Don't get me wrong - there's a ton of hype around blockchains that is completely unjustified. But there are a few applications where it may have some utility, and I think this is one of them. So it irritates me when I see people on HN jump on the "blockchain therefore hype" bandwagon without spending the time to actually think about when this sort of technology is useful and when it isn't.
A decentralized blockchain is far more trustworthy than a centralized database in this scenario. Say Russia controls the centralized voting database, they can just edit whatever value they want to say "Putin" and call it a day. It's not public. No one can verify their vote. It's under the control of one party. The entire point of decentralization is to ensure there is public consensus among multiple parties.
There are other discussions about how to allow or incentivize citizens to run nodes, mitigate lost or stolen IDs/private keys, prevent against spam attacks, etc...but it sounds like you aren't even open to discussing those because you equate the word "blockchain" with "snake oil".
And now you've told everyone exactly how millions of citizens voted.
i disagree. the exact primitive you want is a verifiable counter, where people can be verified as being allowed to add one to the counter, with no ability to determine who added to which counter. that is different from a verifiably immutable log.
also, there are scenarios where a blockchain can be mutated, and i bet you that the election of a country would provide a very enticing target for subverting the blockchain.
> That isn't a defense of this article, or of any of the current blockchain/election projects, but in principle, the idea makes sense.
but in practice, maybe it doesn't? elections aren't some academic thing.
1. Any person can validate that their vote was counted.
2. Any person can validate that their voted counted towards their intended candidate.
3. The collective can validate that no person (i.e. no crypto-id) voted twice.
4. The collective can validate the exact true number of tallied votes (and, e.g. make sure it doesn't exceed the total number of eligible voters).
5. The collective can validate the tallying process. I.e. they can count all the votes on the chain, and themselves reproduce the sums.
That does not address the following:
1. Ensuring that a crypto-id was used by the appropriate person (Although if someone stole your ID, this would likely be discovered by the person it was stolen from, due to previous property #2).
2. Ensuring that a person was not coerced to use their crypto-id against their will.
Which are real problems that I would love to see solutions to. But that doesn't mean we shouldn't try to solve those first 4 as well.
This is a bad idea even in concept. If anyone can validate their vote went for the candidate of their choice, someone else can force them to perform the same validation for money, under threat of violence, familial ostracism, or whatever really.
I get that you understand there is a problem with coercion here, but it's not just an implementation problem, it's a problem with the concept.
I responded to this issue in the previous thread about this. But short answer is: create a verifiable but also deniable scheme.
I like crypto as much as the next person. But the bigger picture means that simpler, dumber systems that rely on lots and lots of humans are more suited to the problem space.
Let's start with imagining a statewide election with a million votes. To move the results by 1% would require 10,000 fraudulent votes. Now, how do we get 10,000 fraudulent votes?
First, we could stuff the boxes with fake ballots. Second, we could have false voter registrations and send "professional voters" around to vote at multiple polling places. Third, we could alter the results at the count, by giving a false count.
Now, let's introduce a process step: all activities that involve touching ballots, whether marked or unmarked, must be done in the presence of representatives of at least two political parties. In other words, if Team A is going to try to physically manipulate ballots or counts, they have to do it where Team B can watch them do it. How does that affect things?
And there's the process of running a polling place. At the beginning of the day, you get X number of blank ballots. They were delivered by two parties, and counted by two parties, and are presumably under some sort of seal. We know how many ballots are in the building. And there's a paper voter registration roll, with the names of every registered voter in the precinct. When a voter comes in, they look up the name on the roll, and the voter signs to say they voted. A tally is kept of how many voters sign. Each voter then gets a ballot, marks the ballot, and puts it in the box. At the end of the day, count the number of ballots. It should match the number of voters on the tally, and can be hand-checked against the number of signatures on the roll in a recount. Spot-checks of this at random precincts prevent widespread alteration without triggering a recount. The number of votes plus the number of remaining blank ballots equals the number of blank ballots at the beginning. So inserting fake ballots is hard. Inserting them in a way that can't be detected at count time or at recount time is harder.
So, how about false registrations and professional voters going around making multiple votes in different precincts? Remember, we need 10,000 votes to move the tally 1% in our theoretical election. Let's say one professional voter can make it to ten polling places over the course of a day. So you would need a thousand of them, trained, with targets. They would need to be either fanatical, or paid. And you need to do this with no leaks, no turncoats, no one who thinks "I could sell my story to the news for tens of thousands", no hidden cameras... yeah. (As an aside, this is why insistence on voter ID is misplaced. The difficulty of the problem prevents it far more than an ID step would.)
So how about altering the count? Well, if it involves altering the ballots themselves, it's a hard problem. (Unless you use those idiotically dangerous touchscreen machines, which ought to be illegal.) You need to remove valid ballots and replace them with altered ones, again with multiple parties observing. Or you can alter the final result count, but then it mismatches the paper ballots, and would be detected as fraudulent at recount time. Spot check hand-counts detect such issues.
Technical implementation example here: In Minnesota, we use Scantron machines. If there are multiple Scantrons at a polling place, we will hand-count one of them and compare to its electronic tally. The electronic tally from the machine is an unofficial result only, until certified.
Now, let's look at some easy things to do to manipulate elections! First, gerrymandering - draw district lines that make it nearly impossible for one party to win. I live in such a district. We're more likely to get visited by aliens than elect a Republican in my district. Second, voter suppression. Make it increasingly more difficult to vote - limit polling station resources in certain districts to force multi-hour lines, require ID, etc. These are popular and common. See how this works?
Blockchain doesn't fix ANY of this. Either it's already fixed, or could be fixed by improving the process based on models that are demonstrably good in other states.
Heck, they do fair elections in poor countries with high illiteracy rates, too. Just stamp each voter's hand when they vote. No one can vote twice because stamps are checked. Ballots can have symbols for parties rather than words. Election validation is easy.
It is exact opposite of what is wanted.
Blockchains provide a verifiably immutable log. This is the exact primitive you want for elections - tamper-proof logging. It is genuinely a good technological solution to the problems of election legitimacy and validation. That isn't a defense of this article, or of any of the current blockchain/election projects, but in principle, the idea makes sense.