[HN Gopher] New Hampshire set to pilot voting machines that use ...
___________________________________________________________________
New Hampshire set to pilot voting machines that use software
everyone can see
Author : isaacfrond
Score : 178 points
Date : 2022-11-04 12:54 UTC (10 hours ago)
(HTM) web link (therecord.media)
(TXT) w3m dump (therecord.media)
| Vvector wrote:
| We need a voter verified paper trail, based on an open standard,
| that can be read by different tabulator machines running
| different software, and still be hand counted just in case.
| jcrawfordor wrote:
| That's exactly what this system, and the majority of electronic
| voting systems used in the US for the last decade, provides.
| contravariant wrote:
| That's basically just pen and paper but with automated counting
| machines.
| Vvector wrote:
| Computer assistance can prevent over-votes and warn of under-
| votes. It also resolves any "voter intent" questions (i.e.
| hanging chads). It can also format the printed ballot to
| increase the speed at which a machine can read them.
| sidewndr46 wrote:
| Unless I can take home the voting machine & verify that the
| software running on the machine is in fact the claimed software
| this doesn't mean anything. You could just as easily publish one
| set of software and have the machine run something completely
| different.
| starkd wrote:
| They can automate the installation of the current code onto the
| machine, which is in turn also open source.
| _-david-_ wrote:
| They are going to have 24 hour cameras pointed to the
| machines after the installation, including during shipment
| right? If not somebody could change the software. Even with
| cameras somebody could manipulate it probably.
| SketchySeaBeast wrote:
| That's my struggle with this as well - what are you going to
| do, show me a checksum on the monitor to somehow "prove" that
| the software is the same?
| sidewndr46 wrote:
| Given that they could just as easily fake the checksum, they
| might as well use a 1-bit checksum. The security of a 1-bit
| checksum is just as good as a 256-bit checksum in that
| scenario.
| SketchySeaBeast wrote:
| Yeah, that's why I wrote it "prove" - it's not proving
| anything. There's absolutely no way they can prove that the
| code in that box is the same as on the repo, not to mention
| all the other upstream issues - it has to send that count
| somewhere to be aggregated, and now we're even further
| removed from all the possible points of "failure".
| ratg13 wrote:
| Personally I think the software is largely irrelevant.
|
| As long as the machine prints a paper receipt that I can verify
| is correct before it is stored, the code that creates the
| receipt doesn't really matter.
| pessimizer wrote:
| Will you be satisfied with that slip of paper if your vote
| was never included in the official count because the software
| was bad?
| ratg13 wrote:
| There will always be minor issues that can be amplified
| even in non-technical solutions (see also: the 'hanging
| chad' fiasco of the 2000 US election)
|
| Giving voters the ability to inspect their ballots and the
| criteria by which they are considered valid at least gives
| the voter the control over making sure things are correct.
| sgc wrote:
| "that everyone can see" makes me want to see completely analogue
| tabulators that tally the vote using only mechanical means,
| inside glass cases that are being recorded and streamed.
|
| Less seriously, add random dry ice steam, fire, and whirling
| gears for best effect.
| ecshafer wrote:
| Open Source is not sufficient for voting machines, and frankly I
| don't think software should be involved at all. How do we know
| the source code was compiled without a tool chain attack? How can
| we verify that the software running even is the source code
| involved? How can we verify there isn't some kind of IME like
| kernel running somewhere that does something nefarious? How we do
| know it wasn't tampered with?
|
| Even if you remove networking from a machine the whole system is
| so fragile and there are very high stakes at play.
| lbriner wrote:
| The same way you verify that manually counted votes haven't
| been miscounted, discarded or altered. You allow witnesses.
|
| Independent examiners will be permitted to verify the source
| code is actually used as-built, that it has a signature
| attached and that every machine that is built has the signature
| checked.
|
| Sure, it's not perfect but neither is manual counting (plenty
| of countries are proving that right now). The question is, I
| guess, does a software-based system provide notable advantages
| over manual counting other than cost and speed of a result?
| sb057 wrote:
| Are you going to have experts examine the hardware of 1
| million+ voting machines in the United States? And are all of
| those witnesses going to be infallible and trusted by the
| public?
| mavhc wrote:
| Don't need to test them all, just enough to
| probabilistically catch anyone hacking them.
| bmacho wrote:
| A witness can ensure that envelops go in a box, and then they
| get them out from it. Box are verifiable.
|
| But how could a witness verify a software and a voting
| machine?
| iso1631 wrote:
| In the UK we go to a voting place. We get given a piece of paper.
| We walk to a little booth, we mark an X next to who we want, we
| put that piece of paper in a black box. Your name is crossed off
| on a piece of paper to say you've voted.
|
| That black box gathers a few hundred votes over the course of the
| day. There are multiple people in the room with that black box
| throughout the day.
|
| At the end of the day the number of people who have voted and the
| number of pieces of paper that have been used, are both counted
| to ensure they are the same.
|
| The box is then sealed (with tamper tape) and transported to a
| central hall, usually in a car, but sometimes by ferry or
| helicopter depending on weather and location. Obviously this
| takes longer for rural areas than for urban areas.
|
| When it arrives, it is unsealed in front of many witnesses, and
| the ballots emptied. They are counted (how many pieces of paper),
| and this number matches the above paperwork.
|
| The ballots are then put into a pile in the middle of the room
| where all the candidates and their teams can see, and are counted
| by a team of however many (say a team of 20 for a district of 60k
| votes - tend to be local council workers being paid overtime).
| From the counts I've seen, 300-600 an hour is a reasonable speed.
| Those are bundled into bundles of 100 and put into piles on
| display.
|
| Any ambiguous marking that the person counting or the people
| watching think is amigious is set aside (the famous
| "WANK/WANK/NOT WANK" case [0]), and the candidates and their
| agents get to see and agree on the paper.
|
| Urban counts of districts with c. 70,000 voters tend to get the
| first ballot boxes about 10-15 minutes after polling closes and
| start counting. Some have large numbers counting in an aim to get
| the count done first (in an hour or so), others take longer, but
| the majority of districts are verified, counted, and recounted
| after about 6 hours. Some places have to wait for the
| aforementioned ferry etc so don't report to maybe 12 hours after.
|
| I don't understand why you need machines to vote or machines to
| count. Breaking the system above by a few votes is probably
| possible with a small team of conspirators, but breaking it
| beyond that doesn't scale.
|
| [0] https://www.joe.co.uk/politics/voter-writes-wnk-all-over-
| bal...
| bmacho wrote:
| > I don't understand why you need machines to vote or machines
| to count. Breaking the system above by a few votes is probably
| possible with a small team of conspirators, but breaking it
| beyond that doesn't scale.
|
| Exactly. Replacing a system that is guaranteed to work with an
| another system that is guaranteed to not work is foolish.
| capableweb wrote:
| Why is one guaranteed to work VS the other one not? Seems a
| bit simplistic.
|
| There are electronic voting systems that have been running
| without issues for decades, why couldn't the US accomplish
| the same?
| SketchySeaBeast wrote:
| Yes, exactly. Canada still does manually counting federally. It
| works. Ironically, it doesn't stop the complaint about bad
| voting machines, but that's because people get their news from
| the states. There are no voting machines, no way for software
| to fudge the numbers just enough for someone's decided
| candidate to win.
|
| Is it more of an effort than trusting a machine is working
| correctly? Yes, absolutely, but this is the literal fundamental
| foundation of democracy we are talking about - let's put in a
| bit of effort.
| capableweb wrote:
| On the other hand, Brazil have been electronic voting
| exclusively since ~2000 with no evidence of fraud/mistakes
| since then, AFAIK.
|
| If it seems to be possible in a country like Brazil, why not
| in Canada/UK/USA?
| BlueTemplar wrote:
| AFAYK seems to be a big downside, AFAIK the Brazilian
| elections were quite "hot" ?
|
| P.S.: Sure enough, here's an example of a "contester" :
|
| https://www.newsweek.com/mike-lindell-hints-brazil-
| election-...
|
| AFAIK not a Brazilian citizen, but this gives an example of
| democracy-sapping claims that are avoided with manual vote
| counts.
| SketchySeaBeast wrote:
| Fair enough, but is Brazil a target that would be valuable
| to destabilize by electronic tampering in its elections?
| mrweasel wrote:
| > I don't understand why you need machines to vote or machines
| to count.
|
| The voting machines isn't for you, it for the politicians.
| Denmark have system pretty much identical to what you
| described. We normal have a result for parliamentary voting
| within five to six hours of the polling station closing. After
| three or four hours we normally have enough votes counted to
| call the election, on a party basis.
|
| The issue is the individual candidates, the well known
| politicians are interviewed a few hours into an election night,
| when their seats are secured. The lesser known politicians may
| have to wait for a day, or two, in order to have their seat
| confirmed. So they get no airtime, no interviews, because the
| media don't care when the personal votes are finally counted
| and confirmed. The voting machine are for those low ranking
| politicians ego.
