Any voting system with a public ledger where you can later check your vote is a disaster for election integrity. It's probably surprising, and certainly counter-intuitive, but that's a vector for fraud.
That's why we have a long history of secret ballots. And no cameras in the voting booth.
From a comment a few weeks ago (https://news.ycombinator.com/item?id=25739051):
> you could look up your own vote and the votes of your friends to confirm
You can't do that because visibility causes voting fraud.
By coercion. If votes can be checked by other people, a very large number of people (enough to change the result) will be forced under threat by someone else to "vote correctly".
The same happens if you can check your own vote, because any mechanism that lets you do that can usually be used by someone else - "give me your phone so I can check you voted for X like I told you to" (while holding a gun).
That's why free & fair elections have secret ballots, without personal identification on the ballots. To prevent coercion fraud.
Second, coercion has been rolled out as an excuse to disenfranchise voters for ages with no evidence that it's a real threat in the modern era. I live in Oregon, which has been doing mail in voting since the 70s. People argue all the time that mail in voting will lead to coercion, but it has literally never happened in Oregon.
Also, voter rolls are public information. I like collecting data, so I have voter rolls of most states, which often allows me to look up name, home address, phone number, and registered party of anyone who is registered to vote. A lot of states even have parts of voting history publicly available. It's super easy for any employer to figure out what party any employee is in, and exactly which candidates that they've donated money to, etc, yet coercion still isn't a thing.
If you look at the pure economics of coercion, it's pretty obvious why it isn't a thing. It just doesn't scale. Every person that gets added under a coercion scheme make it that much more likely that the person running the scheme is going to go to jail for the rest of their life. No one cares so much about politics that they're going to throw their life away for the potential of changing 5 or so votes.
Yes, no problem with that. But the GP was arguing that it's better if ballots are not secret. I think it's a common misconception that if only all votes were open they would be more democratic.
At a small scale, I've directly witnessed people who decided not to vote on issues where their vote could be figured out by others, saying they didn't want social consequences of being seen to disagree. I've also known people afraid to vote with their conscience due to reprisals, and I do mean afraid.
> Second, coercion has been rolled out as an excuse to disenfranchise voters for ages with no evidence that it's a real threat in the modern era.
Good point. For the record, I'm pro mail-in voting too, especially during a pandemic. I'm not impressed by those who sought to disenfranchise votes in the USA this time around by arguing that mail-in votes should not be counted after they have been cast in good faith.
The mechanisms we use to protect vote integrity are meant to be a "best we can do" while still allowing people a reasonable way to actually vote. As soon as people are prevented from voting in the name of "integrity", that's not democracy any more.
Mail-in voting fraud has been found to a notable amount in the UK, though not enough to swing a result. But it did not come from individual homes. It's important to have mechanisms in place to look for it, if only to evaluate that it's not happening to a significant degree. Monitoring mail-in vote integrity should be on the look out for where ballots are posted from, and whether there are collisions with multiple votes from the same persons. If 10,000 votes are detected postmarked from the same employer warehouse with the same handwriting, that's time to be suspicious. When it's from 10,000 individual homes, each marked in a different style, you can be much more confident nobody has the capacity to go around every household to make that happen.
However, back to the technical suggestion of a public verifiable vote. If 10,000 people vote privately and then someone they have a commercial relationship with asks for proof they voted a particular way before they get a discount or whatever, that swings it from "nobody can visit every household" back to "systematic pressure is realistic", and it's not democracy any more.
> It's super easy for any employer to figure out what party any employee is in, and exactly which candidates that they've donated money to, etc, yet coercion still isn't a thing.
If people choose to announce their party affiliation, that's something else. Nothing stops people choosing to broadcast how they voted either. That's fine.
However in both cases, people are free to vote differently in secret than whatever they are broadcasting or socially going along with.
Polling data suggests there are plenty of people who are reluctant to truthfully say how they vote, even when told the polling is confidential. I'm sure there are people who leave it implied among their social groups that they lean one way, when in private they actually vote another way.
You write: > If people choose to announce their party affiliation, that's something else.
In PA (as in most states) one's party affiliation is public by law. In PA it's important because one can only vote in the primary for the party one is registered as a member of. (Voters who do not register an affiliation or are affiliated with a third party simply aren't allowed to vote during the primary.) So it's not really a case of "choosing" to announce their affiliation.
Also, I know multiple individuals in my neighborhood who have confided in me that they registered as members of one party but preferred to vote for the other party. Why? Because (at least historically) our county has a long history of being run by a single party and (to quote my neighbor), "If you are a member of the wrong party your trash won't get picked up."
The secret ballot really DOES prevent certain abuses.
I agree, where affiliation with a party has greater meaning and consequences, and is practically required for access to ordinary local services, the secret ballot is even more important.
That neighbourhood is a great example.
I'm disappointed, really, that in 21st century USA those people are still disenfranchised by local politics from voting in the primary of the party they actually support. But presumably there are good reasons for legal registration.
Even with cameras in the voting booth, voters still have plausible deniability because they can spoil their marked ballot (that they may have photographed) and request a fresh blank one.
In-person paper voting is pretty much the best voting method we have in terms of privacy, usability, scrutability, and reliability.
Eg: We need to make a list of all his enablers before they delete their posts...
If so, why is it in the state's power to decree that we have to trust the politicians but not the 3rd parties?
They are to let you vote as you privately decide with safety from everyone who has an interest in the vote, whether that's third parties, your boss, insurance company, local mafia, etc., or the state.
