No paper ballot in box scheme can do that: anything that is run by officials means that the correctness of the system depends on the officials' word only.
Please sign up and observe your local elections. The Australian Ballot system (private voting, public counting) is time proven, battle hardened.
Paper ballots cast at precincts counted when the polls close is the gold standard. It works because opposing belligerents agree on the outcome. Trust forged from mutual distrust.
Paper ballots permit guaranteeing the physical chain of custody. You should show up and help keep that guarantee.
Here in Romania there were cases when two or more parties agree to cancel the votes for the opposition or even count them as theirs.
We call those "allies".
The security of a digital systems is "good enough" IMO, especially if there's a public cryptographically verifiable ledger. We bank online where the banks essentially only hold cash in the form of a database entry. The benefits of digital voting means we can have more granular input in our government's operations. I don't see paper ever scaling to meet that demand.
Remember that your IMO is not what the consensus among security experts is. There are many things that you and me missed.
The worst problem with electronic internet voting is that depending on country, something like 5-40 percent of voters loses the secret ballot and the opportunity to vote independently without coercion. Husband, brother or other family member will be behind their back to watch how they vote.
Here in Finland I have a friend who has been election official and he says that it's not uncommon common for family member trying to squeeze into ballot box or try get behind. Especially if the ballot has been cast in post office with small space.
Your jurisdiction's voter registration database is (hopefully) up to date. YMMV. Note that verified reports of registration fraud are very, very few. Whereas caging, purging are fairly common.
Briefly, On election day: voter shows up to correct poll site, shows some kind of ID (YMMV), name found in that location's poll book, voter signs in, ballot is issued, voter marks ballot, voter casts ballot. If there's any error (question) during this process, voter is issued a provisional ballot, to be adjudicated out of band.
Ballots are counted before the polls open and again when the polls close. The bookkeeping is simple and easily verified.
Everything is bundled in tamper evident seals, observed and signed by members of opposing parties, physically escorted by opposing members, etc.
I don't see why this level of security couldn't be used to randomly and deterministically assign crypto keys that are used for some kind of blockchain voting scheme. Put a thousand pre-known keys in a hat, one thousand people draw keys from a hat, the key is activated on the blockchain and points to a user-defined voting wallet. Now you have anonymous cryptographically verifiable voting with double spend protection. Am I missing something?
Voting wallets? Assign crypto keys? You mean just like issuing a ballot? How would someone do a recount? An end-to-end audit? Keep track of who was assigned which key (thereby destroying the secret ballot)? Who voted and who didn't? How do you handle provisional ballots? Etc.
PM me once your proposal satisfies the requirements (works as a replacement) for current election administration systems.
Okay, maybe I'm being too dismissive, which I normally hate. But blockchains, crypto, signatures are not magical. Design the whole system, make it auditable while accounting for information leakage, simulate a few real world elections. Do the leg work, unlike Chaum, Rivet, others. THEN we can talk.
"Scantegrity II Municipal Election at Takoma Park: The First E2E Binding Governmental Election with Ballot Privacy"
http://static.usenix.org/event/sec10/tech/full_papers/Carbac...
With the prior Punchscan system, voter privacy is accomplished thru hash collisions. Hiding your ballot in a herd of ballots cast. A trick that works only if your herd (precinct) is large enough and your ballots are simple enough. Definitely would not work (protect voter privacy) in my jurisdiction.
Side note about IRV, as used in Maryland Park: It's now a non-starter. After the handful of well-studied experiments, election administrators are dead set against it. Ballots are complicated, voter education is tough, and IRV necessitates electronic tabulation, which rules out legally required manual recounts. (My jurisdiction often gets over 500k ballots. IRV is not feasible here.)
People lose wads of cash that are valuable to them; they're going to care even less about their electronic verification file.
Might as well just vote then and there
We use this in Mexico, in addition to (non-digital) fingerprint-carrying voter ids. Historically, it has not prevented fraud in general (most of which happened due to insufficient audit procedures and rural polls not having observers from all parties, allowing for stuffed ballots and the like). It did however close that particular attack vector. My trust on the results of an individual polling station in an urban area with observers from all major and most minor parties is actually quite high, even as I know any or all of the observers involved are likely to be corrupt and have low regard for the law. The reason for this is that they are all incentivized to prevent each other from cheating and have the means to detect tampering in such setting (without needing uncommon expertise beyond observation and basic arithmetic).
This is a thing you actively don't want. You don't want to be able to prove to anyone else how you voted. Otherwise it would be absolutely trivial for your boss to say, "So, you voted for that anti-union candidate, right?" (Or your boss to not say that, but just happen to give promotions to people who show proof of voting the way the boss wants.)
The right to a secret ballot is demanded by the Universal Declaration of Human Rights.
Yes, this renders the electronic voting problem - and honestly the voting problem in general - very close to impossible. That's why it's hard.
I just invented a scheme to anonymize votes in 5 minutes. I'm sure if smarter people tried we could definitively solve this. I'm not convinced this is hard as much as people are saying it's hard.
You need to have deniability; I need to be able to revoke my ability to prove how I voted, and moreover I need to be required to revoke it (otherwise I can be compelled not to revoke it). Right now, I am unable to leave the voting booth with any receipt of how I voted, even if I wanted to (i.e, even if someone else wanted me to). I can see my vote, and election monitors prevent anyone else from seeing it until it leaves my hands. In most places in the US, I can't even take a cell phone photo of my votes, and that's a good thing because nobody can ask me to take a cell phone photo of my votes.
2. If they're pre-known, anonymous, single-use keys, nothing prevents a corrupt election official from keeping a copy of the key and voting before the voter gets home. The voter has no way to prove that they didn't vote and that someone stole their key.
(The other thing is that photos of ballots have only become a serious threat in the last few years, and at the moment there's not really voter coercion through those photos, as far as we know. If it becomes a problem, I expect a bigger crackdown on it.)
Tada!
In most countries parties or volunteer groups nominate their own observers. UN can send their own observers.
Electronic voting is by far most vulnerable. It's not the algorithms, it's all other tings around them and verifying them.
To change the outcome of an paper ballot election you need to have thousands of thousands of people on your side and have everybody keep quite.
Do most people trust the officials? Sure. But any campaign with enough volunteers is able to verify everything.
It's to an extent possible to mount a local attack with paper ballots but its cost is an effort too great that it doesn't scale. You would basically have to get your own people, or paid people, to swap the ballots while nobody else is watching to get the results you want in one election district.
Because ballots need to be saved for recounting the marks on the ballots also need to be sufficiently distinct so that they don't look like they all come from a photocopier. Again, if there seems to be anything fishy, people can and will organise to redo the election locally, this time with different representatives from the parties.
With digital voting, vulnerabilities and malware and automated attacks scale to all systems involved and theoretically a single entity can rewrite the election results of the whole nation. Worse yet, it may not be evident whether the results are skewed or not as it's just digits in a computer and those can be changed without a trace.
Then again, it appears in some countries you can just claim millions of fraudulent votes without any proof without being called out for it.
> No paper ballot in box scheme can do that: anything that is run by officials means that the correctness of the system depends on the officials' word only.
This comparison is flawed, the entire correctness of a electronic scheme could only be verified by a few experts, whereas in every polling place with a paper ballot, there is a committee, and witnesses of the vote count. Proving the correctness of a paper ballot system such as the one described in [1] is trivial.
Ultimately, the correctness doesn't even depends solely on officials: In the course of the day, the polling station officials ask voters whether they want to participate in ballot counting as tellers. Voters can also volunteer to do so ; candidates can nominate tellers as well.
[1] http://www.elections-legislatives.fr/en/system.asp (search for "How are the ballots counted"). The presidential elections protocol is the same as the one described here.
[1]: https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-bu...
Even with paper ballot we still have to trust the people/devices counting the votes.
As an American citizen theres no website I can go to and check my vote. How do I know it was even counted, or properly registered.
If such a site existed, vote buying and/or coercion would be a lot more prevalent.