|
| As for the US, who don't have a parliament and only two, or
| three, candidates in each election... I have no idea. Because
| they f-ed up their election system and closed to many polling
| stations, resulting in ballot counting taking to long?
| iso1631 wrote:
| I'm not sure how closing the stations makes any difference.
| The number of votes to count id directly proportional to the
| population, and if a democracy can't afford 5 cents per vote
| once every few years then maybe it shouldn't be a democracy
| eru wrote:
| My thoughts exactly. When I was still living in Germany, the
| system worked pretty much the same. (No clue whether they
| changed anything since then?)
|
| However this sane and simple system would probably not work in
| eg Australia? Their voting system is too complicated.
| fabian2k wrote:
| Germany hasn't changed anything. And there are also seriously
| complex ballots on the local level, so that isn't a limit.
| duxup wrote:
| I always like the mix of the scanning ballots in Minnesota that
| are paper / filled out by hand, scanned and go into a box tied to
| a machine for easy auditing.
| jmyeet wrote:
| I'm glad to see New Hampshire still has paper ballots doing this.
| Pure electronic voting (IMHO) should be banned. Either you should
| fill out a ballot that a computer can verify or use a touchscreen
| that produces a paper (filled-in) ballot.
|
| As for open source, I don't think it matters. I mean, even if the
| software is open soruce, how do you know what the machine is
| running? Are you going to build it yourself and verify hashes?
| Can you?
|
| Don't get me wrong: open source for something like this is a good
| idea. Experts should be able to verify this. It just won't stop
| claims of election fraud because those largely aren't based on a
| lack of transparency but rather political expeidency.
| ccbccccbbcccbb wrote:
| No matter how transparent the voting software and machines are,
| nothing can fix election between candidates who all hatch from
| the same incubator.
| ensignavenger wrote:
| It is worth noting that Windham New Hampshire had a case of
| actual vote miscounting in the 2020 election- though not the
| presidential election- and the miscounts did not change the
| results. The Democrat who lost the race is the one who requested
| the recount (and the recount favored the Republican candidates
| who won).
|
| See https://apnews.com/article/donald-trump-new-hampshire-
| voting...
|
| https://www.concordmonitor.com/voting-machines-nh-new-hampsh...
|
| The news of this has of course been buried under all of the false
| claims of voter fraud from the 2020 presidential election.
|
| So it is not surprising that New Hampshire would be looking at a
| new approach to voting machine technology.
| Rebelgecko wrote:
| Wow, those error rates are actually much higher than I'd have
| expected. I wonder if the cause is something like a difference
| in how humans vs machines deem ballots invalid?
| jandrese wrote:
| You can change a lot of votes by altering the rules as to
| what is considered a valid vote. Read into the details of the
| 2000 election and you'll see just how much of a leg up George
| W Bush got from party control of the vote counting. There are
| plenty of scenarios where he would have lost if the rules
| were decided differently during the counting process. Had the
| decisions been made neutrally Bush would have lost in
| Florida.
| aksss wrote:
| Right, the interest in having auditable and secure elections is
| not simply a right/left issue and does not mean one's an
| "election denier" or an "insurrectionist". It just stands to
| reason that basic controls for governance should be a key
| attribute of how elections are run, and no, the feds shouldn't
| be paying for this, imo.
|
| In my home state, a Republican candidate (albeit disowned) was
| indicted for ballot harvesting, particularly for hiring a
| consultant from CA to run around through a particular east
| Asian community collecting ballots. If a system works, every
| politician will exploit it.
|
| * ID's should be required (like they are for everything else,
| including travel, bank accounts, bars, etc);
|
| * voter rolls should be scrubbed;
|
| * election results should be auditable;
| [deleted]
| falafelite wrote:
| A lot of skepticism and negativity here, with a focus on "open
| source means something to me, not the layman" as well as mentions
| of is that really helpful, is it auditable, etc. Valid concerns,
| but I guess my reaction is hopeful because hey there's at least
| one group of people who are trying to build something that is
| more transparent.
|
| Maybe it's not perfect, but (at least to me) seems like a step in
| a good direction. Also for what it's worth the company making the
| tech has a product for auditing as well. Idk guess I'm feeling
| more optimistic this morning.
| tokai wrote:
| Voting machines are always a bad idea. There are issues of
| trust and security that can never be solved. So trying to open-
| wash this dangerous way of voting is at best just as bad as
| closed machines and at worst an angle to make people think its
| a safe and good idea.
| falafelite wrote:
| Why are they always a bad idea in your view? I'd imagine that
| they're quite nice from the point of view of those who run
| elections and actually have to count them. I'd love to hear
| your thoughts!
| yifanl wrote:
| Consider: the number of available volunteers to count votes
| scales directly with the number of voters in a given
| electorate.
| kube-system wrote:
| But it is a solved problem. You can use machines to mark
| paper ballots, and to quickly tabulate them. This is the best
| of all worlds: the results are auditable, the user can
| confirm their ballot was recorded properly, and the election
| officials can quickly count the ballots.
| Loughla wrote:
| Yes and no. There is never a situation where electronic
| voting with no paper back up that must be stored and
| catalogued for a prescribed time via law is a good idea.
|
| But a system that uses electronics to tabulate votes that can
| be verified via paper ballots that are stored long-term,
| securely? Why not?
|
| Edit: Maybe I didn't describe this well. The person makes the
| vote on paper. The paper is counted by a machine (like the
| article is saying). The paper is stored securely and
| catalogued for later reference and audit. What is the problem
| there?
| nyokodo wrote:
| > But a system that uses electronics to tabulate votes that
| can be verified via paper ballots that are stored long-
| term, securely? Why not?
|
| If the paper ballots as backup are manually created by the
| voter then while it's still possible it's much harder to
| fake the votes en masse but there's more scope for human
| error (what if they vote in two different ways). If the
| paper backup is automatically generated then can they check
| it? If not then there's little improvement over purely
| digital voting. If yes, do they actually check it? Many
| won't bother and maybe there's an exploit there. Then
| there's the fact that this system would require regular
| auditing, and lawsuits and close contests will force a
| certain number of audits every election. No one can
| reliably predict which districts will require audits so
| presumably they'll need to hire sufficient people to do a
| manual recount anyway which eliminates the labor cost
| advantage.
|
| If by using electronic voting we are opening up new
| potential exploits, even with paper backups, and not really
| gaining much of an advantage why would we go to the expense
| and bother of implementing electronic voting?
| Loughla wrote:
| Sorry, when I say backups, I mean paper voted created by
| the voter's own hand as the original vote, counted by
| machine, and held securely as a way to verify the vote if
| any of the candidates call the election into question.
|
| There is no system in which electronically cast and
| electronically created backups are a good idea.
| nyokodo wrote:
| > when I say backups, I mean paper voted created by the
| voter's own hand as the original vote
|
| Fair enough, however the issue of the thread is
| electronic voting machines not electronic paper vote
| tabulation.
| Loughla wrote:
| The story is about electronic paper vote tabulation.
| ianai wrote:
| Yes the negativity is stark and dangerous given the other
| conditions this year.
| lm28469 wrote:
| > Maybe it's not perfect, but (at least to me) seems like a
| step in a good direction.
|
| It just add bigger SPOF. Compromise a single voting machine and
| you control hundred thousands of votes. Compromise one vote
| counter and you control thousands at most
|
| There are literally no problems to solve in modern functioning
| democracies when it comes to votes, it's just some technocrat
| mentality that requires everything to be automated so it's
| faster/more efficient, etc.
|
| So yeah you can make these things faster at the expense of
| basically everything else, including trust
| falafelite wrote:
| Interesting okay. Is a combo of paper and automated counting
| not ideal then? To my mind automatic counting is probably
| great for the speed you mentioned, and I'm sure those who
| have to perform the counting/run the election like it, but
| then keeping paper to hand-count as a backup or to verify
| seems sensible too. Or is the very possibility of a
| compromise too bad to entertain?
| simiones wrote:
| Speed of counting is not a problem. Most countries in the
| world finish counting their election votes by the end of
| the second day after the election, with pure paper voting.
| The great thing about elections is that election officials
| can very easily scale with the number of votes, so there is
| no reason why you'd need automation here.
| carapace wrote:
| If there is a CPU between you and your recorded vote you live
| in a "hackerocracy": you are ruled by the best hackers.
|
| The only reason to have electronic voting machines is to
| subvert the voting process.
| simiones wrote:
| "Open source" voting machines is essentially like baby-proofing
| a machine-gun. All of the problems that electronic voting poses
| to true democracy are 100% still there, but it _looks_ safer -
| which may, unfortunately, make it more attractive.
|
| I'm putting open source in quotes, since only software can be
| open source, a voting machine is a piece of hardware that you
| do not own, so you have no idea what it software it is running.
| eru wrote:
| I wrote some skeptical remarks.
