Fully software, even a combo of software and hardware, cannot by itself make elections secure. Think of the Reflections On Trusting Trust problem, the need to verify firmware, etc. You can't ensure that machines _will_ work correctly, but you _can_ verify that they _did_. To do verify the machines' functioning after the fact you have to do it very soon after closing of the polls, and you have to devise a manual, statistical random sampling method where you manually check randomly sampled, marked paper ballots, against the digital cast vote record, then do a digital risk limiting audit to check that the CVR totals up to the machines' reported results. The sooner after closing of the polls you do this, the better the likelihood that any cheating will be caught. I.e., an immediate manual, partial audit of enough randomly-selected polling locations.
That still leaves tons of other technical problems to address, like security of mail-ballots / absentee ballots, the security of ballot boxes used for early voting (because you probably cannot run the above manual partial audit due to then having nightly results available to the public; or maybe you accept that), voter registration, etc.
Your ID card contains a private key, you use that key to sign a transaction. It doesn't matter that machine you are running on is compromised as these details can be verified at a later date.
Example A:
You vote for candidate A, but software changes to candidate B and software displays that you voted for candidate A. At any later time you can check with an independent device and look at the transaction finding out that it was altered with and retract your vote / change it.
Example B:
How do you know your vote was counted? Publish a hash and the signature of every vote, recompute the final tally and compare with all the votes. If your vote is not in the final tally the hash will be different and you can visibly see your vote in the dataset as every transaction is published. To preserve privacy each round has a number, private key + number -> new key so each fingerprint will be unique between votes.
I've spent a lot of time thinking about this problem, and my conclusion is that cryptography alone is not the solution, for reasons like:
1. The public needs to believe it, and hypertechnical solutions are a hard sell.
2. Any blockchain approach needs to preserve the secrecy of the ballot, otherwise you get all the problems you can expect of non-secret votes (coercion, vote buying, shaming network effects).
3. You still need to have the cryptographic rubber meet the physical road _somewehere_ -- it has to, otherwise the need for vote secrecy means that the results can be entirely fictitious and pre-programmed and there is no way to check!
I.e., you can have a paperless blockchain solution IFF you abandon vote secrecy. That is a very tough to swallow pill.
On the other hand, if you accept paper ballots and manual partial audits as part of the solution, then blockchain can have a role to play. For example, the machines could display a blockchain head every 50 ballots cast, and voters take a copy of the blockchain head visible to them, then after the election the public can verify the integrity of the blockchain, and the fact that you only get running tallies every 50 ballots means you get vote secrecy.
A system that uses paper ballots and partial manual audits can be explained to the public, and the public can develop confidence in it. Blockchains can then add a good deal of confidence: the blockchain tells you that the tallies were not modified after the fact, and the partial manual audit tells you to an acceptable level of statistical confidence that the digital cast vote record contains the actual paper ballots _as marked and cast_ by voters.
A major problem is that if you are able to verify who you vote for, you can either sell your vote or be coerced (by, say, your abusive husband) to vote a specific way.
There is no problem that electronic voting solves that paper ballots and scanners do not, and the latter are not only more secure but are seen to be more secure. Trust is essential in a voting system and only paper ballots provide the necessary level of trust.
Or ballot boxes. Where citizen can keep their eyes on their ballot until it is counted.
Even back in 2002, TV channels in France (60m inhabitants) broadcast the winner at 20:00:30, using statistical models.
But recently, they removed the ability for citizen to stay during the counting, relying on designated persons, which breaks the chain of trust. Might as well cast my vote into a black bag or an electronic machine, no trust at all.
Trust was never the goal. As the means of coercion are higher and the capacity of communication is filtered, it becomes unnecessary to involve citizen in voting, isn't it?
Who makes your ID card, generates the private key, and stores it there? Do you trust them? Did they retain a copy of the key? Did they implement security effectively (a very difficult task, considering the resources of attackers)? What about securing the manufacturing process?
> Example A: You vote for candidate A, but software changes to candidate B and software displays that you voted for candidate A. At any later time you can check with an independent device and look at the transaction finding out that it was altered with and retract your vote / change it.
This seems to make a pretty dramatic change to the election protocol, no?
Consider example A': You vote for candidate A, but later realize that you hate candidate A. You repudiate your recorded vote for candidate A.
But Brazilian gov says their electronic election system is unhackable... Yeah.
