counting if they choose.
The weakness is the absentee votes, which should be stored like you say, at least until the final count is done. Last election here (BC), it took 6 weeks to finalize that it was basically a tie, 43-41-3 and weeks more for the legislature to kick the government out (41+3 beats 43, but the 43 get first chance). At the end the election was decided in one very close riding and while the absentee votes just increased the margin of victory, it could have been the opposite.

Re:This is the attitude of many security experts

[Pseudonym]

The way it works in Australia is that each time the papers are not being actively used (e.g. counted), they are sealed and the seal numbers are recorded. Then when they are opened again, the seals are checked.

The system is so strict that if there is any significant discrepancy, a fresh election is called.

Re:This is the attitude of many security experts

[MichaelSmith]

Yes but if you use a random number generator for that you are vulnerable to a tweaked algorithm, as is the case with crypto algorithms.

Re: This is the attitude of many security experts

[TheRaven64]

There's also one crucial advantage of paper ballots: the expertise required to monitor the election is very low. Even a relatively unpopular candidate is able to find enough people who can watch people put pieces of paper into a box and can watch the boxes for signs of tampering throughout the entire process. You can't have a democracy if the mechanism for collecting and counting the votes can only be audited by a select few experts.

Re:This is the attitude of many security experts

[Anonymous Coward]

Yes but if you use a random number generator for that you are vulnerable to a tweaked algorithm, as is the case with crypto algorithms.

No, just no. For one thing there are hardware random number generators, which produce true random numbers. They are not remotely rare. For the other thing, to somehow take advantage of it, you would have to somehow line people up in order and have the answers pre determined. It is far easier and less error prone just to give people a list of results and let them find the oval.

To clarify. the only thing that is being changes is the order of the answers. I.E.

a. Barack Obama
b. John McCain

on one ballot becomes

a. John McCain.
b. Barack Obama

on another ballot.

The ballot is still self explanatory, and the reader can lookup the ballot pattern and score correctly. You wouldn't even need true random numbers here, just simply alternating would be enough. The point is to:

1. Remove any benefit to being first in the list.
2. Remove any hint of party affiliation. [i.e. you can't count on one or the other to be first.]

The pseudo random ordering doesn't solve every problem, but it is a small way to help balance things.

Re:This is the attitude of many security experts

[Wycliffe]

Around here, the polling places are usually school gyms or churches. Don't know if it would be practical to store the ballots permanently there.

With paper ballots there would be a lot less to store than all the machines that are currently stored. It would be easy enough to supply a safe to each school/church but most churches and schools likely already have a safe so putting the ballots in a tamper proof box in a third party safe would likely be even better as then the ability to get access to all the different safes would be even more difficult. I also would have no problem with the ballots being put in individual safety deposit boxes or even sent home and put in the safe of the local election official as long as it was in a tamper proof box and destroyed in public after the next election.

Re: This is the attitude of many security experts

[Gr8Apes]

There is a valid argument for the use of electronic voting machines for accessibility. Large touch screens are easier to use, especially for people with disabilities, but they should merely be an interface to collect information for printing on a human-readable paper ballot.

I've argued this for a long time. There should always be paper involved. Electronic machines are only good for generating a paper ballot, IMNSHO. Per your statement on paper backed with math - blockchain actually becomes somewhat interesting in this, as voting is essentially one of the largest one time ledgers you could create and validate. It'd be interesting to see how it could address some of the issues related to voter fraud while keeping voting essentially anonymous.

Re:This is the attitude of many security experts

[MtViewGuy]

The best solution has always been mark-sense ballots done with _permanent_ ink. That way, the ballots are both hand-count and machine-count readable and we don't have the nasty "hanging chad" issue that plagued punched paper ballots.

Re:This is the attitude of many security experts

[dryeo]

Never really thought about the logistics of storing all those machines. Another negative with voting machines.
Is there really any reason to keep the ballots after the election results have been certified? Generally the first count is enough to result in a clear winner with a few disputes that don't really affect the overall result.
When it does matter, such as our last Provincial election, most of the ridings (districts) had a clear winner, the close ones went through automatic recounts including digging out all the advance voting ballots and the closest counted a few times. 6 weeks and it was all over, which was longer then usual but once over, why keep the ballots?

Re: This is the attitude of many security experts

[lsatenstein]

It's way too easy for someone to sneak in an extra box of fake ballots to rig an election.

It's hard to rig an election with a single box of fake ballots. It's also hard to bring in thousands of boxes without anybody noticing.

Imagine a fake box was introduced. It could succeed because of low voter turnout. Typical US voter turnouot is so low that the box with fake ballets would not raise suspicion. The sum of the votes, including the fake ones will be less than the total of eligible voters for that polling location.
 

Re: This is the attitude of many security experts

[Anonymous Coward]

+1
Anyone who still supports paperless electronic voting WANTS TO CHEAT!

Use the computer to create a correctly filled out paper ballot.
Use the computer count as the first estimate.
Count the paper ballots manually.

It is not black magic, really...

Re: This is the attitude of many security experts

[swillden]

Per your statement on paper backed with math - blockchain actually becomes somewhat interesting in this, as voting is essentially one of the largest one time ledgers you could create and validate.

You should read the paper I linked.

Re: This is the attitude of many security experts

[swillden]

Use the computer count as the first estimate. Count the paper ballots manually.

You should read the paper I linked. With the Scantegrity system there's neither need for nor value in manual counts. Nothing precludes them, but other mechanisms make them unnecessary.

Re:This is the attitude of many security experts

[Wycliffe]

Never really thought about the logistics of storing all those machines. Another negative with voting machines.

And unfortunately many of them are stored in highly unsecure locations.

Is there really any reason to keep the ballots after the election results have been certified? 6 weeks and it was all over, which was longer then usual but once over, why keep the ballots?

The main reason to keep them for at least a couple years is if questions come up about the legitimacy of the election. 6 weeks is before the new guy is even in office. Once the ballots are destroyed, it would be much easier for a bad actor to change the totals. With an election, you have to always assume the worst which is that the people doing the certifiying and/or making the voting machines are potential bad actors.

Re: This is the attitude of many security experts

[Gr8Apes]

I skimmed it. It seems a touch convoluted to maintain privacy, et al. What I'm talking about is a more general approach that's simple and secure. As soon as I started reading about invisible ink and revealing codes to select candidates, well, I kind of lost interest. Add on top of that the lack of recording devices on site only adds to the potential of box stuffing, unless I stopped reading too early there. Needless to say, integrity in voting needs only the following:

1. 1) Accuracy of count of votes cast
2. 2) Anonymity of vote cast
3. 3) Only 1 vote per voter
4. 4) Ability to audit 1 and 3 without violating 2

Electronic only systems fail on 1, 2, 3, and 4 currently. Absolutely nothing prevents cheating within the system and the systems themselves are subject to hacking making 4 inherently impossible to state for sure. Paper ballots can fail on 1 and 3, but because 4 is fundamentally supported by paper ballots the integrity is maintained. As far as I'm concerned, if electronic systems are used, they should merely make voting easier, faster, and more accurate. The process should be backed by paper no matter what. Yes, that means that there are printers. The fall back is pure paper.

Re: This is the attitude of many security experts

[david_thornley]

The neat thing about manual vote-counting is that people know what it is and trust it. If we have human counters supervised by representatives from all concerned parties, we have guaranteed reliability. We don't have that while running paper ballots through a machine.

Usually it's enough to spot-check the machines, selecting maybe 1% or 0.1% of precincts randomly after the election and comparing the manual count to the machine count.

Re: This is the attitude of many security experts

[david_thornley]

Boxes are labeled with the precinct identifier in my state. A box of ballots would either have no precinct on it, which means it's phony, or a duplicate precinct on it, which means something bad's going wrong.

Re: This is the attitude of many security experts

[david_thornley]

In which case we don't have fair elections no matter what we do. If there's nobody willing and able to act on complaints of dishonesty, anything goes.

Re:This is the attitude of many security experts

[david_thornley]

You don't need incorruptible neutral parties. You need people who are willing to do the job while being watched by observers from the parties. If a counter tries to cheat in favor of the Democrats, the Republican observer shuts it down, and vice versa.

Re:This is the attitude of many security experts

[david_thornley]

You can have central storage with boxes labeled by the precinct they came from. Since they've been pre-counted by machine, any serious attempt to change the vote later will raise suspicion.

This doesn't necessarily apply to really close elections, like Franken-Coleman in Minnesota 2008, but if the vote's that close it doesn't really matter for fairness which candidate is eventually selected.

Re:This is the attitude of many security experts

[dryeo]

The main reason to keep them for at least a couple years is if questions come up about the legitimacy of the election. 6 weeks is before the new guy is even in office. Once the ballots are destroyed, it would be much easier for a bad actor to change the totals. With an election, you have to always assume the worst which is that the people doing the certifiying and/or making the voting machines are potential bad actors.

I don't understand how the totals could be changed after everyone stands around and watches the counting, agree on the totals and they're certified and made public.
It is possible that the voter lists show inconsistencies, eg voters voting twice and it has happened that elections have been declared invalid by the courts and been redone, though it is rare.
Canada is different from the States. We usually vote for one government at a time (Federal, Provincial or Municipal) and using the Parliamentary system, we vote for Legislative members and the government is formed by which ever party(s) can control the legislature. It's even possible to change governments without an election and election dates are not set Constitutionality, rather the Constitution just gives maximums (5 years). Municipalities, not being sovereign, are different and similar to yours.

Re: This is the attitude of many security experts

[swillden]

You really should finish the paper, and understand it. It has all the advantages of normal paper ballots, and eliminates a lot avenues for manipulation. Among other things, it enables individual voters to verify that their vote was actually included in the final tally, but without enabling them to prove to anyone else how they voted. It also allows anyone to independently verify the final tally.

