back
511 comments
I live in an economy where people vote with pencils on paper in cardboard booths and at scalable cost, it just works. Obviously the cost also has to scale linearly for the 200+m voter economies, and time becomes a factor, but for community acceptance I still think paper and pen/pencil beats machine hands down.

(this is Australia. we have compulsory attendance at voting booths for eligible citizens, you can spoil your paper or walk away but we enforce with a fine, participation in the one obligation of citizenship)

-I have been offered voting remotely in elections for my home economy of the UK and I would have welcomed some kind of homomorphic encrypted, secured voting method, given I have done KYC with the UK government to get my pension paid, I don't see there is a problem with them knowing who I am online.

I therefore do not totally agree with the headline, but I'm willing to be convinced by the article, because comparing the land of hanging chad to my own, I think paper and pencil is just fine. BTW we have a senate election which demands ballot papers cut from A0 paper in long strips. Hundreds of boxes to be filled in. What we don't have is the vote for every judge, official, proposition on the table, we just elect representatives and senators, but we have a complex vote method. It just works. We do machine reading, but every single paper is reviewed by people, and parties have rights to monitor the vote, in secured spaces. We do not have a serious concern with the integrity of our vote, and the question is regularly asked and tested. (it's not just because we believe its secure and don't check)

Its a great list of signatories, includes people I respect. I would think that the prime question for americans is "how much worse or better than the current approach could this be?"

Where I live we vote by mail by filling in little bubbles with a pen. the counting is done by simple photoelectronic tabulators and there is a built-in, human readable record that can be checked by hand. It is very economical and hard to compromise at a scale that has any effect. i hate the idea of using internet voting. I also don’t trust the electronic voting booths where the whole action is virtual or the older mechanical systems with the chads. Just a pen and paper is sufficient.
The problem, as I understand it, is that if you can prove to yourself that your vote was counted right, you can also prove it to the guy with the sledgehammer next to you saying "it would be a shame if something happened to your family, so prove how you voted"...
> it just works

The biggest reason "it just works" is that the Australian Electoral Commission, the organisation that sets electoral boundaries and runs the election, is independent of the government. Other reasons are compulsory voting and preferential voting. In my mind, it is these three things that keep Australia's democracy relatively healthy.

Paper systems fail locally and noisily; internet systems fail silently and at scale
I've heard great things about the way that India votes.

It sounds like their Election Commission takes their job very seriously.

> it just works

And the pieces of paper with votes for the wrong candidates are easy to dispose of. See, for example, russia.

That seems common sense. It’s wild that this is an extremist position in the US now.
Australia really uses erasable pencil markings to vote?

I would feel much better if they required ink.

At this point the main problem here is one of trust either way. Most Americans, of any party affiliation, believe that one party’s officials are presiding over a vast conspiracy to steal every election. The Left thinks the GOP is intimidating real citizens who happen to be immigrants from voting by trying to pass laws for proof of identity, and the Right thinks Democrats are trucking in illegals to stuff the ballot box, or that some random voting machine company is systematically rigging every vote. All these positions are presented without evidence.

Then both parties think that if their party’s guy isn’t in charge of the election itself, that the vote counting itself is being faked. Of course, these concerns only ever come out when their preferred party loses.

Mix internet voting into this, and the average person’s utter cluelessness about computers, and no amount of fancy crypto, blockchain, etc. would ever convince any American that their party lost fair and square. “The new online voting system was rigged!”

The thing about paper ballots is that the ways to cheat with them are well-known ("finding" ballots in the trunk of a car, "losing" ballot boxes on the way to the counting center, counting the ballots behind locked doors with observers not present, and so on), and have been well known for centuries. So the counters to them (ballot boxes sealed with an official seal once full, only sealed ballot boxes will be opened and counted, neutral observers present at all times when ballot boxes are being transported and/or counted, and so on) are also well-known. If those anti-cheating counters are in place, that gives you quite a lot of trust in the results. And if observers get thrown out and then ballot counting continues behind closed doors, you can have a reasonable suspicion that cheating is going on, and can make a stink and demand a redo of the vote.

With Internet voting, the ways to cheat are not all that well-known among the general population, and even among an audience like HN I bet we couldn't come up with all the ways to cheat. (That's not a challenge!) So there's going to be fundamentally less trust in the election process than with paper ballots, even if the Internet-voting system was actually made completely secure. (And I'm not persuaded it can be made completely secure, given that secret ballots are a fundamental requirement of the process).

