Basically every adult Dane is mailed a vote-card that you can trade in for a ballot at your local voting place each election. Traditionally you took this paper and got crossed off in a big book, something which created hour long queues at prime times. So we added a bar code to your vote-card, and now we scan it when you arrive.
The interesting bit about this though, is that it’s way more expensive to do things this way because public IT-systems are just damn expensive. Which leads me to your point on “why would you do it”, and I agree, it just doesn’t make sense to digitise elections.
It doesn’t really make them easier to handle. We have to train people on how to setup and use the system, each time. We also have to set up the equipment and the backup equipment. Basically we spend a few thousand hours extra in preparation for each election, so not only is the software/hardware expensive, we actually use more man hours. You could reduce some of that by digitising the vote counting of course, but when we did the math it wouldn’t save us more than we spend.
So there is no financial reason to digitise elections.
We knew this when we decided to digitise part of our election btw, but because we’re the public sector and not a business, well, financial reasons aren’t the only reason we operate. Citizen satisfaction is a major one, and that’s exactly what we get by lowering the queues from a few hours to 10 minutes max.
But what is there to gain by digitising the counting? Getting results at 8pm instead of later during the night? Maybe if it was risk free, but since digital elections are the opposite, there is just no reason.
I guess if you let people vote online like Estonia, but we wouldn’t consider that to be a democratic process.
For some background. In Germany I voted in big cities, medium cities, tiny villages. Big elections and small. I never ever had to wait more than 5 minutes, I don't actually remember ever having had any experience that equated to 'waiting' as you would in a supermarket queue etc. I made some smalltalk with the election helpers sometimes but that's about it. I also never heard anybody ever mentioning waiting time when voting.
Basically voting happens on a Sunday. You get your morning breakfast. You decide to go on a walk with your family either in the morning or afternoon and stroll towards the voting place with your voter registration card and passport. You get the ballot. They strike your name from the list. You vote. You go home.
As for electronic voting. As a software developer I say it makes absolutely no sense whatsoever at all. It is already risky to tabulate the final data in software and forward this electronically. It would be better if it was phoned upwards and the written document then signed, sealed and sent afterwards for verification.
It's such a problematic process on many levels, and it's incredible how many things can go wrong. Things you cannot even imagine: like finger traces on the touch screen. We just observed an increase of risks, without an increase in benefits. For extra safety, our machine produced a paper trace to every vote as well, but it's just not worth it...
Paper and pencils are still the best technology for elections.
And ofc voting at home, by mail or electronically, like in Switzerland or Estonia, is not democratic enough for me. To make it democratic, you have to be alone in a safe space with maximum privacy: a ballot box. You should not be pressured by family or anyone.
I know for sure that in Switzerland (I lived there), in many households, ballot box of the wife are often ticked by the man, and that's nonsense.
Also see https://www.newlyswissed.com/die-gottliche-ordnung-film-revi...
Advised as in stomped in hard with both boots if the canton didn't get its act together, pronto!
To make all this work the paper and electronic trail is digitally signed with something that's only on your voting card.
This is a real problem! The secret vote isn't just about making sure that you can choose privately, but also about making sure that other people don't have ways of coercing you into certain choices.
Consider the simplest case, a binary choice. The system tells you (and only you, and only once and without tangible record) that the public copy will either be inverted or not, a one bit one time pad. Kind of feasible, but already hard enough: will you really assume tampering when the bit that makes the public record match your vote does not match your memory? Then imagine scaling to something more meaningful than a binary vote, even just to more than one binary. I can't see that actually working out.
They are given two random words. One for candidate A, one for candidate B.
They are told they should remember the code-word matching their choice if they later want to scan the printed out QR code (or enter their vote uuid) to one of the validator websites.
Voter makes their choice, completes the process. A thermal printout is printed with their vote uuid and a QR code meant to make it easy to input it.
Now anyone can get that printout with the uuid and scan it and see the code-word representing the voter's selection. However the association is only known to the voter and if asked, the voter can say that's what it was.
never said it's easy, but it is possible.
I've been thinking for a while that it would be nice to have paper ballots with the ability to cryptographically verify the inclusion of your vote in totals all the way up (ballot collection box, polling location, district, city, county, state, nation).
