9

... run a test batch of ballots through it (voting machine)

(Source: step 6.2 of Wisconsin's official vote recount manual, courtesy of Bobson's answer here).

As a software developer, this seems like an obvious (and extremely effective) step to ensure that a voting machine has not been tampered with / hacked. If you feed a test batch of ballots, with known count of expected results, you will know for sure if the machine is deviating in how it counts.

Obviously, a hack could theoretically be sophisticated enough to circumvent that (e.g. by only starting tampering at a certain time of after a certain "deductible" # of initial ballots are counted), but that still seems like a significant upgrade to anti-hacking/tampering capability compared to doing nothing at all.

As such,

Why don't ALL voting machines get fed a test batch of ballots before the election to prevent tampering/hacking? (as a required procedure before polls open).

this works even on machines where there are no paper ballots, because the inputs can be designed beforehand so you know the expected count without the need to check paper trail.

8
  • 2
    Just to be clear, i'm making an assumption here that they don't do that already. If they do, and there's proof of that, it's a very valid answer.
    – user4012
    Nov 25, 2016 at 17:09
  • 3
    Hmm, reminds me of Volkswagen and clean diesel. Testing didn't seem to work too well in that case, if I remember right. Nov 27, 2016 at 5:15
  • 3
    @user2309840 - however, the takeaway from that fiasco wasn't "well, guess we shouldn't test then" :)
    – user4012
    Nov 27, 2016 at 20:07
  • 2
    -1 Why are you assuming that that they don't? There is no implication here to the contrary. The fact that they give machines additional testing during a recount does not mean they did not do it before. I too am a programmer and I run a daily batch of regtests on my code. Would you expect the test results to change day-to-day? No, but once in a blue moon something funky happens even though I tested before. Dec 11, 2016 at 5:47
  • 2
    "but that still seems like a significant upgrade to anti-hacking/tampering capability" - a time check is literally a single line of code. Anyone with the resources to hack a bunch of machines will implement that. Jun 10, 2017 at 12:46

1 Answer 1

3
+200

This seems relatively easy to defeat.

if (ELECTION_DAY == date) {
    make_my_candidate_win();
    restore_executable_from_backup();
} else {
    count_results_correctly();
}

That said, that they run test ballots during a recount does not prove or even suggest that they don't do it before the actual election. If anything, it suggests that they do do it before the actual election, as they are clearly aware of it.

The greater problem is that without a paper trail, they can't detect what actually happened. If the count is altered and the altering code is then replaced, there is no way to detect that the count was altered. Even if the altering code is still there, unless you can work backwards from the given count to the real count, the count is spoiled. But working backwards is not always possible. E.g.

if (MY_CANDIDATE == selection || my_candidate_count <= other_candidate_count) {
    my_candidate_count++;
} else {
    other_candidate_count++;
}

Since that uses the current vote balance to determine whether or not to mess up the vote, you can't even tell if the code altered the count. If the first vote is for the right candidate and that candidate leads from then on, this code has no effect on the results.

This is a solvable problem. For example:

  1. Print ballot based on choices.
  2. Voter takes ballot and inserts in optical reader.
  3. Voter confirms that optical reader is showing votes as desired by voter.
  4. If not, destroy ballot and start over.
  5. If confirmed, drop ballot in box.

That can be reviewed and recounted by hand even. But it gives the advantages of computer control in making a valid selection and counting consistently.

14
  • Your steps for solving the issue seem straightforward, but there were reports in recent US elections that the voting machines were changing votes after the confirmatory stage, or between steps in the process.... Or were visual correct but recorded wrongly.
    – user16741
    May 23, 2019 at 4:25
  • 1
    Yes, which is why my system has a paper ballot that can be recounted rather than an electronic ballot that can be displayed differently than how it is recorded. To change after the confirmation step, this would require actually changing the ballot. To stop the exploit where both the ballot and reader are changed, the voter should check the ballot directly before putting it in the reader.
    – Brythan
    May 23, 2019 at 7:02
  • 1
    Why not just have the paper ballot and nothing else? That's how the UK does it - polling stations close at 11pm, counts go on through the night and we almost always end up with a rock solid result by around 5am. A few constituencies lag on, but the bulk are returned by 4 or 5am.
    – user16741
    May 23, 2019 at 7:21
  • Because then someone can dispute how the ballot was counted, as happened in the US in Florida in 2000. The real problem there was bad ballot design. But since the election was close, they spent a lot of time arguing over whether voter intention was clear. A pure paper ballot can also be complicated if there are a lot of candidates, e.g. the sixteen in the 2016 Republican primary, the ten in the 2016 general election in some states, or the twenty-three at the moment in the 2020 Democratic primary. Both US and UK ballots are simpler due to first-past-the-post voting at the moment.
    – Brythan
    May 23, 2019 at 7:28
  • Again, a problem with the approach (a machine to punch holes?! Why?!) rather than the idea of paper ballots. A simple mark in the right box should do it. We have no issues with significant numbers of ambiguous ballot papers in the UK, it just doesn't happen.
    – user16741
    May 23, 2019 at 7:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .