Split Thread Electronic voting

[Upchurch]

Whether electronic voting machines can or can never be hacked is almost an irrelevant question. It is unreasonable to ask the electorate simply to 'trust' that they can't be.

Well, that too.

 

[Segnosaur]

I think the biggest problem with electronic voting: You can't eat your ballot.

From: https://www.theglobeandmail.com/opi...ss-take-your-ballot-and-eat-it/article727139/
...there have been some Canadians in previous elections who wanted to use their vote for protest. "They don't want to vote and they go and they take their ballot and they eat it," she said.

I mean, how are you doing to do that sort of thing if everything is electronic?

 

[Upchurch]

I think the biggest problem with electronic voting: You can't eat your ballot.

From: https://www.theglobeandmail.com/opi...ss-take-your-ballot-and-eat-it/article727139/
...there have been some Canadians in previous elections who wanted to use their vote for protest. "They don't want to vote and they go and they take their ballot and they eat it," she said.

I mean, how are you doing to do that sort of thing if everything is electronic?

Oh, Canada.

 

[acbytesla]

Well, that too.

I just said what you did with pith.

 

[The_Animus]

Companies have admitted to installing remote access on their machines with the same password (abcde) for all their machines. At a hacking convention every brand of machine was hacked in less than a day. Security experts have testified that short of examining the source code of the machines there is no way to tell whether the result is authentic. Source code is propriety information and generally isn't allowed to be examined and audits are rarely conducted. When Georgia had some sketchy results and information was requested they deleted the data, and the backup data.

Maybe most electronic voting machines are fine, but why in the world would anyone just trust that when this concerns our elections.

Unless the source code can be independently verified and audits are allowed by any party at their own expense, electronic voting machines shouldn't be used at all.

 

[psionl0]

Companies have admitted to installing remote access on their machines with the same password (abcde) for all their machines. At a hacking convention every brand of machine was hacked in less than a day. Security experts have testified that short of examining the source code of the machines there is no way to tell whether the result is authentic. Source code is propriety information and generally isn't allowed to be examined and audits are rarely conducted. When Georgia had some sketchy results and information was requested they deleted the data, and the backup data.

That is truly disgraceful but hardly surprising when politicians and public servants are in charge of the contracting process.

Unless the source code can be independently verified and audits are allowed by any party at their own expense, electronic voting machines shouldn't be used at all.

Agreed.

 

[Upchurch]

Unless the source code can be independently verified and audits are allowed by any party at their own expense, electronic voting machines shouldn't be used at all.

And what happens after the voting machines leave the control of those who are capable of verifying and auditing them? Can we trust that they haven't been modified then?

No, we can't.

 

[Upchurch]

I just said what you did with pith.

I wondered why it sounded familiar...

 

[The_Animus]

And what happens after the voting machines leave the control of those who are capable of verifying and auditing them? Can we trust that they haven't been modified then?

No, we can't.

People can tamper with paper ballots too. That's why there are multiple parties that watch and count them to minimize the risk of funny business. Why couldn't something similar be done with the electronic voting machines? Make remote access not possible on any machines. Let the source code be checked beforehand and once polls close have multiple parties watch or in some way secure the machines to make sure no modifications are done. If any party that analyzes the information thinks results have been tampered with they request the audit and that machine is checked. No system is perfect, but that would give me greater confidence in them

 

[acbytesla]

People can tamper with paper ballots too. That's why there are multiple parties that watch and count them to minimize the risk of funny business.

Totally true.

Why couldn't something similar be done with the electronic voting machines? Make remote access not possible on any machines. Let the source code be checked beforehand and once polls close have multiple parties watch or in some way secure the machines to make sure no modifications are done. If any party that analyzes the information thinks results have been tampered with they request the audit and that machine is checked. No system is perfect, but that would give me greater confidence in them

Who's going to check it? And how do you know whoever that is isn't in someone's pocket? The average Joe can easily audit paper ballots. Not much expertise is required The same cannot be said about electronic voting. Only a handful of people are qualified to comb through thousands, maybe millions of lines of code.

The problem with electronic voting is trust. Not so much with the technology, but the people implementing it.

 

[Upchurch]

If any party that analyzes the information thinks results have been tampered with they request the audit and that machine is checked.

Okay, so, you find a tampered machine. Then what? The polls are closed. The election is over. All the votes cast on those machines are invalidated and thrown away?

