This is one of the few areas where paper is still king, IMHO.
Been filling out paper ballots for years. I don't want to vote on a machine. A machine can count my vote. But there should be a paper that goes in the ballot box, so it can be recounted using multiple methods. Different machines, humans, dogs, cats... whatever. There are real physical artifacts.
The machines in use, from VotingWorks, are precinct tabulators. This means that the voter fills out a paper ballot and the machine scans and retains it, allowing for recount either manually or by alternate machines later on---exactly as you describe. Precinct tabulation was developed to reduce election costs and speed up counting by avoiding the need to transport ballots to a central location and stack and feed them to begin tabulation---they are fed by the voter and tabulated on-site. Almost all precinct tabulators, including those from VotingWorks, are offline and tabulate results to multiple storage media that are physically transported to a totalizing system (typically with paper tape printout as an audit and backup measure, in addition to the availability of the original ballots). This allows election administrators to begin posting a substantial portion of returns within an hour or so of polls closing, rather than the many hours historically required to feed ballots to central tabulators. This is particularly important since polling has found that many voters now distrust results that are delayed in posting and tend to view multiple-day vote tabulation as an indication of fraud, which has added to the motivation of election administrators to have most returns available the night after the election rather than in the following days... a logistical challenge that is difficult to meet without precinct tabulation, given the very limited budget most election administrators have to hire temporary staff.
Unfortunately many people now conflate "voting machine" with direct-recording electronic or DRE machines. While DRE machines became common for a short period after the Helping America Vote Act imposed accessibility requirements that were difficult to meet with paper ballots, most voting machine vendors now offer "ballot marking machines" (sometimes integrated into the precinct tabulator) that allow individuals with special needs to mark a paper ballot using methods like voice feedback. The marked paper ballot can be verified by the voter or another individual before tabulation. Ballot marking machines have mostly eliminated the original motivation for DRE voting and the popularity of DRE voting across the United States has decreased since the shortly-post-HAVA period (2004 election cycle, basically), with many states prohibiting DRE entirely or DRE without voter verified paper audit trail (VVPAT), an arrangement in which all machines essentially function as ballot markers and produce a paper ballot with the voter's selections for the voter to inspect.
DRE with VVPAT can be attractive because it integrates the "ballot on demand" system into the voting machine, simplifying the three-step process typical of precinct tabulation where the voter obtains a ballot from a ballot-on-demand workstation, marks it, and then inserts it into a tabulator. Ballot-on-demand is functionally required by most modern election administrators because it facilitates "voter convenience" models where voters can appear at any precinct (usually within their county), not just at the single precinct in which they reside. The reason for this is simply that, considering the multiple taxing jurisdictions in most parts of the US, a single county election can have hundreds of distinct "ballot styles." Preprinting every ballot style for every precinct is impractical and encourages fraud due to the number of valid ballots "lying around." Ballot-on-demand tends to have a very positive impact on election integrity in this way: the ballot does not physically exist until it is issued by the BOD system which is typically integrated into the pollbook system such that a ballot cannot be issued without marking a voter as voted in the pollbook. DRE with VVPAT is mostly equivalent to precinct tabulation with BOD, but many prefer precinct tabulation with BOD because the majority of voters (those not using assistive technology) mark their ballots manually which decreases the risk of mismarking by a ballot marker.
It's important that American voters understand that non-auditable voting machines are no longer common in the US and are found only in some states, and the portion of votes counted by methods without paper audit trail is decreasing year over year as states replace aging DRE equipment.
Unfortunately, the larger problem with US election administration is not DRE machines but funding. State election administrators usually operate on extremely restrictive budgets. States originally purchased DRE machines mostly because they were the cheapest option that met HAVA requirements, which essentially required many states to wholesale replace their voting equipment on short notice. Most states that use DRE equipment today use it because they cannot afford to replace it. There is very little, even zero, real support for DRE machines other than for the simple reason that states cannot afford to purchase anything else... and this is no longer as true today due to more affordable ballot marking machines, and vanishingly few election administrators are choosing DRE when they have funding available to replace voting systems.
A larger concern in voting security is likely registration and pollbook systems, which are often poorly audited and from small software vendors, once again largely due to the small budgets available to pay for them. In the cases that voting irregularities have been found in the US, they are virtually all a result of defects or limitations of the pollbook system and unrelated to the actual vote tabulation. This encompasses situations like individuals voting multiple times---one voter, one vote is a responsibility of the pollbook system and not the tabulator, which is unaware of the voter's identity as a precaution to protect secrecy of the ballot, constitutionally required for federal and many state and local elections.
So you're for this voting system then? Your messages reads like you're against the system mentioned in the submission, but it seems like the system is actually doing it via paper, just like how you want it?
The trial described in the article:
> On November 8, VotingWorks machines will be used in a real election in real time. New Hampshire is the second state to use the open-source machines after Mississippi first did so in 2019. Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H.