Only a selected few orgs and groups are allowed to audit and in a very controlled environment because they also rely on security through obscurity. The source code is not available to the citizens.
If by any chance I'm wrong and someone can point me a source code repo, please enlighten me.
In my country we still rely on a paper process - which is very hard to tamper with but also has a bunch of problems - recently we needed to repeat local state elections because of such problems including shortages of ballot papers, unusually long queues to vote, ballots being delivered to the wrong locations, and in some cases voters being turned away.
Many of these problems go away with digital voting - but then you have other issues.
While these all are problems, the REAL problem is that the goal of elections isn't to get scientifically or mathematically verifiably correct results. The goal is to produce agreeable consent.
That means it doesn't matter one bit how correct you are if the regular Joe does believe you tricked. Adding computers into the mix always makes this worse. And again, this is not something you can fix with clever solutions and cryptography (that admittedly fascinates me nonetheless), the problem is that people can't see electricity generally and I something at the scale of a computer, even if you could it would be utterly meaningless.
This is why the paper ballot system is so glorious in its stupid inefficiency, because it spreads the trust in a way any adult who has mastered object permanence can verify for themselves. Invite the conflicting parties to monitor and have them begrudgingly admit their defeat in the face of the simple, inefficient but agreeable process.
This is why I as a cryptography fan, programmer and hardware guy think electronic voting is not up to the task for high stakes elections.
> Think of the On Trusting Trust problem, the need to verify firmware, etc.
I mean that's too abstract and philosophical of a problem when talking about voting machines/software: there are much more prevalent and concrete risks including but not limited to APT-grade breach/espionage if your country is important enough, and the various other issues (some in your comment itself).
Yes, of course. See my reply to sibling comment about why a software solution is insufficient, even a soft/hardware solution is insufficient. Cryptography does not save the day. A modicum of physically auditable paper trail is required.
I'm Estonian. E-voting is widely accepted and used here. We've been doing it since 2001, and extensivelly (first parliamentary e-voting) since 2007.
The fact that it's open source is long known (at least in the IT community) and highly appreciated.
There's no inherent doubt about its validity in the local expert and international community.
Living in Estonia, I have a hard time deciding how I feel about this voting system.
Currently, with people trusting the government, this system is great. I can just cast my vote online, like I do everything else here, and I can be reasonably sure that my vote is counted thanks to the aforementioned trust in the system.
But I really fear the day that trust erodes.
On the other hand, though, once the trust is gone, I think it doesn’t really matter whether it’s an analog or digital count. People won’t trust the system anyways.
Then again, there’s a lot of nuances and different levels of trust, which is the reason why I don’t know what the right answer is.
The advantage of paper ballots is that the possible ways that the system can be rigged are technologically limited. Either ballots are forged or ballot are miscounted. Both are mitigated by having election officials physically present who validate that voter registrations are valid and that counting is being done accurately, and having those officials be made up of representatives from each participating political party.
Then the defense-in-depth is that paper ballots are inherently decentralized. Even if you manage to pull off a complex operation to rig ballots at a local voting location, you'd have to do the same at hundreds or thousands of other locations to affect the results of the election.
It's easier to restore the security of elections run with paper ballots because people can get involved locally. It's not possible to steal numerous paper-based elections in a row -- at some point the thieves' energy/funding runs out and security can be restored. With a digital system, if the system is changed to be vulnerable, or if it always was, then there is no way to recover.
I don't agree with this statement. If the system is corrupt (take for example Russia), then the voting system doesn't simply matter. Having absolute access to millions of votes, either digital or on paper, allows any dictator to decide the outcome.
Millions of slips of paper are very easy to burn, and print...
E-votes just make it cheaper/easier to vote in free countries. I don't think we have invented a truly dictator-proof voting system available yet.
There are a lot of folks who, whenever this topic comes up, seem to have no knowledge of the systems which already exist and have actually been used in real elections already. For instance, ElectionGuard has been used in several real elections in the US since 2020[1].
There's issues that are pretty fundamental with the black-box approach that the electronic ballot becomes. Paper and transparent ballots can be scrutinized pretty easily, but once you have a black box that might also be connected to the internet there's nothing you can really trust.
> The intention behind this repository is to make source code of the Estonian online voting system available for public review.
> The repository is not used for active development, but will be kept up to date, so the code that can be found here is the code that is used for election.
