https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy...

Are you saying a recount will be unnecessary if E2E is done properly?

I read the linked article but didn't get it.

I'm not sure where I might have given the impression that a recount would not be necessary. A paper record makes a recount possible and the election system auditable.

The linked Wikipedia article on end-to-end auditable voting systems provides an overview and links to different methods of making voting systems more trustworthy. There's a lot of thought and details that go into it, and if it's something you're interested in, I suggest following up on some of the links and spending more time. I know it's taken me reading a lot of different articles and implementations, and I still need to look up different parts of it.

I did find this slide deck from Ron Rivest helpful:

"Auditability and Verifiability of Elections" ACM-IEEE talk March 16, 2016

https://people.csail.mit.edu/rivest/pubs/Riv16x.pdf

Were there particular areas that didn't make sense to you?

That's not to say that other security precautions can be ignored. Ideally I'd think there should be mature open-source software running on secure intranets for each voting station, and transparency at every level of the process, including better transparency in how those physical receipts are transported, handled, and stored.

The last step of voting is inserting the ballot into the scantron machine. Valid ballots are eaten, invalid are kicked back out at you.

Theoretically the machine can output running totals at any time, and if you've never seen an optical scanner in action you'll be surprised how fast it can scan and grade a classrooms worth of multiple guess tests, less than a minute to scan and process perhaps a hundred tests, so a thousand people living in my voting district is not exactly a data processing challenge. The votes can obviously be counted by hand of course, they're just custom printed multiple guess test sheets.

Optically scanned paper tapes and punch cards were contemporary in the 60s and optical scantron machines appeared shortly after. I'd estimate my state converted from mechanical voting machines and mimeograph machines to scantrons and photocopiers about the same time, lets say 1980 although maybe as late as 1984 or earlier in the 70s. I distinctly remember watching my parents vote one last time on an old fashioned voting machine when I was a little kid, probably voting for Nixon, may have been Reagan but I'd have been too old by then, I think. Old fashioned mechanical voting machines were cool and steam punk ish in appearance.

Its such a simple, cheap, reliable system that it almost leads credence to claims that elections are being intentionally rigged. Its hard to explain otherwise why something so cheap simple and logical is being covered up and so few people know about it. Ironically I live in a non-swing state in a gerrymandered district so my vote has never mattered and never will, but at least if I ever get a chance to influence politics via voting, its pretty obvious my vote would be counted fairly.

Step 1) You queue, get a "Temporary Voting Id"

Step 2) Enter the booth, enter your "TVID"

Step 3) Vote

Step 4) The Machine prints your Receipt with your vote clearly visible and your TVID as local proof its you and your vote is right.

Step 5) You fold your printed ballot and put it in a box.

Step 6) You fold your ID Receipt and place that into a "Validation Box" as you leave.

Step 7) All machines keep and print a "Tally" used as the count.

Step 8) All ballots and validation id's are saved in boxes and shipped ready for recounts if needed, ID's can be matched to ballots to validate attendance and votes anonymously.

Bonus Step) ALL vote machine should produce a "Vote Audit" when asked that will show a full history of votes (without times and in random order) and the ID's used and ALL id generation machine should produce all vote id's generated (again without times and in random order)

The UI of a #2 pencil and a pre-printed form is a lot simpler and easier to use and un-jammable compared to an e-voting machine printer. Also cheaper and harder to hack.

If you keep your ID receipt theoretically you could prove your vote and sell it. If you don't keep your receipt, they might toss out your vote and you'll be unable to prove it. There are cryptographically secure-ish ways to work this, mostly involving statistical security (I forget the exact term, the kind that makes engineers pull their hair out because the algo looks inefficient but the inefficiency is the source of the security)

Even worse I assume multiple votes per TVID would overwrite the previous vote to handle user interface mistakes (see above, why must we use a complicated electronic UI instead of a #2 pencil and paper UI?). So any poll worker with access to the unshredded TVID has root password and can change everyones vote at their leisure.