It seems to involve paper ballots, as far as I can understand it.
I'm not sure I like VMDs. They can lead to slippery slopes.
IE: Only Fred used the VMD... Or how does the counter interpret the VMD? Are people vigilant about checking their ballots?
Pen, paper -> Into Box -> Counting, KISS. I can deal with a scantron. Not much more is needed here. I'd rather we work on chain of custody and figuring out who has voted etc, that are harder to solve. Though honestly, the fraud rates are so low, on double voting, I suspect made up voters, and ballot box stuffing are bigger concerns.
This is what I like about the machine I vote on in Texas. You vote on the machine then it prints the ballot for you. You walk your ballot to a scanner and feed it in where it tells you it successfully read your ballot.
Something like this sounds like the best solution. I want a paper ballot I can inspect before it gets fed into the counting machine (and which is kept after scanning for recounts, should the need arise). If that ballot is marked by machine to avoid "hanging chads", all the better.
The challenge here is that too many people will assume it did it right and not verify. That creates an attack vector. That creates another thing for people to yell fraud about. With paper, there can be no bait and switch, you physically have to press pencil to paper.
As far as the "people don't color the circles correctly", the counter machine can kick that back and say "unclear scan, please verify all circles are colored correctly" and not count that ballot.
I don't understand why that's better than just doing a scantron style bubble form with a pen. That's what we do in Minnesota. Introducing computers to the actual voting (not counting) process seems like needless complexity. Software quality and UI design in 2022 is absolutely abysmal. Keep It Simple, <polite S-word>.
I just voted on the same type of system in Wisconsin. It’s nice to have the paper trail. When I voted in Minnesota, I made my selections by filling in bubbles and then feeding the paper into a machine. Either way there’s a physical piece of paper with my selection on it.
While I agree with you that the ballot should be physical, electronic counting defeats the purpose of transparency. Counting should also be manual in the presence of representatives of each candidate. Marking of ballots and voter eligibility checking do not present any issues if done electronically.
Maybe one way to address the issues of electronic counting would be to have parallel counts by each candidate (and their reps) using their own hardware and software with a manual count in case the electronic counts of every candidate do not match. But this means each candidate has to bring their own counting infrastructure which is prohibitive.
Another nice method to reduce risk from electronic counting is called the "Benaloh Challenge" (after Josh Benaloh, the inventor). The idea is that there are two steps to putting the paper ballot into the machine: first, the machine precommits to an encryption of its count (e.g. by printing some paper with evidence on it), and then the voter decides whether to spoil the ballot or actually cast it. If the voter spoils the ballot, then they get a new paper ballot to vote on, but they can retain the commitment. Voters may spoil any number of ballots. Decryptions of spoiled ballots along with enough information to check the machine's work are provided to the voter, either immediately or at the end of the day. This means that a cheating machine cannot cheat very much, though the whole thing also really relies on a verifiable privacy-preserving audit trail for the actual count (e.g. with homomorphic encryption). It at least means that nobody need trust the actual computers.
I have often imagined having say two scanners in physical sequence (so passing through a ballet is a single operation), and having more than one (competing) recorder for the output of each scanner head.
This would require some standardization of form factors and interfaces, but with small enough electronics units and scanners, in principle parallel data paths could be included in a single intentional "infrastructure".
Everyone thinks about counting. "We need fast counting, we need accurate counting" they say.
We also need to think about understanding and trust. Think of your neighbor, think of 'Florida man', do you expect them to understand a voting machine? Do you expect them to trust a voting machine? I'm a computer programmer and am hesitant to claim I understand voting machines. I do understand paper though, and I do trust the nice people I went to church with when I see them running the polls.
I want to see examples of ballots that changed votes during recounts. I'm curious about what went wrong with the initial scan (I have ideas, of course) but seeing the actual problems would be nice.
The vast majority of voting machines in the US creates a paper trail. Usually, you vote and the system prints out a receipt showing your vote which is then kept in the case of later hand audits.
The title is misleading. New Hampshire uses paper ballots and ballot counting machines. Hand-counting is used in some cases such as recounts. They are trialing new ballot counting machines, not electronic voting machines.
+1! But this is still a net positive. Multiple forms of validation and open sourcing the software running on these machines are both components of a "defense in depth" strategy.
Sorry - so how do I ensure that the code running is the code I expect it to at the moment I vote? I "can simply hire a computer expert to examine it and see, in real time"? That doesn't seem feasible while I'm sitting in the voting booth.
I see they are using manual vote counting this time around to check, but how is that any guarantee the software will be the same in 2 years time when it happens all over again? Knowing there is software in some git repo somewhere that I can audit doesn't make me trust the machine in front of me any more.
The audit strategy for precinct tabulators such as these is not to audit the machines but the actual ballots, which are retained. Upon suspicion (usually this requires a court order, details vary a lot by state) the original ballots, which are retained after the machines tabulate them, can be hand-counted or more practically recounted by independent machines.