Re: This is the attitude of many security experts

[Gr8Apes]

it enables individual voters to verify that their vote was actually included in the final tally, but without enabling them to prove to anyone else how they voted.

This is the logical equivalence of stating "true" is "false". If you can verify your vote was included in the final tally, ie, I cast my vote for candidate A, then yes, you can prove to someone else you voted for candidate A. Otherwise, you cannot verify that your vote for candidate A was included in the final tally. QED

Re: This is the attitude of many security experts

[swillden]

it enables individual voters to verify that their vote was actually included in the final tally, but without enabling them to prove to anyone else how they voted.

This is the logical equivalence of stating "true" is "false". If you can verify your vote was included in the final tally, ie, I cast my vote for candidate A, then yes, you can prove to someone else you voted for candidate A. Otherwise, you cannot verify that your vote for candidate A was included in the final tally. QED

Sigh. Read the paper.

This is actually kind of funny. The last time I posted about Scantegrity (a month or so ago), david_thornley made exactly the same argument, repeatedly. Then I eventually convinced him to actually read the paper and he understood. The same thing happened a year or so ago with a different slashdotter.

Essentially, this verification is a variation on the cryptographic notion of a zero-knowledge proof. It's done entirely differently from common zero-knowledge proofs, but it's conceptually related.

Re:MOD PARENT DOWN -1 REDUNDANT

[Anonymous Coward]

Wow, Chris, you're really off your rocker lately. No one is "trolling" you, we're simply sick and tired of you.

"The"?

[RyanFenton]

Shouldn't it be "the overwhelming majority of computer scientists who've even casually looked at voting security" in favor of paper ballots over the current implementation of computerized voting? Hasn't this been the case for well over a decade?

Ryan Fenton

Re:"The"?

[Mal-2]

Shouldn't it be "the overwhelming majority of computer scientists who've even casually looked at voting security" in favor of paper ballots over the current implementation of computerized voting? Hasn't this been the case for well over a decade?

Unfortunately, the flipped statement is also true. The overwhelming majority of people opposing the current implementation of computerized voting are computer scientists who have even casually looked at voting security. This makes for a fairly small group, and they deserve the assistance of those of us not qualified in CS but who think they're almost certainly right.

Re:"The"?

[Ol Olsoc]

Unfortunately, the flipped statement is also true. The overwhelming majority of people opposing the current implementation of computerized voting are computer scientists who have even casually looked at voting security. This makes for a fairly small group, and they deserve the assistance of those of us not qualified in CS but who think they're almost certainly right.

There are scientists out there who can have their opinion bought.

So if I read you correctly, you are saying that a system that requires private physical access to a huge number of ballot boxes is less secure than a system that is the equivalent security wise, of Internet of Things security cams?

I'd be pretty reluctant to hire a security expert or computer scientist that believes such a thing. Then again, there are people who belive we never wnet to the moon.

Re:"The"?

[Mal-2]

I think you have completely misunderstood me.

What I was saying is that while computer science and security experts understand the danger, they are just about the only group that does. They need help getting the word out, because the public writes them off as alarmists even in the face of clear evidence that they are right.

Re:"The"?

[david_thornley]

When I get into discussions, I also raise the ability of most people to clearly understand that the process is fair. In a democracy, it's at least as necessary to assure the voting public that they weren't cheated as to select a winner.

Re: MOD PARENT DOWN -1 REDUNDANT

[Anonymous Coward]

Perhaps it's time to file a police report about your behavior. Have fun when you get arrested and have criminal charges filed against you.

I am a computer scientist...

[Anonymous Coward]

and I approve of this.

Re: I am a computer scientist...

[Anonymous Coward]

I am a computer scientist and I can vouch that cryptography and blockchain technologies make electronic voting far more secure than paper ballots.

Re: I am a computer scientist...

[Anonymous Coward]

One of the requirements for a proper voting system is that ordinary people can understand it and oversee its correct implementation, so that they don't need to take someone else's word for it. Computers are basically out by definition.

Re: I am a computer scientist...

[Anonymous Coward]

Computers have bugs, both software and hardware. They also may have backdoors installed by the company building these machines. By using these devices, you're handing over control over important events to a few people, the exact opposite of a democracy.

Votes should be and anonymous, hidden from everyone, including computers. Even if the machines don't tamper with the votes, there is a high possibility that they can make voting non-anonymous.

Paper voting is simple, transparent, anonymous, and hard to tamper with on a wide scale. Computer voting is complex, non-transparent, non-anonymous and subject to vote tampering on a wide scale.

Re: I am a computer scientist...

[Ecuador]

I am a computer scientist, and I can confirm you are full of shit. Electronic voting only works in theory (and not even in a more complete theory that takes into accounts all actors involved in implementation & usage of such systems). In practice, you should only use technology to count physical ballots efficiently.

Re: I am a computer scientist...

[Anonymous Coward]

Is there even another country in the world that uses e-voting?
My government tried it for one or two election, and then quickly abandoned it after it was shown to be completely open to abuse.
I think it's more likely that you are a Russian troll.

Re: I am a computer scientist...

[Anonymous Coward]

All of the arguments against electronic voting are hypothetical at best.

there's nothing hypothetical about saying "there is no known way to verify the results"

Re: I am a computer scientist...

[Anonymous Coward]

As secure as Cisco routers shipped overseas to Iran.

Re: I am a computer scientist...

[MichaelSmith]

Please define "secure". The anonymity of voting goes against normal computer security, where A to B and B to A are always traceable.

Re: I am a computer scientist...

[Anonymous Coward]

I am a computer scientist and I can confirm that blockchain technologies are not especially helpful here. Unless you plan to keep a bunch of distributed clients burning electricity between elections for no return, there's nothing that a blockchain gives you that a standard Merkle tree couldn't.

Re: I am a computer scientist...

[Pseudonym]

There's been a lot of work in non-interactive zero-knowledge proofs recently that can help with the anonymity issue.It's nowhere near ready for prime-time in an election, but good enough for a second-tier cryptocurrency.

Re: I am a computer scientist...

[david_thornley]

You're proposing something that I'd have to spend a little time on just to understand, and I'd have to carefully consider the implementation, and I do know something about software and proofs. The average person won't understand. There is a tremendous advantage in having a system that's obviously fair, rather than one with no obvious unfairness.

Re: I am a computer scientist...

[Pseudonym]

I agree. I happen to agree that paper ballots are superior for the foreseeable future, but the anonymity issue is not insurmountable in a technical sense. In principle.

Re:MOD PARENT DOWN

[Anonymous Coward]

You seem to be repeating yourself like a moron.

USE PAPER!!!

[connect4]

THIS ARTICLE IS POSTED AS THOUGH THIS WOULD SURPRISE US

We are well versed in these disciplines, none of this surprises us.

Sure, there are always kids around this site, many of whom probably think we can do this securely with blockchain or some other shit.

THOSE KIDS WILL GROW UP, GAIN EXPERIENCE, AND COME TO THE SAME REALISATION AS THE ADULTS

USE PAPER

Re:USE PAPER!!!

[Baron_Yam]

Actually... hybrid is best. Vote with paper, scan and tally with computers. If there is any doubt, you have the original paper watched over by election officials to verify.

Re:USE PAPER!!!

[connect4]

CORRECT: USE PAPER

Re: USE PAPER!!!

[Anonymous Coward]

Another useless post, Fred.

Re: USE PAPER!!!

[connect4]

THE GROWN UPS GET IT, AND ONE DAY, THE KIDS WILL TOO.

I could type a lot more, but it would be pointless, as it wouldn't accomplish what time will.

Re: USE PAPER!!!

[Anonymous Coward]

You could type a lot more, but it would he repeating the same ad hominem logical fallacy. I pointed out plenty of ways in which paper ballots could be tampered with. You keep claiming that paper is more secure, but haven't provided a single shred of evidence to support it. It seems that the ad hominem logical fallacy is all you have.

Re: USE PAPER!!!

[connect4]

The only thing I "keep claiming" is that you will one day grow up. This is self evidently true, assuming your anger doesn't get the better of you in the meantime.

Re:USE PAPER!!!

[drinkypoo]

Or vote with computers, but produce paper (and show the voter the printout behind glass for verification) as a backup. Whatever method you use, it's critical to produce a paper ballot which is either created or verified by the voter. With that, at least you can go back and look for fraud.

Re:USE PAPER!!!

[Baron_Yam]

>Or vote with computers, but produce paper

I disagree. If the computer is handling the voting, it's easier to corrupt the process, and an equipment malfunction means the poll is closed.

Paper and pencils - vulnerable to fire and theft, but not much else. (And yes, pencils, because they don't dry up in storage, their marks don't run if the ballot gets wet, and you can still see traces of the old mark if someone tries to erase and replace it)

Re:USE PAPER!!!

[currently_awake]

No paper means no paper trail to audit.

Re:USE PAPER!!!

[Anonymous Coward]

No. The whole process from start to finish MUST be understandable and simple for any voter to understand. That means no electronics, no complicated counting systems, no complicated rules.

I don't know a single one who doesn't

[Anonymous Coward]

Computer scientists know that there is no electronic voting system that satisfies all requirements.

That's only part of the problem....

[Anonymous Coward]

Yes, paper BALLOTS are the best at audit trails and recounts and the least hackable. Adequate other controls (such as UUIDs and serialized ballot blanks) can deal with ballot box stuffing or attempts to swap ballots.

However ballots have to be machine countable. Paper ballots (scantrons, punch cards, etc) are the worst at actually recording the voter's INTENT.

The Best system would be a completely split air-gapped system. The system that COUNTS the votes has to be separate from the one that RECORDS the vote.

Touch screens or other devices record the voter's intent onto paper ballots that are HUMAN READABLE. Then the voter can review it for errors, and take it to the other side of the room to put it in the ballot box or system that COUNTS the votes.

