It would be pseudo-anonymous like Bitcoin. You would keep the mapping between public keys and real-world identities private. But perhaps some percentage of people would choose to waive their right to privacy, further strengthening trust in the system. Statistically, the public voters should be in line with the final outcome.

> But perhaps some percentage of people would choose to waive their right to privacy, further strengthening trust in the system.

This has the same problem. Didn't waive your right to privacy and provably vote for the right candidate - you're fired (or worse). That's why taking photos of a ballot isn't allowed, you can't have any way to show who you voted for.

Re: employer, you can just make this illegal and let the police deal with it. Your boss can probably get in trouble with HR for even asking who you voted for (as it provides fodder for a later discrimination lawsuit), though you're free to volunteer that information.

However, your "or worse" note still applies. E.g. a local gang could do the same thing, and they are unlikely to be stymied by illegality.

Huh? If you're asked to waive your right by your employer, I'm pretty sure you can get them in trouble by going to the media and make a fuss about it. This is a silly hypothesis.

I don't know if this is true. Assuming this is an established practice by large companies, there would also be a cultural notion (by managers agreeing with the sentiment, CEOs, famous executives espousing it) that hiding your voting patterns means you are voting for the "wrong people". Plus, by going to the media, you'll be permanently known to any future employer as a rat on your company's practices. While this is good for society it has personal consequences to you.

It's no different from an evil employer who forces their employees to vote and send a picture of their ballot today. Sure, taking a photo of a ballot is illegal, but that's not going to prevent it from happening when you're behind that little curtain. Coercing people to vote for your guy is illegal in both scenarios and you can and will get in trouble if you try and pull that stunt at any significant scale.

When you vote on a paper ballot, you are entitled to request a new sheet of paper if you've messed up a vote. In effect, this would allow you to take a picture of one ballot, toss it, and get another.

So, yes, it is quite different - an employer has no way to validate that an employee has voted a specific way. Any proof is not indicative of the final vote, unlike the proposed Blockchain solution.

But what if our elections are rigged and we don't know it? Is it worth risking a faked election as long as we all feel good about it?

As someone else in the thread pointed out, we already know of a better solution: paper. Any other solution so far turns out to be either convoluted and/or not as good.

Somewhat related, it reminds me of this anecdote about hand-warming handlebars on bikes: http://thedailywtf.com/articles/The_Complicator_0x27_s_Glove...

The problem with paper is that it's too easy to remove and replace the ballots you don't like.

Being physical, you would physically have to remove the previous vote first. This would require some combination of a chemical process, color matching, and/or glue piecing back on.

This all takes time, tight tolerances, and automation to a happen at an impactful scale, which minimal oversight would mostly prevent.

Compare this to an SQL statement to change a whole states worth of votes in a few hundred milliseconds.

You can always recount the paper.

Whatever solution, it require the limitation of involving something physical and difficult to manipulate.

Not really. Best practices in the field involve having representatives from many to all parties present at each step of the voting process, from the distribution of ballots at the booth, to the counting, to the archiving of counted boxes pending recounts.

In Washington State, photographs of each ballot are taken as the ballot is removed from the envelope and after it has been electronically tabulated. This prevents someone from replacing a paper ballot along the way.

Good thing photos can't be deleted. Oh wait.

Photos can be deleted. It would be detected and then law enforcement would or would not do anything.

A blockchain voting system would enable us to detect vote tampering, and then law enforcement would or would not do something about it.

What's the difference?

IMO, 99% of the people wont understand a blockchain system. To them it will just be "X won because a computer said so". So the question is do we want society to be filled with people thinking "I know those votes were made with pen on paper and were counted by my neighbors and trusted friends" or do we want society filled with people who think "it must be true because a computer said so"?

Not across thousands of voting places.

All states allow absentee voting, so...

Mail in voting is a problem. It's too easy to game.

No, it’s not.

It’s easy to tamper with one ballot, but the level of coordination required to tamper with a large number of them quickly enough trends into the impossible category. Especially if you’re trying to keep such an operation a secret.

You don't need to tamper with them.

It’s hard to destroy a large amount of them and get away with it too for the exact same reasons.

You don't need to destroy a large amount.

So we shouldn't attempt anything that could be overridden by illegal activities by employers?

We shouldn't attempt anything that'd make their illegal behaviour easier.

Like mandatory armbands for your religion, a public record of your voting activities is a terrible and dangerous idea.