Every conceivable election method is vulnerable to some type of fraud, and hand-counting leads to relatively very high unintentional error rates. Post-election audit sampling is a typical practice in many states and should be in all.
True, the average voter is not inclined to hire a computer expert to do an analysis, but if there is widespread suspicion, they will at least have the ability to vent their collective outrage into an actual audit of the code. This transparency can provide some assurance.
The OP is talking about the inability to audit the code actually running at the time of voting. You can audit the code in the repo all you like but if the hardware of the voting machine is compromised, or the code you audit is modified or replaced sometime before execution, or there is other malicious code running on the machine interfering with the voting then your audit is useless.
Volkswagen cheated on emissions tests by creating software that did the expected results only during an audit. Doing the same for voting software would be much easier.
There's no way for a computer to completely prove it has the right software for a job.
Can it though? If the audit is called for after the election how do we determine the code that the auditor is inspecting is what was run on election day?
It's still a black box on election day - it's just got detailed instructions written on it claiming that's what is inside.
1. Send the results to multiple independent organisations
2. Print out for each voter a list of codes they can use to show that they voted for each candidate, show on screen the code they need to memorise/highlight for their actual vote
3. Later they voters can put that code into any of the organisations' websites to check their result was recorded correctly, which also means each org can check that they have the same results the voters think they made
Isn't this de-anonymizing the process a bit - I know your name won't be printed directly on it, but now the organization you went to can determine who you are and who you voted for.
yeah open source software isn’t a fix for this it’s a ruse, the last built and deployed binary can in theory contain anything, why are we using computers for this??
Can someone enlighten me why we need a full multipurpose computer that can run custom software just to increment one of two numbers? What's the secret sauce that means we can't run the whole election off of a cluster of 4000-series CMOS's on a breadboard mounted in a plexiglass case in the public somewhere?
Not just one of two numbers. Ballots contain multiple referenda, and races for multiple positions, each of which can have anywhere between 1 and tens of candidates.
You need to display all of that information, take a user's input, store it in an auditable format. Oh, and people like "small government" so making custom hardware is completely out of the question. Using a "multipurpose" computer is the economical choice.
But there's another aspect to this: if you can swap out the hardware and keep the software the same, it makes the whole thing more transparent. A jumble of 4000-series CMOS on a breadboard could hide any number of bugs/backdoors. And, perception of trust is important, nobody wants to vote on your science fair project. Also, you'd need to produce thousands of these machines to run an election. Really easy to procure thousands of commodity multipurpose machines... but you're talking about mass-manufacturing your science fair project. Hell no.
There's a lot to be said for the value of commodity hardware: you almost certainly can't prove that purpose-built hardware has or hasn't been tampered with by the manufacturer. With commodity hardware, the risk that the manufacturer anticipated your use case (voting machines) and implanted a backdoor that can affect their functions is extremely small.
I've always wondered why there isn't overlap between voting machines and slot machines. Surely most of these problems have already been solved by the Nevada Gaming Commission
The problems do look the same. Why don't they share a common enforcement agency? Because they deal with two types of entities (government vs corporation) that operate machines with vastly different use cases with vastly different threat models. A casino's threat model for its slot machine supply chain is completely different than the threat model for voting machine integrity.
Boiling the problem down to the integrity of the hardware and software throws out the nuance of how and why exploitation might occur (and who is doing the exploiting), which has huge implications for how you make regulations and do enforcement.
There are multiple reasons. First, the tabulator typically needs to determine the "style" (layout) of the ballot from one of possibly hundreds of options (due to multiple government and taxation jurisdictions). Second, a typical ballot in most US jurisdictions has a dozen or more questions on it, and cumulatively across all ballot styles there are often over a hundred questions.
Third, though, and perhaps most significantly, "traditional" optical mark reading (OMR) systems using LED or laser sources and diodes were inflexible as to ballot layout and more problematically not very reliable across varying marks (remember the grade-school requirement for #2 pencils due to OMR scoring of exams), a particularly big issue since voters are often not experienced with OMR systems and so do not mark their ballot "correctly." To address this, almost all modern ballot tabulators use a CCD mechanism to take an image of the full ballot and then interpret it via machine vision (this is not a case of machine learning, the algorithms used are actually very simple). This yields much more reliable interpretation of ballots with fewer ballots rejected to hand-counting, but requires more complex software.
It's important to understand that most US election administrators avoid hand-counting in large part because of its inaccuracy. In many US jurisdictions hand-count ballots are counted by two individuals to improve reliability, but the error rate remains higher than machine tabulation. When it is 1AM after a day that started at 5AM and you are on the hundredth ballot you've hand-tabulated since you got off the precinct floor it becomes extremely difficult to tabulate with the virtually zero error rate that US voters expect. This is not a hypothetical scenario but one that's pretty typical of US election working conditions due to the slim budget and expectation of rapid posting of returns.