Less human error, easy recounts, and the voter can directly confirm their intent was properly recorded.

The other third of the problem is making sure voters are who they say they are, are legally entitled to cast a ballot---and that they cast only one ballot.

Re:That's only part of the problem....

[arth1]

However ballots have to be machine countable.

No, they don't. Manual counting works quite well.
Observers who oversee (but cannot inferfere with) the counting and double counting works great in many countries. And they even get their results quicker than the US, both for small and large districts.

Re:That's only part of the problem....

[Sigma 7]

Paper ballots (scantrons, punch cards, etc) are the worst at actually recording the voter's INTENT.

I've used plenty of paper ballots in previous elections. The only reason you can't catch the voter's intent is because it's a coarse first-past-the-post system where the person with the most votes wins. This prevents telling the difference between someone voting for a the best candidate or someone doing strategic voting to prevent a bad candidate from being elected. Likewise, a vote for a kook candidate because someone believes them, or because they're dissatisfied with the other candidates.

Changing from paper ballots only helps if you have some complex system where it becomes difficult to count various combinations.

Touch screens or other devices record the voter's intent onto paper ballots that are HUMAN READABLE. Then the voter can review it for errors, and take it to the other side of the room to put it in the ballot box or system that COUNTS the votes.

Okay, so paper ballots are the worst at recording voter's intent, yet you recommend some form of paper ballot to record the voter's intent? Might as well get a political opinion from a pinball machine.

Paper ballots already match what you described as ideal. A device known as a pencil is used to record a voter's choice, and the voter can review it for errors before putting it in the ballot box and/or counting machine.

Re:That's only part of the problem....

[Anonymous Coward]

First, machine counting is more accurate than hand counting. The problem is reliability (due to hacking or misprogramming) which is handled very well with auditing.

Your comparisons to other countries are not valid (you didn't even cite a single example to compare). A single-race ballot can be hand counted quickly, but manual counting with multi-race ballots (which are almost all general election ballots in the US) is very slow and cumbersome.

Look at the time needed just to hand count a few counties in Florida in Bush v. Gore.

Separate air-gapped system for recording and counting is must easier to audit and verify than when the same system does BOTH recording the votes and counting them.

Re:That's only part of the problem....

[arth1]

First, machine counting is more accurate than hand counting.

No, it is not. With hand-counting, the votes are always counted multiple times by different people. That gives greater accuracy than a machine that will make the same errors over and over again.

Your comparisons to other countries are not valid (you didn't even cite a single example to compare).

That's deliberate. If I did mention a single country, someone would jump in and say "oh, but country X is different because it has [fewer people|more people|bigger districts|smaller districts]".
It won't take you long to find countries where machine voting is illegal, and election results are still available the same night.

And the onus should be on those who claim that machine voting increases speed to provide evidence for that, because not counting with a machine is the baseline.

Look at the time needed just to hand count a few counties in Florida in Bush v. Gore.

That was hand counting machine votes, you dolt. "Dimpled chads" or misplaced optically readable stamp marks is not a problem where the votes are designed for human and not machine parsing.

Re:That's only part of the problem....

[Anonymous Coward]

Minnesota had a gubernatorial election in 1962 that wasn't decided until May. Paper ballots were used, but there were still many ambiguous ballots that were disputed by the two sides. In Florida the machines created a lot of ambiguities but having people use a pencil or pen doesn't eliminate them entirely. The problem in Florida was really the vote marking system, not the vote counting.

Re:That's only part of the problem....

[arth1]

Minnesota had a gubernatorial election in 1962 that wasn't decided until May. Paper ballots were used, but there were still many ambiguous ballots that were disputed by the two sides.

That's a legislative problem, not a voting counting problem.
Instead of allowing party observers to hold up an election, they should be observers only.
The count should be done at least twice - one at the polling station, and one at a central location by different people who won't know the origin of the urn. If the two counts for any urn match, the urn is approved. If they don't match, it's sent to a third location for a recount, and if that result matches any of the two preceding results, the urn is approved.
The minute the the number of approved urns are enough that the remaining urns don't affect the results, the election result are officially declared.
Only if the three results are different, will there be a delay from the streamlined process, and then only for those urns.
The observers can use their collected evidence to sue for change in the voting process and re-election, but not the election result itself. The voting process must be free from political interference.

Re:That's only part of the problem....

[david_thornley]

No, it's a physical problem. Some ballots won't be perfectly filled out, but the law (at least here) says that ballots that show a definite selection of one candidate should be counted.

It's particularly important for voting by mail. If I fill out a ballot at my voting place, and stick it into the machine, it will reject it if it can't read it, and I can get another ballot, so there's some check there that doesn't exist with a mail-in. There are also things like the 2008 Minnesota Senatorial election, in which it turned out that the printed instructions for absentee ballots didn't match what the law said. I'm not at all sure my mother's vote was counted, due to filling things out according to the printed instructions. That was remedied by the next election.

Re:That's only part of the problem....

[arth1]

It's particularly important for voting by mail.

And that's a big problem in itself. It opens up for buying and coercing votes, as the person can be observed when voting.
Other countries solve this by having voting booths for early voting at police stations, town halls, hospitals, military bases and embassies in foreign countries. That allows for verifying that the voter has privacy when picking and casting the ballot, and assists with counting given that the ballots are handled like any other ballots, with an actual sealed urn being sent for counting, and not individual letters.

When humans read the votes, and each ballot box needs a 2 out of 3 agreement by different counters before being approved, you avoid a lot of the problems with determining intent.
Allowing party representatives to challenge votes is perhaps the worst hold-up in American politics. It seems almost self-evident that a requirement for a fair election is to ban interference by those who run in the election during the voting process itself. The only thing that should be allowed is observing, not interfering.

Re:That's only part of the problem....

[david_thornley]

And you've just removing the possibility of voting for immobile people. No system is perfect.

I agree that absentee ballots are trickier than in-person ballots, but there will be people who can vote in no other way.

Allowing party representatives to challenge the process at any time is vital to preserving trustworthiness. What's the use of an observer who can just watch fraud going on and can't interfere with it?

Re:That's only part of the problem....

[arth1]

And you've just removing the possibility of voting for immobile people.

That does not follow. In some countries with universal socialized healthcare, if you can't come to the voting booth, the voting booth comes to you. Ambulatory voting stations is also how votes are cast in hospitals and high security prisons (in most countries, disenfranchisement is illegal).
As long as there are at least two unrelated people somewhere, a voting enclosure can be erected, so the ballot can be cast in secrecy.

The only ones having a real problem are those who are abroad and without access to an embassy or consulate, or trekking alone through the wilderness. But presumably those are in that situation by choice, knowing that it would mean not being able to vote.

Re:That's only part of the problem....

[david_thornley]

In at least some cases, people go places despite losing the ability to vote. There's real uses for voting in advance.

Couple the ability to vote in advance at appropriate locations, and the mobile voting booths you mention, and vote by mail isn't necessary.

Re:Russia? LOL!

[Anonymous Coward]

Fuck every single person who voted for Donald Trump. We've had our troops fighting, killing, and dying in the name of our alliance with the United States, and what do the ignorant racist fucks in america do to honour that sacrifice? Put Donald Fucking Trump in the commander in chief. Fuck all of you unpatriotic filth, reap what you sow.

Physical record is least tamperable

[Anonymous Coward]

Vote on paper. Voters can visually check the recoding of their vote.
Have machine counting and sorting. Then you can manually verify the count on the machine sorted piles and double check the marking. We have the image processing technology to do this with many marks on a page. You can run through the sort machine on any one vote and get it to sort by that particular vote. So with many issues on a ballot any single poll can be checked easily by humans.

Remember how Landslide Lyndon (Johnson) ...

[Anonymous Coward]

Remember how LBJ got the name "Landslide Lyndon" where a ballot box of paper ballots turned up with just enough votes to let him get elected to the Senate?
Paper ballots resist certain attacks but are vulnerable to others. They are not a panacea. Instead they have been hacked in the past many many times.

Re:Remember how Landslide Lyndon (Johnson) ...

[Pseudonym]

They are not a panacea. Instead they have been hacked in the past many many times.

I work as a casual election official in Australia, and believe me we know. For every hack that has been tried in the past (and quite a few that haven't), there is an anal-retentive procedure which combats it.

It's not a panacea, but Australia has some of the cleanest elections in the world. Nobody seriously disputes the results of our elections.

Vote Safer. Vote on Paper. Vote Absentee!

[Gim Tom]

I have been trying to get people I know in my state to request an absentee paper ballot for each election and use it to cast their vote. The process here is very easy, with virtually no tests for actually needing to vote absentee. Perhaps this should be done nation wide as much as possible. If the VOTERS overwhelmed the ballot boxes with absentee paper ballots that might just send the message that computers should not be used for voting!

My state still uses the old Diebold DRE machines that CAN NOT be audited. I was on the evaluation group when they were chosen after the 2000 election and was a lone voice pointing out their lack of security and impossibility of being audited or having a valid recount.

Re:Vote Safer. Vote on Paper. Vote Absentee!

[Anonymous Coward]

The only thing worse than electronic voting is absentee ballots.

Re:Paper has no advantage over digital records

[religionofpeas]

Whatever actions you perform on the paper votes to optimise the security of the system can be done on digital records too.

A layman could inspect a polling station, and witness the paper ballot counting to confirm everything is done accurately. The same layman cannot inspect an electronic voting machine and confirm it has counted all the proper votes.

Canadian paper ballots are amazing

[berj]

The ballots we use up here (and the system we use to count and track them) are amazing.

The voter goes to a table where the ballots are handed out by elections officials. The ballot has the candidate's names in alphabetical order and a removable counterfoil that has a serial number that matches against the book that the ballot was torn from. The official puts their initials on the ballot and hands it to the voter. The voter goes behind the screen and marks the ballot and folds it. The counterfoil and initials are still visible.