You should have inserted the votes into a networked blockchain so people can ask WTF if 50 votes are changed ten minutes after the polls are officially closed. Or people could ask WTF when district #239 is the only district to have 50 revotes more than five minutes after the original vote. And the blockchain would store the former pre-tampering ballot which might be handy once the corruption is identified.

Of course it'll be fun to link the timestamped blockchain to CCTV cameras everywhere, so if you timestampped blockchain you no longer have anonymous voting, every ballot is now linked to license plates and face pictures, thank you "war on fake terror".

If the TVID is not cryptographically secure you don't need access to the box of stored TVIDs, because I see they handed #200 to me, #201 is next on the table, why shouldn't I type in and "correct" votes for TVID #190, #191, #192, #193 ... while standing in my private booth?

If I walk out the door with a cryptographically secure verified TVID and just toss a blank piece of paper into the TVID disposal box, then I can sell my TVID to someone for money or booze or sex, then dude walks in with my TVID, gets one of his own, votes for the two of us. You'd need to timestamp each TVID for a limited validation time. I could see management at companies requiring people to hand in their TVIDs to get their timecards or paychecks. Or at soup kitchens. Or crooked cops, or especially college professors. Imagine trying to explain you can't give your TVID to your feminist studies professor because your african world heritage professor already took it, which class do you accept the "F" in?

Essentially with TVIDs you're trying to implement Kerberos tickets which is tricky enough for computers, much less 80 year old deaf poll workers who dropped out of high school during the great depression and have never touched a computer. Every security hole or bug thats ever existed in Kerberos needs patching.

There are so many problems I'm kinda bored right now, but I can tell CCTV attacks and cellphone camera based attacks are going to be a very interesting problem. Essentially any security guard with a high res camera pix of the stack of TVIDs has root over your system, I think. If the TVIDs are preprinted any corrupt person with physical access to them before the election or before the recount anyway, who owns a cellphone camera or has access to a photocopier has root. Big data attacks might be possible, "sell" memorized TVID number to the bartender as part of a "I voted so now I get a free shot" sounds very much like democracy boosterism until the employer collects memorized ballot receipt number for their own parallel "I voted so I get a free ice cream cone at work" democracy boosterism, until the data is sold and you're powned because you gave away both parts plus the name your employer knows to "separate" entities who are not "separate" after all.

I'm not sure if you fix everything if you basically end up with optically scanned pencil on paper ballot "scantron" voting or if you end up in a parallel but different rabbit hole of higher complexity, cost, and lower security.

That what the voting booth and envelopes are for. Its not a random thing. Our voting systems are low tech, but it's well designed.

And in the latest election where the incumbent party lost, It was pretty publicized that they went to a lot of the poorer colonies to try and get their money, cell phones and tvs back. All quickly forgotten as soon as the media got a whiff of it.

Buying votes in a first world country probably isn't possible as most people are somewhat (and probably wrongly) educated on the topic, and hold pretty firm views on it. However, it's a piece of pie on mostly illiterate people. Even then, people get tired, see the latest elections in Mexico.

- internet voting

- touch screen voting

- optical scan voting

Computers can also be used in other roles, such as voter verification, vote tabulation, and results transmission, result verification, and auditing.

With only paper ballots, arbitrary vote verification is likely to be a tedious process, if possible at all. Cryptographic methods such as homomorphic tallying can ensure vote secrecy and vote verifiation. This can also provide stronger guarantees of chain of custody integrity by verifying voter receipts or cast paper ballots are included in the final tally. With only paper ballots, trust that a given cast ballot is included in the result relies on trust in those doing the tallying and the chain of custody of the ballots themselves.

One could imply from the phrasing of your question that you have reservations about any benefits electronic voting might have. What's your take?

Optical scan is the only above mentioned method that can be verified by laypeople.

Also, although a tedious process, paper voting has worked for quite some time. Centuries?

Chain of custody will always be a problem, whether it be source code to a compile runtime, or paper ballots.

However, the potential for abuse seems less likely for a more manual process.

A voter signs in to vote, so we know how many voters to reconcile to the same number of ballots. If we have more ballots cast than signed in votes, we have a problem.