That's not impossible for a simple electromechanical calculator either. An attachment similar to those paper drums seismographs use would suffice while still being simple enough to be trustworthy; a video recording of the counter along with maybe an array of debug LEDs would suffice too now that I think about it.
I remember hearing about a study on very simple electronic voting machines. These machines had a bunch of buttons representing the candidates. And in the study, they were able to make a decent guess of who voted what by looking at the rf emissions from the machine from a distance.
I could imagine a whole computer being there could make the rf emissions less predictable. I can definitely think of some ways of making a simple machine like that more resistant against an attack like that. Idk if the study looked into that, I can't find the study anywhere.
Timing attacks and similar methods of vote snooping is definitely a big issue I've been thinking about for a very simple calculator like this. At first you'd think you could mitigate that with some sort of analog capacitor timer buffer thing somewhere in the chain but then you screw up a lot of predictablity needed to trust such a device...
It is worth noting that Windham New Hampshire had a case of actual vote miscounting in the 2020 election- though not the presidential election- and the miscounts did not change the results. The Democrat who lost the race is the one who requested the recount (and the recount favored the Republican candidates who won).
Right, the interest in having auditable and secure elections is not simply a right/left issue and does not mean one's an "election denier" or an "insurrectionist". It just stands to reason that basic controls for governance should be a key attribute of how elections are run, and no, the feds shouldn't be paying for this, imo.
In my home state, a Republican candidate (albeit disowned) was indicted for ballot harvesting, particularly for hiring a consultant from CA to run around through a particular east Asian community collecting ballots. If a system works, every politician will exploit it.
* ID's should be required (like they are for everything else, including travel, bank accounts, bars, etc);
Wow, those error rates are actually much higher than I'd have expected. I wonder if the cause is something like a difference in how humans vs machines deem ballots invalid?
You can change a lot of votes by altering the rules as to what is considered a valid vote. Read into the details of the 2000 election and you'll see just how much of a leg up George W Bush got from party control of the vote counting. There are plenty of scenarios where he would have lost if the rules were decided differently during the counting process. Had the decisions been made neutrally Bush would have lost in Florida.
The audit found that the ballots had been folded "incorrectly" (Is there a right way to fold the ballots?) and if the crease went through the mark for a candidate, it would count the crease as a mark. This meant if the voter had marked another candidate, it would think it was double voted and not count it, and if they had not marked a candidate, it would count it as a vote.
I am not sure having the source code of the machines be open source would help, but maybe make it easier to audit and detect that the crease would lead to a miscounted ballot.
> Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H. Anyone who cares to will be able to see if the new machines recorded the votes correctly
If hand counting paper ballots instills confidence, then at some low level of public confidence in elections, it makes sense to do so routinely, rather than just a demonstration. Vilifying doubters doesn't seem to be very effective. For many of those there is no level of proof that could dent their opinion, so little is lost by simply attacking them. But there are many others that are convincible by sufficient openness.
Sure, turning it back into a manual process has its own issues, particularly with efficiency. But with an election efficiency is a minor consideration compared to confidence.
There have traditionally been ways to mess with a hand count.
One example I recall is vote counters wedging a piece of pencil lead under a fingernail. If they see a ballot they don't like, swipe the lead across it and toss the ballot in the "spoiled" pile.
Sure, this requires a little bit of blind eye from the county clerk (or whoever), but if the election goes the right way, it's worth it.
Some problems with this, besides the problems that other posters have already mentioned.
* One vote counter can't make much of a difference by themselves, so you need a conspiracy of vote counters. But conspiracies are difficult to bring about and keep secret in the real world. This is especially so if you have to pay the individuals involved – which seems likely, given that vote counting is boring, thankless volunteer work.
* Everyone involved in the conspiracy risks going to jail, but hardly anyone benefits on a personal level. Why would anyone risk it?
* The extremely large number of spoiled ballots would be suspicious. Especially as they'd probably look rather unlike ordinary spoiled ballots.
* Observers would notice that some counters (those involved in the conspiracy) were processing many more spoiled ballots than others.
I'm reminded of Number 2 pointing out do Dr. Evil that he could quadruple his profits if he shifted his resources away from evil empire building and towards Starbucks. The money and resources spent on rigging the count could be spent more efficiently on 100% legal means of increasing vote count, such as canvasing (= knocking on supporters' doors and encouraging them to go vote).
In the UK party candidates and guests are watching the count so would pick that up. It's very rare that the losing candidate plus all spoiled votes makes a difference in any case, and significant numbers of double voting would raise very interesting questions. They simply don't happen.
In the UK we go to a voting place. We get given a piece of paper. We walk to a little booth, we mark an X next to who we want, we put that piece of paper in a black box. Your name is crossed off on a piece of paper to say you've voted.
That black box gathers a few hundred votes over the course of the day. There are multiple people in the room with that black box throughout the day.