The voter hands the ballot back to the offical who checks both the signature and the serial number on the counterfoil (this ensures the voter has returned the ballot they got). The counterfoil is then removed and now the ballot is completely anonymous. The voter then gets the ballot back and she places it in the ballot box in front of the official.

When it comes time to count the votes, the elections officials count all of the ballots in the presence of other non-partisan officials as well as the candidates themselves or their representatives -- a vote isn't recorded until everyone has seen and verified the ballot. Once everything is counted and verified (does the number of ballots counted match the number given out and returned by voters, etc) the tally is made on paper and the ballots themselves are sealed up and passed up the chain. They are kept for 7 days in case a recount is needed.

The great thing about this system is that it scales to any population size since the ballots are counted right there at the polling station, box by box and verified on the spot.

It's certainly not perfect and there are some opportunities for tampering but nothing even in the same universe as the kind of wide-spread hacking that can occur with electronic systems.

more detail:

http://www.elections.ca/conten...

http://www.elections.ca/conten...

Re:Canadian paper ballots are amazing

[DontBeAMoran]

Since I post too much and never get any mod points, all I can give you is a virtual +1 Informative.

Re:Canadian paper ballots are amazing

[Anonymous Coward]

I don't understand what the point is with this:
> this ensures the voter has returned the ballot they got
I don't really see what it protects against.
Vote buying? Only marginally I'd think? If the one buying the vote required you to return the original, you can still open the "bought" vote, change it, and put it in a new envelope?
People voting multiple times? Can't you just check that they don't come back twice to cast the vote?
I guess it is an extra check that no extra ballots "magically" appeared and disappeared, and maybe I shouldn't complain about an extra layer of security, but it seems a bit overkill.

Re:Canadian paper ballots are amazing

[berj]

Honestly, I'm not sure. I suspect you're right that it's a bit of overkill.. but as you say.. an extra layer of security that is simple to implement can't hurt.

Re:Canadian paper ballots are amazing

[david_thornley]

What it doesn't scale to is US-style ballots with at least two dozen races or questions on a given ballot. Counting those by hand at the polling place is going to be difficult at best.

Re:Canadian paper ballots are amazing

[berj]

There's always a way.

Off the top of my head:

You can have one group of scrutineers (that's what we call the candidates' reps who validate the ballots) and deputy returning officers (the people who run the polling station and actually count the votes) for each race. As each ballot is counted for a particular race or question you mark the ballot as counted and pass it down the line to the next group.

Once a ballot has been exhaustively counted you put it in an envelope which is sealed and passed up the chain.

Alternately the ballot could be perforated so that you tear off the piece that corresponds to each race after counting and before passing the remainder of the ballot down the line. That way the ballots from each race are isolated from each other so that validation and recounts can be handled race by race without interference from or interaction with each other.

There's always a way and regardless of any added difficulty (though I don't see how this can add any since presumably each race has its own funding and thus can pay for the staffers to manage it) it's sitll incredibly secure and accurate. Not perfect, of course. But I can't fathom a world where an electronic system is more secure.

Finally

[markdavis]

I have been complaining for many years, ever since my State ditched the simple and effective "punch cards" and went to horrible touch-screen computer voting. It removed every trace of auditing capability and introduced a system that not only could be horribly abused or hacked, but also made it easy to track the identity of who voted- clearly violating the principles of confidentiality of voting.

Finally, this November, my State switched to paper ballots. The voter is registered as usual, then given a generic paper ballot, and just marks on the paper what they want, and the voter inserts it into a machine that reads it and stores the sheet of paper securely. Cheap, simple, easy-to-use, 100% verifiable, and anonymous. I only hope that every State follows such an example.

The next challenge is to get ranked/IRV (Instant Runoff Voting). Then things can really start to change for the positive.

http://fairvote.org/

Re:Paper has no advantage over digital records

[Anonymous Coward]

"On the other hand, the electronic version has many more advantages like immediately creating as many copies as required."

My vote is my vote. It should be counted without duplication. That's kind of one of the principles of voting.

I don't mean this sarcastically. A vote is a transient record that matters only in context.

If you think you're good enough to build electronic voting systems: you probably are not. Sorry.

Re:Paper has no advantage over digital records

[CustomSolvers2]

A layman could inspect a polling station, and witness the paper ballot counting to confirm everything is done accurately. The same layman cannot inspect an electronic voting machine and confirm it has counted all the proper votes.

And what if that layman wants to unfairly affect the results? There would have to also be another layman looking at what that first layman is doing; but what if, etc. At the end you have to trust in something/someone. The more eyes/checks the better and a properly designed electronic system can perform lots of checks, backups, logs, perfectly-understood-by-laymen reports, etc. Or how do you think that virtually everything works in the world? With people looking closely at what computers do? The problem here isn't about doubting the counting reliability of computers, but about some unreasonable fears regarding digital systems being more vulnerable than conventional ones.

Re:Paper has no advantage over digital records

[CustomSolvers2]

My vote is my vote. It should be counted without duplication. That's kind of one of the principles of voting.

Backuping/redundance isn't duplication, but a safety measurement. What if there is a fire in the room where you voted and everything is lost? How do you think that most of big websites work such that no matter what happens to their computers your data is always accessible? You can have 5, 10, 100 copies of the same record, always verifying some basic constraints like all of them always having the same value, without that affecting the uniqueness of your vote.

If you think you're good enough to build electronic voting systems: you probably are not. Sorry.

I guess that I cannot always win. At least, I know that I did all what I could to get one of those juicy contracts. LOL.

Re:Paper has no advantage over digital records

[Anonymous Coward]

In every election, there are opposing sides (naturally) and people from opposing sides who can and will oversee the election and each other. A paper ballot vote can easily be performed in a way that does not give any single actor a way to manipulate the voting, counting or tallying process. This is not the case with electronic voting.

Hybrid required.

[Gravis Zero]

People seem to praise paper ballots like they are flawless but they forget that ballot box stuffing and corrupt vote counters existed before we invented the computer.

What we need is a hybrid system of human readable votes and computerized automation. While generally hyped as a technology a information for a blockchain could be stored both on the paper ballot and voting machine memory to ensure no votes had been inserted, erased or altered. Using this methodology with a series of isolated single microcontroller systems not just air-gapped but lacking the basic hardware needed for network communication would combined with signed binaries and radiation-hardened software (yes, that's a thing) would radically improve security.

We have the technology to fix this problem and remove all single points of failure but have yet to do it.

Re:Hybrid required.

[Anonymous Coward]

Yeah, the problem with that is that we are not using any of those things.
And you are stuck using chips fabbed in some shithole next door to china.
the reality of electronic voting is that you have a lowest bidder shitbox that can be reprogrammed to do whatever the fuck you want.

Re:Hybrid required.

[Anonymous Coward]

>People seem to praise paper ballots like they are flawless but they forget that ballot box stuffing and corrupt vote counters existed before we invented the computer.

Corrupt counters are possible. But there's significant problems with trying to corrupt the counters.

1) There isn't a single counter at any polling station. For local elections, all candidates will be present to observe the count. For larger scale elections then it will be representatives of the candidates or their parties. For a count to be considered official all involved parities need to agree that the count was fair and accurate. So to unfairly influence the count, you'd need to have paid off the counters and all the loosing candidates. That's an expensive problem. And leads to another problem.

2) Corrupting counters doesn't scale very well. You've spent the money to corrupt the one station but typically speaking it's just one station in many. You need to corrupt at least half of the stations in order to control a vote. But the more people you add into the conspiracy, the more likely that information will be leaked.

It's far more cost effect just to launch a propaganda campaign then it is to try and corrupt a paper ballot system. And paper ballots, by the design of the system, become less susceptible to corruption as a population grows, since more polling stations are added which reduces the the damage that any one failing station can cause.

>What we need is a hybrid system of human readable votes and computerized automation. While generally hyped as a technology a information for a blockchain could be stored both on the paper ballot and voting machine memory to ensure no votes had been inserted, erased or altered. Using this methodology with a series of isolated single microcontroller systems not just air-gapped but lacking the basic hardware needed for network communication would combined with signed binaries and radiation-hardened software (yes, that's a thing) would radically improve security.

As someone wiser then me once said; "You've just invented an expensive pencil."

The only real advantage that computer counting has over paper ballots is that it's infinitely faster to tally the ballots. With that advantage comes significantly problematic security concerns though. Chips can be counterfeited (Ask FDTI, Prolific, Intel, AMD, Nvidia etc. just how much of a headache they have with counterfeiters getting into legitimate supply chains) at which point it won't matter what software is used. Now you can detect it but it usually requires destructive testing of the devices in question.

Re:Hybrid required.

[Anonymous Coward]

You don't understand. When the voters do not understand the system, the system loses credibility. It does not matter how cool or secure the new automated system might be.

First they obfuscated our money and our livelihood lost meaning. We don't know anymore if the fiat currency we use is worth anything tomorrow.
Now they obfuscate our democracy and our freedom loses meaning. We don't know anymore if our votes have any effect.

An interesting series of events, maybe

[blindseer]

Do I have this right? We have "progressive" organizations (called such in the article) that fought hard for electronic voting machines. Trump gets elected. Now they want paper.

There's been suspicions among "right wing" groups that these "progressives" have been using absentee voting and electronic voting machines to make vote fraud easier. The progressive candidates get their head handed to them on a platter in an election a year ago and NOW they think electronic voting is a bad idea?

There's a part of me that thinks these people that have been participating in voter fraud realized that the opposition could in fact be also participating in fraud. To actually prove there was fraud though requires a paper trail. Electronic voting means no paper trail.

Regardless of why these "progressive" groups got the message I'm just glad they did.

I'm not saying any fraud has in fact happened, only that everyone seems to be accusing the other of participating in fraud.

