If you can independently verify the election result, then it does not matter if any of the counts were made using proprietary software.

If you can not independently verify election results, what good does published source code do?

Elections are a process, not a result.

I agree insofar as ensuring all e-voting implementation attempts are open source will enable us to more comprehensively prove that it is a fundamentally bad idea.

One of the few things I was happy with Texas legislation this year was moving all to paper ballots. They still use the "bubble counter" machinery though and not human eyeballs. But it's not like it still relies on honest people and a government that is neutral when it comes to counting votes. That's starting to look like it is less and less possible with the current regime's banana republic chaos.

> I agree that paper ballots are better,

You didn't define how paper ballots are better. Given that many electronic systems print paper ballots, I'm not sure how they could be said to be universally better.

Electronic ballots can be much better than paper in two ways. Firstly, they are faster to count. I'm not sure why that matters, but it's true and seem people seem to think knowing the outcome quickly is important.

Far more importantly to me: they are easier to use. In Australia we have compulsory voting. A lot of attention is paid to how many votes are invalid. It currently runs at 5%, but ranges up to 10% in areas with lower education levels or non-English speaking. Voting machines can tell you verify if the vote is valid, help you if they aren't, provide information from the candidates if you want to know more.

One the downside, a poorly designed voting machine can be far less secure than out current paper system. Sadly, I don't think I've seen proprietary voting voting machine that didn't have significant design flaws. Making the situation worse is the voting machine companies like to keep their flaws well hidden (flaws aren't good for sales). In Australia, we've had examples of the Australian Electoral Commission perusing academic researchers in the courts for revealing flaws. [0] Mandating open source mandate is a solution to that.

https://www.unimelb.edu.au/newsroom/news/2019/november/flaws...

Candidates drop out, die, or become ineligible in all kinds of ways. Paper is not strictly better and can create costs and complications on the day of the election itself.

Electronic voting is fine. Why can't we just have a printer in the polling booth? I run my ballot, then hit print, then I can manually verify it, and then drop the printed ballot in a box.

Literally the easiest thing to do.

there are even ways that paper ballots can fail. there needs to be a better process that has proper controls and checks regardless of the format used.

I wouldn't trust any democracy that uses electronic voting. It is not possible to secure voting machines and make them democratically accountable.

Haven't watched it, but to summarize what I imagine someone aligned with me would say: A ballot's entire lifecycle can be watched as it goes from the stack to the booth to the dropbox to the counting pile. Poll watchers are vestigial as soon as voting machines are involved; it becomes the honor system, which is not trustworthy enough in a system where the parties do not trust each other. The best you have is 'we have found no evidence of widespread voter fraud', a carefully couched statement from media organs you don't necessarily trust either. You, a (Democrat/Republican), can trust a system with paper ballots, because people from your party will observe all relevant details of the process everywhere the process occurs.

First video:

Arguments against electronic voting: 1) one person can change millions of votes 2) vulnerable even outside the country 3) even if you audit the software, it's hard to verify that the audited software is what is actually loaded on the machines 4) even if you check hashes of the software, how do you check the software that checks the software (this is a restatement of the Ken Thompson Hack) 5) proprietary software 6) USB sticks are insecure 7) final computer tallying everything is owned and located in a single place 8) XSS attacks on e-voting pages.

Arguments for physical voting: 1) centuries old, many attacks have already been tried and failed 2) no identifying marks on ballot = no opportunity to pressure voters to change their vote 3) multiple people involved in each stage of the process

I realized after typing that out that YouTube has a "Show Transcript" function, so try that for the second video.

In addition, and I think the punch line, if you take measures to decentralize and audit every single part of the digital process, you have just made the most expensive pencil and it'll not perform that much better against manual voting to begin with.

Too easy to cheat.

This isn't a technology problem, really. It's a problem of corruptible humans. In US elections, there are billions and even trillions of dollars at stake. Observe the grifting being done by the current administration. Thus, humans are extremely incentivized to corrupt the process. Technology just makes the corruption easier. Technology enables the grifter.

How do you know? How can their citizens know?

They don’t have stellar democracy grades from The Economist’s index: https://en.wikipedia.org/wiki/The_Economist_Democracy_Index and both seem worse off in the last ten years than the ten years before.

Are they using only the electronic version or the mixed version? We used the mixed version in some elections here in Argentina. The paper trail is harder to fake, and the electronic part close a few problems of theonly paper version.