Additionally, ballots are serialized, though not associated with any particular individual. So we know what ballots were used and unused. If we find multiple ballots with the same serial number, we know there is a problem, too.

Voting should not rely on a blackbox algorithm. The majority of the voting public can count pieces of paper, but can they understand and verify code running on a device?

Who cares if it saves time, particularly at the cost of transparency and trust?

My question to you is, what problem did electronic voting solve (as implemented in the US), that needed solving?

Properly done, a voting machine doesn't need to do anything more than count and tabulate. You press a button, and it adds a new vote to it's table. The vote could be printed out on paper. It could even be done via punch cards first, and then fed into the voting machine (which makes the process more inspectable by humans.)

The voting machine need not know what each candidate even is, what party they are, just assign them numbers. And it doesn't need to receive updates, or have any method of input other than reading punched cards or a voter pressing a button. It certainly doesn't need to be based on windows XP and have usb inputs. It certainly shouldn't send votes over wifi.

I think pushing for "superior voting systems" is really allowing the best to be the enemy of the good here. STV is perfectly doable by hand. AMS is only fractionally more complicated than FPTP. But most US elections (and the UK parliamentary ones, although none of the other kinds of election in the UK) are FPTP.

Let's not allow the desire for better voting systems to be tied to untrustworthy technology.

Edit: the barrier for getting a system adopted has to be "can you explain this to a partisan of the opposing faction with a high school education, and get them to agree that it's fair?"

I really dislike instant runoff voting and similar systems like STV. They are better than FPTP, but not by much. One big issue is discussed here: https://www.youtube.com/watch?v=7Q7rzqJ0YS8 But my main concern is they might tend to elect more extreme candidates, because they quickly drop candidates that don't have enough first votes, even if they are everyone's second vote.

The problems of actual existing electronic voting are a microcosm of bigger problems. We get insecure, ineffective voting machines because procurement is difficult and tends to be captured by lobbyists.

Condorcet superiority seems not all that important in practice: http://www.fairvote.org/why-the-condorcet-criterion-is-less-... , and if you have suitable multi-member constituencies for STV then you tend to end up with a couple of "extremists" and a large group of moderates in the middle.

Again, let's not let the best be the enemy of the good.

Don't throw the baby out with the bath water. Just because current electronic voting is bad, doesn't mean it has to be.

http://scorevoting.net/BayRegsFig.html

There is even a theorem that, under plausible models of voter strategy, Approval Voting will tend to elect Condorcet winners (i.e. candidates who beat all rivals by a head-to-head majority).

http://scorevoting.net/AppCW.html

Clay Shentrup Co-founder, The Center for Election Science

- Wait until all electronic ballots are set up in their zones in election day. - Randomly (this can be even done in a public, audited draw) select a few ballots to test. - Remove those ballots from use and replace them with spares. - Now, somebody publicily double votes on the tested ballot: they publicily vote for candaidate X in the ballot, and on paper (although just showing the vote allows any observer to keep count indefinetely). - At the end of the test, print the count from the tested ballot and verify that it is accurate to the publicily counted votes.

What do you think about this?

IMO, while not totally fool-proof, this brings the cost of manipulating electronic elections rather close to paper elections, if the following assumptions hold:

- The draw is fair, so a malicious actor could not program only the selected ballots to be fair; - The chain of custody of the ballot is solid (easy to do if there are party auditors that never lose sight of the ballots), or that the ballot is not moved out of the sight of the public instead; - There's no available method to make the ballot know it's being tested, and change its behavior (like in the VW emissions scandal).

The last point is tougher, although auditable source code, code-signing, and reproduction of as many 'true' conditions as the real election (same duration, same time, same voting frequency, etc, maybe going as far as to randomly select normal voters to participate in the process).

Paper votes work, and they work well. Besides the obvious downside of needing to wait for them to be counted, they are safe, open, they don't break down, they can't be hacked, anyone can verify them, and they are 100% anonymous.

At worst, you'd need many people to collude to stuff a single ballot box in a single district, and even that can be thwarted by a single person watching the ballot box all day.

So what's the gain with electronic?