The repository is not used for active development, but will be kept up to date, so the code that can be found here is the code that is used for election. As the voting system used for legally binding elections must strictly follow the legislation, the actual development of Estonian I-voting system and I-vote verification application is supervised by State Electoral Office of Estonia. Please refer to www.valimised.ee for further information.
But updates are promised, so GP's question is valid: where are they, and since they're not there, why? Is this the final product's source code and it has not been modified since?
I know the answer is "you don't", but suppose I vote vote electronically for candidate A. In the end, the candidate loses with 764 votes. How do I convince myself that my vote was counted in the 764 votes, and that it was not a randomly chosen number (with a RNG skewed around "plausible" scores) ?
To take it one step further: how does the election authority convince everyone that their vote was counted?
Us "computer folks" convincing ourselves is the easy part. Maybe after enough studying of the system, I'd be absolutely sure that my vote was counted, but what would the other 90 % of the population think? This not a "people are stupid" argument, a brain surgeon or nuclear physicist or philosopher isn't going to put in the effort to understand fully homomorphic cryptography, hardware-based security, etc. Why should they?
The alternative works perfectly fine and it's so easy to explain. It's obvious to anyone, no matter their level or field of education, how their vote makes it from their hand into the tally, what prevents it from being misused and what they can do to further reduce that already tiny probability.
You can see, feel and experience the technical measures keeping your vote safe. The people keeping their eyes on the ballot box alp day may literally be your neighbours, as are the people counting. You can reason about their motivations, you can theorise in your head about what lengths you'd have to go to in order to change even a few votes and how unlikely you would be to succeed.
The biggest danger to elections, ultimately, isn't the risk of cheating. It's the risk of losing the people's trust.
(I'm in the local election commission (that's layer 2 out of 4 in our particular election management hierarcy), we just had a big referendum, everyone keeps asking me about online elections so this rant was fresh on my mind)
In any system, I suspect it is possible. There are strategies that allow doing private set intersections (or similar): https://en.wikipedia.org/wiki/Private_set_intersection (i.e. a set with one member is "you", and you can check to see if you're in that 764, without knowing who the others are)
I'm not sure what strategies would also allow you to not reveal to the vote collectors where your vote went, but there might be something.
> Private set intersection is a secure multiparty computation cryptographic technique[1] that allows two parties holding sets to compare encrypted versions of these sets in order to compute the intersection. In this scenario, neither party reveals anything to the counterparty except for the elements in the intersection.
Revealing even elements in the intersection, if that means revealing individual votes, breaks ballot secrecy.
There is a separate verification tool I've used that lets me confirm who I voted for, and that the server has registered my vote. Also, like in elections in other places, every election has observers take part. OSCE regularly send their lot, their report on the last parliamentary election can be read here https://odihr.osce.org/odihr/elections/estonia/551179.
I think this is an easy enough problem to solve, the issue is that someone else can how force you to reveal who you voted for. Spouse, rouge employers, mafia, corrupt politicians. You can now "sell" your vote.
I think such a system could still work, but just like the voter has to go to the booth alone to vote, they must go the booth alone to verify.
I've been an overseer at election booths several times. I kept a good look at the transparent ballot box, along with complete strangers. In the end, once, I may even have inadvertently recognized my envelope and bulletin during the opening and counting - because we where very very few people to choose that candidate in my polling station :D And I was lucky enough to follow the president of the polling station to the town hall where armies of public servant where doing the addition, and I checked the CSV on next Monday, etc, etc...
You convince yourself the way you do with any elections: you trust the people/system that counts the votes. If you think about it for a second, the requirements of a secret ballot (meaning it's not possible to know who voted who) and the fully verifiability you are asking for are mutually exclusive. You can have either one but not both at the same time.
That being said I think the Estonian voting system does a decent job of being trustworthy. Publishing the source code is a big step to the better as well. As far as I knew the system was written in Java but seems like they have upgraded it in Go. Good job! Probably the best in the world.
> If you think about it for a second, the requirements of a secret ballot (meaning it's not possible to know who voted who) and the fully verifiability you are asking for are mutually exclusive.
I might be missing something obvious but I'm not quite seeing the logical inconsistency between their two goals. Note they're only asking to verify their own vote, not to verify every other person's vote. For that, isn't it enough for authorities to announce a product of large primes, letting each person verify that their own prime was in the set? At each stage, the machines only report the product of primes up the chain, not the individual ones.