Two or more block chains. Each run by different parties. And a need for the same vote to show up on multiple blockchains to count. The voters would visit multiple websites to cast their votes which would then be verified between the various block chains, potentially by software that anyone can run on their own computer or vps. Every single person does not have to vote on multiple platform. Just enough that you can validate the voting.
Too late to edit my own post but please s/voting booth/polling station/ in the parent. Of course every voter should have absolute privacy in the voting booth in order to rule out coercion, but the ballot storage in the polling station should be publicly verifiable.
First of all, there are fifty elections in the US (not counting territories like Puerto Rico and Guam). Each state runs its own elections separately and can decide on their procedures.
Secondly, some jurisidctions already experimented with making election days a holiday. Aside from the fact that this only affects government employees (private businesses set their work schedules at their discretion, just as they do for other holidays), this ended up decreasing turnout, because people ended up taking the previous day off, treating it as an extra-long weekend for travel or vacation.
Third, this is a moot point when most states (34/50) offer early voting, and three more vote by mail, making "election day" rather arbitrary. It's really the last date on which someone can cast their vote. Those states also include three of the four largest states, meaning that the vast majority of people in the US have the option to vote well ahead of election day.
(For the record, the states which have neither early voting nor no-excuse absentee voting are Alabama, Connecticut, Mississippi, Kentucky, Virginia, Missouri, Michigan, Pennsylvania, South Carolina, Rhode Island, New Hampshire, and New York)
https://en.wikipedia.org/wiki/New_Black_Panther_Party_voter_...
https://www.theguardian.com/us-news/2016/nov/05/election-day...
That includes "shouting racial slurs" in your first link.
* Unboxing the ballot is done in public, anyone can come and watch those.
* Counting the votes is public and anyone can come and watch.
Voting on paper is dead simple, has withstood centuries of attacks, counting scales insanely well while attacks don't scale and it just takes one person to notice it and your whole plan goes south. Whereas electronic voting requires trusting black boxes, more black boxes, and understanding asymmetric cryptography.
Show up and keep showing up. Take notes. Fact check.
Over time, you'll know when the story doesn't add up.
Been there, done that. For years. It works.
If that's "too hard to fix" then there must be at least a fraction of people who don't think this is broken.
The time to fix it is right after elections.
This paper shows you know to achieve exactly that. You can vote anonymously and receive a proof that your vote was counted correctly, without ever telling anyone what that vote was. To prove that your vote was miscounted, I believe you do need to reveal who you voted for, but you can prove to the world that there was fraud.
This paper solves one of the major problems with blockchain based voting, but there are many more. I don't endorse blockchain voting.
https://en.wikipedia.org/wiki/Secret_ballot
So I guess ballots should be anonymous. So how to do that with a blockchain. Well simply by assigning some random number or hash to the voters that no one else knows.
Perhaps it would be better to turn the vote-selling market into a publicly verifiable open market?
If I say that it would cost a buyer $10k more for me to vote yes than the highest open bid for me to vote no, that is a strong quantifiable indication of the magnitude of my opposition. I'm sure the vote-pricing data would be a gold mine for statisticians.
Of course, this would make the plutocratic oligarchy operate out in the open, officially, rather than behind the scenes with lobbying, campaign contributions, and speaking fees. Some people might find that objectionable: both those who do not want a plutocracy and those who do not want their money influence on politics to be openly known.
If you can not possibly reveal your vote (like with the ballot box) you can not sell your vote.
And that's even before we conclude the preferred candidate of the plutocratic oligraphy would actually be massively aided by being able efficiently purchase the votes of the indifferent rather than having to inefficiently purchase airtime to convince people their candidate actually has merit. (And of course they'll still be able to continue to organise their vote-buying operations through shadowy umbrella organizations to the extent they can be bothered to disguise who they want to win)
For electing state officials, no. A voting scheme needs to be designed for the worst possible circumstances which practically means a bordering civil war, and where trust between voters is zero at best. Voting allows revolution to take place peacefully.
Therefore the method of voting needs to be understood, carried over, and be verifiable by the common (wo)man. No electronic scheme can do that: anything that runs in software means that the correctness of the system depends on the experts' word only, and that word is likely to mean nothing when half the population is already collecting arms.