Many programmers know about the "beauty" of encryption and secure voting algorithms. They know that open source works, and it's really tempting to try and think up a system that is "perfect" and can't be gamed by anyone.

But this is an instance where messier and less "perfect" is better, because the absolute worst case scenario of being able to actually change the election is so much harder with paper, and anything less than that worst case scenario doesn't change anything (and still has all of the risks and downsides).

The reason I want this is because it allows much more fine-grained voting. My ideal democracy is a direct democracy where every voter can, if he/she chooses, to vote on arbitrary issues, but _delegate_ their vote to someone else by default. As an example: "I politically align with Bernie Sanders, so I want by default my vote to delegate to whatever he's voting for, but for issue X I vote Y."

In an ideal world you could even delegate votes based on "tags", e.g. for Internal Affairs you choose X, and Economy Y, etc. But that seems fairly easy to manipulate by whoever is assigning the tags to issues.

I am sure that there are ways to improve citizen participation in the democratic system, but directly voting on issues is not going to give us the sensible behaviour you might hope for. Representational democracy exists in part to prevent minorities from abuse by any majority — with direct democracy you eliminate that protection.

It's certainly more work to count those votes, but on the other hand, everybody is entitled to go check the vote count and everybody can do so with no technical knowledge needed. Any system that requires the observer to be firm in a given piece of technology is not a superior system since it removes peoples ability to exert their right to check the public vote.

Also frankly more people are familiar with the UI of "#2 pencil and piece of paper" than any electronic UI I can think of or imagine, which is somewhat damning for cultural reasons on this site resulting in it being double plus ungood badthink to imply anything could be superior to contemporary trends in web and phone app UIs.

"Fill in the correct bubble" was very new technology when I was a young adult, apparently its still in use.

One handy thing about the ballot eater machine, as a voter, is I feed it a valid ballot and it emits a happy cartoonish beep song while eating and storing my ballot for later hand recounting, and feed it an invalid or questionable ballot and it immediately kicks it back at you with musical accompaniment indicating R2D2 is clearly not amused. The OCR contrast settings can be messed with such that anything even slightly questionable (erasures, etc) will simply not be accepted. The paper ballots being cheap and the technology being easy to understand, the poll workers simply give the voter a new ballot.

My ideal system would have a voting machine that handles the complexity and fills in the bubbles for you. Then prints it out and let's you inspect it, and turn it in like a normal ballot.

I also have other issues with them. Like runoff voting systems drop a moderate candidate that most people would prefer in a 1 on 1 election, but isn't listed as enough people's second vote. Resulting in more extreme, less liked, candidates getting elected. It's better than FPTP, but not by much.

Not so sure, the paper ballot system may been hacked in 2000 US election. The other criminal activities of the Bush family make it more suspect, IMO.

This makes voter intimidation real easy. Just say: "if anyone's vote is made public and not for candidate X, I will murder them and their family". That basically turns voting for candidate Y into gambling with the life of your entire family.

This helps with ballot stuffing, if 200 voters in the district verified their vote and election monitors counted about 200 people walked thru the door but the corrupt system published half the ballots online and theres 500 of them implying 1000 voters, well, someone faked an extra 800 voters.

The problem is complicated and you can't actually use DnD dice because most disenfrancised voters fill out straight ticket ballots and are therefore not part of the decision making fraction of the population, so someone could pay or punish based on votes exactly half their victims who don't have a ballot that looks like it was made by a purely random dnd dice roller. So you actually have to figure the percentage of people last time around who voted like whatever logical scheme, then make the poll worker fill in ballots that look like a reasonable ballot from last time around. "VLM you get serial number 200 and I as poll worker fill out serial number 201 and looks like your "random" historical voter for 201 is straight ticket R"

Also you can't let the voter pick the ballot he fills out because then Mr bad guy can kill any odd serial numbered voter for Trump because he told his employees or students or whatever they must select and vote the odd one never the even one, so half the random ballots being odd means trouble for half the voters. Face down pick one might be OK.

Note that under this scheme it might be safe to even publish the name of both ballots, just so long as a random half get shredded.