It seems to me the difficulty is with the fact that we have so many places to hide malicious things with modern technology (tiny electronics, firmware, etc.), not a logical incompatibility between the goals. If you had some sort of abacus that did all this mechanically without reprogrammability... or a large computer whose logic was fully verifiable... then everyone could inspect the machine and verify that it behaves correctly prior to elections, and e.g. a camera/observers/etc. can ensure no tampering occurred with the machine until the tallies were conducted.
All the source code in the world means nothing when it comes to elections. It's the object code, down to firmwares, BMCs/MEs, even microcode that matters. It's hard to establish trust in those things.
Nope. Vote tallying is public with random overseers, in transparent boxes watched by a room of people from diverse opinions, with random inspections - precisely because we DO NOT trust the system or the people who count the vote.
Which has always been my biggest beef about digital vote. I'm all trusting the people writing voting software to do their best, actually. Being a Software engineer myself, I'm more concerned about bugs and hacks than deliberate tampering by the government. Especially in an age where AI agents can access pretty much anything ever connected to an electric plug...
In a paper election, you have a chain of people who supervise each other. Depending on where you live, you can volunteer to be part of that and see it for yourself.
In code, you have no insight into what actually happens.
Fully software, even a combo of software and hardware, cannot by itself make elections secure. Think of the Reflections On Trusting Trust problem, the need to verify firmware, etc. You can't ensure that machines _will_ work correctly, but you _can_ verify that they _did_. To do verify the machines' functioning after the fact you have to do it very soon after closing of the polls, and you have to devise a manual, statistical random sampling method where you manually check randomly sampled, marked paper ballots, against the digital cast vote record, then do a digital risk limiting audit to check that the CVR totals up to the machines' reported results. The sooner after closing of the polls you do this, the better the likelihood that any cheating will be caught. I.e., an immediate manual, partial audit of enough randomly-selected polling locations.
That still leaves tons of other technical problems to address, like security of mail-ballots / absentee ballots, the security of ballot boxes used for early voting (because you probably cannot run the above manual partial audit due to then having nightly results available to the public; or maybe you accept that), voter registration, etc.
You solve all of these with cryptography.
Your ID card contains a private key, you use that key to sign a transaction. It doesn't matter that machine you are running on is compromised as these details can be verified at a later date.
Example A: You vote for candidate A, but software changes to candidate B and software displays that you voted for candidate A. At any later time you can check with an independent device and look at the transaction finding out that it was altered with and retract your vote / change it.
Example B: How do you know your vote was counted? Publish a hash and the signature of every vote, recompute the final tally and compare with all the votes. If your vote is not in the final tally the hash will be different and you can visibly see your vote in the dataset as every transaction is published. To preserve privacy each round has a number, private key + number -> new key so each fingerprint will be unique between votes.
> You solve all of these with cryptography.
I've spent a lot of time thinking about this problem, and my conclusion is that cryptography alone is not the solution, for reasons like:
1. The public needs to believe it, and hypertechnical solutions are a hard sell.
2. Any blockchain approach needs to preserve the secrecy of the ballot, otherwise you get all the problems you can expect of non-secret votes (coercion, vote buying, shaming network effects).
3. You still need to have the cryptographic rubber meet the physical road _somewehere_ -- it has to, otherwise the need for vote secrecy means that the results can be entirely fictitious and pre-programmed and there is no way to check!
I.e., you can have a paperless blockchain solution IFF you abandon vote secrecy. That is a very tough to swallow pill.
On the other hand, if you accept paper ballots and manual partial audits as part of the solution, then blockchain can have a role to play. For example, the machines could display a blockchain head every 50 ballots cast, and voters take a copy of the blockchain head visible to them, then after the election the public can verify the integrity of the blockchain, and the fact that you only get running tallies every 50 ballots means you get vote secrecy.
A system that uses paper ballots and partial manual audits can be explained to the public, and the public can develop confidence in it. Blockchains can then add a good deal of confidence: the blockchain tells you that the tallies were not modified after the fact, and the partial manual audit tells you to an acceptable level of statistical confidence that the digital cast vote record contains the actual paper ballots _as marked and cast_ by voters.
7 replies →
A major problem is that if you are able to verify who you vote for, you can either sell your vote or be coerced (by, say, your abusive husband) to vote a specific way.
13 replies →
> software displays that you voted for candidate
This enables coercion of voters. It must be impossible to attribute any vote to any specific person.
