Forget the problems electronic voting has if it's implemented well, this sort of stuff is the real reason to be worried about systems like this. Because there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest or to hire developers who don't know a thing about security.

A secure evoting system is hard enough to implement, and even a well done version is worse than a paper ballot. But it's the kind of system described here that'd be the likely result of electronic voting being implemented in countries like the US. A hacked together, insecure piece of junk that's wide open to being compromised by bad actors at every level.

> there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest

Not just a tendency. When choosing a contractor, government offices in Germany are required to choose the lowest bidder who fulfils (or rather, claims to fulfil) the requirements stated in the call for bids.

They are bound to take the most economical offer which is not necessarily the cheapest. Cost must always be a significant factor but others can be included. The criteria must be fixed before starting the process and can include follow-up cost, technical aspects, environmental considerations, duration, user experience, or anything else that is quantifiable, appropriate, and non-discriminatory.

It is far easier to just look at the cost but it's absolutely not uncommon to have other criteria included in a tender.

An offer that is unusually cheap has to withstand additional scrutiny. It is not allowed to choose such an offer (even if it's the cheapest) if it's price-dumping or unlikely to be completed due to the tight calculation.

Yes, but that's only half of the story. We just spent 40 mio on a thing that had 10 year old cabling contracts. We managed to fix it, but there's plenty of trash that we didn't manage to fix. The problem is that there is close to zero accountability on senior management.

Germany is full of stuffed old guys, who have no reason to be afraid of ANYTHING. Nothing is ever going to happen to them. All the people that screwed up the major government construction projects went straight to go on to continue doing the next government construction projects. Same with every other industry here.

Blaming the "Ausschreibung" or bidding stuff is only a tiny part of the problem. Every time I see the people responsible for this crap I almost puke when I see them give each other a pat on the back.

Oh and while I'm at it. We have a software contractor that has a contract that basically lets them build anything they want and bill it to us. Add to that I'm supposed to architect their software and micromanage, so they get to bill us for the work. On top of it we pay them to get training in Angular 2.0, which we will then pay for to have them train us. I asked management to change the contract so they couldn't do what they want, but they just don't want to touch it.

They were not chosen as part of the bidding process btw. I've seen the same in the US. It's the same crap you have in any other country.

To be fair, that is more a rationale for having rally good people speccing your system and producing detailed requirements.

Ok, let's just do that : spec a voting system. Such a system should be as secure as physical paper and anybody should be able to assess its security by inspecting it (good luck with that one).

The level of detail your talking about to prevent the kind of mistakes they made is so specific that you might as well just develop the thing in house since you clearly already have the experience.

Maybe what we need is a rules that any critical government infrastructure should be independently pen tested before it's bought. This should hopefully put off the inexperienced from taking on such projects and offer a way out for governments should the contract go sour.

I agree, this is often an issue. In my company a lot of people only make specs, and the "development" for a lot of components is outsourced. But these specs are basically developed already, so in the end, we're only making the expensive developers write a spec that's so detailed that it's more work to write the detailed spec, than if you programmed it directly from a non-detailed spec.

That's certainly not wrong, but it also is somewhat at odds with how we know modern software projects should be managed, which is a reasonable explanation for why so many government projects work out the way they do.

> even a well done version is worse than a paper ballot.

It is not. There are many voting schemes that offer all the benefits of paper voting together with the verifiability and transparency of cryptographically verifiable vote counting.

All experts I've heard from on this agree that we're decades from being able to implement such systems in a secure way, if it's possible at all. Most people trying to tell you that's not true are trying to sell you something, usually with some vague blockchain reference.

I'd recommend the various talks and papers J. Alex Halderman has given/written on this topic, especially on Estonia's e-voting system.

I also recommend Andrew Appel's talk on the mechanics of voting. In addition to the dangers inherent in any complex electronic system, he also discusses how we invented the secret paper ballot. It may look "low tech", but the secret paper ballot is several hundred years of bugfixes and security features that we would be foolish to ignore.

https://www.youtube.com/watch?v=abQCqIbBBeM

> There are many voting schemes that offer all the benefits of paper voting

A major benefit of paper voting is that you don't need a math PhD to verify for yourself the integrity of the vote process.