|
| But yes: this is definitely progress compared to closed source
| machines.
| DoingIsLearning wrote:
| > Maybe it's not perfect, but (at least to me) seems like a
| step in a good direction.
|
| Is it? Provided you have a working democratic state with checks
| and auditing, what is the problem that voting machines solve?
|
| The level of guarantees that you have with a paper vote is hard
| to surpass and the inconvenience of paper vote is not that big
| considering how often voting occurs (even in the extreme case
| of Swiss style referendums).
| davoneus wrote:
| >Provided you have a working democratic state with checks and
| auditing, what is the problem that voting machines solve?
|
| It solves the problem of waiting days or weeks for a result.
| It solves the problem of multiple languages on a ballot. It
| solves the problem of visually-impaired voters accessing the
| voting machine, it solves the problem of incorrectly filled
| out voting sheets (hanging-chat).
|
| Hell, that's just off the top of my head, and I'm sure others
| can contribute more.
| falafelite wrote:
| Is a paper-vote a reference to literally marking a piece of
| paper, or a human counting said piece of paper? Sorry if
| that's a dumb question, just want to make sure I follow. It
| seems like this tech works with marking a piece of paper that
| is then read by a machine. I suppose if the paper is kept,
| perhaps it's nice from the point of view of the election-
| handling-folks to automate the counting process, but be able
| to audit the paper ballots?
| up2isomorphism wrote:
| Voter id voter id voter id, that's it.
|
| It is ridiculous that we are still debating on that , which shows
| how messed up we are now.
| mrweasel wrote:
| What do you mean? As someone not in the US, I don't know what
| you mean if you just write "voter id" three time.
| Simulacra wrote:
| "Software everyone can see" sounds like window dressing.. You
| would have to understand how the software works. Open source
| voting software is a great idea, but the vast majority of people
| are not gonna have any clue.
|
| Is this _really_ transparency?
| eru wrote:
| It's a small step in the right direction.
| pessimizer wrote:
| > You would have to understand how the software works.
|
| No you don't. You have the opportunity to trust someone who
| understands how the software works, which you wouldn't have if
| the people you trust weren't allowed to inspect the software.
|
| With this kind of logic, you could never trust an election
| where you didn't physically count all of the votes yourself.
| Since that doesn't make sense (not scalable when elections get
| beyond about 20-30 people), we allow voters to send people they
| trust to observe and participate in the vote count. This is
| like that.
| jmclnx wrote:
| > there's a paper record to prove it.
|
| Well at least NH seems to be doing it right. But if I use that
| machine, do I get to see the paper record. What I mean, is it
| printed for me to look at and placed into a sealed ballot box ?
| If not, then I am glad I do not live in NH.
| [deleted]
| ilc wrote:
| This is one of the few areas where paper is still king, IMHO.
|
| Been filling out paper ballots for years. I don't want to vote on
| a machine. A machine can count my vote. But there should be a
| paper that goes in the ballot box, so it can be recounted using
| multiple methods. Different machines, humans, dogs, cats...
| whatever. There are real physical artifacts.
| jjeaff wrote:
| The vast majority of voting machines in the US creates a paper
| trail. Usually, you vote and the system prints out a receipt
| showing your vote which is then kept in the case of later hand
| audits.
| capableweb wrote:
| So you're for this voting system then? Your messages reads like
| you're against the system mentioned in the submission, but it
| seems like the system is actually doing it via paper, just like
| how you want it?
|
| The trial described in the article:
|
| > On November 8, VotingWorks machines will be used in a real
| election in real time. New Hampshire is the second state to use
| the open-source machines after Mississippi first did so in
| 2019. Some 3,000 voters will run their paper ballots through
| the new machines, and then, to ensure nothing went awry, those
| same votes will be hand counted in a public session in Concord,
| N.H.
|
| It seems to involve paper ballots, as far as I can understand
| it.
|
| And this is how the authors of the voting system describes it
| themselves: https://www.voting.works/voting-system
| ilc wrote:
| I'm not sure I like VMDs. They can lead to slippery slopes.
|
| IE: Only Fred used the VMD... Or how does the counter
| interpret the VMD? Are people vigilant about checking their
| ballots?
|
| Pen, paper -> Into Box -> Counting, KISS. I can deal with a
| scantron. Not much more is needed here. I'd rather we work on
| chain of custody and figuring out who has voted etc, that are
| harder to solve. Though honestly, the fraud rates are so low,
| on double voting, I suspect made up voters, and ballot box
| stuffing are bigger concerns.
| dpkirchner wrote:
| I want to see examples of ballots that changed votes during
| recounts. I'm curious about what went wrong with the initial
| scan (I have ideas, of course) but seeing the actual problems
| would be nice.
| alexvoda wrote:
| While I agree with you that the ballot should be physical,
| electronic counting defeats the purpose of transparency.
| Counting should also be manual in the presence of
| representatives of each candidate. Marking of ballots and voter
| eligibility checking do not present any issues if done
| electronically.
|
| Maybe one way to address the issues of electronic counting
| would be to have parallel counts by each candidate (and their
| reps) using their own hardware and software with a manual count
| in case the electronic counts of every candidate do not match.
| But this means each candidate has to bring their own counting
| infrastructure which is prohibitive.
| a9h74j wrote:
| > parallel counts by each candidate
|
| I have often imagined having say two scanners in physical
| sequence (so passing through a ballet is a single operation),
| and having more than one (competing) recorder for the output
| of each scanner head.
|
| This would require some standardization of form factors and
| interfaces, but with small enough electronics units and
| scanners, in principle parallel data paths could be included
| in a single intentional "infrastructure".
| onionisafruit wrote:
| This is what I like about the machine I vote on in Texas. You
| vote on the machine then it prints the ballot for you. You walk
| your ballot to a scanner and feed it in where it tells you it
| successfully read your ballot.
| alistairSH wrote:
| Something like this sounds like the best solution. I want a
| paper ballot I can inspect before it gets fed into the
| counting machine (and which is kept after scanning for
| recounts, should the need arise). If that ballot is marked by
| machine to avoid "hanging chads", all the better.
| rootusrootus wrote:
| It would take a lot to convince me of that. I haven't voted
| at a precinct in decades. I vote in my living room, then
| drop the ballot in my mailbox. Plenty of time to do some
| research, consider my options, banter with my wife about
| the issues, etc. A few days later I go to the county
| website to make sure they received my ballot.
|
| The only thing I'd like to see is a relaxation of this idea
| that ballots need perfect secrecy as the most important
| goal, because that runs directly at odds with
| accountability. I'd like my ballot to come with a UUID that
| I could put into the public web site and verify my votes
| were recorded correctly. All those UUIDs and corresponding
| votes should be public, so everyone can do their own math.
| It would make coercion easier, but I don't see that as the
| most important issue.
| jcrawfordor wrote:
| Vote-by-mail ballots are fed through a computer
| tabulation system once received. In some states,
| especially those that are entirely vote-by-mail like OR
| and WA, large centralized tabulators are used that read
| multiple ballots per second from a stack feeder. In most
| states though it's very common for mail-in ballots to be
| fed through the same precinct tabulators as in-person
| votes, just at the election administrator's office
| instead of in a precinct location. This "mail-in
| precinct" approach has the advantage of keeping the
| process very consistent across voting methods, although
| it tends to require more staff since precinct tabulators
| are not built to quickly feed large numbers of ballots.
|
| Remember that hand-counting of ballots has been unusual
| in the US for quite some time. Some states process their
| mail-in ballots through large central tabulators even
| though they have only a small portion of mail-in votes,
| simply because they still have the central tabulators
| from before they switched to precinct tabulation, back
| when they used to drive the ballot boxes from every
| precinct and have staff re-stack the ballots and feed
| them to a tabulator after close.
|
| Ballot secrecy is unlikely to change. It was widely
| adopted in the US as a direct result of the fact that
| non-secret ballots facilitated purchased and forced
| votes, since the payer could verify that the voter cast
| the ballot they were supposed to. This is not a
| theoretical problem but one that was widespread in the
| 19th century.
|
| Something like you describe is already in available in
| many states, though, at the pollbook level rather than
| the tabulation level: in many states you can obtain a
| record online of whether or not you were issued a ballot
| and, if you were issued the ballot by mail, whether or
| not it was received back. The ballot is 'severed' from
| this record system (usually by physical means like dual-
| envelopes or even passing through a slot in a wall)
| before tabulation so that your voting choices cannot be
| proven after the fact to facilitate bribery or
| intimidation.
| odysseus wrote:
| I have a love/hate relationship with mail-in voting.
|
| It's super convenient. You don't have to be at the
| polling place at a certain time in bad weather. Just fill
| out the form in the comfort of your home and drop it in
| the mailbox.
|
| I hate it though because it really does make fraud and
| mismanagement easier:
|
| - People are sent ballots for people who no longer live
| in the house, or are dead
|
| - The post office fails to actually send you your ballot,
| as in this case:
| https://www.wmar2news.com/matterformallory/mail-in-
| ballots-f...