2 replies →
How do you know no fake votes were added?
1 reply →
Relevant xkcd: https://xkcd.com/2030https://xkcd.com/2030
There is no problem that electronic voting solves that paper ballots and scanners do not, and the latter are not only more secure but are seen to be more secure. Trust is essential in a voting system and only paper ballots provide the necessary level of trust.
4 replies →
> You solve all of these with cryptography.
Or ballot boxes. Where citizen can keep their eyes on their ballot until it is counted.
Even back in 2002, TV channels in France (60m inhabitants) broadcast the winner at 20:00:30, using statistical models.
But recently, they removed the ability for citizen to stay during the counting, relying on designated persons, which breaks the chain of trust. Might as well cast my vote into a black bag or an electronic machine, no trust at all.
Trust was never the goal. As the means of coercion are higher and the capacity of communication is filtered, it becomes unnecessary to involve citizen in voting, isn't it?
Who makes your ID card, generates the private key, and stores it there? Do you trust them? Did they retain a copy of the key? Did they implement security effectively (a very difficult task, considering the resources of attackers)? What about securing the manufacturing process?
In the end, you always must trust humans.
5 replies →
> Example A: You vote for candidate A, but software changes to candidate B and software displays that you voted for candidate A. At any later time you can check with an independent device and look at the transaction finding out that it was altered with and retract your vote / change it.
This seems to make a pretty dramatic change to the election protocol, no?
Consider example A': You vote for candidate A, but later realize that you hate candidate A. You repudiate your recorded vote for candidate A.
What should happen?
5 replies →
But Brazilian gov says their electronic election system is unhackable... Yeah.
Only a selected few orgs and groups are allowed to audit and in a very controlled environment because they also rely on security through obscurity. The source code is not available to the citizens.
If by any chance I'm wrong and someone can point me a source code repo, please enlighten me.
https://international.tse.jus.br/en/electronic-ballot-box/pr...
Nothing is unhackable though is it?
You just need to find the right balance.
In my country we still rely on a paper process - which is very hard to tamper with but also has a bunch of problems - recently we needed to repeat local state elections because of such problems including shortages of ballot papers, unusually long queues to vote, ballots being delivered to the wrong locations, and in some cases voters being turned away. Many of these problems go away with digital voting - but then you have other issues.
I don’t think a perfect solution can exist
One would think they'd have the balls to put up a billion dollar bounty.
2 replies →
While these all are problems, the REAL problem is that the goal of elections isn't to get scientifically or mathematically verifiably correct results. The goal is to produce agreeable consent.
That means it doesn't matter one bit how correct you are if the regular Joe does believe you tricked. Adding computers into the mix always makes this worse. And again, this is not something you can fix with clever solutions and cryptography (that admittedly fascinates me nonetheless), the problem is that people can't see electricity generally and I something at the scale of a computer, even if you could it would be utterly meaningless.
This is why the paper ballot system is so glorious in its stupid inefficiency, because it spreads the trust in a way any adult who has mastered object permanence can verify for themselves. Invite the conflicting parties to monitor and have them begrudgingly admit their defeat in the face of the simple, inefficient but agreeable process.
This is why I as a cryptography fan, programmer and hardware guy think electronic voting is not up to the task for high stakes elections.
> glorious in its stupid inefficiency, because it spreads the trust
What is the goal? Having fancy crypto or people being confident about elections?
If spreading the trust is the goal what makes you say "inefficient". It is orders of magnitude better then any crypto system.
2 replies →
> Think of the On Trusting Trust problem, the need to verify firmware, etc.
I mean that's too abstract and philosophical of a problem when talking about voting machines/software: there are much more prevalent and concrete risks including but not limited to APT-grade breach/espionage if your country is important enough, and the various other issues (some in your comment itself).
Yes, of course. See my reply to sibling comment about why a software solution is insufficient, even a soft/hardware solution is insufficient. Cryptography does not save the day. A modicum of physically auditable paper trail is required.
I'm Estonian. E-voting is widely accepted and used here. We've been doing it since 2001, and extensivelly (first parliamentary e-voting) since 2007. The fact that it's open source is long known (at least in the IT community) and highly appreciated. There's no inherent doubt about its validity in the local expert and international community.
Living in Estonia, I have a hard time deciding how I feel about this voting system.
Currently, with people trusting the government, this system is great. I can just cast my vote online, like I do everything else here, and I can be reasonably sure that my vote is counted thanks to the aforementioned trust in the system.