Any individual poll worker with a photographic memory could theoretically sell a list of ballots he filled out vs the voter filled out but its purely he-said-she-said and the poll workers memorization job will be hundreds of times larger than a voters memorization job so I think it incredibly likely the voter will be trusted to lie as best serves him rather than the poll worker be trusted to tell the truth.

How the random half get shredded is likely going to be a sticking point. It has to be visually enforced the entire voting period that each voter puts one ballot in one pile and one in the other and when polls close the observers do a coin flipping cryptographic protocol and immediately shred one random stack. You can't shuffle them all and then shred or whatever. Someone putting both ballots in one pile will screw things up. There are trivial ways to enforce this of course.

A list of all my historical published votes would after decades provide a random signal and a pattern of my own voting. However my own voting makes a random signal for some other dude, and today any goofball who wants to discriminate can pull the district records and know the couple hundred of us who vote here always vote about 80% R so although discrimination would be possible it wouldn't be any easier or more effective than it is today anyway. Go ahead, knowing nothing other than I live in an 80% R district take a guess what I usually vote...

Technically this scheme disenfranchises a completely random half the population. Well, since only half the population votes you only disenfranchised a quarter. Only half the population votes anyway is a good justification for tossing out a random half the actual votes and replacing them with cryptographically strong noise. I suppose to satisfy dumb people who don't understand statistics you could run two elections and tell the dumber people that half their votes got tossed each time so ta da now all your votes got counted once across the two, but thats numerically unethical.

A weakness I see in both your system and ThreeBalot, is the need to trust in some decision maker to act correctly. You need the poll worker to actually work randomly (and not have awesome memory), ThreeBalot needs a way to confirm ballots are entered correctly.

I think the biggest sticking point with your system is the random aspect. We are essentially introducing noise into the votes. The noise might be negligible, but it impacts people's perception massively. There is also the challenge issue, because you'd need some arbitrary cut-off on the probability of the noise being to large. After all, the chance is technically nonzero that all random votes went the same way, and only the random votes were counted.

The main reason I want to get sane electronic voting is so we can vote online from home. Given the inability of democrats and republicans to come up with any acceptable method of handling voter ID, though, I'm pretty confident that it won't happen for decades if ever. In the meantime at least my state does vote by mail.

* Count and record our money

* Operate and monitor medical equipment

* Monitor and control planes, trains, ships, and cars

* etc

To think that we cannot use a computer to record votes is insane.

How will you know if an electronic voting system produces a wrong result, except by running a paper voting system in parallel?

Do municipalities choosing voting machine contractors have incentives aligned to promote election integrity? Can they critically evaluate security properties of what they're being sold?

I don't think so.

The republic is experiencing significant harm. If it was not, people would not be talking about it.

> How will you know if an electronic voting system produces a wrong result, except by running a paper voting system in parallel?

Audits? Open Source? Checksums? Hashes? We have many tools to verify the integrity of electronic data (I also never claimed it had to 100% digital)

> Do municipalities choosing voting machine contractors have incentives aligned to promote election integrity? Can they critically evaluate security properties of what they're being sold

If the choice is federally verified company A or federally verified company B, then yes.

I think recent history has shown this hasn't worked out quite that well in many cases, and that in other cases was easily manipulated for purposes of fraud. There are entire sections of various law enforcement agencies that focus on this very topic.

>> Operate and monitor medical equipment

What would be the benefit of manipulating this?

>> Monitor and control planes, trains, ships, and cars

What would be the benefit of manipulating this?

I would second guess anything that uses a computer to keep a record of something that someone would have a direct benefit if manipulated. It's not a matter of whether it works or not, it's a matter of how easy is it to manipulate for a particular goal.

Killing people. Imagine a StuxNet type attack that targets medical equipment or an attack that can drop planes from the sky (https://www.wired.com/2015/05/feds-say-banned-researcher-com...)

> I would second guess anything that uses a computer to keep a record of something that someone would have a direct benefit if manipulated

Then you better move to the woods. Basic economic principals (scarcity) mean that every resource has value to an interested party.

