I don't understand


Why not design some voting system based on internet so that people can use computer everywhere with secure network to vote?

And why keep those systems, hardwares or softwares, in secret? Why not opening everything to public so that everyone can check its correctness and security?

reply

I think it is a bad idea because there would be no way to prove the person voting is the registered voter.

Junior could have opened Mom's mail and logged on to the net and cast her vote.

reply

Then find some way to prove it. Technology is advanced enough to improve politics and democracy now. And you really believe people can't design a system to prevent impostors? Is this a tougher project than landing on the moon?

reply

The problems are considerable, especially w/o a central ID system (which has its own problems), and w/o some kind of security system on every home computer (card readers, or sophisticated digital signature/encryption SW that too few people know how to use properly). And the possibilities for fraud are considerable.

With current technology, and with little additional resources, I think that it would be possible to have a hybrid system that would have more convenience than most (if not all) current voting systems, and that would also add considerable oversight/audit:
* Have Open Source software available on the internet. Promote multiple implementations that audit each other based on an open standard for ballot storage.
* Fill out your ballot at home, on your own computer, and save your votes to a memory card (a USB stick), pretty much use it as an e-Ballot. You could do this months or weeks before the election, and review your ballot in detail (ie, pretty much, as you decide on each candidate/issue). Your voter registration card -if equiped with a memory chip- could be used as an e-Ballot, but you'd need a special reader/writer at home -which is a problem- or there would have to be some investment to equip voter registration cards with a USB interface. Using USB sticks would probably be the best way to go, since they're pretty much everywhere (it would also make it more transparent). If you don't have a computer at home, you would go to your voting place, and fill out your ballot there, and save it to a USB stick (either provided by you, or provided to you by the County).
* Take your e-Ballot to a voting place (where you have to properly identify yourself as a registered voter), read it on a voting computer, review it on screen (as interpreted by a certified version of the SW), and then submit it for counting. Since there is little input being done, and you already made your selections at home, data entry issues and errors would be minimized.
* The voting computer would save a digitally signed version of your e-Ballot to your memory stick (which wouldn't contain any personally identifiable information) and to non-volatile own memory (hard drive, or network, memory card, etc).
* You would take your memory stick home, where you can review your cast ballot, and you can upload it to auditing and polling web sites (there would be little to no personally identifiable information collected -ultimately, just your IP address, which could be anonymized). You'd be encouraged to upload it to as many third parties as you could.
* Uploaded ballots could be randomly compared versus the ballots collected from the voting machines by certified authorities, and could also be used by third parties to independently tally the votes, and generate projections.
* Ballots would be centrally tallied, and audited against uploaded ballots.

The main hurdles are:
* Agree on standards that include computer generated IDs for elections, ballots, and machines. It would also require agreement on digital signatures for both voting machines, and individual ballots and never include personally identifiable information.
* Technology resistance
* A USB stick per individual, which could the common stick, and even end-user provided.
* A convention for storage on the USB stick would also beee needed, probably an XML database that would include multiple ballots for different elections (including a voting ID), in order to shield voters from the "complexity" of a file system.
* Apathy and lack of technology knowledge

At the end of the process, there are at least 2 copies of every ballot. A copy that was left on the voting machine, that will be sent back to a central election authority for counting, and the signed copy you took in your memory stick.

By using digital signatures, and comparing ballots after the election, you can detect tampering. If differences are encountered in a considerable number of e-Ballots collected online differ from e-Ballots collected from the voting machines (ie, the differences can't be explained as data corruption), then the election authority could invalidate the election. This would allow to have an automatic recount of a large percentage of the votes: no need to have the candidates call for a recount, since it takes few resources to count all of the votes as many times as needed (almost instantaneously).

The voting machines don't have to have inordinate levels of security, and even if they were hacked, there is a trail that would allow to detect systemic fraud. Furthermore, the could be 2 types of machines, some that are used to just review your e-Ballot (that you filled at home), so you can move on quickly, and some that have a more sophisticated user interface, to allow data input at the voting place. One of the weakest links in current e-voting machines is the need to have a friendly user interface w/o a keyboard (a touch screen). If you were to reduce requiring this technology (by allowing you to fill yout ballot at home), it would reduce the number of glitches, and speed up the voting process.

By using a memory stick instead of paper, you avoid the technical issues and costs of printing, while retaining a secure trail. Technically, it's considerable better than a paper record, since more third parties could participate in the election audit, and the process could be highly automated (again, while being very secure and accurate).

By using open source software, and a standard ballot data format, you ensure transparency, and avoid any kind of mis-representation in the user interface (as shown in the film, that you press one button, and end up voting for someone else).

The most important element is the voter, as it should be, and it depends on people to verify the election ballot by ballot (everybody participates in a "virtual recount"). People need to be whiling to review their ballot 3 times: once when they are filling it out at home, once when they submit it at the voting place, and once again back at home before uploading it to third parties. Since all 3 reviews are done using different (and open) SW applications and different computers, it would be very difficult for someone to make you think you voted for someone, while you actually voted for somebody else under the hood. And by being able to tally the votes from the digital ballots collected online (which doesn't have to include the complete population), and from their copies stored on the voting machines, you also protect against fraud at the central computers.

The main weakness I've found in this system is that it is susceptible to voter intimidation and bribery, since your ballot is not necesarily secret (http://en.wikipedia.org/wiki/Secret_ballot): you always have it with you, it's up to you to keep it secret. Someone could coerce you to vote in a given manner, and then confirm if you did it by having you bring them your e-Ballot after it's been cast. A possible counter-measure would be to avail voters with "fake" e-Ballot generators, where you could fill out a ballot, and have it signed as cast with an invalid machine signature (valid machine signatures would only be known to election officials and certified third parties). While this e-Ballot would be indiscernible from a real one, it wouldn't be valid (would be flagged in a tally process), and a bully wouldn't be able to tell otherwise (unless the central machine key list had been compromised, but in this case, you probably have a bigger problem than coercion). This countermeasure would also require that machines are able to sign using a large set of keys chosen randomly, so the fraudlent party is not able to infer a list of keys by sampling multiple ballots from the same voting place.

reply