But I really fear the day that trust erodes.
On the other hand, though, once the trust is gone, I think it doesn’t really matter whether it’s an analog or digital count. People won’t trust the system anyways.
Then again, there’s a lot of nuances and different levels of trust, which is the reason why I don’t know what the right answer is.
The advantage of paper ballots is that the possible ways that the system can be rigged are technologically limited. Either ballots are forged or ballot are miscounted. Both are mitigated by having election officials physically present who validate that voter registrations are valid and that counting is being done accurately, and having those officials be made up of representatives from each participating political party.
Then the defense-in-depth is that paper ballots are inherently decentralized. Even if you manage to pull off a complex operation to rig ballots at a local voting location, you'd have to do the same at hundreds or thousands of other locations to affect the results of the election.
It's easier to restore the security of elections run with paper ballots because people can get involved locally. It's not possible to steal numerous paper-based elections in a row -- at some point the thieves' energy/funding runs out and security can be restored. With a digital system, if the system is changed to be vulnerable, or if it always was, then there is no way to recover.
I don't agree with this statement. If the system is corrupt (take for example Russia), then the voting system doesn't simply matter. Having absolute access to millions of votes, either digital or on paper, allows any dictator to decide the outcome.
Millions of slips of paper are very easy to burn, and print...
E-votes just make it cheaper/easier to vote in free countries. I don't think we have invented a truly dictator-proof voting system available yet.
> at some point the thieves' energy/funding runs out
I don’t see why that should be the case. If you can influence gov elections every couple of years that seems like a pretty big deal.
On the other hand having the voting source code public and auditable seems like a good way to build trust
There are a lot of folks who, whenever this topic comes up, seem to have no knowledge of the systems which already exist and have actually been used in real elections already. For instance, ElectionGuard has been used in several real elections in the US since 2020[1].
[1]: https://electionguard.vote/
Used in the real world doesn't mean it's secure.
There's issues that are pretty fundamental with the black-box approach that the electronic ballot becomes. Paper and transparent ballots can be scrutinized pretty easily, but once you have a black box that might also be connected to the internet there's nothing you can really trust.
[dead]
Interesting that there are no updates for almost a year. Cool stable software, I guess?
Explanation is in the README:
> The intention behind this repository is to make source code of the Estonian online voting system available for public review.
> The repository is not used for active development, but will be kept up to date, so the code that can be found here is the code that is used for election.
from README
The repository is not used for active development, but will be kept up to date, so the code that can be found here is the code that is used for election. As the voting system used for legally binding elections must strictly follow the legislation, the actual development of Estonian I-voting system and I-vote verification application is supervised by State Electoral Office of Estonia. Please refer to www.valimised.ee for further information.
But updates are promised, so GP's question is valid: where are they, and since they're not there, why? Is this the final product's source code and it has not been modified since?
2 replies →
The answer is paper backed by an ID, but i guess is too late for that.
I know the answer is "you don't", but suppose I vote vote electronically for candidate A. In the end, the candidate loses with 764 votes. How do I convince myself that my vote was counted in the 764 votes, and that it was not a randomly chosen number (with a RNG skewed around "plausible" scores) ?
To take it one step further: how does the election authority convince everyone that their vote was counted?
Us "computer folks" convincing ourselves is the easy part. Maybe after enough studying of the system, I'd be absolutely sure that my vote was counted, but what would the other 90 % of the population think? This not a "people are stupid" argument, a brain surgeon or nuclear physicist or philosopher isn't going to put in the effort to understand fully homomorphic cryptography, hardware-based security, etc. Why should they?
The alternative works perfectly fine and it's so easy to explain. It's obvious to anyone, no matter their level or field of education, how their vote makes it from their hand into the tally, what prevents it from being misused and what they can do to further reduce that already tiny probability.
You can see, feel and experience the technical measures keeping your vote safe. The people keeping their eyes on the ballot box alp day may literally be your neighbours, as are the people counting. You can reason about their motivations, you can theorise in your head about what lengths you'd have to go to in order to change even a few votes and how unlikely you would be to succeed.
The biggest danger to elections, ultimately, isn't the risk of cheating. It's the risk of losing the people's trust.
(I'm in the local election commission (that's layer 2 out of 4 in our particular election management hierarcy), we just had a big referendum, everyone keeps asking me about online elections so this rant was fresh on my mind)
In this system: I have no idea.