So yes, paper ballots are very much the way to go.

The most important feature of public elections is trust. Efficiency is one of the least important feature.

When we moved away from paper voting with public oversight of counting to electronic voting we significantly deteriorated trust, we made it significantly easier for a hostile government to fake votes, all for marginal improvements in efficiency which don't actually matter.

Moving to internet voting will further deteriorate the election process, and could move us to a place where we completely lose control and trust of the election process.

We should move back to paper voting.

I agree with the risks, the overall theme being it's much easier to potentially manipulate a million internet votes than physical. In other worlds, internet vote manipulation scales significantly more than physical.

But I could make the argument with any high trust internet system.

Let's take another high trust activity we do on the internet - banking. Internet banking gives a hacker the ability to steal millions while sitting across the world. This is the same argument the authors make about changing a million votes.

So it really comes down to the pros vs cons. That's the more important discussion imo.

Do the benefits of internet voting outweigh the cons?

>Malware on the voter’s phone (or computer) can transmit different votes than the voter selected and reviewed. Voters use a variety of devices (Android, iPhone, Windows, Mac) which are constantly being attacked by malware.

Yeah see this is where I thought this was going.

Phones can be insecure, but in aggregate they are secure enough for literally every other component of life to be conducted on them.

>Malware (or insiders) at the server can change votes. Internet servers are constantly being hacked from all over the world, often with serious results.

Again, great point. Accepting this point will the government erase all the private identifiable data it has collected on me from its systems? Probably not, because they have made a cost/benefit analysis that suggests the risk is middling compared to the reward.

>Malware at the county election office can change votes (in those systems where the internet ballots are printed in the county office for scanning). County election computers are not more secure than other government or commercial servers, which are regularly hacked with disastrous results.

This seems like a weird seppo thing.

Currently the risk of an election being seen as fraudulent is high, and the reward of online voting is low.

But we dont have to conceptualise the modern boring election when we look at online elections. We can look at alternative models, closer to real time use and other gains that tip things back in its favor.

Actually the biggest issue I see with online democracy is apathy and minimum quorum sizes.

To some extent, I think the cost of paper voting is almost a feature. It takes more work and effort to corrupt a paper voting system enough to change an electoral outcome, it helps more people gain familiarity with the electrical process and places an additional weight on the decisionmaking,
Voting is not a monolithic process. It's actually a combination of 3 things:

- How votes are cast

- How votes are counted

- How votes are custodied

In order for an election to be trusted, all three steps must be transparent and auditable.

Electronic voting makes all three steps almost absolutely opaque.

Here's how Mexico solves this. We may have many problems, but "people trust the vote count" is not one of them:

1. Everyone votes, on paper, in their local polling station. The polling station is manned by volunteers from the neighborhood, and all political parties have an observer at the station.

2. Once the polling station closes, votes are counted in the station, by the neighborhood volunteers, and the counts are observed by the political party observers.

3. Vote counts are then sent electronically to a central system. They are also written on paper and the paper is displayed outside the poll both for a week.

The central system does the total count, but the results from each poll station are downloadable (to verify that the net count matches), and every poll station's results are queryable (so any voter can compare the vote counts displayed on paper outside the station to the online results).

Because the counting is distributed, results are available night-of in most cases.

Elections like this can be gamed, but the gaming becomes an exercise in coercing people to vote counter to their preference, not "hacking" the system.

**

Edit: Some people are confused about what I mean by "coerced." Coerced in this case means "forced to vote in some way."

The typical way this is done is as follows:

- The "coercer" obtains a blank ballot (for example, by entering the ballot box and hiding the ballot away).

- The blank ballot is then filled out in some way outside the poll station.

- A person is given the pre-filled ballot and threatened to cast it, which they will prove by returning a blank ballot.

- Rinse and repeat.

This mode of cheating is called the "revolving door" for obvious reasons.

It’s not that it’s impossible - it’s that the established players are already questionable. And any new entry would require more than any simple company could provide. Heavy investment and collateral is required.

Our livelihoods are increasingly (almost entirely) digital and endure great efforts to abuse. But banking and/or retail operate on a different spectrum. For one they make money. The costs associated allowing their business online may never make sense for a non-profit based activity like voting.

Do we have any examples of internet activity as tempting to infiltrate/pervert that is secure and doesn’t extract value?

Anyways it seems greater damage will be done before we even reach a provably secure system. So paper/pencil voting would be better.