So the Australian Senate is currently vulnerable to vote buying, for what it's worth.
https://www.zdnet.com/google-amp/article/us-voter-records-fr...
https://gizmodo.com/nearly-15-million-texas-voters-reportedl...
https://thestack.com/security/2016/04/25/93-4-million-mexica...
So much for such an important feature.
I’m not sure if there’s a way around that, but it would be awesome to be able to absolutely prove all votes were correctly counted.
At every step of this way, if there is software involved it becomes instantly easier and less risky to influence. Whether it is online voting, voting machines, vote counting software, tabulation software, emailing results upwards etc.
> [...] my expert says your expert is wrong and so it is/isn't fraud.
Or how about all the issues over running out of paper ballots, long lines, etc. With electronic voting you could have everyone pre-enter their vote electronically & just "drop" it off by scanning their phone & getting a printed receipt they can use to confirm their vote was recorded correctly cryptographically.
It is possible to actually design secure electoral systems that actually protect the integrity of the election better (better anonymity, better traceability, better auditing, less error, more accessibility, etc, etc, etc). Convenience is also important; there are even ways you can potentially design the system to run on semi-trusted hardware which means lower cost & more polling stations, easier access etc. This rhetorical argument of making fun of the idea as "we can wait a couple of days for the results" completely ignores the actual advantages of such a system. It also completely ignores that a paper trail isn't mutually exclusive from electronic voting.
The challenge is in making sure the process for creating these systems isn't corrupted, especially by technologically illiterate legislative leaders who don't seem to place any of the most basic protections that experts recommend. They also don't have the balls to hold the voting companies to task for designing secure systems; somehow it's a non-issue for the same companies to do the obviously right things when it comes to their other customers (banks).
I think the misunderstanding on your part may have been similar meaning I'm advocating for entirely electronic.
To me electronic voting means a machine generating your ballot which avoids spoilage like hanging chads, incorrectly filled out ballots, etc (paper ballots should also be an option). Electronic voting means using counting machines to tabulate everything quickly while creating & retaining a paper trail for auditing. This is literally what Schneier is talking about: merging the advantages of both to mitigate the disadvantages of either.
...if you assume the least useful interpretation of the comment. Could having a real physical object to examine be useful?
The paper as a "backup" is worse than backwards, it's an excuse to implement electronic voting, and since there is "no evidence" of problems, why would you need to examine the paper anyway?
Also, I think you're misunderstanding. The "no evidence" conclusion comes from auditing the paper ballot (as Schneier points out in that blog post above). You don't get to say "no evidence of problems" until the electronic & paper ballot agree. If there's disagreement you don't know which method is right & thus you have to hold a new election.
Then just use paper.
Recounts (which is what your suggestion will get called in practice) require legal maneuvers which are fought by the winning side. Adding a electronic component to voting will never lower it's complexity.
I don't know if it is the consensus opinion among experts, but it certainly wasn't the opinion Schneier expressed in that article.
Granted, he had strong words to say about the voting machines used in the US. And justifiably so. They are just plain horrible, they've been known to be horrible for years if not decades now and I find it hard to understand why the most sophisticated and wealthy places on the planet continue to use them. Particularly as we have known how to do it right for almost as long as they have been in use.
To Schneier's credit he does explain how electronic voting can be done securely in the article. Which makes your comment all the more puzzling.
That might be an understandable opinion if it is accepted as a conscious trade-off, but if you pretend that it will never happen you are just lying to yourself.
Everyone understands paper in ballot boxes, and how they can be cheated, what to look for. Everyone can assess an argument as to whether this happened based on the evidence presented.
Basically nobody would understand what to even look for in cheating the electronic system. It would be totally my expert says your expert is wrong and so it is/isn't fraud. Having even the possibility of that argument for electoral fraud is completely insane.
It doesn't just have to be fair, it has to be seen to be fair. Really it does. We need to have reason to have faith in our democratic processes most especially when the people you want to win, don't and the result surprises you.
The sooner we get to "Any electronic voting must be used to mark a standard paper ballot which becomes the entire source of truth." The better. Everything else in electronic voting is dangerous, sinister and flat out evil. Oppose it. Loudly. At every opportunity. Especially if you're known as someone who understands computers on some level.