(What makes these people so "progressive" anyway? What are they progressing towards? Progress implies a path to take, or some goal to achieve, I'm not sure what that is though.)

Re:An interesting series of events, maybe

[Anonymous Coward]

Do I have this right? We have "progressive" organizations (called such in the article) that fought hard for electronic voting machines. Trump gets elected. Now they want paper.

Replace "Trump" with "GWB" and recognize the whole complaint originated because of Florida and the butterfly ballot. Further, note that progressive organizations often call for "progressive" (aka new) ideas and then quickly go against them because, well, progressives are often idiots who are more interested in new than good.

There's been suspicions among "right wing" groups that these "progressives" have been using absentee voting and electronic voting machines to make vote fraud easier. The progressive candidates get their head handed to them on a platter in an election a year ago and NOW they think electronic voting is a bad idea?

I find it odd that "right wing" groups are worried that "progressives" are committing voter fraud in a fashion that they could just as well do since they've so well outlined, in their minds, how to do it. Ie, if there is voter fraud, I can only imagine it being an across-the-board thing.

There's a part of me that thinks these people that have been participating in voter fraud realized that the opposition could in fact be also participating in fraud. To actually prove there was fraud though requires a paper trail. Electronic voting means no paper trail.

Which is, again, a major reason progressives quickly realized electronic voting was a bad idea. Again, this is nothing new. Progressives are often reactionary idiots that have to take a step back and realize there's a reason for the old way. Which is not to say "butterfly ballots" were ever a good idea.

Regardless of why these "progressive" groups got the message I'm just glad they did.

Which then makes it odd because it was Republicans and Democrats alike which have kept pushing electronic voting even after the backlash from "right wing" and "progressive" groups. Does that give you a message about who really is in power?

I'm not saying any fraud has in fact happened, only that everyone seems to be accusing the other of participating in fraud.

What better thing to do than to muddy the water, regardless of who wins? It discourages voting and encourages long-standing R or D districts to keep going the same way. Those in power don't care about the R or the D. They just want to stay in their current job.

(What makes these people so "progressive" anyway? What are they progressing towards? Progress implies a path to take, or some goal to achieve, I'm not sure what that is though.)

Improvement, often through technological means. Think utopia sci-fi. Obviously, such is a fantasy and more moderate progressives (which are the norm, just like moderate conservatives) know that technology should be evaluated before being used for whatever improvements can be made to society. Individually, of course, it's just whatever what a person wants to do. I do think it funny, btw, that progress is such a dirty word to job creating conservatives. Oh, right, job creation is a side-effect of business, not an intentional act and not a by-product of ideology.

Re:An interesting series of events, maybe

[Anonymous Coward]

The detected fraud in the 2016 election was by ultraconservatives who believed liberals were ballot stuffing (several admitted to voting for Trump, all were conservatives or in conservative precincts). So spreading the unfounded rumor that there was *widespread* election fraud has caused election fraud. Thank you blindseer, for being the cause of the problem.

https://www.washingtonpost.com/news/the-fix/wp/2016/12/01/0-000002-percent-of-all-the-ballots-cast-in-the-2016-election-were-fraudulent/?utm_term=.2827f5fe56f6

These few fraud cases do not encompass the entirety of the conservative antidemocractic machine. Illegally purging polls, moving polling places, closing polling places, creating unconstitutional barriers to voting have resulted in undercounting by millions. Not to mention the holdover from slavery the Electoral College and the unrepresentative Senate.

Re:An interesting series of events, maybe

[Anonymous Coward]

Do I have this right? We have "progressive" organizations (called such in the article) that fought hard for electronic voting machines. Trump gets elected. Now they want paper.

No, you do not have it right. The Bush administration pushed for electronic voting in response to the Florida fiasco in 2000. A bi-partisan congress provided funding to the states to buy electronic voting machines. The bi-partisanship ended in 2004 when the conservative CEO of voting machine company Diebold stated, "I am committed to helping Ohio deliver its electoral votes to the president."

Re:An interesting series of events, maybe

[david_thornley]

A discussion of voting systems really should leave one's personal politics out of it. This isn't a partisan issue.

And, of course, you're wrong. People all over the spectra wanted electronic voting machines for one reason or another. The most egregious case was when the head of Diebold, who produced voting machines, said he'd deliver Ohio to Bush. (Bush, as it happens, has seldom been described as "progressive".)

There have been lots of people arguing for paper rather than electronics for a long time now. This is nothing new.

Naturally, this wouldn't eliminate all fraud. It would not, for example, eliminate making it harder for some people to vote or register, or pruning voter rolls, or being more lenient on the requirements for the "right" absentee ballots.

"The"

[bistromath007]

All computer scientists worthy of the name prefer paper voting.

Re:"The"

[Anonymous Coward]

If I had karma to give I would give you all of this so much THIS

It's called computer science, but...

[Anonymous Coward]

It's really "information theory and practice". If people whose first idea usually is to use a computer tell you not to use a computer for an information gathering and processing job, you should take heed. You know they have tried everything to make it work with their favorite tool, but they still ended up recommending against it.

Re:Paper has no advantage over digital records

[religionofpeas]

And what if that layman wants to unfairly affect the results?

The layman is only allowed to watch, not touch.

At the end you have to trust in something/someone

No, because you can go to the polling station yourself, and be that layman.

a properly designed electronic system can perform lots of checks, backups, logs, perfectly-understood-by-laymen reports, etc.

How can you tell it's actually properly designed ? You have to assume the worst, namely that it was purposely designed to rig the election, and fake the checks, backups, and logs.

Or how do you think that virtually everything works in the world?

We do what we can. Elections have some unique aspects that make it necessary to be extra vigilant. The anonymity of the process makes a proper audit very difficult, and the stakes are huge.

Re:Paper has no advantage over digital records

[Anonymous Coward]

Until you show me a voting system with not flaws in it, paper is better.
The current systems have all been shown to be weak, and yet people still insist electronic voting is better.
Maybe the mythical perfect implementation. But that doesn't exist in reality.

Re:Paper has no advantage over digital records

[CustomSolvers2]

You might even come up with alternatives to compensate the lack of trust; for example, automatically generating printed copies of all the votes such that people interested in crosschecking the results might count all of them manually. There are many possible alternatives and no need to abandon a format with many more advantages because of unreasonable fears. A computer is as hackable as a paper vote might be removed/added.

Re:Paper has no advantage over digital records

[CustomSolvers2]

We do what we can. Elections have some unique aspects that make it necessary to be extra vigilant. The anonymity of the process makes a proper audit very difficult, and the stakes are huge.

People can beat computers on many fronts, but not on objectivity and fairness. You want to account for a worst-case-scenario of human behaviour by relying on humans?! You can rig a computer system as much as you wish, but there will always be a clear track of actions and actors. You cannot track people's decisions. You are kind of implying that computers are obscure and unpredictable, but they are right the contrary. People are obscure and unpredictable.

Re:Paper has no advantage over digital records

[religionofpeas]

automatically generating printed copies of all the votes such that people interested in crosschecking the results might count all of them manually

And what are you going to do if the voter claims that the printed vote is wrong ?

a format with many more advantages

There's only one advantage: it's faster. The whole election circus takes months. We can wait another day for the votes to be counted.

because of unreasonable fears

There's nothing unreasonable about fearing tampering with elections.

Re:Paper has no advantage over digital records

[CustomSolvers2]

yet people still insist electronic voting is better.

I am not defending electronic voting, but electronic records in general; at least, its reliability and traceability. Paper is almost part of our past already. The fact that, due to the peculiarities of voting like mistrust among parties as highlighted by other comments, some electronic voting approaches haven't been too good doesn't invalidate what is applicable everywhere else. You might even create a mixed system if you prefer. But for all what is related to (huge amounts of) data, the electronic version will always have tons of advantages with respect to any other one.

Re:Paper has no advantage over digital records

[religionofpeas]

You can rig a computer system as much as you wish, but there will always be a clear track of actions and actors.

That's not helpful if there's no way to audit that track.

You are kind of implying that computers are obscure and unpredictable, but they are right the contrary. People are obscure and unpredictable.

Agreed. If people programmed the computer to rig the votes, that's exactly what's it going to do.

Re:Paper has no advantage over digital records

[CustomSolvers2]

And what are you going to do if the voter claims that the printed vote is wrong ?

Press the rigged-election alarm button, put the person developing that system in jail and immediately hire me as you should have done the first time? LOL. See, it seems clear that neither of us are willing to change our ideas, so I hope that you don't mind if I cut the chat here.

Re:Paper has no advantage over digital records

[Anonymous Coward]

Uh, you simply have one layman for each interested party attend. And there be buck and "what if" stop, because if the party has people in it trying to change the election to the party's disadvantage, the issue is no longer an election system. It may affect the correctness of the election, but it doesn't really break its usefulness as a democratic tool.

> Or how do you think that virtually everything works in the world?

By either keeping everyone happy enough (but in elections someone has to lose, so not an option) or by having the courts and police step in and decide and enforce what is "correct" (this would badly erode the legitimacy of elections).
Also a lot of systems in the real world get hacked and fully compromised, and remain so undetected for years. That is a worse track record than any kind of election in the world ever had, those that are bought or manipulated usually everyone at least knew they were, and usually even before they got started.
So I am not sure where you were going, you seem to have rather argued the opposite of your point...

> but about some unreasonable fears regarding digital systems being more vulnerable than conventional ones.

