In other words: It doesn't help at all against malware on the computer.
> The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button.
In other words: If the USB firmware is infected, it's still not secure.
> With these modifications, and the ability to check a cast vote has been received, you can have secure elections on insecure devices.
So, if you are using secure devices ... then you can have secure elections on insecure devices? In this scenario you aren't actually using the insecure device, other than for establishing a connection to the internet.
Or rather, as you described it, it also functions as the input device--but that is a security problem because it can be used to violate the secrecy of the vote, so it's not actually secure that way either. The only way to make it secure (sort-of) is to not use the insecure device.
> However it requires trust in the officials to do their jobs correctly and to not tamper the tally.
And that is the reason why electronic voting is not an option. Elections have to be able to remove a government from power against its will. An election process that depends on the integrity and honesty of the government that you want to remove from power is inherently broken. An election process that only works when there is no conflict is not a useful election process.
In the 2016 US presidential election officials basically typod the election results in the town of Hazelhurst in Wisconsin, where almost half the votes went missing until a citizen volunteer noticed the mistake. The party officials nor election officials caught the mistake.[2]
If mistakes like that can happen then how often do they go unnoticed? How often are these mistakes deliberate?
[1] https://news.err.ee/916525/vote-miscount-in-narva-may-cost-e...
So, could you point to any one election in Estonia's history where electronic voting would have been any better?
> The Soviet era showed that election fraud happens anyway.
That's just bullshit. Just because a solution for a problem is not perfect, does not mean it's useless and that every non-perfect approach is equally bad.
> The problem with paper voting is that mistakes in counting happen very often.
Which is irrelevant to the discussion of security. Mistakes are a very different thing from intentional manipulation, both in how you can prevent them and in the effects. In particular, mistakes tend to average out, which is why they usually don't matter for elections as long as they happen at a reasonably low rate.
> In the 2016 US presidential election officials basically typod the election results in the town of Hazelhurst in Wisconsin, where almost half the votes went missing until a citizen volunteer noticed the mistake. The party officials nor election officials caught the mistake.
... which is why we should employ a voting process where only the election officials have any insight into what is going on, so we minimize the chance that a citizen discovers any errors?
> If mistakes like that can happen then how often do they go unnoticed? How often are these mistakes deliberate?
... and how would an election process that is completely opaque to the public possibly help with any of that?
With electronic voting nothing stops sysadmin from doing UPDATE votes SET vote = 'Good Candidate' WHERE vote = 'Bad Candidate'.
Also, they cannot store signatures with votes because that would disclose voter's identity and their choice. They have to store signatures separately from the votes and it means that the votes can be freely modified.
Here is what Wikipedia says [1]:
> This criticism was underscored in May 2014 when a team of International computer security experts released the results of their examination of the system, claiming they could be able to breach the system, change votes and vote totals, and erase any evidence of their actions if they could install malware on the election servers.
Of course, the government can install enything on its servers.
Here is a quote from a report on vulnerabilities [2]:
> The e-voting system places complete trust in the server that counts the votes at the end of the election process. Votes are decrypted and counted entirely within the unobservable “black box” of the counting server. This creates an opportunity for an attacker who compromises this server to modify the results of the vote counting.
> ...
> The attack’s modifications would replace the results of the vote decryption process with the attacker’s preferred set of votes, thus silently changing the results of the election to their preferred outcome.
Read: the government can "draw" any outcome they would like. Maybe they already did it, who knows.
[1] https://en.wikipedia.org/wiki/Electronic_voting_in_Estonia
You can check who you cast your vote for through online voting. You can do it 3 times for half an hour after you voting. You cast your vote on a PC and at the end the voting software shows you a QR code. You can then use an app on your phone provided by the government to check who your vote was counted for.
Read more here: https://www.valimised.ee/en/internet-voting/checking-i-vote
You have no way of asserting that that was the vote that was actually counted in the reported result.
httpp://news.mit.edu/2009/rivest-voting
Of course you need monitors from all interested parties to prevent ballot stuffing, but that's true in every election. It's up to monitors to read the voter list and verify that (probabilistically) there are no/few fake voters on it.
> Despite positive gestures towards transparency — such as releasing portions of the software as open source and posting many hours of videos documenting the configuration and tabulation steps — Estonia’s system fails to provide compelling proof that election outcomes are correct. Critical steps occur off camera, and potentially vulnerable portions of the software are not available for public inspection.
are not immune to attack either. Unless you go to the extraordinary lengths of making your own hardware in a facility you secure and keep secured for the duration of your democracy, there is no such thing as a 'secure device'. Not when the prize is something so hugely lucrative and advantageous as control over an entire country.
All assuming you trust your government. With opposition parties monitoring vote counts, that's easy. But what about when they have to look for dopant-level chip defects?
This feels safe, and as they have the original paper, they can revote - but they have all the ones in the district in a box somehow.
It is not without reason that most common fraud here in Sweden (around 80%) is someone calling under false pretense asking a victim to use the hardware token in order for the fraudsters to create a new electronic id which is then used to empty the bank account, create credit accounts, and so on. So far those security tokens has had a perfect track record from a hardware perspective, as much good that does. Maybe that is a bomb waiting to explode but it is hard to see a stronger incentives for criminals than what already exist.
When people here discuss electronic voting, security of the hardware tokens is not usually brought up. It is rather all the other elements which makes it a bad choice. There would be no physical ballots that can be verified, questionable anonymity, and a loss of a controlled voting environment. All the common solutions to those problems usually results in the conclusion that it then easier to just keep the current system as is.
"The authority might just lie about the count or throw away or counterfeit votes, or coerce voters other vote a certain way" is not solved by paper voting either, as seen in Russia and many other places.
My main criticism is that as it is it could still feed the card with the wrong vote to sign. The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button.
With these modifications, and the ability to check a cast vote has been received, you can have secure elections on insecure devices.
However it requires trust in the officials to do their jobs correctly and to not tamper the tally.
I, personally, love a lot of e-Estonia initiatives, but consider electronic voting to be a bad idea, unless you are ready to get rid of the anonymity of the vote (you can have secure non-anonymous remote voting)