|
| - This article details several more ways to commit fraud
| via mail-in voting/absentee ballots - and cites fraud
| cases from both Republicans and Democrats:
| https://insidesources.com/mail-in-ballots-make-voter-
| fraud-e...
| alexvoda wrote:
| If you would have a ID you can later imput and check what
| you voted, you can be pressured by your
| boss/spouse/parent/etc. to reveal your vote and then be
| punished if you voted wrong. If voting is truly
| anonymous, you can just lie about your choices.
| rootusrootus wrote:
| True, I recognize this is the trade-off. You cannot have
| perfect secrecy and perfect accountability both. Lately
| it seems like we're suffering a crisis in confidence, so
| maybe we could relax the perfect secrecy a bit to regain
| that trust.
| metiscus wrote:
| The UUID thing is an attractive thought but it also would
| act as an incentive to sell ones vote. Secret ballots
| protect from coercion and vote selling, as you can't
| verify someone voted how you paid them to. With
| validation you could see people literally buying votes.
| Just something to think about. I totally agree it would
| be nice to have a post vote validation. Maybe you get a
| UUID but have to submit that in person with an ID check
| to view the results? That would seem to meet the intended
| goal and minimize the hazards but with a cost to
| convenience.
| rootusrootus wrote:
| I don't know how to make it work with in person ID
| verification. They could just give you a faked UUID. I'd
| put it on the ballots when they're generated, so it was
| just as untraceable as the ballot itself.
|
| My assumptions are that 1) individual votes have almost
| no value on their own, so coercion or vote selling should
| be limited by low appeal, and 2) we still have a justice
| system, if someone forces you to vote a certain way,
| report it. Buying any significant number of votes would
| be exceedingly difficult to keep secret. Especially given
| how little compensation could be offered for them.
| metiscus wrote:
| You know, you're right about the ID verification - I
| didn't really think that through. You don't want your ID
| encoded with the ballot in a way that they can be
| associated.
| Wowfunhappy wrote:
| > we still have a justice system, if someone forces you
| to vote a certain way, report it.
|
| While it's true that law enforcement has a role to play
| here, if you're being paid, you probably aren't going to
| report on yourself.
|
| > individual votes have almost no value on their own
|
| That's probably true in a national election, but it might
| not be true in e.g. a mayoral race.
| smeej wrote:
| An anecdote I share, recognizing the risk of downvoting:
| I've been an anarchist for years, and so do not normally
| cast votes.
|
| I have offered to sell my vote to anyone in my area (a
| swing area of New Hampshire) who wants another vote for
| their side in any election at any level. I've never even
| set a price.
|
| Not one person has ever offered a cent for it.
|
| I mention this just by way of making the point that
| small-scale vote buying, which would be the hardest kind
| to detect, isn't happening.
|
| Theoretically at least, detecting and preventing vote-
| buying at a scale significant enough to change the
| outcome of an election should be much easier.
|
| Would-be buyers have to get word out to enough people for
| it to matter, but if most people assume this is unethical
| (or even just undesirable), it shouldn't be hard to get
| nearly everyone else to be willing to rat out the buyers.
|
| I don't think the problem is nearly as hard to solve as
| you're thinking it is.
|
| The odds of your vote swinging an election at any level
| are lower than the risk of being struck by lightning
| _twice._ Nobody wants to buy one vote. They need to buy
| hundreds or thousands before it will matter, and that
| makes them easier to catch.
| crazygringo wrote:
| > _With validation you could see people literally buying
| votes._
|
| I think this is an area where you don't need a
| technological solution, just a legal one.
|
| Vote selling/buying just needs to be as illegal as
| blackmail, fraud, etc. Fines and jail terms. (As I assume
| it already is?)
|
| The thing is, it's going to be incredibly easy to catch,
| because if you're attempting to pay a group of people
| (employees, villagers, whatever) to sway their vote,
| there's always going to be at least one person who
| doesn't want to and inform the law. (Or else you don't
| need to be paying in the first place.) Hell, set up
| punitive damages so a whisteblower is guaranteed 50x
| whatever price they were being offered for their vote.
| ElevenLathe wrote:
| Personally, I don't understand why buying votes in this
| way is bad. I should be able to sell my vote if I want.
| Rich people can skew elections either way, at least this
| way ordinary people might get a cut of the corruption.
| afarrell wrote:
| It is bad because it takes a problem and makes it much
| worse.
| idiotsecant wrote:
| It's not much of an incentive if you just publish all the
| UUIDs on a public website and who they voted for. If my
| employer says 'let me see your UUID and if you voted for
| Bob Jones you get an extra day off!' I can just find a
| UUID that voted for Bob Jones and give my employer that
| and they won't be any the wiser, regardless of who I
| voted for in reality. Recording results is no big deal as
| long as they aren't provably _my_ results.
| _-david-_ wrote:
| Vote by mail also easily allows selling votes. You can
| sell your ballot and signed envelope to somebody. The
| best way to avoid this is only having in person voting.
| Ekaros wrote:
| Or control absentee voting in same way as real voting.
| renewiltord wrote:
| Currently we only have sale of majority votes contingent
| on wins: If you vote for me, I will give you X. Enabling
| vote sales will enable sale of minority votes and not
| contingent on wins. This is better for people with
| minority opinions and allows them to correctly line up
| their desires with monetary reward.
|
| If you hate abortion, but like $100 more than you hate
| abortion, then why shouldn't we just give you $100?
|
| Of course, there is the knock-on effect of wanting
| inequality so you can control people and keep the vote
| price low, that's true. But that's just a question of the
| vote economics. I'm sure we can work something out.
| Wowfunhappy wrote:
| > If you hate abortion, but like $100 more than you hate
| abortion, then why shouldn't we just give you $100?
|
| Because it gives the person with more money more voting
| power (even moreso than they already have).
| renewiltord wrote:
| Well, that is always the case given that no candidate who
| raises 100 M+ loses to a candidate who raises less than
| 100 M, irrespective of per-donation size. Once we have a
| market, everyone can participate in this rather than just
| the big donors. It's a democratization of the voting
| market!
| nano_o wrote:
| With fancy cryptography (e.g. zero-knowledge proofs), you
| can allow the public to verify that the tally is correct
| while keeping votes secret. It's called end-to-end
| verifiable voting, and this is a good introduction:
| https://www.microsoft.com/en-us/research/publication/end-
| end...
|
| The idea is that people post their votes publicly, but
| encrypted, and there's a procedure (based on zero-
| knowledge proofs) that allows to check that an encrypted
| vote is correctly accounted for in the tally without
| decrypting said vote. If sufficiently many voters post
| their encrypted votes (and if it's not too predictable
| who will do so), a wrong tally will be detected with high
| probability.
| alistairSH wrote:
| Yeah, mail-in paper ballots work too. I was speaking more
| in the "we must have in-person" mind-set - I assuming
| convincing the election skeptics to use good machines is
| an easier task than convincing them on mail.
| 988747 wrote:
| The difference between in-person vote and mail vote is
| chain of custody. Basically, when voting by mail you can
| never prove that your vote has not been tampered with in
| transit. With in-person vote there usually are procedures
| in place to ensure that no one messes with the ballot
| box.
| lotsofpulp wrote:
| The best solution is mail in ballots like WA/OR. Assuming
| there is some level of trust left within the members of the
| society.
| snarf21 wrote:
| The challenge here is that too many people will assume it did
| it right and not verify. That creates an attack vector. That
| creates _another_ thing for people to yell fraud about. With
| paper, there can be no bait and switch, you physically have
| to press pencil to paper.
|
| As far as the "people don't color the circles correctly", the
| _counter_ machine can kick that back and say "unclear scan,
| please verify all circles are colored correctly" and not
| count that ballot.
| antihero wrote:
| How do you verify the scanner software is telling you the
| truth though? Also what exactly is the point of doing this?
| kube-system wrote:
| You take the stack of ballots and run them through a
| different scanner, and/or look at them with eyeballs.
| coldpie wrote:
| I don't understand why that's better than just doing a
| scantron style bubble form with a pen. That's what we do in
| Minnesota. Introducing computers to the actual voting (not
| counting) process seems like needless complexity. Software
| quality and UI design in 2022 is absolutely _abysmal_. Keep
| It Simple, <polite S-word>.
| kube-system wrote:
| Because not everyone is familiar with the proper way to
| fill out a scantron, and some mess it up. "Hanging chad"
| type issues happen on scantrons -- people put an X or a
| checkmark through a bubble, people make a mistake and then
| "cross out" a bubble, mark too many options, etc.
|
| A voting machine that marks a paper ballot for you is the
| best of both worlds -- it is a paper ballot, but it marks
| it consistently, and allows the user to affirmatively
| confirm their choices were recorded correctly.
| Thlom wrote:
| We solved this issue by having one ballot for each party.