You could say the same thing about tax returns, credit reports, Facebook accounts, medical records, etc. For all these things an employer would benefit by coercing an employee to provide them to the employer. But the risk is worth the reward, so we still have these things. Why is a semi-anonymous voting database any different? I could think of some easy mitigations to your concerns with almost no thought. Make it so that only those who's vote hashes end in a certain number get their private key, so you have plausible deniability. Say 10%. A sample of that size should be enough to verify the vote.

If your employer uses medical records to disqualify you from a position or terminate your employment, get a lawyer because you have a case.

None of those things you mention should be something employers can act on. In many states it would be illegal to factor those things into decisions about hiring, retention, compensation or promotion.

Call centers get entire lists of registered votes (or what they last were registered as) when targeting for polls.

Now they do not come with who the individual voted for which is probably how they get around this.

So many times when you would call someone and say, "Records show you are a registered as a democrat/republican, is that correct?"

Rebuttal, "How do you know what I'm registered as isn't that illegal?"

Candid response, "Knowing who you voted for is illegal, I do not have that information, however your registered party is public information and any questions about who you voted for you can refuse."

Most of the time they didn't like that and hung up but meh throws arms up in the air not caring

If it’s even possible to waive anonymity, people will try to entice or coerce others to vote in a certain way, and require they prove it. That’s why taking a picture of your ballot is illegal in the US.

This isn’t just a theoretical concern - there are various real-life allegations of it happening, in Southeastern Europe and other places.

Meh, the concern of the integrity of the election itself is a thousand or a million times more pressing than the concern about somebody trying to coerce somebody.

Plus such coercion isn't impossible now, like you said it can be done with a camera. Presumably if you're being coerced by threat the "illegal" doesn't really help you at all.

It seems obscene to me to pass up such an obvious improvement like a verifiable record over such a theoretical concern.

>Meh, the concern of the integrity of the election itself is a thousand or a million times more pressing than the concern about somebody trying to coerce somebody.

1) Coercion is literally the biggest concern within elections. You put a big guy with a pair of brass knuckles outside of the polling location and he beats up everyone who comes out without a picture of his ballot with the right vote in place.

Theoretical? Lol. This WAS and IS common. This is why we have international election observers.

2) There's no integrity loss with paper if things are done right. Every ballot given out at a voting booth is recorded - you can't stuff the box as a voter. The only way you can do so is if election officials from all parties collude to fudge the books together, which they would need to do in view of the public as they man the voting desks, or under the supervision of the locale manager during the end-of-night count.

You know what else is verifiable?

Paper.

For the record, I far prefer paper ballots over closed-source digital voting.

I don't have such faith in blockchain anonymity. Data will leak.

See the paper "Backpage and Bitcoin: Uncovering Human Traffickers" which talks about using timing based reconciliation, relationships between wallets, and superficial metadata within Bitcoin to deanonymize human traffickers:

http://www.sysnet.ucsd.edu/sysnet/miscpapers/backcoin-kdd17....

There’s no reason to have identifying information at all. That would be handled at the voting location just like it is now.

Blockchain voting doesn’t mean you can then vote over the Internet — you’d just have a better type of system in place at the voting locations.

Incrementalism is powerful.

The problem with blockchains in this situation is that your security has to be perfect forever. If anyone figures out a way to de-anonymize votes, they get all of them due to the public and append only nature of blockchain systems.

I suppose every election they could randomly distribute voter ids that are unique to that election? Ie, pull an I'd from a hat at the polling station then use it and keep it for verification?

Edit: undo auto'correct'

Because now you can prove to anybody which way you voted, opening yourself to blackmail, bribery, or duress. The secrecy of the vote is crucial to its integrity.

Maybe you could move things down the chain: make it illegal for any entity (with perhaps some exceptions for anonymity compliant polling) to ask for voting proof, with very significant felony punishments (large organizational fines, jailtime for individuals).

Or you can just use a voting system where producing proof is non-trivial, like paper ballots.

You may not want to sell your vote, but others will. And the mere suspicion that other people can sell their votes erodes trust in the system, making it useless for a democracy.

Criminals don't follow laws. Plenty of things are felonies, they still happen, often.

"The secrecy of the vote is crucial to its integrity."

Secrecy is also what makes it possible to stuff the ballot box with fake votes.

And multiple independent observers watching the process can make that pretty hard to do at significant scale.