If we were to take some average person on the street, who in addition believes you are a liar and full of shit (but is generally reasonable), how would you envision would a digital voting system to look like that would make it easier to convince him that the election result is valid, compared to a paper one?
I feel fairly confident about the paper one, with the main arguments
- it's been in use since a really long time
- each significant party has someone present at the polling station, checking they are not disadvantaged, and they can do so by looking at every step as it happens. You surely do generally trust the people in party X you are voting for?
- the voting results in each district are printed e.g. in the paper, so these people from the polling station can and will check that everything was reported and added up correctly.
Specific concerns with vote buying, ballot stuffing etc. can be addressed fairly easily as well (though it should be noted that some places have rules that are a rather bad idea and do allow for much easier vote buying, e.g. if you cannot get a replacement ballot or you are not allowed to correct your vote and worse things for some digital systems).

Re:MOD PARENT DOWN

[Anonymous Coward]

What value did you contribute?

Simon is wrong!

[thegarbz]

Simon has fallen victim to fake news. Russians didn't attempt to meddle with the election, Putin said so and Trump has the uttermost faith that his BFF isn't lying about that.

Re:Simon is wrong!

[Anonymous Coward]

https://theintercept.com/2017/09/28/yet-another-major-russia-story-falls-apart-is-skepticism-permissible-yet/

Re:Paper has no advantage over digital records

[Anonymous Coward]

Votes burning does not matter when they are counted.

Votes are _transient_, not permanent records.

If the votes burn, you redo the vote. End of story.

It's become pretty obvious

[rsilvergun]

that there were Al Gore presidential election style shenanigans going on in at least Wisconsin. The only real question was why Hilary didn't push for a recount. The theory is she was so shocked by losing that it demoralized her. I could see that. She never for a moment thought she'd lose even with shenanigans. The dumb ass actually believed in that 'blue firewall' and 'Changing demographics' crap. That's not being in a bubble, that's being in a lead lined box at the bottom of the ocean.

Basically if you're even a _little_ tiny bit progressive in this country you have to win by at least 5 points or risk having electronic voting snatch the election from you.

Re:It's become pretty obvious

[Anonymous Coward]

There were no "shenanigans" in WI. Clinton didn't even campaign there, and there was a full recount which turned up nothing out of the ordinary. Why would HRC push for a recount when she had Jill Stein demanding recounts for her as a proxy? Get a grip on reality dude.

the USA has "too much" democracy

[Anonymous Coward]

I think part of the problem is that the US has "too much" voting going on, in terms of positions to fill and timing.

In November 2016, you had elections in many places for:

* president
* federal representative
* federal senator
* state governor
* state representative
* state senator
* mayor
* city councillor
* judges
* criminal prosecutors
* sheriff / police chief
* various state propositions / referendums
* etc.

All of this on one day. In 2018, in Toronto, Canada, I will be voting for:

* provincial representative in June
* mayor in October
* city councillor in October
* school trustee in October

The dates of the two elections are purposefully months apart to allow voters time to consider each election separately on the issues that are important for each one.

printf is easy debug method

[Anonymous Coward]

Trust but verify

Re:What a liberal puff piece.

[currently_awake]

And no way to disprove it, either. The system is designed to prevent audits.

Voting: should we even be doing it?

[Anonymous Coward]

Stalin said that they who vote decide nothing; they who count the votes decide everything.

I have extensive knowledge of this field as a former political operative. It is very possible to rig elections with electronic or paper ballots, and it does happen at times.

At the same time, not everything is a conspiracy. I have also seen many other times when people claim an election was rigged despite there being no rational evidence to substantiate the claim.

Far more common than changing the vote is having people who are ineligible to vote cast ballots, sometimes under the names of other people.

But here is the real problem: what kind of system is this where we all get together and make a big deal out of collective decision making over the lives of other people? And that the system is so fragile that it can be manipulated this easily? The fundamental problem is not that we need to fix voting; the problem is that we have voting at all. No, I do not mean we should want a dictatorship. We should want freedom: in our economy and in our personal lives.

Some of the best work on this subject has been done by Hans Hoppe in Democracy: The God that Failed. This is not an easy book, so do not start it unless you are committed to a serious study.

http://www.riosmauricio.com/wp-content/uploads/2013/04/Hoppe_Democracy_The_God_That_Failed.pdf

Re: Voting: should we even be doing it?

[Anonymous Coward]

This is not what political operatives do.

And having people vote in place of registered voters is easily detectable unless you've killed the real voters.

Re:Voting: should we even be doing it?

[david_thornley]

Far more common than changing the vote is having people who are ineligible to vote cast ballots, sometimes under the names of other people.

You left out the possibility of manipulating the voting rolls by various means, so the "right" people have a significant advantage over the "wrong" people. I've read of absentee ballots facing different degrees of rigor depending on the candidate, removing voters from the rolls without sound reason, making it easy for the "right" precincts to vote compared to the "wrong" precincts, etc.

Re:Paper has no advantage over digital records

[CustomSolvers2]

Votes burning does not matter when they are counted.

Whatever you prefer. The fact of not wanting to maximise one of the multiple advantages of an evidently superior format doesn't represent a reason to use the inferior one. I see many apparently-computer-savvy people in this thread complaining about similar "unsolvable problems" and defending the perfect solution of paper + manual counting (which BTW I guess that, in many scenarios, is fed into a computerised system to aggregate all the city/regional results)!! I would have understood punctual critics to specific aspects of certain implementations or people without too much knowledge being somehow afraid of what they don't fully understand, but seeing a so unanimous and apparently-knowledgeable position is kind of surprising.

The title of this irks me.

[hey!]

The editors seem to think a computer scientist would be expected to think digital only voting is a good idea.

Do you know anyone with expertise in computer science or engineering who thinks paperless voting is a good idea? I mean excluding people who work for companies that make the machines? Can you name even a single respected independent computer security expert who favors the damn things?

The overwhelming consensus among people who know anything is that paperless voting is a terrible idea.

another blooming idiot

[Anonymous Coward]

But for all what is related to (huge amounts of) data, the electronic version will always have tons of advantages with respect to any other one.

Well yes, OF COURSE, a system where it is easy to make massive fraudulent changes to all of the data has tons of advantages over a system where it is extremely difficult and expensive to commit fraud in a significant way.

Re:another blooming idiot

[CustomSolvers2]

Well yes, OF COURSE, a system where it is easy to make massive fraudulent changes to all of the data has tons of advantages over a system where it is extremely difficult and expensive to commit fraud in a significant way.

But how are you supposed to do such a thing in an even partially properly built system? Tell me, why all the banks have their own online versions (and, as said above, I am NOT defending online voting, because this would be much more difficult) and, consequently, all the money being electronically-accessible? Are you saying that changing some votes is way much more important than stealing millions of millions from anywhere, any time? Because once you have everything on a computer you can change it as you want, right? What about defense systems, nuclear plants, internet itself, etc.? How all that is working at all, when the only trustworthy thing we know is paper and manual counting?! LOL. We are talking about simply keeping track of relatively small amounts of data which are offline!!!! This is a low-level problem in today's programming world and many people here are showing it as an unsolvable nightmare, it is not! And additionally, you insult me!! You, the paper and manual-counting person! LOL. You are a very stupid "person".

Re:another blooming idiot

[Anonymous Coward]

I am NOT defending online voting

YES YOU ARE:

We are talking about simply keeping track of relatively small amounts of data which are offline!!!!

This is a low-level problem in today's programming world

you are making statements IN DEFENSE of online voting

learn what the word "defending" means, russian troll!

Re:another blooming idiot

[CustomSolvers2]

YES YOU ARE:

I cannot say too much against a so brilliant defense of your originally quite sensible random insult. You are repeating the same and putting everything in caps, you have to be right! LOL. You are soooo stupid that even writing it seems redundant.

you are making statements IN DEFENSE of online voting

No. Electronic voting (actually, electronic records). You know? You can do things on computers without dealing with internet at all. Well... I guess that all these are too complex ideas for you, sorry about having provoking you a headache with all these new ideas. LOL.

russian troll!

Out of all the stupidities you have written so far, this is the only one which I find slightly relevant. See, some random idiots like you have called me troll at different points and for different (no) reasons. As far as these pathetic idiots were ACs like you with extremely limited understanding and just coming in to randomly insult and then disappeared, I never had the chance to understand why they were saying that. I mean, you people seem crazily stupid so I don't expect you making too much sense but well...

So, you are saying that the fact of being Spaniard (born and currently living there and from 100% Spanish family up to no idea what generation), being called Alvaro (a very Russian name! LOL), not knowing anything about Russia (never been there, don't speak Russian, almost never met people from that country), not showing any kind of agreement with Russia or what it represents, being a remotely-working programmer whose main channel is precisely internet (e.g., what I am writing right now here can be read by a potential client), etc. All that means nothing to you, right? Because I wrote something which you don't like, consequently, I deserve to be insulted and, right after that, being called troll + from Russia (because currently you don't like this country)! Because anyone saying something which you don't consider right deserves to be insulted and be called troll (from Russia). LOL. Seriously, don't you understand that this (= talking to me) is not your place? Please, stop making a fool of yourself.

Re:another blooming idiot

[CustomSolvers2]

A small detail which I forgot to include in my previous reply: I usually refer to ACs (Anonymous Cowards in Slashdot) as "other AC" because I am also an AC, but not like you, a coward anonymously insulting others (as clearly highlighted in my profile, I never post anonymously here), but because of my name + first family name (Alvaro Carballo). As far as you seem specially stupid, I preferred to not confuse you more and just called you "AC". Hopefully, the words and the concepts in this post are simple enough for you to understand it. LOL

Re:another blooming idiot

[CustomSolvers2]

Another not-related-to-your-comment clarification (but, not sure why, I feel like this is a good place to write it): as clearly stated in my profile, I am poor what I always correct with "kind of poor" because I am not a hypocritical, detached-from-reality asshole unable to understand his tremendous luck for having been born in a relatively-rich country. I am poor from my country (Spain) perspective, but not from the world perspective. Poor means that I (or my family) have no goods, assets, properties, money, etc. but I do have quite a few debts; additionally, my only income source (= my salary; better: clients as far as a self-employed worker) is currently very low because I prefer to put my focus on long-term/quality, on doing things properly and on not caring about the ridiculous expectations of in-unreasonable-hurry idiots only provoking problems to everyone caring about their nonsense. On the other hand, I am very rich in application of "the less you need the richer you are". I am also quite rich in clear ideas, principles, knowledge, freedom, respecting others, humour (although you might not get most of it), objectivity and taking full responsibility for each of my actions (BTW, I expect everyone, regardless of their fanaticism/stupidity, to do exactly the same :)).