At the end of the day the number of people who have voted and the number of pieces of paper that have been used, are both counted to ensure they are the same.
The box is then sealed (with tamper tape) and transported to a central hall, usually in a car, but sometimes by ferry or helicopter depending on weather and location. Obviously this takes longer for rural areas than for urban areas.
When it arrives, it is unsealed in front of many witnesses, and the ballots emptied. They are counted (how many pieces of paper), and this number matches the above paperwork.
The ballots are then put into a pile in the middle of the room where all the candidates and their teams can see, and are counted by a team of however many (say a team of 20 for a district of 60k votes - tend to be local council workers being paid overtime). From the counts I've seen, 300-600 an hour is a reasonable speed. Those are bundled into bundles of 100 and put into piles on display.
Any ambiguous marking that the person counting or the people watching think is amigious is set aside (the famous "WANK/WANK/NOT WANK" case [0]), and the candidates and their agents get to see and agree on the paper.
Urban counts of districts with c. 70,000 voters tend to get the first ballot boxes about 10-15 minutes after polling closes and start counting. Some have large numbers counting in an aim to get the count done first (in an hour or so), others take longer, but the majority of districts are verified, counted, and recounted after about 6 hours. Some places have to wait for the aforementioned ferry etc so don't report to maybe 12 hours after.
I don't understand why you need machines to vote or machines to count. Breaking the system above by a few votes is probably possible with a small team of conspirators, but breaking it beyond that doesn't scale.
Yes, exactly. Canada still does manually counting federally. It works. Ironically, it doesn't stop the complaint about bad voting machines, but that's because people get their news from the states. There are no voting machines, no way for software to fudge the numbers just enough for someone's decided candidate to win.
Is it more of an effort than trusting a machine is working correctly? Yes, absolutely, but this is the literal fundamental foundation of democracy we are talking about - let's put in a bit of effort.
> I don't understand why you need machines to vote or machines to count.
The voting machines isn't for you, it for the politicians. Denmark have system pretty much identical to what you described. We normal have a result for parliamentary voting within five to six hours of the polling station closing. After three or four hours we normally have enough votes counted to call the election, on a party basis.
The issue is the individual candidates, the well known politicians are interviewed a few hours into an election night, when their seats are secured. The lesser known politicians may have to wait for a day, or two, in order to have their seat confirmed. So they get no airtime, no interviews, because the media don't care when the personal votes are finally counted and confirmed. The voting machine are for those low ranking politicians ego.
As for the US, who don't have a parliament and only two, or three, candidates in each election... I have no idea. Because they f-ed up their election system and closed to many polling stations, resulting in ballot counting taking to long?
I'm not sure how closing the stations makes any difference. The number of votes to count id directly proportional to the population, and if a democracy can't afford 5 cents per vote once every few years then maybe it shouldn't be a democracy
> I don't understand why you need machines to vote or machines to count. Breaking the system above by a few votes is probably possible with a small team of conspirators, but breaking it beyond that doesn't scale.
Exactly. Replacing a system that is guaranteed to work with an another system that is guaranteed to not work is foolish.
Man, people are really negative about this, but it's a great idea.
In the old days, paper ballots would also 'go missing' from districts known to be favorable to the other side (aka be chucked out of trucks on a bridge over a river).
The best option seems to be open source voting machines + paper audit. This way you get immediate counts and then an audit trail, so would-be manipulators have to mess with BOTH at the same time which is significantly harder.
>In the old days, paper ballots would also 'go missing' from districts known to be favorable to the other side (aka be chucked out of trucks on a bridge over a river).
The problem with electronic voting, however, is that it takes roughly the same effort to change one vote than it takes to change millions
There are other ways to achieve an audit trail with paper ballots. Like cameras. Electronic voting is opaque by nature compared to a bunch of people in a room actually counting paper ballots.
Brazilian here, we've been using voting machines for quite some time now. We are currently facing nation wide protests at least partly due to suspicion of election fraud. People aren't accepting the election's results.
Questioning the legitimacy of the voting machines has also become illegal ("fake news").
(Because of unfounded claims of fraud, according to the losing candidate).
It's a shame. There are many ways that the voting machines could be improved but that will be much harder now that the far right has monopolized the discourse on auditable paper trails in their self-serving attempts to overturn valid election results.
Voting machines should not exist. Even if they are just printers.
Computerized vote counting is a ridicolously bad idea on every imaginable level. Especially if there is any amount of centralization.
Computerized ballot printing "just" makes it very easy to deanonymize people.
Here where I live your name is crossed of a list after you have shown your ID card. Then you get a piece of paper which is thrown into a box. Given the incentives, anything less rigorous seems quite ridicolous.
Readit News
Been filling out paper ballots for years. I don't want to vote on a machine. A machine can count my vote. But there should be a paper that goes in the ballot box, so it can be recounted using multiple methods. Different machines, humans, dogs, cats... whatever. There are real physical artifacts.
Unfortunately many people now conflate "voting machine" with direct-recording electronic or DRE machines. While DRE machines became common for a short period after the Helping America Vote Act imposed accessibility requirements that were difficult to meet with paper ballots, most voting machine vendors now offer "ballot marking machines" (sometimes integrated into the precinct tabulator) that allow individuals with special needs to mark a paper ballot using methods like voice feedback. The marked paper ballot can be verified by the voter or another individual before tabulation. Ballot marking machines have mostly eliminated the original motivation for DRE voting and the popularity of DRE voting across the United States has decreased since the shortly-post-HAVA period (2004 election cycle, basically), with many states prohibiting DRE entirely or DRE without voter verified paper audit trail (VVPAT), an arrangement in which all machines essentially function as ballot markers and produce a paper ballot with the voter's selections for the voter to inspect.
DRE with VVPAT can be attractive because it integrates the "ballot on demand" system into the voting machine, simplifying the three-step process typical of precinct tabulation where the voter obtains a ballot from a ballot-on-demand workstation, marks it, and then inserts it into a tabulator. Ballot-on-demand is functionally required by most modern election administrators because it facilitates "voter convenience" models where voters can appear at any precinct (usually within their county), not just at the single precinct in which they reside. The reason for this is simply that, considering the multiple taxing jurisdictions in most parts of the US, a single county election can have hundreds of distinct "ballot styles." Preprinting every ballot style for every precinct is impractical and encourages fraud due to the number of valid ballots "lying around." Ballot-on-demand tends to have a very positive impact on election integrity in this way: the ballot does not physically exist until it is issued by the BOD system which is typically integrated into the pollbook system such that a ballot cannot be issued without marking a voter as voted in the pollbook. DRE with VVPAT is mostly equivalent to precinct tabulation with BOD, but many prefer precinct tabulation with BOD because the majority of voters (those not using assistive technology) mark their ballots manually which decreases the risk of mismarking by a ballot marker.
It's important that American voters understand that non-auditable voting machines are no longer common in the US and are found only in some states, and the portion of votes counted by methods without paper audit trail is decreasing year over year as states replace aging DRE equipment.
Unfortunately, the larger problem with US election administration is not DRE machines but funding. State election administrators usually operate on extremely restrictive budgets. States originally purchased DRE machines mostly because they were the cheapest option that met HAVA requirements, which essentially required many states to wholesale replace their voting equipment on short notice. Most states that use DRE equipment today use it because they cannot afford to replace it. There is very little, even zero, real support for DRE machines other than for the simple reason that states cannot afford to purchase anything else... and this is no longer as true today due to more affordable ballot marking machines, and vanishingly few election administrators are choosing DRE when they have funding available to replace voting systems.
A larger concern in voting security is likely registration and pollbook systems, which are often poorly audited and from small software vendors, once again largely due to the small budgets available to pay for them. In the cases that voting irregularities have been found in the US, they are virtually all a result of defects or limitations of the pollbook system and unrelated to the actual vote tabulation. This encompasses situations like individuals voting multiple times---one voter, one vote is a responsibility of the pollbook system and not the tabulator, which is unaware of the voter's identity as a precaution to protect secrecy of the ballot, constitutionally required for federal and many state and local elections.
The trial described in the article:
> On November 8, VotingWorks machines will be used in a real election in real time. New Hampshire is the second state to use the open-source machines after Mississippi first did so in 2019. Some 3,000 voters will run their paper ballots through the new machines, and then, to ensure nothing went awry, those same votes will be hand counted in a public session in Concord, N.H.
It seems to involve paper ballots, as far as I can understand it.
And this is how the authors of the voting system describes it themselves: https://www.voting.works/voting-system
IE: Only Fred used the VMD... Or how does the counter interpret the VMD? Are people vigilant about checking their ballots?
Pen, paper -> Into Box -> Counting, KISS. I can deal with a scantron. Not much more is needed here. I'd rather we work on chain of custody and figuring out who has voted etc, that are harder to solve. Though honestly, the fraud rates are so low, on double voting, I suspect made up voters, and ballot box stuffing are bigger concerns.
As far as the "people don't color the circles correctly", the counter machine can kick that back and say "unclear scan, please verify all circles are colored correctly" and not count that ballot.
Maybe one way to address the issues of electronic counting would be to have parallel counts by each candidate (and their reps) using their own hardware and software with a manual count in case the electronic counts of every candidate do not match. But this means each candidate has to bring their own counting infrastructure which is prohibitive.
I have often imagined having say two scanners in physical sequence (so passing through a ballet is a single operation), and having more than one (competing) recorder for the output of each scanner head.
This would require some standardization of form factors and interfaces, but with small enough electronics units and scanners, in principle parallel data paths could be included in a single intentional "infrastructure".
