Furthermore how does your average voter verify that the code itself is secure? How are your grandparents going to validate the crypto? How can your illiterate cousin ensure the hardware isn't backdoored?

I just don't get the draw of an electronic voting system.

Paper works, and it works well. Anyone that can count can validate a single precinct. You can have one person, or 100 people all standing there watching a ballot box all day for tampering. You can have a whole group of people count the results, or just a few.

In a traditional paper system, swaying a single precinct with "blackhat" methods takes a lot of physical resources, a lot of time, and in most cases a lot of people. Then multiply that by every precinct in the country, and it quickly becomes pretty much impossible to do (and get away with).

I've said it before, and i'll say it again. Electronic voting is dangerous and is a very bad idea. And it doesn't matter if it's FOSS, it doesn't matter if it's vetted, it doesn't matter what safeguards are put in place, all it takes is one mistake. One fuckup, and someone can now choose the leader of a nation.

And replacing a system where literally everyone can validate a system on voting day if they want to with a system where only a fraction of a fraction of people can even read and understand the code, let alone validate the code (and can't actually validate the hardware, or make sure what is running on the hardware is actually that code), and it takes a magnitude more time to do so, just isn't a good idea.

> I just don't get the draw of an electronic voting system.

Make elections cheap. For those that wish to experiment with majority rules a reliable system would allow the people to technically be able to vote in their government on a daily, weekly, monthly basis.

So further to this if elections are easy to run and are cheap what does it matter if someone breaks one election? You can just run the next one fine. It changes the variables somewhat and requires a sustained and persistent threat to be engaged to subvert the democracy. Combined with a team that investigate irregularities you can create a vaguely stable system, especially if you consider ideas such as binding authentication to geography instead of identity making it more difficult to stuff ballot boxes as teams can easily verify how many votes should be possible from a specific gps co-ordinate.

I'm not saying its a great idea, its probably awful but it opens up an option to society that previously hasn't been available and that's interesting.

The problem is so many government decisions can't be rolled back, like military, treaty, supreme court appointments, some environmental regulations... You'd have to change everything else and every other country first to tolerate a "by bad, we're gonna redo" attitude and then implement "my bad, redo".

An interesting simpler direct majority rule scheme is to halt elections completely and use jury selection techniques to select decision makers. What we'd lose in expertise we'd more than gain in the lack of sociopaths and psychopaths. A government completely of jury duty/draft would be far more effective than the one we have, which is probably why no one in power wants it.

>What we'd lose in expertise we'd more than gain in the lack of sociopaths and psychopaths.

I think far more likely these people would mostly just end up taking advice from whichever experts are left further down the hierarchies, who would then effectively run the country.

OK, I'm not saying no, but you'd need to explain how that's different than the current situation other than the top leadership would be less crazy and less corrupt on average. Or aside from being different, how would having better leadership make the situation actively worse.

Surely you can't be implying we have subject matter experts running the country now. Or that the subject matter experts we do have from law and show business who are in charge now are only in charge of their areas of expertise specifically law or show business? I'm just saying there's nothing wrong with having congress leading the American Bar Association, its just that having lawyers in charge of, say, nuclear power plants, is about as dumb as having plumbers in charge of source code.

So, using the US Federal government as an example, the sociopaths would need to convince 600-ish random people to do what they want on a continuous basis. Currently, the sociopaths need to convince ~100M random people to do what they want once every two years. The former might be superior, but it's not obviously so.

You make good points but as I understand it, Switzerland has a relatively direct form of democracy and already runs referenda very often.

> what does it matter if someone breaks one election? You can just run the next one fine

This assumes it's easy to detect manipulation which I think is very unlikely.

Edit: according to Wikipedia, Switzerland has 13 national referendums (not "referenda" apparently) in 2016 so not as many as I thought. https://en.m.wikipedia.org/wiki/Swiss_referendums,_2016

Well, many things are decided by elected comitees, but referendum are required to change the constitution (we're ok with it changing, it's not seen as an untouchable artifact here).

Citizens can also decide to submit things to referendum, and that has absolute decision power. To do so you need to gather a set number of signatures depending on the level of the decision (communal, state-wide or federal). This is very often used by political parties as a "weapon" to counter their opponent's decisions - they organise signature gatherings, and if they reach their goal the people gets to have the final word on the topic at hand.