| In the voting booth you pick your party of choice ballot,
| fold it and put it in the box.
| alexvoda wrote:
| I suggest that your terminology is wrong.
|
| Voting is not the process of marking the ballot. Voting is
| the act of casting a ballot (marked, unmarked, vandalized,
| etc.) into a secure pile of ballots therefore making it
| anonymous.
|
| In terms of voting security the digital scanning and
| counting is much more problematic than electronically
| marking of choices on paper.
| amalcon wrote:
| The advantage is mostly that if you're blind or can't hold
| a pen, the computer can help you with that. These folks
| otherwise need a trusted human to help them -- which mostly
| works, but not everyone has a trusted human.
| snarf21 wrote:
| If they are blind or disabled, someone likely brought
| them physically to the voting precinct or they can do a
| mail-in ballot.
| snazz wrote:
| I just voted on the same type of system in Wisconsin. It's
| nice to have the paper trail. When I voted in Minnesota, I
| made my selections by filling in bubbles and then feeding the
| paper into a machine. Either way there's a physical piece of
| paper with my selection on it.
| jcrawfordor wrote:
| The machines in use, from VotingWorks, are precinct tabulators.
| This means that the voter fills out a paper ballot and the
| machine scans and retains it, allowing for recount either
| manually or by alternate machines later on---exactly as you
| describe. Precinct tabulation was developed to reduce election
| costs and speed up counting by avoiding the need to transport
| ballots to a central location and stack and feed them to begin
| tabulation---they are fed by the voter and tabulated on-site.
| Almost all precinct tabulators, including those from
| VotingWorks, are offline and tabulate results to multiple
| storage media that are physically transported to a totalizing
| system (typically with paper tape printout as an audit and
| backup measure, in addition to the availability of the original
| ballots). This allows election administrators to begin posting
| a substantial portion of returns within an hour or so of polls
| closing, rather than the many hours historically required to
| feed ballots to central tabulators. This is particularly
| important since polling has found that many voters now distrust
| results that are delayed in posting and tend to view multiple-
| day vote tabulation as an indication of fraud, which has added
| to the motivation of election administrators to have most
| returns available the night after the election rather than in
| the following days... a logistical challenge that is difficult
| to meet without precinct tabulation, given the very limited
| budget most election administrators have to hire temporary
| staff.
|
| Unfortunately many people now conflate "voting machine" with
| direct-recording electronic or DRE machines. While DRE machines
| became common for a short period after the Helping America Vote
| Act imposed accessibility requirements that were difficult to
| meet with paper ballots, most voting machine vendors now offer
| "ballot marking machines" (sometimes integrated into the
| precinct tabulator) that allow individuals with special needs
| to mark a paper ballot using methods like voice feedback. The
| marked paper ballot can be verified by the voter or another
| individual before tabulation. Ballot marking machines have
| mostly eliminated the original motivation for DRE voting and
| the popularity of DRE voting across the United States has
| decreased since the shortly-post-HAVA period (2004 election
| cycle, basically), with many states prohibiting DRE entirely or
| DRE without voter verified paper audit trail (VVPAT), an
| arrangement in which all machines essentially function as
| ballot markers and produce a paper ballot with the voter's
| selections for the voter to inspect.
|
| DRE with VVPAT can be attractive because it integrates the
| "ballot on demand" system into the voting machine, simplifying
| the three-step process typical of precinct tabulation where the
| voter obtains a ballot from a ballot-on-demand workstation,
| marks it, and then inserts it into a tabulator. Ballot-on-
| demand is functionally required by most modern election
| administrators because it facilitates "voter convenience"
| models where voters can appear at any precinct (usually within
| their county), not just at the single precinct in which they
| reside. The reason for this is simply that, considering the
| multiple taxing jurisdictions in most parts of the US, a single
| county election can have hundreds of distinct "ballot styles."
| Preprinting every ballot style for every precinct is
| impractical and encourages fraud due to the number of valid
| ballots "lying around." Ballot-on-demand tends to have a very
| positive impact on election integrity in this way: the ballot
| does not physically exist until it is issued by the BOD system
| which is typically integrated into the pollbook system such
| that a ballot cannot be issued without marking a voter as voted
| in the pollbook. DRE with VVPAT is mostly equivalent to
| precinct tabulation with BOD, but many prefer precinct
| tabulation with BOD because the majority of voters (those not
| using assistive technology) mark their ballots manually which
| decreases the risk of mismarking by a ballot marker.
|
| It's important that American voters understand that non-
| auditable voting machines are no longer common in the US and
| are found only in some states, and the portion of votes counted
| by methods without paper audit trail is decreasing year over
| year as states replace aging DRE equipment.
|
| Unfortunately, the larger problem with US election
| administration is not DRE machines but funding. State election
| administrators usually operate on extremely restrictive
| budgets. States originally purchased DRE machines mostly
| because they were the cheapest option that met HAVA
| requirements, which essentially required many states to
| wholesale replace their voting equipment on short notice. Most
| states that use DRE equipment today use it because they cannot
| afford to replace it. There is very little, even zero, real
| support for DRE machines other than for the simple reason that
| states cannot afford to purchase anything else... and this is
| no longer as true today due to more affordable ballot marking
| machines, and vanishingly few election administrators are
| choosing DRE when they have funding available to replace voting
| systems.
|
| A larger concern in voting security is likely registration and
| pollbook systems, which are often poorly audited and from small
| software vendors, once again largely due to the small budgets
| available to pay for them. In the cases that voting
| irregularities have been found in the US, they are virtually
| all a result of defects or limitations of the pollbook system
| and unrelated to the actual vote tabulation. This encompasses
| situations like individuals voting multiple times---one voter,
| one vote is a responsibility of the pollbook system and not the
| tabulator, which is unaware of the voter's identity as a
| precaution to protect secrecy of the ballot, constitutionally
| required for federal and many state and local elections.
| Dracophoenix wrote:
| Even of that leads to hanging chads potentially costing a
| presidency again?
| tylersmith wrote:
| How does giving the vote aggregators a piece of paper assure to
| you that the outcome reflects that paper?
| cjpearson wrote:
| The title is misleading. New Hampshire uses paper ballots and
| ballot counting machines. Hand-counting is used in some cases
| such as recounts. They are trialing new ballot counting
| machines, not electronic voting machines.
| anonym29 wrote:
| +1! But this is still a net positive. Multiple forms of
| validation and open sourcing the software running on these
| machines are both components of a "defense in depth" strategy.
| ElijahLynn wrote:
| I'm having a tough time finding the link to the source code in
| the article. Am I missing it?
| Stevvo wrote:
| "the Python and Linux programming languages are all open-source"
| upofadown wrote:
| Wait, you mean that there is currently non-inspectable software
| in a path that could allow that software to switch around votes?
| How could that possibly work?
| pessimizer wrote:
| That's been the case since the dawn of voting machines.
| schimmy_changa wrote:
| Man, people are really negative about this, but it's a great
| idea.
|
| In the old days, paper ballots would also 'go missing' from
| districts known to be favorable to the other side (aka be chucked
| out of trucks on a bridge over a river). The best option seems to
| be open source voting machines + paper audit. This way you get
| immediate counts and then an audit trail, so would-be
| manipulators have to mess with BOTH at the same time which is
| significantly harder.
|
| Think you know a better way HN? Let's hear it.
| rozab wrote:
| There are other ways to achieve an audit trail with paper
| ballots. Like cameras. Electronic voting is opaque by nature
| compared to a bunch of people in a room actually counting paper
| ballots.
| kaapipo wrote:
| >In the old days, paper ballots would also 'go missing' from
| districts known to be favorable to the other side (aka be
| chucked out of trucks on a bridge over a river).
|
| The problem with electronic voting, however, is that it takes
| roughly the same effort to change one vote than it takes to
| change millions
| calvinmorrison wrote:
| Yes, that's why we have poll watches / volunteers from both
| sides.
| matheusmoreira wrote:
| Brazilian here, we've been using voting machines for quite some
| time now. We are currently facing nation wide protests at least
| partly due to suspicion of election fraud. People aren't
| accepting the election's results.
|
| Questioning the legitimacy of the voting machines has also
| become illegal ("fake news").
| ufo wrote:
| (Because of unfounded claims of fraud, according to the
| losing candidate). It's a shame. There are many ways that the
| voting machines could be improved but that will be much
| harder now that the far right has monopolized the discourse
| on auditable paper trails in their self-serving attempts to
| overturn valid election results.
| matheusmoreira wrote:
| Your argument makes no sense to me. You think there's many
| ways the system can be improved. In other words, you think
| it's fallible. At the same time, you think any results
| produced by such a system are legitimate and should be
| accepted at face value. Why shouldn't "the far right"
| question results that are questionable?
| ufo wrote:
| If you really do believe the election was stolen, then I
| have a bridge to sell ya.