Can we just not blockchain voting and move on to other things?

Thanks.

> Statistically, the public voters should be in line with the final outcome.

Not likely. Social stigma means the "acceptable" candidate would have a larger proportion of the public votes than total votes. For example, the Democrat candidate in Chicago.

The votes can be public but that doesn’t mean the data needs to include information that identifies the voter.

then what's the point? can you list a single use case that would make sense with this idea?

Yes. Voting. That’s how voting works. You go to the polling place, you confirm your identity with one person, then you go to another person to get the ballot. There is no linkage between your ballot and your identity, as they are done in separate and independent steps.

But people can always take a photo, it's illegal, but so is buying votes.

The voting system sends out postcards to registered voters with a temper-evident scratch-off covering, over a private key.

This key can be used with a personal computer, or public voting computer, each using the same open-source, audited software, to produce a printed ballot with a 2D barcode on it, and a printed voting token with a 2D barcode on it.

The ballot printout can be scanned and verified independently, before casting it, that all the choices are correct. Again, all using the same open-source, audited software as the public vote-recording computers. This printout contains a hash of the voting token. This is so a party can't just print out a bunch of pre-filled ballots, and then hand them out for voters to cast, and also useful for recounts and audits.

A separate printout encodes the voting token. It cryptographically verifies that a registered voter is voting now. The voter registration system associates a different hash of the voting token, a voter hash, with the voter. The voting system can associate the ballot hash of the voting token with the voting choices. If you have a voting token, you can compute the voter hash, look up the registered voter on the voter site, compute the ballot hash, and look up what their votes were on the vote-counting site. You can't tell whether that particular ballot is the one that counts for that voter.

Because up until the end of the election, the voter can also request a new token, which invalidates their previous ballot, and cast a new one. That token will also be associated with their votes and their name, but the official election system knows to count that one, and not another one. Or they can request a "provisional", "test", or "decoy" token, which can be used to cast a ballot that will never be counted.

Anyone that attempts to coerce a voter into voting a particular way, or who tries to pay for votes, can be given a genuine token that is later cancelled, or a dummy token that was never valid to begin with. They have no means of validating if the token represents a vote that counts until after the election is over. At that time, an audit or recount might show that it was a decoy vote. You can't work backwards from a ballot to see who cast it. You can't work backwards from a public voter registration to see how they voted in any election. You can only start from the set of tokens, verify that one belongs to a registered voter, verify that it was used to cast a ballot, and if you also have privileged access to the voter registration system, determine whether or not that token is the single authoritative voting token for that voter in the current election.

In a recount or audit, the voter registration authority consults its database, finds all the tokens valid for a given election, computes the ballot hashes for each, and prints out all the ballot hashes, including machine-readable barcodes. A sorting machine could be loaded with the list, and automatically spit out a pile of ballots to be counted, and a pile of ballots that don't count. Or a human could sort them by hand, by consulting the list of valid ballot hashes, and crossing out the one printed on the ballot they are looking at. Any ballot not on the list, or already crossed off of it, goes in the "don't count" pile. Then, once again, by machine or by human, the ballots in the "valid" pile can be independently counted for the office or issue in question, and compared against the original automated count.

The secret part of this voting system is the secret kept between the voter and the government with respect to "does this specific ballot count or not?".

Fantastic.

Now explain how that works to non-programmers. You may not hand-wave, you may not ask them to trust a black box, and they must truly understand and trust your system.

And then you can compare that explanation to the explanation for paper ballots, envelopes, and voting urns.

The public's trust in a voting system is a very important feature of that voting system. That the public can participate in voting is also a very important feature. If voting is relegated to a black box that everyone should trust, because, pinky promise, a very clever person designed the black box, then people will stop trusting voting.

Well said. I like to remember that our highest goal is not to count votes correctly, but to build a stable society where we can be safe and happy.

I believe a foolproof computer system could count votes perfectly, but it may make our society less stable in the process. Our current population is not ready to understand a fancy computer voting system, and are not capable of distinguishing between a foolproof system and `print "I win!"`.

You are requesting new requirements that are not part of the voting system currently in use.

I currently have to trust a black box whose inner functions are hand-waved away such that I cannot understand it even if I wanted to. Established systems of voting have equally established attack vectors.