But fear not - even if we abolish voting machines we aren’t out of the hole just yet. We have good company with concepts like Citizens United as well as activities like sweepstakes that try to sway the populace to throw away a vote for a chance at a million. Illegal - sure - but that won’t stop the ostensible infinitely wealthy from enduring a slap on the wrist - or more appropriately a verbal reprimand (which is all that happened last time) for their part in electioneering. And if that didn’t work we have an onslaught of reAlIty and bots that poison our conversations in order to form our world views.

I’m jaded. I’m overly pessimistic. I’ll go now.

Mandatory Tom Scott video why electronic voting is a bad idea: Original: https://youtu.be/LkH2r-sNjQs?si=okd-iy_6JTRmmoqe Second part: https://youtu.be/w3_0x6oaDmI?si=EpS7SXd7Boe_1jn5
paper & pen has tremendous value as a recording mechanism. Although it's slower at counting and indexing, it is far better at reproducibility and durability:

* records last > 500 years with no electricity . corruption is obvious at first glance. ( bad records don't appear to be good).

* counting is easily distributed by number of workers

* readily visually inspected with no special tools . ideal for auditing

* records stay in order at rest.

* easy to detect & protect against tampering

* easy to train new users . CRUD tooling costs pennies per operator

* cheaper to scale writes & reads

TCO and risk-assessment for paper records exceeds digital on nearly every measure.

So my internet banking is secure for my funds, but internet voting is not for my vote. Right... OK, we got the message.
Hey all, coauthor here. Interesting to see it on Hacker News.

I'm a professor in Georgia Tech's CS dept that works on problems related to security, privacy, and public policy. (CV: https://mikespecter.com/)

Happy to answer any questions you all have.

If half the points here were true than internet banking and ecommerce would have already failed. Does the current system prevent fake votes? Did old banking and commerce prevent more fraud?

Here is the thing you are missing. With Internet voting we can have votes way more often. Limiting the damage caused by fraud. Yeah you could have malware on your phone that changes your inputs to a sandboxed voting app, and the malware also tracks your real votes so when you request an audit it shows you what you actually voted for. In reality that is extremely difficult to pull off over a long period of time.

I don't care about any of the names on the list, as far as I'm concerned they are missing the forest for the trees.

Estonians seem to have funny ideas on this. They're very VERY digital-forward.
>Voters should not be able to prove to anyone else how they voted – the technical term is “receipt-free” – otherwise an attacker could build an automated system of mass vote-buying via the internet. But receipt-free E2E-VIV systems are complicated and counterintuitive for people to use.

This can easily solved be done via letting people forge receipts. Then anyone can forge a vote to give to someone offering to buy them.

The receipt is in fact the best part of such systems as with paper voting it is impossible to verify if your ballot was counted or if it got "lost."

So where is the thought on mail in these days? It’s what we have in Washington and I rather like it.
> It’s difficult to make an E2E-VIV checking app that’s both trustworthy and receipt-free. The best solutions known allow checking only of votes that will be discarded, and casting of votes that haven’t been checked; this is highly counterintuitive for most voters!

Actually, Benaloh's challenge also does not offer receipt freeness. The adversarial strategy in such a model is to outsource the challenger itself in a hash function which decides whether to accept or discard the vote. It may look impractical at first, but one can build an app that could do that efficiently.

It can be said that all existing end-to-end verifiable remote e-voting systems compromise individual verifiability when reconciling it with receipt-freeness by introducing an assumption about the hardware-based protection of voters' secrets. If they leak or are predetermined by a corrupt vendor implementation, the malware on the voter's client can manipulate the vote at submission, and the adversary later fakes verification for the voter by exploiting that knowledge.

Still, I believe it's a solvable problem which needs more attention. Bingo evoting system is almost there, for instance, with verifiably random generated trackers, but needs a voting booth with a Bingo machine taken at home.

I believe the piece we're missing is the government (citizen?) service which issues (manages, replaces, revokes) constituents' cryptographic tokens for use with such things.

Then our voting systems could be electronic, secure, open, verifiable, and mostly private; assuming effective oversight / this organization does not issue fraudulent tokens or leak keys or identities (big assumption, but I don't think it's impossible.)

I live in Spain, and we have paper-based elections. Similar to what I've read from other comments, in our system, people are randomly selected to participate in oversight and counting. Different actors in the elections are able to oversee the process and count. Counts are performed by the randomly selected people and sent to headquarters from the site itself. Then, each ballot box count is available for display right after the counts are completed. Ballots are transported by the police to a safe location in case a recount is needed or randomly selected.