In summary, I consider that I have much more than people like you, cluelessly attacking others, perhaps manipulated, perhaps randomly, perhaps out of blind fear, frustration or hate. A ridiculous joke, with ridiculous expectations performing ridiculous actions, nonetheless. Also all my references to having a private jet or a butler are logically meant to be understood as jokes; firstly, because I don't (didn't and, mostly likely, will never) have anything even close to enough money for something like that, neither interest in having it; and mainly, because my attitude is extremely incompatible with the kind of spoiled, egoist and narcissistic personalities usually associated with this kind of expenses. All this should be evident for any non-extremely-stupid person after having read any of the multiple texts about my personality and expectations which you can find in many places (precisely a reaction to some interactions with idiots like you, unable to understand anything properly and spontaneously coming up with ridiculous interpretations for anything), but probably not for you. Again, I am not sure why, but I have the feeling that you (and others like you) will read this post :)

Re:another blooming idiot

[CustomSolvers2]

And even another completely-unrelated clarification (just to have all the ideally-not-necessary-but-required-by-idiots-like-you-unreasonably-attacking-others stuff together): as clearly highlighted in the current version of my profile and signature here (which might be changed in the future, but this post will always remain), Custom Solvers 2.0 is the same than varocarbas and than me (Alvaro Carballo Garcia). Despite all the plurals, there is only one person here: myself, a 39-yo man, Spaniard, mechanical engineer by education (my relevant university degree, but not my only one) but programmer by career, heterosexual, single (and, at the moment, just caring about work), not too much into politics but leftist, honest, fair, adaptable, reasonable and objective; extremely allergic to fanaticism, people not able to understand humour, invasive/imposing personalities and anyone thinking that there is any chance that they can affect others without consequences. Although you will not find many references about that, I am a white man, slim and tall, with glasses, but I have replaced most of my public pictures with the Custom Solvers 2.0 logo to highlight that my appearance doesn't matter for my work (and internet is basically work for me).

Varocarbas has been my personal nickname since a quite long time ago (short-form of my name and first family name: alVARO + CARBAllo + S because sounds kind of better), but why choosing a so weird commercial name (because, as self-employed, the real name of my company is my own name) as Custom Solvers 2.0 you might wonder? This is my second self-employment attempt and, in the first one, Custom Solvers made much more sense. I only wanted to somehow relate my new activity (= still programming & numerical/engineering analysis, but by being much more patient, individual, self-made and looking for much fairer and properly-appreciating-clients than ever before) to that old one, even though my expectations now are completely different. To know more about my evolution as a self-employed programmer, you can visit the corresponding pages of my main site (customsolvers.com). You might also want to do that to know anything else about me, my knowledge/expertise, expectations, etc. There are lots of information in that main site, in my R&D site (varocarbas.com) and in all my public profiles linked from any of those. You might also ask me anything, call me or send me an email. You know? Performing any action allowing you to know even a bit about the person who you are defining, as opposed to what you did (= putting together the first two random words coming to your).

Re:another blooming idiot

[david_thornley]

The big difference between most transactions and voting is that bank transactions are traceable and reversible. If there's a $2K transfer between my account and someone else's, I can find exactly why that transaction took place and how it was authorized. If it turns out to be erroneous and/or fraudulent, the bank can transfer the money back. If Joe gets 2100 votes and Moe gets 2200 votes, we can't attribute those totals to any individual or individuals. We have no records of who voted for whom, by design. If Fred is convinced that he voted for Joe but he was tallied for Moe, there's no recourse. There's no way to investigate beyond the evidence immediately present.

Physical evidence is bulky, heavy, and inconvenient. It presents few attack surfaces, and those are fairly obvious. It's easy for people to understand. We have large amounts of pieces of paper, individually unimportant. Electronic storage can be corrupted in different ways, not all of which will be obvious. We have a small set of numbers, and the set as a whole is very important.

The Internet is not safe or secure by any definition. Defense and nuclear systems have multiple layers of defense, and are not normally connected to the Internet, except possibly by very limited firewalls. A voting system will have to connect tens or hundreds of thousands of locations, some very far-flung, and be accessible in some sense to every voter in the country. It's much more like the Internet than a defense system.

Re:another blooming idiot

[CustomSolvers2]

The big difference between most transactions and voting is that bank transactions are traceable and reversible. If there's a $2K transfer between my account and someone else's, I can find exactly why that transaction took place and how it was authorized. If it turns out to be erroneous and/or fraudulent, the bank can transfer the money back. If Joe gets 2100 votes and Moe gets 2200 votes, we can't attribute those totals to any individual or individuals. We have no records of who voted for whom, by design. If Fred is convinced that he voted for Joe but he was tallied for Moe, there's no recourse. There's no way to investigate beyond the evidence immediately present.

That example doesn't make any sense. It doesn't matter whether the voter is anonymous, the vote is well defined (= click on the button = perfectly recorded). From the point of view of the banks, the system doesn't care about dealing with two different persons or not. Even actions within the same account will be recorded. Even actions on the records on that account performed by bank staff will be recorded. Your example might seem only logical for a random person with no computer knowledge only roughly understanding what happens after they click on the button. As said in my previous comment, I don't think that a somehow knowledgeable person (+ with intention of bringing that knowledge into picture, rather than having an almost fanatical behaviour whose goal is to prove whatever has to be proven) could seriously think that electronic records are even slightly unsafe in a generic way.

We had some chats in the past and all of them followed a similar pattern where you kept insisting (respectfully and reasonably though) on trying to impose your views, mostly via repetition, by providing further quite-irrelevant additional data and without intending to understand my position/learn. I am a very experienced programmer who have developed lots of applications dealing with a huge number of different scenarios and you seriously think that you can change my mind about what I have a very good knowledge (= built over the years by learning, making errors, going further, etc.) via repeating a couple of generic (logically faulty) examples? I see... Seriously, I don't want to be disrespectful, but I will stop reading what you write in this chat and, in the future, I hope that you will make some effort to engage in more sensible conversations. If you aren't interested in learning, understanding others' (mine, in this case) views, getting a proper insight into whatever problem and you only want to impose whatever truth, conviction, fear or expectation you might have, you should try to avoid dealing with me because I might stop being so patient and understanding (nothing personal, just confirmed that being reasonable with certain people isn't always a good idea).

Re:another blooming idiot

[CustomSolvers2]

The Internet is not safe or secure by any definition.

PS: it would also be excellent if you could make an extra effort to at least understand what all this is about. AGAIN: I have expressly said various times that I am not defending internet-based voting (too dangerous on exchange of no relevant advantage). All my comments were about DIGITAL RECORDS as opposed to paper and manual counting. NOTHING TO DO WITH INTERNET. I was talking about an offline (or restricted/local network or offline + punctual connections to a central repository) system. The only people bringing internet into picture were those blindly attacking (+ anonymously insulting) me.

Re:another blooming idiot

[david_thornley]

(= click on the button = perfectly recorded)

You appear to have a lot more faith in that than most people. Those of us who are actually in the software field have a pretty good idea of things that could possibly go wrong, and we're not nearly as confident that we know all of them.

I don't think that a somehow knowledgeable person (+ with intention of bringing that knowledge into picture, rather than having an almost fanatical behaviour whose goal is to prove whatever has to be proven) could seriously think that electronic records are even slightly unsafe in a generic way.

Digital records are fine in themselves, but they can frequently be altered untraceably. There are various ways to secure them better. Simple hardening of the system holding the records is useful. Other things that are useful are matching records. (For example, a record of each transaction affecting my checking account is good for assuring that my balance is what it should be.) Backups are useful, since it's more difficult to change a current result and the backups can reveal tampering.

What's really good here is large piles of paper ballots, counted by machine. Given proper physical security, which is a well understood field, they're hard to tamper with.

Re:another blooming idiot

[CustomSolvers2]

You appear to have a lot more faith in that than most people. Those of us who are actually in the software field have a pretty good idea

What are you talking about?! I have been full-time working as a programmer during over the last 8 years!! We were discussing about C/C++ advantages for various days?! Seriously, what is the matter with you? This is my last reply and will think twice before replying you the next time. Now I feel that I did lose my time in the past by being understanding (+ generous, although perhaps you didn't realise about that bit either) with you. Bye.

Re:Paper has no advantage over digital records

[CustomSolvers2]

The underlying idea to your post is similar to the ones of many other posts here (a bit surprising, IMO): digital records being less trustworthy than manually-written ones or being felt as such by laymen (you should either educate them or ignore their opinions, but why seriously considering the by-definition-unreliable concerns of those not knowing about the specific matter?). That might make kind of sense under very specific conditions but, in absolute terms, seems evidently wrong (or are we planning to start replacing most of our current computer dependence with paper and manual counting?); at least, for a knowledgeable and objective enough person willing and able to come up with the best solution for the problem.

*Everyone* with 2+ braincells prefers that.

[Qbertino]

Errrm, and your point being?

Everyone with 2+ braincells to rub together prefers voting with paper. Every computer expert on the entire planet says computer driven voting is generally a notably stupid idea. It's only dimwits and people who want power and have a solid interest in controlling elections that want computers as a middle man for votes.

This is news from more than 2 decades ago.