If someone cannot understand what a cryptographic hash function does, even if they don't need to understand how, they cannot function in civil society without trusting someone else who can. Someone might go to a hundred HTTPS sites a day, and the security works invisibly to them, with no complaints, and yet while voting once every two years, one of the simplest concepts in all of cryptography is suddenly a problem? It's simpler than Bitcoin. The public can handle it.

> You are requesting new requirements that are not part of the voting system currently in use.

They are absolutely part of the voting system currently in use.

I strongly suggest that you follow tptacek's advice in the top comment and volunteer as an election worker a couple of times so you get a feel for how the process actually works.

> Someone might go to a hundred HTTPS sites a day, and the security works invisibly to them

Most people have no idea why or how that is more secure than HTTP, they can't tell the difference, they don't need to know the difference. But the biggest difference is that in online banking or whatever, there are humans who can check if something's gone wrong, if your account has been hacked, you can call your bank and ask them what happened, and you can usually trust them to know what's going on and what went wrong, and you'll get your money back. Or not, and then you can sue them. Either way, it's fixable.

Voting has no authority that can fix things if something went wrong. The voters are the authority, which means that all the voters need to understand and trust the entire system for it to be authoritative.

You have suggested that I don't know how my voting process "actually works", and that I cannot know that without volunteering to help run an election. I do not agree with your premises. Furthermore, that's an ad hominem argument.

The black box I am referring to specifically is the optical scan vote tabulator machine that sits between me and the ballot box, in my current polling place. I have seen it multiple times, and examined it to the extent that I am able. When I lived elsewhere, there were different machines. Every one of them has been a black box to the voting public.

I very explicitly do not trust those machines, because I know how the grey boxes that build the black boxes typically work. The publicly available information about them does not inspire trust. They are defective by design, and stink of corruption.

Some places do have trustworthy elections, using publicly-observable hand-counted paper ballots, like in Minnesota; or slightly less trustworthy vote-by-mail for everyone, like in Oregon. Good for them. I have never voted in those places. Bad for me.

And voting does have an authority that can "fix" things. It's usually the secretary of state for the state, then the supreme courts for that state and for the US. I remember when the SCotUS threw the PotUS election to GW Bush by interfering in Florida's lawful elections process. They didn't back up the voters' authority in that instance. I have felt the frustration of statewide elections where I had a sense that someone was dicking with the results, and there was nothing I could do about it without putting so much effort in that I'd be turning elections activism into an expensive, thankless hobby.

I have zero trust in the current US elections process, and never believed that my vote actually counted for anything. I honestly don't know why I keep voting--gesture of defiance, maybe. I think the voting systems in every place I have voted have all been broken, from the enabling legislation all the way down to local procedures at the polling place. First-past-the-post is broken mathematically. Ballot access laws are cheating. Gerrymandered district boundaries are cheating. Restricted primary voting is cheating.

I can't do anything to fix the systemic flaws without spending 20 years becoming the controlling authority of a single-issue political bloc and fundraising it all the way to actual significance, but encryption math and open, publicly-auditable software is a lot less work, and could still help with the local procedures. Of course, we'd also need a trustworthy compiler that can produce bitwise-identical binaries of different machines, and a trustworthy computer to run the compiler on, and some way for the public to verify that the software running during the election is the same software that was compiled at the public ceremony. And then also assume that an attack on integrity might still succeed, and proceed under the assumption that the system is compromised, whether by intentional act or accidental mistake, by auditing the final results in a non-predictable way.

Buuuuuut... it's not really my job to restore trust in the system. That's up to the ones profiting from it. I have named a system that I, personally, could possibly trust. But it will probably not be adopted, because the trust comes from the tamper-resistance, and elections tampering is a feature desired by those currently holding elected office. In my estimation, voting in the US won't be fixed within the next 5 years, because there is currently profit to be taken by keeping it broken.

This is already a theoretical risk with vote-by-mail systems, and in practice it is Not a Problem.

Oregon has had vote-by-mail for more than two decades; there are present-day voters who were born after Oregon dropped polling places entirely.

Vote coercion is not a concern, after 20 years of practical experience with the system. Neither is voter fraud (something like 54 fraudulent ballots cast, out of 2+ million, in 2016; the vast majority of those were people voting in Oregon and in another state.)

The benefit, however, comes in the form of increased turnout; no need to rush to a polling place on a day that's very likely not a holiday for you.

I wish everyone would switch to vote-by-mail the way Oregon does it.