I'm leaving out other measures and details, but you get the general idea.

I used to flirt with the idea of a digital voting system, but now I clearly see that it is a problem of scale. It's very difficult to interfere with an election at scale when many independent actors and parallel flows are in place. This is what provides the system with its trustworthiness.

However, I think fraud is moved elsewhere (with campaign funding, fake news, and other methods...), but that's a whole different topic

If we can’t create a secure online voting system why do we use it for passports, banking, medical records, drivers licenses, criminal and law record keeping.

This is just an attempt at control using the majority of cases that most websites and applications are insecure. If enough effort and time is invested of course we can create a fairly robust and secure voting system.

The article talks about being “receipt free” as a required feature of any electronic voting system.

Fine. But by that standard, in a world where someone can bring their phone or AI glasses into the voting booth to record the whole voting process, how can any voting system be deemed secure? Anyone can show anyone else how they voted.

Voting is one of those things that people care very little about but it's extremely important as it can determine who is the head of state (a position that has a lot of power an influence).

A single compromise once can have incredibly bad long term consequences for the majority of a ruling elite gain power indefinitely.

Which of these vulnerabilities do not apply to any other internet system? And yet all of everyone's money is accessible over the internet and that seems to be working fine. If they really care about security at this level then they should ban all non in person voting methods.
Agree with everything being said here.

However, it is no longer even remotely paranoid to be concerned that the current administration plans to do one or more of:

1. Put its thumb on the scale by "guarding" urban polling places with paramilitary forces on election day,

2. Declare mail-in ballots illegitimate and seize them,

3. Seize voting machines or attempt to stop vote counts before all votes are counted,

4. Intimidate state legislatures by threats or economic blackmail to disregard results.

I don't see an alternative to trying to figure out how to make online voting secure. That won't solve (4) but it will at least mitigate some of the more direct methods of election fraud.

In person and by mail voting with a blockchain ledger-based receipt is how to prove one's vote is counted anonymously.

There must always be a paper trail and a blockchain ledger provides the most reliable and secure means to maintain integrity.

* “all your money lives on the internet and it’s safe”

* “internet voting is insecure”

who wins?

Electronic processes are way to easy to rig one way or the other.:

Tom Scott: Why Electronic Voting Is Still A Bad Idea https://youtu.be/LkH2r-sNjQs

Sure, there are ways to cheat with paper votes too. But counting paper ballots should always be open to watch for voters interested in observing the process. And voting should be done in secret, disallowing photos, to make it hard to "prove" the vote to possible buyers.

With the world the way it is now a days and software/firmware being insecure, it is difficult to see Internet Voting as a secure means of voting. Paper ballots with multiple biometric tools or AI to measure a voter's physiological state of mind, honesty, confirm identity may be something that should be considered.
If I can photograph a $10,000+ check with my phone and deposit it into my bank via an app, then people can surely create a secure voting app with the same technology. Maybe we should use blockchain technology to store public ballots in an open fashion. Who cast the ballots would be a secret like it always is.
I applied for my passport online. If it's secure enough for that, then it's secure enough for voting.
You need a private, secure booth, as you cannot guarantee really free (of mind, body) voting via internet, because of coersion, threats. Women threatened by their men to vote-anti women. Religious coercion. Internet voting will always be anti-democratic.
True.

Mail in voting suffers from some of the same issues. We go to great lengths (cabins, curtains, no pictures allowed etc.) to ensure people can verifiably cast a free will vote, then open a giant loophole for potentially coerced, non private or transactional voting.

The problem is that nothing is immutable about computing. Software itself is mutable. So is data. The transferability of software makes hardware mutable also.

It seems like pen and paper is currently the best verifiable and immutable voting approach.

And a favorite Phrack article on the same topic - Internet Voting: A Requiem for the Dream [1]

[1] https://phrack.org/issues/69/11

This feels like one of those cases where the technical consensus has been clear for years, but the policy and media narratives keep resetting to "maybe this time it's different."
Vote should be in person at a designated place, based on a census.

There's absolutely no justification (or excuse) for anything else.

It is much better to have less votes than to allow any avenues for manufacturing the results.

https://xkcd.com/2030/
My take: this is a paid-for hit piece to discredit a way of voting that makes total sense and is not all that hard to secure and make verifiable.
This is an alarmist headline and should be reconsidered before being posted anywhere.