Umm.. I wouldn’t say fine.

https://www.bbc.com/news/articles/cj9w43p7741o.amp

Things have always been iffy. No one knows for sure.

Edit: That link is the most recent example. Googling for voting machines themselves would bring more examples. Every election cycle we go through reports of malfunctioning, no audit, audit not matching, extra machines appearing, machines being taken around by politically connected, even things like pressing any button on the machine voting for the same party…etc., but ECI has been pushing it aside and refusing to open up. This recent one became an issue because the manipulation (allegedly) went a layer deeper into the voter rolls themselves and they are public data.

We don’t know what’s up with the machines.

Placed 56 and 41, respectively, on the Democracy Index.

Haha no. Voting machines caused absurd amounts of political instability here in Brazil. It's essentially become wrongthink to question the system.

Our elected representatives have tried to add a paper trail to the machines twice now and it was ruled unconstitutional for total bullshit reasons. Our former president was banned from future presidential races because he questioned the machines. We have a judge loudly proclaiming that the machines are UNQUESTIONABLE with such unwavering pride you'd think he'd have the balls to start a billion dollar bug bounty and post it here on HN. He only allows you to "audit" the system by appointment behind closed doors and the only tools you're allowed to bring with you is a pen and a piece of paper. People found issues even with these restrictions. There are people protesting to this day, laymen asking for source code, completely unaware of the existence of supply chain attacks and the fact the source code would prove nothing and serve only to humiliate them. We have former US president Biden's top CIA guy telling our former president to stop questioning the machines, wouldn't be surprised if they had access to this shit.

Germany did it right: voting machines are unconstitutional because citizens do not understand it. Elections must be fully auditable by the average person. This is the correct stance.

Voter rolls are public information in the US; there are several watchdog groups that perform verification services and have done so for decades; and to date, none have uncovered the kind of large-scale voter fraud that would necessitate doing anything differently from what we do now.

In fact, I'd argue that having 50 different voting systems with 50 different ways to prove eligibility makes our elections more resilient to large-scale voter fraud, even if it makes it more difficult to verify voter rolls wholesale.

Cryptocurrencies don't need to do things like make sure that no human gets more than one vote, only humans (no bots) from a specific part of the world get a vote, and keep votes secret. Blockchain is not the solution.

A single polling station usually only has a few thousand voters. During the day, polling officers at the station processed (signed/stamped/tore/etc) every single ballot that went into the boxes. They also verified every person's ID. When polling closes, why is it enormous human labor to count the votes, but all the processing during the day is not?

> The cost of human labor to count all ballots by hand will be enormous

In Taiwan, this is how it's done. Every ballot is counted by human. It's completely public: you can just walk in any polling station during the counting process and watch they count.

Chile has a very good election system and there's basically no machine input in the process.

What's important is being able to segment the population in enough voting places so that each voting place is maneaganle just by a small number of people. The Chilean system is scalable because you can always just add more voting places as the population grows.

Usually these voting places are civic centres, stadiums, schools.

It's a good system and generally for a presidential election we get the results in about 4 hours after voting ends.

Australia hand-counts. In a federal election, a voter will typically cast a preferential vote for the lower house, and a more complicated proportional vote for 3 senate seats. Rarely, they'll vote on 1 or 2 propositions ("referenda"). This seems comparable to a federal US ballot (first-past-the-post votes for house/senate/president).

The US casts 10 times as many votes - so it seems reasonable for the US to hire 10 times as many poll workers? Hand-counting is O(n) i.e. constant per-capita, and it scales horizontally.

Local and state ballots in the US can feature tens of elected positions and propositions, I could imagine hand-counting them to be quite expensive.

I'm much less concerned about automated vote counters, as long as they are not connected to the Internet, enough ballots are hand-reviewed to make sure that the values from the machine don't seem way off, and the specific type of counting machine isn't uniform across the whole election.

The cost of human labor? Maybe US-exceptionalism is peeking through?

In actually democratic countries the elections are done on holidays(Sunday) and the polling stations are in where you live.

It is your vote you silly. It is your democratic duty, right and responsibility to guard it if you don't trust the observers by becoming one. Everybody should be able to watch the process and the count!

Losing one day of revenue would not hurt. Especially on a holiday.

If your paper ballot are counted by simple, airgapped machines - that's both a vastly reduced attack surface, and is easy (if laborious) to physically audit.

> I live in California, where the voting method is vote-by-mail and you sign your ballot. That breaks anonymity right there, plus there's a barcode that matches address and ballot for traceability, so in theory anyone involved in the election process could look at my ballot, cross-reference against address, and figure out how I vote

They actually go through quite a bit of effort to prevent breaking anonymity.