I can only see the benefit of a targeted assassination for a very specific subset of a subset of a subset of people, not large scale killing of people. Warfare maybe? For fun? Not as obvious as fraud for monetary gain, there is a scale issue to consider.

I worry more over bugs that kill people on the operating table or in the air as opposed to someone manipulating the equipment for some unknown benefit.

>> Then you better move to the woods.

I think you're exaggerating just a bit.

Wars are extremely profitable for some.

> I think you're exaggerating just a bit.

I think you are being myopic. We trust computers with thousands of important tasks. If we can't trust them for voting, we really have to reconsider their usefulness.

That is an excellent point.

But, reading back over the posts I see that I introduced the concept of warfare even though the original points I questioned did not. So, back to my first questions; who benefits from manipulating medical and aircraft equipment on a large enough scale to be compared to potential financial fraud?

Wait, targeted assassination that starts a war... That's been done before, but unlikely.

>> If we can't trust them for voting, we really have to reconsider their usefulness.

It's not that I don't trust the computers, it's that I don't trust people.

I assumed "killing people" was broad enough to include obvious cases such as war :)

> So, back to my first questions; who benefits from manipulating medical and aircraft equipment on a large enough scale to be compared to potential financial fraud

Competing corporations via corporate espionage. A targeted hack against Siemens infusion pumps would force hospitals to consider alternatives.

> It's not that I don't trust the computers, it's that I don't trust people.

Every system in the world has been created by people with their own biases and faults. If we are really going down that path, then you must seriously consider going off the grid.

Better yet, do mail-in voting. It works fine for several states already, and all of them see strong correlation with voter participation, unsurprisingly. It's also cheaper. And keep a few basic polling locations around as a fallback for those unable or unwilling to deal with mail.

And then there's the cases of voting papers being dumped rather than delivered to constituents. And the possibility of tampering with the votes in the mailing system. It wouldn't be hard for malicious actors to toss out papers in majority Republican or Democrat areas to attempt to sway the election.

And having "a few" polling stations would mean that they are further apart and less accessible for people, especially poorer people who don't have the same means and time for transport.

Yeah I bet. Your boss will trade your mail in ballot for your paycheck this week. Turn it in with your calculus exam for 5 bonus points. Don't forget to take your ballot to Bible study group this Sunday, we're going to fill them out together to make sure we do it correctly. If you're in a nursing home just hand it to your favorite nurse, after all she's in charge of your medication so you have motivation to keep her happy. Your postman will simply toss it out if he doesn't like your vote but he does have a bid out for $5 if you'd like to sell, because one of the local parties is buying from him for $10 per ballot. On the other hand the gas station clerk down the street is offering $9 because his margins are lower and he paid off the cops like he paid off the health inspector and he's easier to get in touch with.

I suppose if all the dollars are concentrating in ever fewer hands, we need some kind of paper currency, and if they'd allow early voting up to perhaps 3 years and 364 days before the next election... Its possibly the only way we'll ever see the government getting a form of currency into the general public's hands to boost economic activity rather than just bailing out the bankers as usual.

Mail in is fairly banana republic tier. Its kinda like drug legalization, yeah that stuff isn't good for you, but at least if its above board and semi legalized then at least we can observe and track it, kinda, rather than underground and out of control. Actually its more like a red light district, the only way to make it worse would be to drive it underground. At least looking at vote totals we can tell how corrupt an election is based on level of mail in voting rather than knowing its bad but not how bad in total.

At the same time, I'm not aware of literally a single complaint about this kind of thing in US states that practice mail-in voting...

And drug legalization is "banana republic tier", really? No. It's a recognition that "this stuff isn't good for you" is not a sound basis for passing laws, for one thing - and for another, it turned out that a lot of "isn't good" was just plain out lies and misdirection.

I mean, seriously, are you saying that WA and OR are banana republics?

When the community is sufficiently engaged, either you have differing political views and thus don't have to worry about conspiracy, or everyone has the same opinion and the conspiracy would just reinforce the true outcome.