Do you need a math PhD to do use encrypted messaging apps? To use SSL? Clearly that's a fallacious argument. The math can be wrapped inside an easy to use shell, just like it is in your https enabled web browser.

I don't need a Math PhD to use all of those. But if I want to be audit it? Probably. I can audit paper ballots just fine, anyone can. But that easy to use shell? How do I know that it does what people claim it does? I have to trust those people. The people that have the ability to audit now hold absolute power over the result

You can make an interface that hides the complexity and lets people check their votes in a user-friendly way. There's nothing that makes it fatally complicated to use.

As I said: The problem is not using the software itself but knowing that the green checkmark (or whatever) it displays actually means the vote was correctly counted. The former is trivially done by a competent team, the latter not so much.

Just an example from another field: It is easy to compare key fingerprints shown by WhatsApp/Signal/GPG but how do I know that the software does not encrypt the text with a second key? Personally I am not competent to do so and have to trust others. Don't forget that it's not enough to audit the code itself but you would also need the check the whole build process from scratch (and processors it was done on for that matter - and while we are at it: how can I know that the display actually shows that it was asked to do?). How many people know how to do so?

Hiding the complexity is exactly the wrong approach. You want to reduce the complexity so that the average person can understand it just fine.

How do you verify that the machine actually does what it displays and/or print without hooking a hardware debugger on it?

Could you link to details of one such scheme (perhaps the one you feel is best), please?

When I've thought about e-voting it's seemed tractable except the conflict between verifiability and keeping the ballot secret. I'd be interested to see how such schemes manage this point in particular.

Read this algorithm: https://en.wikipedia.org/wiki/Homomorphic_secret_sharing#Exa...

It's a proof of concept, it still has drawbacks, but it proves that you can have a system where all the votes can be accounted for without any information being revealed about any individual's vote: the ballot is secret.

>"There are many voting schemes that offer all the benefits of paper voting [...]"

You appear to have one incomplete theoretical scheme?

Thanks in any case for sharing it.

Edit: just on a quick reading - if I think I'll lose a seat, and can corrupt a single authority, I can get them to return a random set of numbers for their part of the polynomial, this randomises the results, doesn't it, giving me a chance to win. As there's no verifiability, it can not be observed in the voting data?

The ballot is secret – as long as the vote counters are not colluding, nobody can observe the votes in transit, and nobody can access all votes. It seems better than most proposals I have seen but I certainly would claim that this system offers "all the benefits of paper voting". And I haven't even mentioned that voters can generate polynomials that gives them multiple votes without anyone noticing.

Like I said, it's a proof of concept that shows it is possible to have transparent auditability and secret ballots at the same time. It's not ready for implementation as it is, though, for the reasons you mentioned.

From what I understand, verifiability and transparency is something you don't really want because it enables vote selling. In a secret ballot, someone dishonest enough to sell you their vote is probably dishonest enough to vote the other way.

You can already sell votes, see this start-up: https://www.votebuddy.de/

Quite telling are their FAQ:

Is this legal?

According to German law this is illegal. Thus we're based in New York and the website is served from the US.

Just FYI, that site doesn't actually do anything. It is designed by the Peng Collective to create outrage, nothing more. The same happened during the 2000 US presidential elections with voteaction.com, a German-based site (as it's against US law) that turned out fake as well.

But of course, postal votes make vote selling possible.

> None of the steps taken in response addressed the fundamental, obvious security policy issues. Even their band-aid fixes were broken.

I feel like it is a universal truth of engineering, that you can't expect anyone who implemented such a grossly broken system in the first place to be capable of anything but band-aid fixes of the specific flaws pointed out to them.

>- The automated software updates have no signature and are downloaded insecurely over HTTP

I have two conflicting thoughts at the moment:

1. It's insane

2. It's awesome. I wish I could get my hands onto one of those machines.

... my personal website has better security than this :|

This is worrisome

Would you be interested in hosting the next German election? Sounds like they need someone!