Of course, anyone can submit a referendum on anything, as long as you gather the required number of signatures. You don't need to be elected or in a party or anything like that.

The system does lead to some ridiculous things being put up for nation-wide discussion, but that is usually seen as the cost of living in a direct democracy. I can think it's stupid, but it's your right to bring it to my attention if you consider it important (a bit like freedom of speech and the old "I'll fight your your right to say it even though I disagree").

EDIT: doh' I did repeat the "referenda" mistake here :/ Edited out.

I would not want to live in any country where elections are run on the basis of cost.

I wouldn't want to live in a world where people's imaginations were bound by their current reality. I don't make this argument as a "right", its a what if. AND if they're cheap you can run em all the time, that's interesting isn't it?

No, I think being able to run more elections is dangerous, because there are a lot of reasons republicanism works better than direct democracy at scale, but people are self-entitled idiots and will want to weigh in on things they have no idea about or useful input on because they're important.

You seem to suggest that the complement of "direct democracy" is "republicanism", rather than "representative democracy". "Republicanism" is the opposite of "Monarchism", and it is possible for a republic to be a direct or representative democracy (or anti-democratic).

You're not one of those people who think "America isn't a democracy, it's a constitutional republic" are you? I see that meme expressed online a lot, and it's really unnerving that people believe that.

Also, might I infer that your support of "republicanism" over "democracy" is because you support the Republican party in the US and have been taught to fear and loath anything which starts with the string "Democra"?

> "people are self-entitled idiots"

Actually, that answers my question, thanks.

Republic: a form of government where elected officials exercise power on behalf of the public.

I would argue that kind of by definition, a republic is a representative democracy, though it's possible there are representative democratic governments that aren't republics.

The US is a republic, which is a form of representative democracy -- much like Im a mammal and a eukaryote.

The end of your comment of course is just a non-sense ad hominem. I don't support the Republican party, but your need to other and slander people you don't agree with is troubling.

And yes, people are self-entitled idiots. You, me, everyone else. That's why, even with it as our full time job, a support staff, and the genuine motivation to make a difference, we couldn't keep up with the actual complexity of every vote. Expecting the average person to do what a professional with staff can't is ludicrous!

Now, there are lots of ways we could use technology to better harness the public for decision making, but having them vote on everything would just be a disaster.

Thank you for your clarification and I apologise if I over-reacted. It felt like you were excluding yourself from the "self-entitled idiots" designation, which would itself be an attempt to "other and slander people". For what it's worth, I think you are under-estimating yourself if you describe yourself as simply a self-entitled idiot, but certainly we all have a bit of that in us.

My point, though poorly worded, was that very intelligent people with a lot of dedication routinely fail while working as senators and representatives because the job is legitimately complicated and hard.

We feel that we'd do good at it because most of us honestly have no idea what's actually required to work in that environment. I don't imagine that I, as an amateur with a job and social life, would really be more informed than the people in Congress. I don't think most of us would be.

So the solutions to the problem need to address how to combine our effort and expertise, rather than asking us all to be experts. (If that makes sense....)

I think there's a lot of promise in, say, using ML and public repos (eg, github) to let us collectively scan, annotate, and suggest edits for legislation.

Why isn't Congress just the maintainers of the authoratative repo that anyone can make a PR to? That seems much more useful than having a vote about everything -- let's argue about it, lay out our best cases as the PRs merge up the hierarchy, and let the Congress people argue out the final merge of a dozen proposal PRs? I mean, that's basically what they do, but it's weirdly pay-to-play, and it seems much more democratic to, ya know, let the public in on it.

Yes there are theoretical justifications for a republic over a democracy. But in modern practice, do you believe that the average person is more of a "self-entitled idiot" than the corporate lobbyists writing our laws?

Yes.

Not self-entitled part, but the idiot (on a particular topic) part. I think lobbyists could sell the public on things they could never sell senators on.

Now lobbying is a problem, but the solution should be in our picking and regulatory mechanisms, not in letting them lobby the public directly.

There are many forms of democracy and to act as if we've got it all figured out today and have the best system is potentially another form of being self-entitled and silly. Our system very much "sucks least".