Regardless, the possibility of that conspiracy is another great way to encourage participation. Republicans and Democrats both have an interest in the other side not tampering - combined that turns into a pretty strong interest in removing tampering altogether.

The resistance [from several in the industry not just your comment] to making voting happen via software really concerns me.

If the voting machine vendor executives faced actual personal serious jail time for botched counts, I might be more inclined to trust it. Then again, I bet you a tenner they'd suddenly have a lot more fail safes in place.

Aligned incentives is absolutely, 100% required for anything to work in our society. It's what we're built on. Otherwise you will always be swimming upstream.

I wish more people understood this simple fact of human psychology. It's astonishing how often people will support some system that incentivizes bad behavior, and then act surprised when people behave badly.

What's more, when faced with this situation, these same people will resort to shaming the bad actors rather than fixing the broken system.

Each and every idea has a logical optimum strategy for the trust to maximise income, and all of them aren't quite what you're trying to achieve. So you really want to blend some of these (and others) together in just the right mix, but without creating hundreds of hours of admin just to support the metrics.

Even with a threat like that, they'd probably still walk free by just using the DMCA to silence the security researcher

[1] https://en.wikipedia.org/wiki/Online_Policy_Group_v._Diebold....

With electronic voting, any method of verifying your vote is incompatible with the principle of a secret ballot.

(edit: additionally, with paper ballots and adversarial scrutineers, every vote will certainly be counted properly as the people who stand to benefit(the politicians) can raise an issue if a ballot is being counted the wrong way. It's much less likely that every individual would verify their own vote).

The resistance for voting via software may really concern you, but the push for it really really concerns me...

What are the incentives for voting machine manufacturers to do a good job? Engineering a trustworthy system is tough, and it's expensive. If the machines cost twice as much, no one will buy them and it won't matter if they're more secure. And the market itself is unhealthy. If you spend 10 million on voting machines, you won't replace them the next year even if a bunch of security issues surface. You'll "demand" the company fix them, they'll issue some half assed patch, and you'll go on using the junk you bought.

At the bottom of each voter's paper roll entry is a big bar code. This allows quick recounts by running the paper roll through a machine that reads the bar codes. A full manual check is also possible, but slow. The system goes through miles of thermal paper for each election, but works OK.

https://people.csail.mit.edu/rivest/voting/papers/Chaum-Secr...

Not sure it beats paper ballots and hand counting in terms of practicality, though :)

OK VLM your boss needs a Trump receipt, your communist college professor needs a Clinton receipt, you need another Clinton receipt for facebook and github or they will delete your accounts, that'll be one R, three D, would you like any complimentary green party receipts? OK here's all your receipts thanks for voting see ya in 4 years!

Heck hand them out with the bake sale goods. Have a free set of pre-printed fake receipts for ALL the candidates with some delicious chocolate chip cookies that fund this schools PTA. "Could I interest you in this cageless chicken egg gluten free organic soy oil brownie with a complimentary fake green party receipt?"

Don't forget that Wells Fargo was able to open millions of accounts without consumer authorization. So maybe financial accounts are less secure than you think.

I'm also surprised by blanket assertions that electronic voting is inherently bad. But I'm equally surprised by assertions that electronic voting is inherently good.

Voting systems do not have that.

There's no way voting for candidates can account for vote theft in the same way.

Anyone can count along with a ballot box. Anyone can stand there all day and watch the box to ensure there is no tampering, they can count, recount, and recount again. Anyone can do this. Plumbers, programmers, doctors, the unemployed, the elderly, and even the illiterate. It can be counted by one person, or 100.

But when things go electronic, the number of people that can even understand it is cut down to programmers. And the number of those that could accurately vet the security of a program is even smaller. And even a perfect electronic system needs loopholes (you can't just disenfranchise voters because they forgot their password or don't have a computer), which means the ability of fraud is still there.

Paper works, and takes a LOT of resources to sway even one precinct (even just the fact that it requires purchase of physical materials ups the amount of cover up required), let alone a county, state, or the federal levels. And because of the number of people involved, if someone did try the chances they would be found out is pretty damn high.