Everyone thinks about counting. "We need fast counting, we need accurate counting" they say.
We also need to think about understanding and trust. Think of your neighbor, think of 'Florida man', do you expect them to understand a voting machine? Do you expect them to trust a voting machine? I'm a computer programmer and am hesitant to claim I understand voting machines. I do understand paper though, and I do trust the nice people I went to church with when I see them running the polls.
I see they are using manual vote counting this time around to check, but how is that any guarantee the software will be the same in 2 years time when it happens all over again? Knowing there is software in some git repo somewhere that I can audit doesn't make me trust the machine in front of me any more.
Every conceivable election method is vulnerable to some type of fraud, and hand-counting leads to relatively very high unintentional error rates. Post-election audit sampling is a typical practice in many states and should be in all.
Dead Comment
The OP is talking about the inability to audit the code actually running at the time of voting. You can audit the code in the repo all you like but if the hardware of the voting machine is compromised, or the code you audit is modified or replaced sometime before execution, or there is other malicious code running on the machine interfering with the voting then your audit is useless.
There's no way for a computer to completely prove it has the right software for a job.
It's still a black box on election day - it's just got detailed instructions written on it claiming that's what is inside.
You need to display all of that information, take a user's input, store it in an auditable format. Oh, and people like "small government" so making custom hardware is completely out of the question. Using a "multipurpose" computer is the economical choice.
But there's another aspect to this: if you can swap out the hardware and keep the software the same, it makes the whole thing more transparent. A jumble of 4000-series CMOS on a breadboard could hide any number of bugs/backdoors. And, perception of trust is important, nobody wants to vote on your science fair project. Also, you'd need to produce thousands of these machines to run an election. Really easy to procure thousands of commodity multipurpose machines... but you're talking about mass-manufacturing your science fair project. Hell no.
These are machines that read paper ballots and compute totals. See https://news.ycombinator.com/item?id=33469882
Boiling the problem down to the integrity of the hardware and software throws out the nuance of how and why exploitation might occur (and who is doing the exploiting), which has huge implications for how you make regulations and do enforcement.
Third, though, and perhaps most significantly, "traditional" optical mark reading (OMR) systems using LED or laser sources and diodes were inflexible as to ballot layout and more problematically not very reliable across varying marks (remember the grade-school requirement for #2 pencils due to OMR scoring of exams), a particularly big issue since voters are often not experienced with OMR systems and so do not mark their ballot "correctly." To address this, almost all modern ballot tabulators use a CCD mechanism to take an image of the full ballot and then interpret it via machine vision (this is not a case of machine learning, the algorithms used are actually very simple). This yields much more reliable interpretation of ballots with fewer ballots rejected to hand-counting, but requires more complex software.
It's important to understand that most US election administrators avoid hand-counting in large part because of its inaccuracy. In many US jurisdictions hand-count ballots are counted by two individuals to improve reliability, but the error rate remains higher than machine tabulation. When it is 1AM after a day that started at 5AM and you are on the hundredth ballot you've hand-tabulated since you got off the precinct floor it becomes extremely difficult to tabulate with the virtually zero error rate that US voters expect. This is not a hypothetical scenario but one that's pretty typical of US election working conditions due to the slim budget and expectation of rapid posting of returns.
I could imagine a whole computer being there could make the rf emissions less predictable. I can definitely think of some ways of making a simple machine like that more resistant against an attack like that. Idk if the study looked into that, I can't find the study anywhere.
Deleted Comment
Oversimplification isn't helpful.
See https://apnews.com/article/donald-trump-new-hampshire-voting...
https://www.concordmonitor.com/voting-machines-nh-new-hampsh...
The news of this has of course been buried under all of the false claims of voter fraud from the 2020 presidential election.
So it is not surprising that New Hampshire would be looking at a new approach to voting machine technology.
In my home state, a Republican candidate (albeit disowned) was indicted for ballot harvesting, particularly for hiring a consultant from CA to run around through a particular east Asian community collecting ballots. If a system works, every politician will exploit it.
* ID's should be required (like they are for everything else, including travel, bank accounts, bars, etc);
* voter rolls should be scrubbed;
* election results should be auditable;
I am not sure having the source code of the machines be open source would help, but maybe make it easier to audit and detect that the crease would lead to a miscounted ballot.
If hand counting paper ballots instills confidence, then at some low level of public confidence in elections, it makes sense to do so routinely, rather than just a demonstration. Vilifying doubters doesn't seem to be very effective. For many of those there is no level of proof that could dent their opinion, so little is lost by simply attacking them. But there are many others that are convincible by sufficient openness.
Sure, turning it back into a manual process has its own issues, particularly with efficiency. But with an election efficiency is a minor consideration compared to confidence.
One example I recall is vote counters wedging a piece of pencil lead under a fingernail. If they see a ballot they don't like, swipe the lead across it and toss the ballot in the "spoiled" pile.