The incoming ballots are scanned and sorted by machine to record that they arrived. Later, signatures on the envelope are checked. The signature verified sealed ballots are then moved and fed into a high speed extractor separating the ballot from the envelope so the envelope label isn't visible, breaking any linkage between the ballot and the voter's identity. Ballots are stacked with other ballots, still folded and moved elsewhere to be counted. The empty envelopes are kept and scanned again.

All of this happens with multiple people and on camera.

The ballot barcodes don't record any unique information that can identify voters - they're just things like precinct, ballot language and page number.

Because of the extreme diversity in voting methods in the US (it varies not only by state, but by county within the state) it's impossible to accurately make any generalization about voting in the US. For example, in my parents' county in Wisconsin, you show up at the polling place, they check you off the list of registered voters, and they hand you a ballot with no individual markings at all. Once you finish filling it out, you put it in a box with the other identical ballots, to be counted later. It's as anonymous as you could possibly ask for, except that they know that someone claiming to be you showed up and voted.

As far as party registration goes, is that required where you are? Because if so that's insane and the government there needs to change that. Everywhere I've lived you don't need to register any kind of party affiliation (and indeed some places you couldn't), you just register as a voter and you're good. Maybe it's different where you are, but if so just be aware that it is (thankfully) not universally done wrong in the way you describe.

Human tallying is a source of errors, but it typically doesn't affect the outcome in major ways. This is more of an argument against large scale winner-takes-it-all election systems, as they have the least resilience against this kind of error.

The main benefit of manual tallying is that election tampering at scale becomes a rather labor-intensive and physical process that is more likely to leave detectable traces. Compare that to the the last US presidential election that has statistical oddities in machine-tallied voting results of kinds that have historically been shown to correlate with election fraud. If this was indeed caused by fraudulent voting software, it happened without leaving any other obvious traces of tampering.

You can introduce procedures to minimize the error to a point that it’s not significant anymore.

Having a paper trail and an observable counting process is worth a small error margin.

I've counted paper ballots for multiple presidential elections in my country.

People who think it's not safe should really spend some time learning how it works. It's impossible to cheat at scale. Each ballot is verified to be correct my multiple eyes. A person is reading, one is writing down the name, one is verifying and some other things I don't remember.

To cheat you need to have everyone in on it. A whole town involved to cheat and to at best win one polling station. It's safe because anyone can attend the counting, so each party can send someone to check no shenanigans is going on.

So the more votes you want to be winning by cheating the more people must be brought in the conspiracy. That's impossible to be unnoticed at the scale of a city, much less at the scale of a country.

>Humans are actually quite bad at hand-tallying hundreds of millions of datapoints.

Humans just need to be able to separate a few hundreds of ballots into a couple of piles. When introducing double checking this makes an incredibly rigorous process, which can be open to the public. This is the case here in Germany.

Everything after that can be done by computers as all the data after that is published.

These system used for voting means that humans don't hand tally hundred of millions of votes. They tally those in a voting district only. Those them get aggregated with other districts and so on until the whole states and then the country is counted.

The problem with the accuracy assumption of electronic voting is that a) its all coded without errors and b) someone hasn't deliberately but code into manipulate the vote numbers.

User name checks out.

>We need to do everything possible to increase participation in the democratic process

Do we? Participation should be made easy for those eligible and inclined to do so, but I don't see the benefit of encouraging participation from people who can't be bothered to put some effort into it, or are ignorant of the issues and candidates and are easily swayed by trashy campaign ads. I've seen the statistic thrown around that less than half of americans can even name the 3 branches of government, and if that's true I think those people have a civic duty not to vote.

> Posting those links without any insight from your side is just quoting dogma

It would certainly be exhausting to share an opinion on every single resource you want to share with someone.

One of the weird things for computer people about the Irish voting system is that it's non-deterministic! You can count the same ballots in a different order and get a different result (because it depends which votes you choose as "surplus" to redistribute).

In practice it doesn't seem to matter that much. The counters even out the first-level effects of this, so it only matters for votes that have been transferred more than once; it can be determined statistically that it changes the result only in a very small number of cases; and there are plenty of other weird threshold effects to care about instead. But it's one property you might expect of a fair voting system that Ireland doesn't give you.

This is in no way intended to be disparaging: there are processes that work within the scale of small European nations that simply won't at larger scales.