| matheusmoreira wrote:
| Where did I say I believed it? I said many people in my
| country believe it, and that it's okay to question such
| things. Nobody should have to accept a questionable
| election.
|
| Remember, such questioning is being literally censored
| and supreme court judges are publicly saying the results
| are "unquestionable" and anyone who spreads suspicion
| will be treated as anti-democratic criminals. If you
| really believe censorship and judiciary dictatorship is
| okay I really don't know what to say anymore.
| ufo wrote:
| That's kind of what I was saying. The far right pulled
| all the oxygen out of the room with their clown show. Any
| changes to the system will have to wait a couple of years
| until everyone has forgotten about it.
| SketchySeaBeast wrote:
| Sorry - so how do I ensure that the code running is the code I
| expect it to at the moment I vote? I "can simply hire a computer
| expert to examine it and see, in real time"? That doesn't seem
| feasible while I'm sitting in the voting booth.
|
| I see they are using manual vote counting this time around to
| check, but how is that any guarantee the software will be the
| same in 2 years time when it happens all over again? Knowing
| there is software in some git repo somewhere that I can audit
| doesn't make me trust the machine in front of me any more.
| starkd wrote:
| True, the average voter is not inclined to hire a computer
| expert to do an analysis, but if there is widespread suspicion,
| they will at least have the ability to vent their collective
| outrage into an actual audit of the code. This transparency can
| provide some assurance.
| nyokodo wrote:
| > audit of the code
|
| The OP is talking about the inability to audit the code
| actually running at the time of voting. You can audit the
| code in the repo all you like but if the hardware of the
| voting machine is compromised, or the code you audit is
| modified or replaced sometime before execution, or there is
| other malicious code running on the machine interfering with
| the voting then your audit is useless.
| capableweb wrote:
| Require (by law) that the actual machines be available for
| potential inspection for X weeks/months after each
| election. If there is suspicion of fraud/issues, inspection
| happens on the machines that have been stored since the
| election. Since the machines are offline the entire time
| (by design it seems), manipulation doesn't seem that easy,
| granted the machines are stored in a secure location in the
| meantime.
| nyokodo wrote:
| > manipulation doesn't seem that easy
|
| I wasn't suggesting manipulation was easy. But for a
| sufficiently motivated and resourced actor with direct or
| indirect physical access to the machine all bets are off.
| r00fus wrote:
| The problem is that "audits" of those machines is itself
| a threat model.
|
| The auditing needs to be controlled such that a malicious
| auditor doesn't compromise the machine.
|
| State couldn't prove that the machines audited by a
| private group in Arizona weren't compromised so they had
| to replace them [0] to a tune of $2.8M.
|
| [0] https://www.businessinsider.com/arizona-audit-
| maricopa-count...
| mFixman wrote:
| Volkswagen cheated on emissions tests by creating software
| that did the expected results only during an audit. Doing the
| same for voting software would be much easier.
|
| There's no way for a computer to completely prove it has the
| right software for a job.
| SketchySeaBeast wrote:
| Can it though? If the audit is called for after the election
| how do we determine the code that the auditor is inspecting
| is what was run on election day?
|
| It's still a black box on election day - it's just got
| detailed instructions written on it claiming that's what is
| inside.
| jcrawfordor wrote:
| The audit strategy for precinct tabulators such as these is not
| to audit the machines but the actual ballots, which are
| retained. Upon suspicion (usually this requires a court order,
| details vary a lot by state) the original ballots, which are
| retained after the machines tabulate them, can be hand-counted
| or more practically recounted by independent machines.
|
| Every conceivable election method is vulnerable to some type of
| fraud, and hand-counting leads to relatively very high
| unintentional error rates. Post-election audit sampling is a
| typical practice in many states and should be in all.
| luxuryballs wrote:
| yeah open source software isn't a fix for this it's a ruse, the
| last built and deployed binary can in theory contain anything,
| why are we using computers for this??
| mavhc wrote:
| 1. Send the results to multiple independent organisations 2.
| Print out for each voter a list of codes they can use to show
| that they voted for each candidate, show on screen the code
| they need to memorise/highlight for their actual vote 3. Later
| they voters can put that code into any of the organisations'
| websites to check their result was recorded correctly, which
| also means each org can check that they have the same results
| the voters think they made
| SketchySeaBeast wrote:
| Isn't this de-anonymizing the process a bit - I know your
| name won't be printed directly on it, but now the
| organization you went to can determine who you are and who
| you voted for.
| constantcrying wrote:
| Voting machines should not exist. Even if they are just printers.
|
| Computerized vote counting is a _ridicolously_ bad idea on every
| imaginable level. Especially if there is any amount of
| centralization. Computerized ballot printing "just" makes it
| very easy to deanonymize people.
|
| Here where I live your name is crossed of a list after you have
| shown your ID card. Then you get a piece of paper which is thrown
| into a box. Given the incentives, anything less rigorous seems
| quite ridicolous.
| cakeface wrote:
| You can see the source code on github
| https://github.com/votingworks/vxsuite
|
| Looks to be TypeScript running on node. They have an embedded
| kiosk browser.
| ElijahLynn wrote:
| Thank you, I was skimming the article for a link to the source
| code but was having trouble finding it.
| cosmojg wrote:
| I don't get why we don't just print receipts with anonymous
| hashes at polling stations, publish all counted votes with those
| hashes, and allow people to independently verify that their vote
| was counted. This would be so easy to implement. It's truly
| depressing that it hasn't.
| yamtaddle wrote:
| You'll still have people saying there were extra votes or that
| the votes weren't counted _correctly_. It 'd have almost no
| effect on complaints about election integrity, just like...
| every other indication they're barking up the wrong tree hasn't
| had an effect.
| elil17 wrote:
| When I voted in this year's election in the US, I used a computer
| which printed my ballot after I filled it out digitally. That
| ballot was then scanned by another computer and put in a ballot
| box for any potential future recounts. That seems like the ideal
| way to do it to me - I eliminate the risk that my ballot isn't
| counted due to my admittedly poor scantron filling skills but I
| still get a paper ballot in a box that a human can count if need
| be.
| tomatotomato37 wrote:
| Can someone enlighten me why we need a full multipurpose computer
| that can run custom software just to increment one of two
| numbers? What's the secret sauce that means we can't run the
| whole election off of a cluster of 4000-series CMOS's on a
| breadboard mounted in a plexiglass case in the public somewhere?
| willcipriano wrote:
| You probably want a record of votes with times and not just a
| simple counter.
| yifanl wrote:
| I'll come off as glib. but... why? So third parties can make
| a funny youtube infographic timeseries?
| delecti wrote:
| So you can demonstrate that votes correspond to people
| voting. Not on an individual basis, but just to make sure
| that if you have 100 votes on a machine (or 1000 votes
| across 10 machines at a location, they happened when there
| were 100 (or 1000) people at that voting location. It
| prevents adding votes before or after the fact, like
| putting a thumb on a scale.
| yifanl wrote:
| You'd have to hide the results of the vote if you're
| collating them with timestamp, otherwise you could pretty
| easily figure out Bob who showed up early voted for the
| square.
|
| And I'm unsure how adding timestamp helps with the
| problem you're trying to solve, don't you just need
| Sum(machine vote count at location X) == voters visiting
| location X. (Also this hueristic is kinda leaky since how
| do you account for voters protesting with intentional
| spoilers?)
| im-a-baby wrote:
| You could print a receipt that contains the voter's
| selection. The voter would then verify the selection and
| deposit the receipt into a receptacle. The voting machine
| results could then by audited by comparing the receipts to
| the voting machine's history.
| yifanl wrote:
| I should clarify my question "why" is specifically about
| conflating votes with timestamps. I have more general
| concerns about voting machines, but those have been
| raised elsewhere in the comments many times by other
| commenters.
| im-a-baby wrote:
| The timestamp of each vote in the machine could be useful
| during the audit. Imagine you found a discrepancy, you'd
| then want to determine when the discrepancy started.
| yifanl wrote:
| If you're able to determine some subset of voters from
| the attached timestamp information, then you're equally
| able to use that data to harass people who didn't vote
| for the candidate you want.
| bweitzman wrote:
| What if the voter doesn't deposit the receipt?
| willcipriano wrote:
| If you let the government get away with just simple counts
| they don't have to work as hard to fake an election. A time
| series can be compared with exit polling for example to
| highlight irregular patterns.
| yifanl wrote:
| I can assure you that a corrupt nation-state level actor
| is at least as good at statistics as any analyst you
| know, if that's the threat model.
| willcipriano wrote:
| A motivated person could kick open your front door and
| tickle you, that doesn't mean a deadbolt isn't useful as
| part of home security plan.
|
| Defence in depth.
|
| A very least now they have to bring a math nerd into the
| conversation, increasing the footprint of the operation.
| tomatotomato37 wrote:
| That's not impossible for a simple electromechanical
| calculator either. An attachment similar to those paper drums
| seismographs use would suffice while still being simple
| enough to be trustworthy; a video recording of the counter
| along with maybe an array of debug LEDs would suffice too now
| that I think about it.