We have plenty of evidence that governing by asking a large, diverse population over and over about local issues just leads to exactly the sort of tragedy-of-the-commons that government is meant to reign in.

Having too many votes simply doesnt work, because the voters can't put in the required effort per vote to decide on a prudent course of action.

The only reason to switch off paper ballots is of you're running so many elections you're just influence laundering by pretending to be democratic when you're not.

Interesting in the Chinese way :-(

well yea, you might not want to live there.....

  Paper works, and it works well. Anyone that can count can validate a single precinct

Add to that there's not really a need to speed up deployment of the results for elections and referendums in Switzerland.

Except for the "house of representatives" (Nationalrat) where it can take a tad longer due to the complexities of the vote, results are usually in at voting day before 6pm (Voting closes at noon).

I'm also deeply reluctant to accept the necessities of electronic voting. Given all parameters it's a really hard (if not impossible) problem to crack.

> voting day before 6pm (Voting closes at noon).

As a late sleeper, I find this voting system biased and unfair.

Sigh!

You don't have to show up on voting day in person. You can mail your vote in up to one month in advance. (Postage paid by your taxes)

You can chose not to vote for (usually dumb) reasons. But wanting to sleep in is not one of those.

How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced?

There is always going to be a weak point where you have to trust somebody - this is why party members should not be involved in every step from setting constituency borders, all the way to being in charge of any balloting and reporting results. It needs to be independent (e.g. in the UK it is fiercely independent of party members' involvement at any level).

The interesting attack vector here is your ISP could trick you. That can be mitigated with certificates and some of the measures banks use to identify themselves to customers (strings that you added at registration being displayed at login that only you know, etc.)

But yes, a hard problem to solve.

>How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced?

You can watch it.

With a "ballot box" system, you could get there, put your vote in the box, then sit there and watch it all day until it's counted. Hell if you want you could get there and inspect the box before they start voting.

And it's not just you that can do that, everyone can do that regardless of profession, age, race, background, education, etc...

To clarify on top of Klathmon's point: this actually happens in Switzerland, it's not just a theoretical argument.

Actually, the government is required to have some people watching the counting (specific rules vary on a per-canton basis). Some states select random citizens for that (similar to jury duty in the US - you get fined if you don't show up, but get paid for your time). Other states have a pool of people they choose from randomly (you volunteer for the pool).

EDIT: Furthermore, Swiss people vote in their community. It's not like you need to go out of your way to watch the counting - it happens in your town hall or (sometimes) the school. It always happens on Sundays (which is a required day off in Switzerland except in some rare cases).

That's nice to know!

If you don't mind me asking, how does Switzerland handle those which are required to work on election days?

That's one of the ugliest parts of the US election system to me, is the fact that many people need to fit the election around their work schedule, and I know of at least 3 people that couldn't get time to vote this year, and my state makes it so you basically need to be actively deployed in the military, or be hospitalized to get an absentee ballot.

Like I added in my edit, there is almost no such case: Sundays are a mandatory day off for most. That means you can't go shopping on a Sunday, except in very few shops (train station shops have exceptions). Doctors, pharmacies and most other emergency things operate on a reduced schedule.

I'm not certain what would happen if say a nurse working a shift in an ICU was selected. I'm pretty sure it's either announced early enough that the hospital would have to switch shiftees or they would be given a pass for free. I suspect a person working in a train station shop on a Sunday would tell their boss, and would simply be shifted to another time (it's not like the boss or the employee can do anything about it - it's law).

EDIT: to clarify once again - I'm pretty sure it does happen, but the case is probably rare enough for it not to matter too much. The rule works for a good 90% of cases, exceptions can certainly be done on a case-by-case basis at community level.

In Spain, where the system is similar to what you described (staff for the day is chosen at random from all citizens in that voting district, and similar to jury duty), some professionals (doctors, nurses, air controllers, etc.) can decline the request if they will be on watch, and there are assigned replacements for them.

A non-critical worker cannot refuse but:

a) Chosen citizens are paid, even if not much (60€ I think).

b) Chosen citizens have the following Monday morning free, should they need to travel back to their job site, etc.

c) Chosen citizens have strong legal protections should their boss try anything.

