> there's a tendency for governments and councils to outsource the work to whatever contractors are the cheapest

Not just a tendency. When choosing a contractor, government offices in Germany are required to choose the lowest bidder who fulfils (or rather, claims to fulfil) the requirements stated in the call for bids.

They are bound to take the most economical offer which is not necessarily the cheapest. Cost must always be a significant factor but others can be included. The criteria must be fixed before starting the process and can include follow-up cost, technical aspects, environmental considerations, duration, user experience, or anything else that is quantifiable, appropriate, and non-discriminatory.

It is far easier to just look at the cost but it's absolutely not uncommon to have other criteria included in a tender.

An offer that is unusually cheap has to withstand additional scrutiny. It is not allowed to choose such an offer (even if it's the cheapest) if it's price-dumping or unlikely to be completed due to the tight calculation.

Yes, but that's only half of the story. We just spent 40 mio on a thing that had 10 year old cabling contracts. We managed to fix it, but there's plenty of trash that we didn't manage to fix. The problem is that there is close to zero accountability on senior management.

Germany is full of stuffed old guys, who have no reason to be afraid of ANYTHING. Nothing is ever going to happen to them. All the people that screwed up the major government construction projects went straight to go on to continue doing the next government construction projects. Same with every other industry here.

Blaming the "Ausschreibung" or bidding stuff is only a tiny part of the problem. Every time I see the people responsible for this crap I almost puke when I see them give each other a pat on the back.

Oh and while I'm at it. We have a software contractor that has a contract that basically lets them build anything they want and bill it to us. Add to that I'm supposed to architect their software and micromanage, so they get to bill us for the work. On top of it we pay them to get training in Angular 2.0, which we will then pay for to have them train us. I asked management to change the contract so they couldn't do what they want, but they just don't want to touch it.

They were not chosen as part of the bidding process btw. I've seen the same in the US. It's the same crap you have in any other country.

To be fair, that is more a rationale for having rally good people speccing your system and producing detailed requirements.

Ok, let's just do that : spec a voting system. Such a system should be as secure as physical paper and anybody should be able to assess its security by inspecting it (good luck with that one).

The level of detail your talking about to prevent the kind of mistakes they made is so specific that you might as well just develop the thing in house since you clearly already have the experience.

Maybe what we need is a rules that any critical government infrastructure should be independently pen tested before it's bought. This should hopefully put off the inexperienced from taking on such projects and offer a way out for governments should the contract go sour.

I agree, this is often an issue. In my company a lot of people only make specs, and the "development" for a lot of components is outsourced. But these specs are basically developed already, so in the end, we're only making the expensive developers write a spec that's so detailed that it's more work to write the detailed spec, than if you programmed it directly from a non-detailed spec.

That's certainly not wrong, but it also is somewhat at odds with how we know modern software projects should be managed, which is a reasonable explanation for why so many government projects work out the way they do.

> even a well done version is worse than a paper ballot.

It is not. There are many voting schemes that offer all the benefits of paper voting together with the verifiability and transparency of cryptographically verifiable vote counting.

All experts I've heard from on this agree that we're decades from being able to implement such systems in a secure way, if it's possible at all. Most people trying to tell you that's not true are trying to sell you something, usually with some vague blockchain reference.

I'd recommend the various talks and papers J. Alex Halderman has given/written on this topic, especially on Estonia's e-voting system.

I also recommend Andrew Appel's talk on the mechanics of voting. In addition to the dangers inherent in any complex electronic system, he also discusses how we invented the secret paper ballot. It may look "low tech", but the secret paper ballot is several hundred years of bugfixes and security features that we would be foolish to ignore.

https://www.youtube.com/watch?v=abQCqIbBBeM

> There are many voting schemes that offer all the benefits of paper voting

A major benefit of paper voting is that you don't need a math PhD to verify for yourself the integrity of the vote process.

Do you need a math PhD to do use encrypted messaging apps? To use SSL? Clearly that's a fallacious argument. The math can be wrapped inside an easy to use shell, just like it is in your https enabled web browser.

I don't need a Math PhD to use all of those. But if I want to be audit it? Probably. I can audit paper ballots just fine, anyone can. But that easy to use shell? How do I know that it does what people claim it does? I have to trust those people. The people that have the ability to audit now hold absolute power over the result

You can make an interface that hides the complexity and lets people check their votes in a user-friendly way. There's nothing that makes it fatally complicated to use.

As I said: The problem is not using the software itself but knowing that the green checkmark (or whatever) it displays actually means the vote was correctly counted. The former is trivially done by a competent team, the latter not so much.

Just an example from another field: It is easy to compare key fingerprints shown by WhatsApp/Signal/GPG but how do I know that the software does not encrypt the text with a second key? Personally I am not competent to do so and have to trust others. Don't forget that it's not enough to audit the code itself but you would also need the check the whole build process from scratch (and processors it was done on for that matter - and while we are at it: how can I know that the display actually shows that it was asked to do?). How many people know how to do so?

Hiding the complexity is exactly the wrong approach. You want to reduce the complexity so that the average person can understand it just fine.

How do you verify that the machine actually does what it displays and/or print without hooking a hardware debugger on it?

Could you link to details of one such scheme (perhaps the one you feel is best), please?

When I've thought about e-voting it's seemed tractable except the conflict between verifiability and keeping the ballot secret. I'd be interested to see how such schemes manage this point in particular.

Read this algorithm: https://en.wikipedia.org/wiki/Homomorphic_secret_sharing#Exa...

It's a proof of concept, it still has drawbacks, but it proves that you can have a system where all the votes can be accounted for without any information being revealed about any individual's vote: the ballot is secret.

>"There are many voting schemes that offer all the benefits of paper voting [...]"

You appear to have one incomplete theoretical scheme?

Thanks in any case for sharing it.

Edit: just on a quick reading - if I think I'll lose a seat, and can corrupt a single authority, I can get them to return a random set of numbers for their part of the polynomial, this randomises the results, doesn't it, giving me a chance to win. As there's no verifiability, it can not be observed in the voting data?

The ballot is secret – as long as the vote counters are not colluding, nobody can observe the votes in transit, and nobody can access all votes. It seems better than most proposals I have seen but I certainly would claim that this system offers "all the benefits of paper voting". And I haven't even mentioned that voters can generate polynomials that gives them multiple votes without anyone noticing.

Like I said, it's a proof of concept that shows it is possible to have transparent auditability and secret ballots at the same time. It's not ready for implementation as it is, though, for the reasons you mentioned.

From what I understand, verifiability and transparency is something you don't really want because it enables vote selling. In a secret ballot, someone dishonest enough to sell you their vote is probably dishonest enough to vote the other way.

You can already sell votes, see this start-up: https://www.votebuddy.de/

Quite telling are their FAQ:

Is this legal?

According to German law this is illegal. Thus we're based in New York and the website is served from the US.

Just FYI, that site doesn't actually do anything. It is designed by the Peng Collective to create outrage, nothing more. The same happened during the 2000 US presidential elections with voteaction.com, a German-based site (as it's against US law) that turned out fake as well.

But of course, postal votes make vote selling possible.