Sure, this requires a little bit of blind eye from the county clerk (or whoever), but if the election goes the right way, it's worth it.
* One vote counter can't make much of a difference by themselves, so you need a conspiracy of vote counters. But conspiracies are difficult to bring about and keep secret in the real world. This is especially so if you have to pay the individuals involved – which seems likely, given that vote counting is boring, thankless volunteer work.
* Everyone involved in the conspiracy risks going to jail, but hardly anyone benefits on a personal level. Why would anyone risk it?
* The extremely large number of spoiled ballots would be suspicious. Especially as they'd probably look rather unlike ordinary spoiled ballots.
* Observers would notice that some counters (those involved in the conspiracy) were processing many more spoiled ballots than others.
I'm reminded of Number 2 pointing out do Dr. Evil that he could quadruple his profits if he shifted his resources away from evil empire building and towards Starbucks. The money and resources spent on rigging the count could be spent more efficiently on 100% legal means of increasing vote count, such as canvasing (= knocking on supporters' doors and encouraging them to go vote).
That black box gathers a few hundred votes over the course of the day. There are multiple people in the room with that black box throughout the day.
At the end of the day the number of people who have voted and the number of pieces of paper that have been used, are both counted to ensure they are the same.
The box is then sealed (with tamper tape) and transported to a central hall, usually in a car, but sometimes by ferry or helicopter depending on weather and location. Obviously this takes longer for rural areas than for urban areas.
When it arrives, it is unsealed in front of many witnesses, and the ballots emptied. They are counted (how many pieces of paper), and this number matches the above paperwork.
The ballots are then put into a pile in the middle of the room where all the candidates and their teams can see, and are counted by a team of however many (say a team of 20 for a district of 60k votes - tend to be local council workers being paid overtime). From the counts I've seen, 300-600 an hour is a reasonable speed. Those are bundled into bundles of 100 and put into piles on display.
Any ambiguous marking that the person counting or the people watching think is amigious is set aside (the famous "WANK/WANK/NOT WANK" case [0]), and the candidates and their agents get to see and agree on the paper.
Urban counts of districts with c. 70,000 voters tend to get the first ballot boxes about 10-15 minutes after polling closes and start counting. Some have large numbers counting in an aim to get the count done first (in an hour or so), others take longer, but the majority of districts are verified, counted, and recounted after about 6 hours. Some places have to wait for the aforementioned ferry etc so don't report to maybe 12 hours after.
I don't understand why you need machines to vote or machines to count. Breaking the system above by a few votes is probably possible with a small team of conspirators, but breaking it beyond that doesn't scale.
[0] https://www.joe.co.uk/politics/voter-writes-wnk-all-over-bal...
Is it more of an effort than trusting a machine is working correctly? Yes, absolutely, but this is the literal fundamental foundation of democracy we are talking about - let's put in a bit of effort.
If it seems to be possible in a country like Brazil, why not in Canada/UK/USA?
The voting machines isn't for you, it for the politicians. Denmark have system pretty much identical to what you described. We normal have a result for parliamentary voting within five to six hours of the polling station closing. After three or four hours we normally have enough votes counted to call the election, on a party basis.
The issue is the individual candidates, the well known politicians are interviewed a few hours into an election night, when their seats are secured. The lesser known politicians may have to wait for a day, or two, in order to have their seat confirmed. So they get no airtime, no interviews, because the media don't care when the personal votes are finally counted and confirmed. The voting machine are for those low ranking politicians ego.
As for the US, who don't have a parliament and only two, or three, candidates in each election... I have no idea. Because they f-ed up their election system and closed to many polling stations, resulting in ballot counting taking to long?
Exactly. Replacing a system that is guaranteed to work with an another system that is guaranteed to not work is foolish.
There are electronic voting systems that have been running without issues for decades, why couldn't the US accomplish the same?
However this sane and simple system would probably not work in eg Australia? Their voting system is too complicated.
In the US, this is racist.
> where all the candidates and their teams can see
In the US, this is insurrectionist.
In the old days, paper ballots would also 'go missing' from districts known to be favorable to the other side (aka be chucked out of trucks on a bridge over a river). The best option seems to be open source voting machines + paper audit. This way you get immediate counts and then an audit trail, so would-be manipulators have to mess with BOTH at the same time which is significantly harder.
Think you know a better way HN? Let's hear it.
The problem with electronic voting, however, is that it takes roughly the same effort to change one vote than it takes to change millions
Questioning the legitimacy of the voting machines has also become illegal ("fake news").
Computerized vote counting is a ridicolously bad idea on every imaginable level. Especially if there is any amount of centralization. Computerized ballot printing "just" makes it very easy to deanonymize people.
Here where I live your name is crossed of a list after you have shown your ID card. Then you get a piece of paper which is thrown into a box. Given the incentives, anything less rigorous seems quite ridicolous.
Voting machines have attack vectors which can not work on humans.