Strategic tampering-and-get-caught could be just as effective of a strategy as straight up vote hacking.

Who's going to check it? And how do you know whoever that is isn't in someone's pocket?

You defeat that by having two people do the audit on every machine. Which, of course, compounds the problem of the scarcity of expertise. To make matters worse, you have to check each machine in person and then you don't know that the machine isn't tampered with after the auditors leave.

Things like blockchain are cool and all, but it doesn't solve the fundamental problems with electronic voting.

The online banking model might make it seem like you could pull off online voting, but it breaks down that when something malicious happens with online banking, there is a history and "paper" trail you can follow to make sure everything is correct.. There is no personal auditing of one's voting history that your vote counted the way you expected it to. Even if there was, what happens? Once the election has been certified, do you go back and re-open the election to recount that votes based on corrected history?

 

[acbytesla]

Okay, so, you find a tampered machine. Then what? The polls are closed. The election is over. All the votes cast on those machines are invalidated and thrown away?

Strategic tampering-and-get-caught could be just as effective of a strategy as straight up vote hacking.



You defeat that by having two people do the audit on every machine. Which, of course, compounds the problem of the scarcity of expertise. To make matters worse, you have to check each machine in person and then you don't know that the machine isn't tampered with after the auditors leave.

Things like blockchain are cool and all, but it doesn't solve the fundamental problems with electronic voting.

The online banking model might make it seem like you could pull off online voting, but it breaks down that when something malicious happens with online banking, there is a history and "paper" trail you can follow to make sure everything is correct.. There is no personal auditing of one's voting history that your vote counted the way you expected it to. Even if there was, what happens? Once the election has been certified, do you go back and re-open the election to recount that votes based on corrected history?

Two people can be bought.

There was a time I thought we would all vote online. Just because we can do something doesn't mean we should.

 

[Skeptic Ginger]

That's the trouble: Then what?

 

[Mongrel]

I think the biggest problem with electronic voting: You can't eat your ballot.

From: https://www.theglobeandmail.com/opi...ss-take-your-ballot-and-eat-it/article727139/
...there have been some Canadians in previous elections who wanted to use their vote for protest. "They don't want to vote and they go and they take their ballot and they eat it," she said.

I mean, how are you doing to do that sort of thing if everything is electronic?

I've been known to do some rude doodles or write "They're all wankers" as a means to deliberately spoil my ballot. I'm of the opinion that while not voting can be a protest it's hard to differentiate between protest or laziness.

That's the trouble: Then what?

Rein in the change for the sake of change. Identify what problems it's meant to solve and look at other ways to solve them

 

[Upchurch]

Rein in the change for the sake of change. Identify what problems it's meant to solve and look at other ways to solve them

The OP was referring to online voting, not just electronic voting, which is way more vulnerable. However, I would presume that the problem it meant to solve is voter turnout/participation. A very worthwhile goal.

I think a better approach, instead of adding complexity and vulnerability to the voting system, would be to (1) declare a national holiday on voting day, (2) legally enforce a ...4? hour window employers must allow their employees off in order to vote, and (3) allow on-site voter registration with a provisional ballot. Remove the barriers to voting.

 

[Jack by the hedge]

It's all just too onerous compared with pencil and paper. It's like designing an uncheatable test for the JREF MDC.

Every voting machine's hardware and software would have to be checked and verified and then it would have to be treated like a piece of legal evidence with a full chain of custody not only up to the election but until it was clear no recount or other check was needed. And every step in the chain of custody of every machine needs at least two people from opposing parties. That's crazy, but that's what you need to be as good as pencil and paper.


Yes, you can make parts of the system completely unhackable but people just look for other vulnerabilities. Rather like cars with uncrackable keys, thinking that will end car theft is just hubris; car thieves become burglars and steal keys instead.

 

[Upchurch]

MDC?

 

[Jack by the hedge]

MDC?

Randi's Million Dollar Challenge for paranormal abilities.

 

[The_Animus]

Two people can be bought.

There was a time I thought we would all vote online. Just because we can do something doesn't mean we should.

The people counting paper ballots can be bought too.

 

[Jack by the hedge]

The people counting paper ballots can be bought too.

And more cheaply, because most people can count, whereas people with serious computer expertise expect to charge a lot for their time.

On the upside, since it's a task almost anyone could do, it's sufficiently easy to recruit unpaid volunteers to count pieces of paper that you can have lots of them checking each others work.