I uh.. Sure :) I'm all up for it, I'll read a book or two on cryptography and security and leggo! Good intentions will definitely be enough.

This is why electronic voting is such a huge problem to solve. You can't just check one or two boxes like "blockchain" and "biometric authentication" and think "there, we now have secure electronic voting". There are so many other things that should go into securing the electronic voting, including doing thorough audits of the code before the election, keeping the systems up to date, having anti-tampering protection, allowing users to verify their vote in a secure way, and so many other things I can't think of right now.

But all of those things will get lost when talked about in the media or on TV, and the politicians won't care to implement them either. It's a little like nuclear energy being "safe" - except for all the problems humans and their corruption could cause around it. But electronic voting is much worse, because I very much doubt the current political climate would want to handle electronic voting with at least as much care (it's the democracy at stake after all) as they do nuclear power plants. If anything, the two main parties would probably be fine with some vulnerabilities if they think only they can exploit them.

So I guess what I'm trying to say is that electronic voting has always been doomed to fail and will always be doomed to fail due to all of the other implementation details that always lack from the discussion beyond a few main check boxes. All of that stuff is "nerd talk" so few of the leaders will care about them, which means budgets won't go towards solving those problems and ensuring those other checks exist, too, and are properly managed.

... well, wow. (Great summary.)

How widely is this system used in the the german national elections? Is it just one of the states? (Which one?)

Note that this isn't a system running in the voting booth. All votes are cast on paper ballots. The software is just for tabulating the results and maybe maintenance of the voting rolls.

It's obviously a terrible situation, but I'm somewhat confident that you couldn't actually throw the election even with complete access. I, for example, always stop by at a polling place a friend volunteers at after the polls are closed and watch them count the ballots. Everyone is free to observe, and you can get as close as you could want, and count the ballots yourself.

There are only a few hundred voters per precinct, so any person can, if they want, verify their (or another) precinct's results end-to-end: count some or all the ballots, then compare with the results posted online.

The volunteers manning the polling places are also incredibly dedicated and professional. I'm pretty sure that at least one of them also verifies the data. It's a diverse crowd (not, for example, party officials or public servants), which makes it practically impossible to get their buy-in to any corruption.

> and you can get as close as you could want, and count the ballots yourself

It usually is no problem if they do but an outside observer should not touch the ballots themselves and is not allowed to. They can look closely though which gives them the same degree of certainty.

One more info: this software is just used for the preliminary results, not for the final results.

The software for the final results is entirely different and seems to be much more secure.

Knowing how German government offices operate, the "software" for the final results is likely sending letters stamped with an official seal by post and calculating the result manually/with very low-tech software.

Which is how election results should be handled. Sealed letters are cheap and extremely hard to forge.

The two products by "vote IT", one of which is the vulnerable "PC-Wahl", are used by 2700 authorities, responsible for ~66% of Germans. ("Insgesamt haben 2.700 Behörden die Produkte von vote iT lizensiert. Damit werden für rund 66 % der Einwohner Deutschlands die Wahlen mit unseren Produkten organisiert und präsentiert.") [1]

[1] https://vote-it.de/

That's insanely messed up. Very high level heads have got to roll for this, right? Like at least one direct report to Merkel?

Direct reports to Merkel have absolutely nothing to do with this. This software was procured by local authorities which are completely independent from the federal government. Even if Merkel wanted, she has no authority whatsoever on local authorities.

Ok.

So maybe one conclusion is that the responsibility for the voting process should be on the federal level, then.

What indication do you have that any federal solution would be better than the state one? They're operating under the same laws and RFP/selection requirements.

The only difference at the federal level would be it affects 100% of Germans instead of 66%.

So my theory was: Having a federal, shared solution would allow more money to spent on this. Thus avoiding embarassing fuckups like this one.

Anyway, I just think you should scrap all electronic voting; your local regional governments clearly don't have the chops to avoid idiotic things like this. Just go back to paper ballots. They work fine!

We still have paper ballots. This whole story is only about the software that calculates the numbers announced on election night (i.e. does a bit of summation of the manual counts).

Ah.

Horrific