In practice, when an employee is chosen for election duty the boss just deals with it as best as they can, since it's a case where judges and police are super strict: messing with election duty will get you heavy fines and/or jail time. So no-one is going to fire you or retaliate if you are assigned election duty.

In my current commune of residence, I have been (s)"elected" for that task during a couple of years and:

- I never had to show up (there seem to be enough people volunteering...). - If you have good reasons, you can contest the election.

(IIRC, formally, I've been elected to that task... but I have no idea who did elect me...).

Switzerland has easy mail voting for everybody. I have never once in my live voted by going somewhere.

Sure, you don't have to. But you can (and many people do).

EDIT: also, the mail goes to one of these places where people are standing around watching the people counting (your community's townhall, usually)

I've been thinking lately that it shouldn't just be possible to watch the ballet process end-to-end, it should be actively encouraged.

Voting days should be public holidays, polling stations should be festivals, and moving ballet boxes should be a parade.

We hold festivals like these for far less important purposes, so why not celebrate the foundation of our society.

In all the German elections I participated the only people watching (apart from the regular citizens that are appointed official poll workers) were the few people showing their children how voting works - and they leave after a few minutes because let's be honest, counting ballots is rather boring. It would be nice if a few more people were watching the process.

> counting ballots is rather boring

So is pulling down a lever and watching spinning wheels. Permit placing bets on the outcome. Turn it into entertainment. That always works. And if money is involved, people will triple check. [oh the Humanity. I forget now if this comment started as an /s.]

To add to your point, also with ballot system it's very hard to change results. You can by a few votes, though it's a drop in the water compared how much you can buy and how many vote. If you want to change the outcome of the vote - you need to have a lot of resources (look at Crimea's occupation by Russia). Where's with e-voting, there could be few north koreans who would be able to compromise e-voting system in the country, which is on the other side of the world, just for the kicks.

I suppose that I could, in theory, watch it. It's a physical ballot, so we could do that. But does anyone actually do this? And more importantly, are all the votes watched?

It's completely impractical to try to watch millions of physical ballots. Or to even simply count to a million without making a mistake.

But if the voting was done (correctly, securely) in software, each person could independently audit the complete results. And to be clear, it's the overall election being audited that's important, not my vote in particular.

Perhaps it would be more difficult to understand the algorithm and code than following a physical ballot, but not a million times more difficult.

paper voting is so great because it scales so well.

There is no one person counting millions of votes. There are people counting hundreds or even thousands of votes in every precinct. Then from there they are publicly announced, and then anyone and everyone can tally up the totals.

The more people that vote, the more precincts there are, so the amount that any one person or place is responsable for (even only partially) is kept small so that mistakes or "bad actors" can only do a very small amount of damage on their own.

And if you read down in this submission a bit, people are pointing out that some countries (namely Switzerland) not only encourage people to watch ballot boxes and count along, but actually "draft" people to do it similar to a jury-duty kind of thing in the US.

Also I think you are severely underestimating the difficulty of auditing code. For starters, it completely removes the ability for the vast majority of the population to audit even if they wanted to. non-programmers can't read programming. Not to mention the illiterate, the elderly, and anyone else that doesn't have the knowledge to be able to read and follow a programming language.

Then there's the amount of time it takes. Watching a ballot box takes the duration of the election day. A day at most. Auditing every inch of a codebase? Months, years, even longer. You can point out that not everyone has to review every single line, but then you are back to letting a fraction of a percent of the population validate the code (and in a ballot box system, you can have everyone validate the process, adding magnitudes more redundancy that something shady will be caught). And what percentage of programmers do you think have a good enough grasp on cryptographic protocols and voting systems to be able to correctly and securely vet a system like this? I'd be willing to bet good money there are less than a thousand of them in the united states, and by sheer (un)luck at least one of them will be a "bad actor".

But probably the biggest thing is that to sway a "paper and pencil" election, you need materials, you need a LOT of people, and all it takes is one person to see what's going on and it all collapses. If you're really clever, you might be able to get away with changing the outcome of a single precinct, but what about the rest of the county? the state? the nation? In 2012 there were 2712 voting precincts in virginia alone. Orchestrating a system where you can put a person at a majority of them that will do something nefarious to sway the election means you are looking at 1000 people spread across a not-insignificant amount of land. And that's just for one state.