| [deleted]
| klyrs wrote:
| Not just one of two numbers. Ballots contain multiple
| referenda, and races for multiple positions, each of which can
| have anywhere between 1 and tens of candidates.
|
| You need to display all of that information, take a user's
| input, store it in an auditable format. Oh, and people like
| "small government" so making custom hardware is completely out
| of the question. Using a "multipurpose" computer is the
| economical choice.
|
| But there's another aspect to this: if you can swap out the
| hardware and keep the software the same, it makes the whole
| thing more transparent. A jumble of 4000-series CMOS on a
| breadboard could hide any number of bugs/backdoors. And,
| perception of trust is important, nobody wants to vote on your
| science fair project. Also, you'd need to produce thousands of
| these machines to run an election. Really easy to procure
| thousands of commodity multipurpose machines... but you're
| talking about mass-manufacturing your science fair project.
| Hell no.
| bastawhiz wrote:
| There's a lot to be said for the value of commodity hardware:
| you almost certainly can't prove that purpose-built hardware
| has or hasn't been tampered with by the manufacturer. With
| commodity hardware, the risk that the manufacturer
| anticipated your use case (voting machines) and implanted a
| backdoor that can affect their functions is extremely small.
| rgacote wrote:
| And some positions allow you to vote for "up to" some number
| of candidates. Town selectman is a typical example.
| klyrs wrote:
| Excellent point, I've never seen that. The whole structure
| of election has a lot of variation from place to place,
| which is a major stumbling block for people who want
| simple, universal technological solutions.
|
| And I forgot write-ins! You don't even have a fixed set of
| candidates in a given election!
| jefftk wrote:
| _> You need to display all of that information, take a user
| 's input, store it in an auditable format._
|
| These are machines that read paper ballots and compute
| totals. See https://news.ycombinator.com/item?id=33469882
| TT-392 wrote:
| I remember hearing about a study on very simple electronic
| voting machines. These machines had a bunch of buttons
| representing the candidates. And in the study, they were able
| to make a decent guess of who voted what by looking at the rf
| emissions from the machine from a distance.
|
| I could imagine a whole computer being there could make the rf
| emissions less predictable. I can definitely think of some ways
| of making a simple machine like that more resistant against an
| attack like that. Idk if the study looked into that, I can't
| find the study anywhere.
| orangepurple wrote:
| Run a low power spark gap transmitter nearby to prevent
| snooping lol
| tomatotomato37 wrote:
| Timing attacks and similar methods of vote snooping is
| definitely a big issue I've been thinking about for a very
| simple calculator like this. At first you'd think you could
| mitigate that with some sort of analog capacitor timer buffer
| thing somewhere in the chain but then you screw up a lot of
| predictablity needed to trust such a device...
| jcrawfordor wrote:
| There are multiple reasons. First, the tabulator typically
| needs to determine the "style" (layout) of the ballot from one
| of possibly hundreds of options (due to multiple government and
| taxation jurisdictions). Second, a typical ballot in most US
| jurisdictions has a dozen or more questions on it, and
| cumulatively across all ballot styles there are often over a
| hundred questions.
|
| Third, though, and perhaps most significantly, "traditional"
| optical mark reading (OMR) systems using LED or laser sources
| and diodes were inflexible as to ballot layout and more
| problematically not very reliable across varying marks
| (remember the grade-school requirement for #2 pencils due to
| OMR scoring of exams), a particularly big issue since voters
| are often not experienced with OMR systems and so do not mark
| their ballot "correctly." To address this, almost all modern
| ballot tabulators use a CCD mechanism to take an image of the
| full ballot and then interpret it via machine vision (this is
| not a case of machine learning, the algorithms used are
| actually very simple). This yields much more reliable
| interpretation of ballots with fewer ballots rejected to hand-
| counting, but requires more complex software.
|
| It's important to understand that most US election
| administrators avoid hand-counting in large part because of its
| inaccuracy. In many US jurisdictions hand-count ballots are
| counted by two individuals to improve reliability, but the
| error rate remains higher than machine tabulation. When it is
| 1AM after a day that started at 5AM and you are on the
| hundredth ballot you've hand-tabulated since you got off the
| precinct floor it becomes extremely difficult to tabulate with
| the virtually zero error rate that US voters expect. This is
| not a hypothetical scenario but one that's pretty typical of US
| election working conditions due to the slim budget and
| expectation of rapid posting of returns.
| kunwon1 wrote:
| I've always wondered why there isn't overlap between voting
| machines and slot machines. Surely most of these problems have
| already been solved by the Nevada Gaming Commission
| bastawhiz wrote:
| The problems do look the same. Why don't they share a common
| enforcement agency? Because they deal with two types of
| entities (government vs corporation) that operate machines
| with vastly different use cases with vastly different threat
| models. A casino's threat model for its slot machine supply
| chain is completely different than the threat model for
| voting machine integrity.
|
| Boiling the problem down to the integrity of the hardware and
| software throws out the nuance of how and why exploitation
| might occur (and who is doing the exploiting), which has huge
| implications for how you make regulations and do enforcement.
| alexb_ wrote:
| There was a voting machine posted here a while back that was
| _literally_ transparent, as in you would literally be able to see
| the computer marking off the paper ballot through a transparent
| box. Is this the same thing, or is this something different? I
| don 't think "computer experts say it's okay" is going to help
| build trust when people are distrusting of authority in the first
| place, so I hope it's the transparent one.
| eru wrote:
| The article says:
|
| > "There's a strong desire to see how ballot counting machines
| are actually counting the ballots," New Hampshire's Secretary
| of State, David Scanlan, told Click Here in an interview. "And
| open-source software really is the only way that you can do
| that effectively."
|
| In any case, I don't think voting machines are a good idea.
|
| I know that you can use enough cryptography and enough open
| sourcing to make them secure, but what might convince me
| wouldn't convince the 'village idiot'.
|
| Paper voting and traditional election observers work in a nice
| 'analog' way. It's tangible, and even a 'village idiot' can
| understand how it works.
|
| Most voting systems aren't complicated enough to need a
| computer to evaluate them.
|
| (And those that are should arguable be changed.)
| fredleblanc wrote:
| I live in New Hampshire, and though I've never voted on a
| computer where I'm touching a screen, I still feed my paper
| ballot into a scantron machine that seems to do all the
| counting. I've voted in maybe 20 elections (between local,
| state, and federal) in my lifetime, and it's always been done
| this way around here. Maybe we all forget that _that 's_ a
| computer, too.
|
| All that said, I live in a town of less than 3,000 people. I
| don't know that the solutions that work for us here would
| work everywhere.
| frob wrote:
| Electronic ballot-tallying machines are necessary to running
| accurate and speedy elections. As we saw in the Arizona
| fiasco with the "Cyber Ninjas," hand-counting ballots takes
| weeks, if not months. Additionally, hand-counting has an
| error margin of 1-2%. In a era where many races are within a
| point or two, hand-counting ballots will lead to the wrong
| person winning office.
|
| We also have tons of checks in place to make sure the
| machines work. There are calibration runs where known stacks
| of votes are sent through the machines and confirmed at the
| end. The vote totals on the machines are checked against the
| number of people who voted. Post-election, election officials
| randomly choose machines, open them up in front of the public
| at preannounced times, and confirm that the ballots that have
| been locked inside the machine match the tally the machine
| produced.
| CHY872 wrote:
| In the UK all ballots are hand counted, and the counting is
| done within a day.
|
| I would expect that the amount of time it takes to tally a
| paper election is related to how many people you have
| counting.
| eru wrote:
| Same in Germany.
| jcranmer wrote:
| How many races are on your ballot? Next Tuesday, I'll
| have 11 races to vote for, plus 4 ballot referendums.
| That's probably a median election ballot in the US.
| whoooooo123 wrote:
| In the UK? Typically just one race: you vote to elect
| your local MP.
|
| You might also vote for someone to represent you in the
| devolved Welsh/Scottish/Northern Irish governments if you
| live in those countries, but that's only 15% of the
| population and those elections aren't necessarily on the
| same day as the general election.
| neverartful wrote:
| I disagree. While I do agree that hand counting paper
| ballots is extremely time consuming and error prone, it's
| not the only alternative to an electronic voting machine.
| The other alternative is a mechanical voting machine. No
| electronics and no software involved. I grew up in south
| Louisiana and this is the kind of voting machine that was
| used when my parents went to vote. The downside is that the
| machines were big and heavy. The voter steps inside the
| curtains and pulls a big lever that closes the curtains
| behind them and makes the machine ready for voting. The
| voter physically moves a lever for each choice. When
| they're done voting, they pull the big lever in opposite
| direction and it tallies their votes, returns the levers to
| their original positions, and opens the curtains. I don't
| know the exact procedure of reporting the polling station
| results, but I'm sure it required multiple individuals (and
| maybe even a supervisor) to read off the results from each
| voting machine. Even if you have a polling station with say
| 20 voting machines, that's just 20 additions per voting
| choice that must be summed. This is much easier and faster
| than hand counting paper ballots. Additionally, I think it
| would be nearly impossible to alter the voting machines in
| an attempt to steal votes. I would like to see this
| everywhere. Voting integrity and quick results.