Hey BeauHD

[Anonymous Coward]

You know that NYT article is nothing but FAKE NEWS right?

https://theintercept.com/2017/09/28/yet-another-major-russia-story-falls-apart-is-skepticism-permissible-yet/

Re:What a liberal puff piece.

[Anonymous Coward]

Exactly! And notice the response. Democrats, doing what republicans were doing in the 50s. It really is hard to decide if one is more repulsive than the other. Between them (and the people that vote for them) there is no lesser evil, there is only evil.

Re: MOD PARENT DOWN -1 REDUNDANT

[Anonymous Coward]

"911, what is your emergency?"
"WAAAAHHHH I am a 50 year old football player and someone made fun of me on the INTERNEEEEEEEEEET!"
"Oh my God sir, I'm patching you through to the FBI Cybercrimes division immediately!"
"Snif snif thanks..."

EXPERTS RULE IF THEY COUNT

[Anonymous Coward]

COUNT THE NUMBER OF VOTERS! If the ballot count does not match, then you have stuffing. Serial numbers tied to ballot books also helps. Results are not accepted until parties involved all agree; they oversee the counting. Other countries solved this long ago (Canada.)

"I consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this — who will count the votes, and how." -Stalin

Anyone with any knowledge of computers wants a pap

[Tangential]

The idea of totally electronic voting tells me that people care about their vote about as much as they care about their privacy. We see how poorly secured and hackable all of our systems are everyday. If someone wants a computer screen to facilitate the creation of a paper ballot and (Maybe) to provide an alternate count to check against I think most IT professionals would support that.

Re:What a liberal puff piece.

[Anonymous Coward]

There is no definition of the word "liberal", nor of "conservative", that makes the article have a liberal position.

Electronically generated paper ballots could work

[rickb928]

Not too difficult. Whatever the UI is, let the ballot be generated, and then a paper receipt printed for me to compare with the on-screen tally. If I approve, I click 'Accept' and take my receipt to the counters, where it is scanned and returned to me.

Later I can go to the web site and validate that my vote was counted as expected, either with the scancode or GUID.

Counting is immediate, accuracy is within my hands, and I can even self-select to be part of a QA process that audits the blockchain and confirms my vote was accepted, counted, stored, and part of the final results - accurately.

And the miscreants that would claim later 'that's not my vote' can be dealt with, somehow, or admonished that clicking 'Accept' was a binding agreement. There is only so much we can do.

Re:What a liberal puff piece.

[squiggleslash]

There's plenty of evidence they influenced the election. You'd have been on-topic and accurate if you'd just left your blanket statement at "hacked".

Isn't that like every computer scientist?

[KingTank]

Never met one who thought it was a great idea. Computers are tools we use to manipulate data. That's the last thing you want to able to do easily when you're talking about votes. Anyone who really understands what a computer is should understand it's the wrong tool for the job.

Re: Russia? LOL!

[Anonymous Coward]

Ha.

Computers will probably take over

[Anonymous Coward]

The only people qualified to decide if voting machines are ready, are security and cryptography expert. They also need an OK from someone with a high level view of the acquisition, production, etc. process.

While it's a more complex process, a secure cryptographic system will be harder to tamper with than paper ballots, and it will be much more efficient. In the future, it may actually matter to not print hundreds of millions of pieces of paper every few years.

There are now enough information security experts around that we can trust that an open system will be vetted by multiple highly qualified experts from all sides. As long as these experts tell me no, sure keep the paper. But it's not helpful if all the PHP programmers and cable draggers chime in because they "know computers" and viruses are scary.

Banks have gone fully electronic, and are doing fine. So are stock markets, police records, casinos, and most of the world in general. If you could hack crypto, would you adjust the election by a few %, or secretly siphon a few billion out of banks? I know I would do the second(or just publish a boring old paper). It is only practical for a malicious group to adjust the outcome by a few percent, or people will surely raise questions and require the whole process to be repeated. Maybe with paper.

Re:Electronically generated paper ballots could wo

[Anonymous Coward]

The receipt will be used to prove that have voted in the way someone paid you to vote.

Therefore, there MUST BE NO RECEIPT for the voter.

Re:Electronically generated paper ballots could wo

[rickb928]

Then exchange the readable receipt/ballot for a QR code based receipt. Losing the chain. Potentially failed. And if you give in the QR code, you have to keep the PIN with it, and I'm just smart enough to figure out that faking a PIN is no risk to me if the collector has dozens, and can't keep track of the owner.

But even this fails, since such an effort would be hard to disguise, even in Philadelphia.

True, pay for vote or pure extortion is a risk, but this is already a risk.And already being practiced. Perhaps the lesson here is that all electronic voting is intended to speed counting or reduce costs, and neither is sufficient to justify the risks.

+1 include me!

[micahraleigh]

I have 2 computer science degrees.

Given that it is public record the FEC tried to hack into our voting systems (forget Russian meddling!), we should absolutely not have votes sent digitally anywhere.

There is so much corruption in this process. Thankfully it is mostly local corruption at this point (exhibit A: Al Franken, exhibit B: Harry Reid with the SEIU), but we are not far from this at the federal level.

Definitely pass an amendment to keep the FEC out of states voting systems. If a state wanted to do this I'd allow it, but it would probably be a blue state and it would be their D votes to lose.

The thing about machine politics is it has never yielded anything good since its inception under Van Buren. It forced HRC on a party that didn't want her.

Re:+1 include me!

[david_thornley]

FYI, there was no noticeable corruption in the Franken Senatorial election. The immediately tallied vote is often a thousand or more votes off the final total, and in almost all cases that doesn't matter.

Since the vote was that close, Minnesota law required a recount. This was done by people working under close supervision of both Democrat (DFL, actually - Minnesota is a little quirky) and Republican observers. The paper records were maintained pretty well.

There were a few irregularities, but no corruption. One precinct's ballot box just disappeared, and so the initial machine counts were accepted instead. One precinct had some doubt about the disposal of spoiled ballots, but not in sufficient numbers to affect the outcome. It turned out that the printed instructions for absentee ballots were not quite in accordance with the law, which looks to me a lot more like a mistake than corruption.

The recount was done under the supervision of a three-judge panel, and the Minnesota Supreme Court affirmed their work after about a month of study. That was a total of eight judges, four of which had been nominated by Republicans, and who could be expected to have raised a ruckus if the Franken campaign had been manipulating anything. (Two others had been nominated by Democrats, and two by Jesse Ventura when he became governor unaffiliated with either party.)

Re:+1 include me!

[micahraleigh]

In the Franken case cars were showing up during the recount with ballots marked almost entirely for Franken.

If I remember correctly this was showing up in Politico !!

Guys, this is AL FRANKEN. He's literally a comedian. His understanding is all jokes !

The stamp of committee approval with politicized judiciaries doesn't do much to gain my confidence either.

The Obama election, by contrast, had much less shenanigans, and the sum total of the peculiarities was well below what it would have taken to give it to McCain. Romney was pretty close, but I didn't hear much about any sketchy activity in that one.

Re:Paper has no advantage over digital records

[david_thornley]

Digital records are less reliable than properly processed paper records. There's different ways to attack digital security, and it's a lot easier to have an untraceable attempt with digital than paper.

Re:Paper has no advantage over digital records

[CustomSolvers2]

I don't agree with your statements and even think that a programming/computer-experienced person shouldn't think in that way (i.e., software you are building and managing being more obscure than people+paper!). That's why I don't think that we should continue with this chat.

Re:Electronically generated paper ballots could wo

[david_thornley]

If I can confirm that my ballot was counted for Joe rather than Moe, then someone else can compel me to reveal how I voted. Right now, someone else can't confirm who I voted for, so if I agree to vote for Joe, and then vote for Moe, and claim later I voted for Joe, who's going to know?

Verifiable voting is a really dangerous idea. There's reasons why we've used the secret ballot for a long time now.

Re:Electronically generated paper ballots could wo

[rickb928]

And we circle back to trusting the process.

In my home state, a recount was questioned because the room where the ballots were stored overnight was found to contain an ashtray and used cigarettes the next morning, despite none being there the evening before. State Police were stationed at the door from then on, but the questions began...

Trust. When that's gone, well, the system is gone.

Re:Paper has no advantage over digital records

[david_thornley]

I've been in software for something like forty-seven years now, in various capacities. You don't seem to be experienced enough to have learned humility yet. Until you accept that the software you are writing almost certainly has bugs, please don't tell your elders what they should think.

Re:Paper has no advantage over digital records

[CustomSolvers2]

have learned humility yet

I don't need working experience (in programming) to learn that. I am an extremely respectful, humble and sensible person always trying to properly understand others, having as less prejudices as possible and, at work, carefully analysing every situation. Currently, I am putting a tremendous effort into focusing my whole activity in its widest sense (including also the kind of clients/coworkers/expectations with whom I want to deal) on quality. So, what you are implying is even less applicable now. In any case, there are things which seem way too evident and, in our current society, saying that electronic records are unreliable in general doesn't make any sense.

You might have lots of experience and even much more knowledge than me on some aspects, but you have proven to have a pushy, trendy, unreasonable-expectations-driven behaviour various times and that's why I don't like what you represent and, honestly, you aren't proving yourself as a knowledgeable developer, not even as an objective person mostly interested in knowing more/improving. There are many things going wrong in the software development world, market, trends and, as for your behaviour so far, you seem to be the archetypal personality which explains why things are like this (abstract talking, trend-driven expectations, blind-trust-in-random-authorities, nepotism/arbitrariness, pushy behaviours, etc.). As said in my first comment yesterday, I don't see the point of continuing with this chat and, if your behaviour doesn't change in the future, I will not talk to you anymore. Now, say all what you want because I will write any other post in this thread.

Re:Paper has no advantage over digital records

[CustomSolvers2]

Logically, with "because I will write any other post in this thread." I really meant "because I will NOT write any other post in this thread." (yes, the current post is quite ironic).