That's an inquisitive 7 year old. Definitely reward them. Let's explain. A good voting system needs to guarantee

- Secrecy of who voted for whom

- Transparency of everything else. The names of everybody in the process, the process itself and all the statistics should be verifiably public.

Being an observer to your polling station must be a guaranteed voter right. Similarly all participating parties must have the right to send representatives to observe the entire process.

Before opening the polling station all ballots are counted by multiple observers from all sides. This is recorded into files / documentation of each observer. So the number of possible ballot papers that can be voted on is documented.

Then each ballot paper needs to be stamped with a official local seal. This is also observed by every observer. The number of stamped ballots is also counted and documented. The number has to match the original ones.

The number of people who can vote in that voting station is determined by a population survey. In bigger cities each region must have roughly the same number of constituents.

The number of ballots that are stamped must match the number of eligible voters in the polling station. A voter can request to change a damaged ballot paper. The replacement should be done in front of all observers and the voter. The replaced ballot is destroyed in front of everyone.

After putting their ballot into the box, the voter has to sign their name in multiple printouts of the list of eligible voters of that polling station. These printouts of the lists are held by observers from multiple sides. The number of signatures has to match the number of ballots in the box.

Everybody can observe the count. All the numbers are checked against each other.

If you think that this is infeasible, I come from a country of 80 million people and live in a similarly sized one. Both of them use the same system. It works. It scales since it is an almost trivially parallelizable problem. We get the election results in the same day of voting.

What signature or stamp? In my country we make any mark, although conventionally a cross is used in illustrations.

Many countries have secret ballots, mine doesn't, for reasons which are extremely sketchy (and presumably why my country is blue, not dark blue like New Zealand on the democracy map)

I prefer paper ballots. I'm in a country that uses paper ballots exclusively. I didn't make that argument here because the topic was voting machines.

It’s not a non-sequitur. The thesis behind the push for in person paper is predicated on the idea that it makes it prohibitively difficult to steal an election. That’s demonstrably untrue based on current and historical examples.

As another example, you don’t have to swap the ballots at all. Somewhere in the chain of custody, someone could just “lose” ballots for a region that is projected to vote against whoever they’re trying to fix the election for. They could forge or lose some other accompanying paperwork that was to manage those ballots, too. Or they could not bother doing that either because what are you going to do, redo the election?

Cooking up examples is sort of pointless. There are always going to be new and unexpected ways to commit fraud. The actual root issue isn’t technological. It’s sociological trust.

> If you can't trust other humans at their word, democracy cannot fundamentally work.

This, but also, important to point out that this is a question of scale: "If you can't trust other human*s*" - plural.

To rephrase: "You should trust political volunteers."

Surely we could do better? Testimony doesn't assuage my concerns that the process may not be tamper proof.

How do you feel that the paper bill counter in your bank is closed source? It does not matter because it's trivial to verify. The counter says "here is a pack of one hundred ballots for candidate A," and if you're in doubt, you just count them again. While representatives from candidate A's and B's team are watching.

Even if it's open sourced, how do you know the machine actually runs the same code as you see on Github (or wherever the repo is hosted)?

Verifying that requires more expertise than verifying the physical ballots themselves.

If you moved to another district you should vote there.

If you want people temporarily out of their district to vote, then in district X you could have a box for district Y, put paper ballots in, and send the sealed box to Y to be counted. The important thing is that the vote is cast in person by the right voter and put immediately into the box.

In other countries everyone has an ID automatically. That is a requirement to use IDs for voting. You need a proper national ID system, not the hodgepodge of random identity documents the US uses.

Correct on the idea maybe, but their implementation schemes are designed to disenfranchise those less likely to vote for them.

In Ohio we have early voting, and then we also have absentee ballots which I think solves both of those challenges. We even have what's called curbside voting for folks who can't get out of their car.

I guess in some sense I'm arguing for the existing system [1], and not to move to any sort of electronic voting, but adding in a new federal holiday for the actual Election Day. It should be a celebration of democracy, a day of reflecting on our republic, and an opportunity to be patriotic with special programming and events, parades, etc. Just a hope/dream there.

I guess the main thing I'd like to say is, I think we should have the day off from work and we should all get together as much as possible as a society and celebrate this damn thing we have instead of sitting at home on the Internet just complaining and doing nothing all the time.

[1] Today we have ballot markets which electronically mark and print the ballot. I'm not quite as concerned about those being hacked (from a layman's perspective not any expertise), and then we have the actual ballot that was cast by the citizen that we can reference. When I think about open-source voting systems, electronic voting, etc. I think of doing it through your computer.