In any system, I suspect it is possible. There are strategies that allow doing private set intersections (or similar): https://en.wikipedia.org/wiki/Private_set_intersection (i.e. a set with one member is "you", and you can check to see if you're in that 764, without knowing who the others are)
I'm not sure what strategies would also allow you to not reveal to the vote collectors where your vote went, but there might be something.
From that wiki:
> Private set intersection is a secure multiparty computation cryptographic technique[1] that allows two parties holding sets to compare encrypted versions of these sets in order to compute the intersection. In this scenario, neither party reveals anything to the counterparty except for the elements in the intersection.
Revealing even elements in the intersection, if that means revealing individual votes, breaks ballot secrecy.
1 reply →
There is a separate verification tool I've used that lets me confirm who I voted for, and that the server has registered my vote. Also, like in elections in other places, every election has observers take part. OSCE regularly send their lot, their report on the last parliamentary election can be read here https://odihr.osce.org/odihr/elections/estonia/551179.
So there is a tool that remembers who you voted for. That's great to convince your bully that you actually did what they told you.
However, how do you know you're one of the X votes displayed in the final tally ?
I think this is an easy enough problem to solve, the issue is that someone else can how force you to reveal who you voted for. Spouse, rouge employers, mafia, corrupt politicians. You can now "sell" your vote.
I think such a system could still work, but just like the voter has to go to the booth alone to vote, they must go the booth alone to verify.
Most likely similarly how you know in regular "paper" elections
I've been an overseer at election booths several times. I kept a good look at the transparent ballot box, along with complete strangers. In the end, once, I may even have inadvertently recognized my envelope and bulletin during the opening and counting - because we where very very few people to choose that candidate in my polling station :D And I was lucky enough to follow the president of the polling station to the town hall where armies of public servant where doing the addition, and I checked the CSV on next Monday, etc, etc...
In theory, it's much easier to fake a number stored electronically in a computer than a large number of paper ballots.
1 reply →
You convince yourself the way you do with any elections: you trust the people/system that counts the votes. If you think about it for a second, the requirements of a secret ballot (meaning it's not possible to know who voted who) and the fully verifiability you are asking for are mutually exclusive. You can have either one but not both at the same time.
That being said I think the Estonian voting system does a decent job of being trustworthy. Publishing the source code is a big step to the better as well. As far as I knew the system was written in Java but seems like they have upgraded it in Go. Good job! Probably the best in the world.
> If you think about it for a second, the requirements of a secret ballot (meaning it's not possible to know who voted who) and the fully verifiability you are asking for are mutually exclusive.
I might be missing something obvious but I'm not quite seeing the logical inconsistency between their two goals. Note they're only asking to verify their own vote, not to verify every other person's vote. For that, isn't it enough for authorities to announce a product of large primes, letting each person verify that their own prime was in the set? At each stage, the machines only report the product of primes up the chain, not the individual ones.
It seems to me the difficulty is with the fact that we have so many places to hide malicious things with modern technology (tiny electronics, firmware, etc.), not a logical incompatibility between the goals. If you had some sort of abacus that did all this mechanically without reprogrammability... or a large computer whose logic was fully verifiable... then everyone could inspect the machine and verify that it behaves correctly prior to elections, and e.g. a camera/observers/etc. can ensure no tampering occurred with the machine until the tallies were conducted.
2 replies →
You can be a observer in the room when the ballot is counted. So you can monitor if everything was done as intended.
This, and the need for everyday Joe to be able to understand what is done at every step.
All the source code in the world means nothing when it comes to elections. It's the object code, down to firmwares, BMCs/MEs, even microcode that matters. It's hard to establish trust in those things.
3 replies →
Nope. Vote tallying is public with random overseers, in transparent boxes watched by a room of people from diverse opinions, with random inspections - precisely because we DO NOT trust the system or the people who count the vote.
Which has always been my biggest beef about digital vote. I'm all trusting the people writing voting software to do their best, actually. Being a Software engineer myself, I'm more concerned about bugs and hacks than deliberate tampering by the government. Especially in an age where AI agents can access pretty much anything ever connected to an electric plug...
1 reply →
How do you convince yourself of this in a regular election?
In a paper election, you have a chain of people who supervise each other. Depending on where you live, you can volunteer to be part of that and see it for yourself.
In code, you have no insight into what actually happens.
4 replies →