| sidewndr46 wrote:
| > The vote totals on the machines are checked against the
| number of people who voted.
|
| Isn't that just checking that "x == x" in software if
| everything is done by machine?
| frob wrote:
| Nope. The people running the election sign every voter in
| uaing a system independent of the voting machine (often
| paper). At the end of the day, they know that 216 people
| voted at that precinct. If the counting machine doesn't
| say 216 votes on it, something is awry and must be
| investigated.
| sidewndr46 wrote:
| Couldn't the person just signing me in record my vote on
| paper & then add it to a tally?
| jcranmer wrote:
| 1. That's not a secret ballot.
|
| 2. The typical US ballot has a dozen or so different
| votes that need to be done.
| HPsquared wrote:
| Ranked choice voting systems (e.g. single transferable vote)
| have a lot of "game theory" advantages over e.g. first-past-
| the-post, but are hard to implement with manual counting.
|
| Edit: I suppose that doesn't mean voting machines are
| required though, just that the results on each ballot paper
| need to be inputted to a computer to determine the outcome. A
| lot of data inputting required, but still auditable.
| eru wrote:
| First-past-the-post is pretty horrible. Alas, experience
| from Australia shows that single transferable vote isn't
| any better in practice, either. It's more complicated with
| no benefit in practice. (See
| https://rangevoting.org/rangeVirv.html for more details on
| Australia.)
|
| If traditional voting is required, I have higher hopes for
| approval voting or the slightly more complicated range
| voting. These are quite easy to evaluate completely by
| hand. Especially the former.
|
| If you are happy to go a bit off the beaten track, using
| sortition amongst volunteers might be a good way to fill up
| a parliament. (Or any other body big enough for the law of
| large numbers to kick in.)
|
| As a slightly more complicated system, I would have every
| voter indicate their favourite candidate on a ballot sheet,
| and then draw enough votes at random to fill up parliament.
|
| (Use your favourite mechanism to handle the same candidate
| being voted for multiple times in your sample. Perhaps give
| them more weight, or re-draw, or have people write down an
| ordered list of preferred candidates, and admit the highest
| ranked one who isn't already in parliament, etc.)
|
| Random sampling is surprisingly powerful. It also
| completely bypasses Arrow's impossibility theorem.
| BlueTemplar wrote:
| Does it ?! Wow, that _is_ tempting...
| velcrovan wrote:
| I'm curious, do you distinguish between _ballot counting_
| machines (what the NH SoS is talking about) and _voting_
| machines (your term)?
|
| I understand "voting machine" to be any mechanism that acts
| as a substitute for a paper ballot, or that acts as an
| intermediary between you and a paper ballot. And I would
| agree that the former are a terrible idea and the latter
| probably don't provide much net benefit.
|
| But ballot counting machines are a different matter. Here's
| the thing: there's no voting process without a ballot
| counting machine. It's just a matter of whether that machine
| will be a carbon-based one subject to bias, fatigue, boredom
| and hunger, or an electronic one that excels at stupid-simple
| repetitive tasks and is subject to none of those things.
| eru wrote:
| There's a third option: a mechanical ballot counter.
|
| I know that human beings are fallible. That's why I wrote:
|
| > I know that you can use enough cryptography and enough
| open sourcing to make [electronic machines] secure, but
| what might convince me wouldn't convince the 'village
| idiot'.
|
| People are used to the failure modes of other humans. And
| they trust other humans in a way they don't trust machines.
|
| This is similar to how juries still put a lot of stock in
| eye witnesses.
| velcrovan wrote:
| How is "mechanical ballot counter" a third, distinct
| option from "ballot counting machine"? Are you saying
| that if it had no electronics and operated solely by a
| human turning a crank on a bunch of gears, springs and
| levers, people would see it as more reliable and
| trustworthy?
| nicoburns wrote:
| IMO secure isn't enough. You also need to make it auditable.
| As far as I can see, it's pretty much impossible to do this
| satisfactorily with a digital solution. It also seems
| entirely unnecessary. Manual counting systems work well, and
| allow people to feel like they are participating in the
| democratic process (because they are).
| frob wrote:
| Most states use paper ballots that are then run through
| electronic tallying machines. This process is completely
| auditable. This is how people lying about the 2020 election
| were able to do all of their sham audits in Arizona and
| Wisconsin.
| nicoburns wrote:
| > This process is completely auditable
|
| Presumably the auditing process would involve tallying
| the votes manually... in case why bother with the
| electronic process? Unless you only run the audit if
| there's a complaint. Which I guess works. But personally
| for something as important as elections I would much more
| comfortable with a system where the transparent, hard-to-
| corrupt process is used by default.
| _-david-_ wrote:
| You are missing the part that somebody could add
| additional ballots which is a claim that is being made.
| Supposedly there was a water leak and then people brought
| in some extra ballots.
| johnsbrayton wrote:
| Ballot boxes that scan ballots are auditable because they
| keep the paper ballots.
|
| In my state, election workers have to ensure that the
| number of ballots is the same as the number recorded by the
| ballot box on election night - although we don't recount
| who voted for who. The ballots are preserved.
| snarf21 wrote:
| Voting machines should only ever be used to automate counting
| of votes. They should never mark the voting sheet. Having the
| physical paper lets us easily recount or reverify. If it was
| marked erroneously, all is lost.
| kube-system wrote:
| No, the paper should be marked by a machine, and displayed to
| the user for confirmation. If you let the user mark the
| paper, you get 'hanging chad' problems.
| [deleted]
| hirundo wrote:
| > Some 3,000 voters will run their paper ballots through the new
| machines, and then, to ensure nothing went awry, those same votes
| will be hand counted in a public session in Concord, N.H. Anyone
| who cares to will be able to see if the new machines recorded the
| votes correctly
|
| If hand counting paper ballots instills confidence, then at some
| low level of public confidence in elections, it makes sense to do
| so routinely, rather than just a demonstration. Vilifying
| doubters doesn't seem to be very effective. For many of those
| there is no level of proof that could dent their opinion, so
| little is lost by simply attacking them. But there are many
| others that are convincible by sufficient openness.
|
| Sure, turning it back into a manual process has its own issues,
| particularly with efficiency. But with an election efficiency is
| a minor consideration compared to confidence.
| bediger4000 wrote:
| There have traditionally been ways to mess with a hand count.
|
| One example I recall is vote counters wedging a piece of pencil
| lead under a fingernail. If they see a ballot they don't like,
| swipe the lead across it and toss the ballot in the "spoiled"
| pile.
|
| Sure, this requires a little bit of blind eye from the county
| clerk (or whoever), but if the election goes the right way,
| it's worth it.
| iso1631 wrote:
| In the UK party candidates and guests are watching the count
| so would pick that up. It's very rare that the losing
| candidate plus all spoiled votes makes a difference in any
| case, and significant numbers of double voting would raise
| very interesting questions. They simply don't happen.
| SketchySeaBeast wrote:
| I do believe audits and observers would catch that pretty
| quick.
| foldr wrote:
| Some problems with this, besides the problems that other
| posters have already mentioned.
|
| * One vote counter can't make much of a difference by
| themselves, so you need a conspiracy of vote counters. But
| conspiracies are difficult to bring about and keep secret in
| the real world. This is especially so if you have to pay the
| individuals involved - which seems likely, given that vote
| counting is boring, thankless volunteer work.
|
| * Everyone involved in the conspiracy risks going to jail,
| but hardly anyone benefits on a personal level. Why would
| anyone risk it?
|
| * The extremely large number of spoiled ballots would be
| suspicious. Especially as they'd probably look rather unlike
| ordinary spoiled ballots.
|
| * Observers would notice that some counters (those involved
| in the conspiracy) were processing many more spoiled ballots
| than others.
|
| I'm reminded of Number 2 pointing out do Dr. Evil that he
| could quadruple his profits if he shifted his resources away
| from evil empire building and towards Starbucks. The money
| and resources spent on rigging the count could be spent more
| efficiently on 100% legal means of increasing vote count,
| such as canvasing (= knocking on supporters' doors and
| encouraging them to go vote).
| TrevorJ wrote:
| The fact that at some point over the last 6 years, a huge
| bipartisan majority of people expressed doubts about the security
| of our elections (One party in 2016, another in 2020) and yet
| very little real change has been accomplished is pretty telling.
| Fact is, if you are _in_ power, there 's very little motivation
| to mess with or risk a change to the system that got you into
| power.
___________________________________________________________________
(page generated 2022-11-04 23:02 UTC)