Define, "human nature." Don't compare me with an activist.

I can't edit my previous comment so I'll continue:

This isn't and has never been true in a universal sense. Athens was democratic plutocracy with slaves. The United States didn't have popular democracy until well until the 20th century and it's worth noting that it was the Southern Democrats which wanted to restrict the basic political rights of blacks in the name of, "popular sentiment." The Fukuyamist position which takes a naive view of western democracy as totalizing in a historical sense is being rapidly called into question all over the world. People (almost) universally want the expansion of the their quality of living and political autonomy in a sense which includes but also transcends the ability to cast a paper ballot. We see with Trump that this naive notion has, "serious flaws." In the 1930's the Nazis came to power under a democratically elected conservative government. Democracy means pragmatism. Pragmatism means something about, "having a superior conversation about what we would like to be." The ability to cast a vote is an extension of this sentiment-- it isn't its foundation. We see that in the general experience of the Chinese middle class. They live under a totality but neighborhood associations and not actively being managed by the CCP results in many reporting feeling freer under this system than under ancillaries geopolitically.

Paper still needs a system to verify ballots aren't forged, and that system should be robust and transparent too.

Other countries get preliminary election results the same day even with hand-counted paper ballots. So even that isn't impossible.

The absolute number of people doesn't matter. If you have more people voting, you can have more people counting. If you have more people, you have more polling stations, you can keep the size of them constant no matter your total population.

Other countries do paper ballots and manual counting without issues. The US isn't that special or unusual.

There is too much power at stake and too many dollars in the mix for this to work. Take a look at how expensive it is to break electronic voting machines then compare that to the billions of dollars that flow into an election cycle.

> I don't think those problems are insurmountable.

As soon as you try to be more clever than electronic counting of paper ballots, yes they are.

You can either audit the count by replaying the input event stream, or you can't.

it’s called distributed voting centers, there’s this many people so there’s plenty of people available who can count their block’s ballots, there’s no motive of convenience in using electronics for voting that could ever surpass the motive for simplicity and trust, it’s just not that hard of a thing, there was no new problem that suddenly emerged when electronics became available for this, this notion should inform you of the various motives of why someone started to market them to decision makers

You can trust machines. You can't trust computers.

I can assure you I am as white as they come, my family being a mix of Quebecois and Irish I'm "wears sunscreen in the winter" pale.

I'm at a loss for why you would assume something about my racial background from my view that voting should be made easy and convenient in a democracy. I'll go even further, in addition to being able to vote digitally you should automatically be registered to vote when you establish residency, voting should be compulsory*, and it should be a national holiday. But outside the bigger picture I selfishly want this because I don't want to bother driving to my polling place when I could voted in less time than it took to type this reply.

* I wouldn't have any punishment for not voting, that would be a huge mess. But I would have it on the books in the hopes that people would follow it simply because it's the law.

> The US doesn’t have a national ID system, so your proposal doesn’t make sense. The closest thing is social security cards but those are not photo IDs.

RealID is a national ID system (that they pushed since the 90s for no reason), and we're all issued voter IDs when we register as voters.

> A signed affidavit or local ID should be fine to establish identity.

I don't think you understand that people are against showing any ID to vote; if you pull one out, the poll workers' eyes get big and they fall over themselves trying to get you to put it away (I just took it out so you could read my address to pick my precinct, ma'am.) An ID which, very soon, will be required to be a RealID if it isn't already in your state. It is in mine.

I also don't think you really mean that a signed affidavit is enough to establish identity, even though you said it clearly. If you actually do mean what you said, I'd love to hear the argument.

> That can be done when signing up for mail in voting

Mail-in voting allows other people to watch you as you vote, and is the opposite of voter integrity. You should not be able to prove who you've voted for, or else you can be forced to prove who you voted for. This is why you are not allowed to take pictures of your ballot in the voting booth.

There's absolutely no reason to spend any time on open source voting code if you'll allow churches to call their entire memberships in to fill out their mail-in ballots together (under pain of expulsion), or hypothetical gangsters to go door to door threatening to shoot people if they don't give their ballots up.

> Voter fraud is extremely rare under the current system.

1) There is no way to know, and 2) if so, that makes this proposal even sillier.

I personally am very interested in electronic voting and voting algorithms. I've read a million papers and think about it all the time. But this is not a technical problem. There is no country that has a worse voting system than the US. Normal countries don't take weeks to count up the votes.