The state's role, in a democracy, is to ensure state-level elections take place with the various ingredients that ensure it has high integrity. That requires a lot of things; a lot of resources, making sure everyone knows about it, making it clear the result will be respected by the state itself, acting as a coordination point with some kind of authority so that people will tend to respect that an election actually took place.
If you have a third party available who can do that, by all means go for it, but generally you don't have one, and if you did you would start calling it the state.
However, in a democracy the electoral process should be administered as separately as possible from the politicians of the day. Politicians of the day should not be getting much involved, other than to ensure it takes place with all the usual resources.
Note that "the state" and "the politicians" are not the same thing in a democracy. The state consists of multiple institutions, many of which do not particularly trust politicians either.
The people most directly involved in actually running it should demonstrate a commitment to the integrity of the election itself foremost, ahead of their personal political views. On the principle that democracy itself is more valuable than winning any particular election, while still being drawn fairly from a range of people. But they should be observed (without interference) at multiple levels by representatives of different political groups.
Making a combination of people, systems and motivations to achieve integrity is the art of institution building (and maintenance), an electoral commission or something like that. Its independence from politicians of the day is one of its key features.
Regardless of who runs it and who you trust, you still need secret ballots to ensure integrity of the result.
With a paper-based system, all you need to understand is that your paper goes into a box and someone counts it later on. Everyone understands every step, including the steps required to secure that box. But once you require people to understand blockchain you are putting the intregrity of the election in the hands of a privileged elite.
I would say, even worse, we would have to require people to TRUST a system that uses blockchain in addition to understanding it. The fact that in some thin layer of a gigantic inscrutable system there's a mathematically irrefutable "truth" does NOT make people feel better about it.
Trust is NOT a mathematical concept.
In any case for blockchain to ever take off in common usage, it's going to have to overcome its association with scammy cryptocurrency schemes. That's going to be a while!
That is something we do a lot of R&D on @Electis, along with the fine fellows from InfernoRed, Microsoft and others. Because the value of an election is the thrust that voters have in it!
It is part of what the homomorphic encryption protocol we use (electionguard) aims at solving. Your ballot is encrypted with a joint public key, and all the "artifacts" of the election are published after it closes. You can verify that your encrypted ballot is present in the artifacts, and that the whole artifacts archive verifies mathematically.
https://www.electionguard.vote/ https://electionguard-python.readthedocs.io/ https://www.electis.io/ https://electeez.com/
A secret ballot makes it impossible to verify votes even with collusion between the voter and interested party. That makes vote-purchasing infeasible, since I could take money to vote for you and still defect at the secret ballot box.
A cryptographically-secure secret ballot in this threat model would need to provide the voter with a valid zero-knowledge proof for their actual vote and an imposter zero-knowledge proof for their alternative vote. Something like "if I input A into the system, then it counted vote X; if I input B then it counted vote Y," with A/B remaining private to the voter.
However, that doesn't help unless you know that every vote was a legitimate and eligible vote. How do you know the votes are legitimate and eligible if the address is anonymous? You need some system to either publicly identify each address or you need a central authority saying which addresses are allowed to vote.
The latter goes right back to the situation we are in today and the blockchain becomes no more useful than a centralized database, because we are still reliant on the centralized authority to tell us how many valid votes mattered.
There is a new voting event, each citizen can now create a voting wallet using their Citizen Key then vote on the various motions by sending a transaction to a destination wallet created for this event.
At the end of the voting event, the votes are counted and no transaction can be send to the destination wallet.
You do have a central authority, it's the country (or state). Only citizens can vote, and only citizens have a valid set of keys.
The benefits is that anyone voting or people who want to verify the voting numbers can do, and without having to trust the software managing the database (I mean, you of course have to trust the blockchain itself...).
Make the whole system as hard as possible to manipulate by involving a lot of people who distrust the person they're working with.
There is a tiny chance your personal vote will get lost in all the paper handling, but you can be assured that the system is a lot harder to manipulate simply because of the sheer number of people involved.
If citizens can see exactly where their dollars go it could make corruption very difficult and lead citizens to be far more engaged in their democracies.
But the fact is, (almost) no one really cares. Many people want to believe they would care, but they don't really. Either way, knowing what's being spent where only makes corruption marginally more difficult. It certainly doesn't lead citizens to be any more engaged. We know this because what you want is already here and it has solved precisely nothing (IMO).
I personally think the engagement part would come instead from "My $5000 in tax went through the system and was eventually spent on a federal initiative I don't agree with" (or since it's all granular: "only $13 of that $5000 went to anything that benefits my community?"). No, I'm not saying that everyone will care, but I think that more people will care.
Yes a contractor could still charge $10k for a hammer, but citizens would uncover that almost immediately.
I'm generally opposed to software voting because I have a complete distrust for such systems, but a public ledger (preferably not based on proof of work, so not ethereum) has interesting characteristics. And the price or inefficiency isn't an issue in this context.
Edit: people commenting seem to misunderstand the proposition. I'm perfectly aware of the privacy around voting and not advocating against it. It should be possible to have a system where your vote is registered publicly as a transaction between your wallet and a "referendum" wallet, in that case unless you have a way to link the public identity of a wallet to an identity (meaning people would somehow leak their public address somewhere) you do not have a way to know my vote. The only thing you could know is the number of total votes and their choice. You can of course generate a new wallet per voting as a way to not have a history.
Edit 2: the plausibility deniability is a fair point, I concede.