With an electronic voting system, one bug is all it takes. One vulnerability, one crypto flaw, one guy somewhere that can put the backdoor in the manufacturing of the CPUs for the vote counters. A single person can (if the are very smart and lucky) completely change the outcome of the election. And they might get caught, but the chances are much smaller than if it required thousands of people at the least to do so.

Every state does things a little differently, but where I live paper ballots enter an optical scanner and every dozens/hundreds of ballots a subtotal is printed on a continuous stored piece of cash-register like tape. The presumably neutral election volunteers and the opposing party observers are fascinated by that tape every time it prints something. I don't know if there's a law or mere gentleman's agreement to not report results until after the polls close, but something is being periodically reported.

The subtotal tape cries out to have a block chain added to make it impossible to rewrite history. Once the five neighboring precincts hash and sign my precincts results it would be very difficult to later fake historical results.

There is of course the false assumption that everyone involved in elections wants a fair election, in which case systems will be constrained to make a fair election impossible, with technologies such as e-voting or obscure registration procedures or strange voting laws in general. But its very easy to run a fair election if the people running it want it that way. If. The sheer amount of problems indicate a very large number of people actively discourage democracy in practice.

In the USA it is common for election work to be run or observed by pairs of majority-party workers: one Democrat and one Republican. So there are multiple pairs of eyes watching the boxes by people of different parties.

This doesn't make funny business impossible but does make it both unlikely and difficult to tamper with on a large scale.

When I did poll watching (for knocking up supporters) for Labour a while back we where not allowed in the building and you could not have anything with the candidates name on within 50 or 100 yards - plain rosettes where ok.

Just FYI

UK: Knocking up - visiting, in this case going door to door to canvass voters

North America: Knocking up - making pregnant

this is on a similar level of trust as the question about whether your paper vote is actually counted by some volunteer or just scraped. But I agree, that e-voting systems require a high level of trust by the users but I would argue that it is comparable to the trust you need in letter voting. The main difference in my view is the authority is typically split between fewer people with an e-voting system giving a single person more potential influence when they abuse their power. (e.g. a single server admin can deploy a malicious version of the system rather than a person only having access to maybe a few thousand ballots)

Speaking of trust, your comments are interesting and over the decades I've been struck by the symmetry and asymmetry between evoting systems and our heavily automated financial system. There is enormous financial reward to corrupt an e-voting system and enormous financial reward to provide a trustworthy secure financial system. No great surprise which system works and which system will never work.

The solution seems simple at first glance; scrap the entire voting system, scrap the entire fundraising system, and whichever candidate receives more individual $1 donations via check or money order wins. You can vote a dollar to as many candidates as you want but your federal tax return for that year is only getting a single $1 election credit. You could require the candidates to declare to the IRS each $1 contributor which makes election fraud also a form of income tax fraud.

Certainly, our financial marketplaces and clearinghouses at their absolute worst are more trustworthy and reliable than our evoting systems at their absolute best. And the additional infrastructure to transfer a hundred million bucks every four years is utterly trivial (well, more often due to primaries and midterm elections, but its still a drop in the bucket ...)

The anonymity emperor has no clothes, anyway. Thanks to the miracle of modern technology everyone who matters already knows exactly who you voted for and your complete financial life, you're just plausibly deniable on an individual basis against some non-state opfor some of the time. May as well face reality and make all votes part of the public financial record. Sure, it sucks. But better to face a reality you don't like, than to live in a fantasy world of completely broken anonymity. Living a lie means you'll slip up and the consequences of the slip up are likely worse than the lack of anonymity itself.

> this is on a similar level of trust as the question about whether your paper vote is actually counted by some volunteer or just scraped.

No, if you don't trust that your paper vote is actually counted you could stay in the election hall all day, watch the counting, check the when the results are transmitted. You don't have any comparable option with e-voting.

But how do you verify that the compiler produces the code you wanted it to create?

But how do you verify that the Computer actually does what is in the Bytecode?

"But how do you verify that the compiler produces the code you wanted it to create?" You open it in disassembler and look through. It's a white box.

"But how do you verify that the Computer actually does what is in the Bytecode?" It is much closer to the original question. hardware backdoors is a difficult topic