29

There is ongoing criticism of voting machines, due to the ease of manipulating the outcome of a vote that is counted digitally. I have heard the opinion that every computer-implemented voting procedure, including electronic voting via the internet, is in principle more susceptible to manipulation than traditional pen-and-paper voting.

Is this true, or are there electronic voting concepts that have the desired properties of paper voting?

  • possible duplicate of What challenges remain for online voting?; I think the answers available there would be similar if not exact. – Kevin Peno Dec 4 '12 at 22:41
  • 5
    My question is much more specific than "What challenges remain for online voting?". – clstaudt Dec 4 '12 at 22:47
  • It is, I agree. I'm not sure the answers would be much different though. – Kevin Peno Dec 4 '12 at 22:53
  • 1
    The answers should be different as voting machines guarantee some basic details that online voting systems do not guarantee, as an example you can say that every voter at a machine has been authentified as being eligible to vote, something you cannot be sure of with an online voting system. – Sven Clement Dec 4 '12 at 22:57
  • 1
    @KevinPeno: I think the answers will be different because "What challenges remain for online voting?" focuses on what we have now, while this question focuses on what is possible (plus on security rather than other issues) and also on electronic, rather than just online voting. Given that there are 3 differences, I think this deserves to be it's own question – Casebash Dec 4 '12 at 23:48
21

This would depend on what you consider "the desired properties of paper voting". Applied Cryptography lists these requirements for secure online elections:

  1. Only registered voters can vote
  2. Voters can only vote once
  3. Nobody can determine a particular's voter's vote
  4. Nobody can change a voter's vote after it's been submitted
  5. Nobody can duplicate another voter's choice (voting for the same person, even without knowing who it is)
  6. Voters can verify that their vote was counted correctly

Voting electronically in person is essentially the same as voting by physical ballot, so most of the conditions are satisfied. The problem is the lack of a paper trail: there's no guarantee that the machine has actually recorded the vote you told it, regardless of what it says on the screen (on the other hand, there's no guarantee that the poll worker didn't light your ballot on fire as soon as you turned around). Nonetheless, this could be solved by issuing each voter a unique ID and giving them a web interface that maps the ID to the vote, so they can check from home.

Voting online is much more complicated and throws all the requirements into question. Presumably you have some way to issue each registered voter a unique nonce, even if it involves mailing it to them. Given this, there are cryptographic schemes that provide a way to let everyone submit their votes to a centralized tabulator (or even a decentralized system, although these tend to be infeasible and aren't necessary here anyway) that satisfies all these requirements. The easiest way to ensure a secret ballot is to anonymize the initial nonce distribution, although it's difficult for the voters to know for sure that this has been done (i.e. it requires a degree of trust in the central authority)

  • 6
    "there's no guarantee that the poll worker didn't light your ballot on fire as soon as you turned around" Yes there is; you inserted a paper ballot into a sealed ballot box. – Richard Gadsden Jan 12 '13 at 17:35
  • 12
    However, this would fail the privacy requirement. A is forcing me to vote for candidate Y, and knows I did so because he was looking over my shoulder as I cast my vote. I recall hearing that one country (Eritrea?) allowed online voting and allowed people to vote as many times as they liked, with only the last vote counting. So I could vote at home with my overbearing father looking over my shoulder, and then I could pop down the the library and vote again, this time expressing my real preference. – TRiG Jan 12 '13 at 23:32
  • 2
    "there's no guarantee that the poll worker didn't light your ballot on fire as soon as you turned around" at least here, poll workers are volunteers and recruited from all parties and walks of life, there's never only one poll worker. Almost everyone can count paper votes, it'S easy to have several people checking each other. – mart Jul 6 '15 at 14:34
  • "there's no guarantee that the poll worker didn't light your ballot on fire as soon as you turned around" I presume that there is a known number of ballets on site before polls open, the number of voters is counted, and we know how many ballets are used and remaining when the polls close. Plus there are a number of workers from a diverse background keeping an eye on each other. – Andy Mar 3 '16 at 0:48
  • @Andy: not only that, but you can also stay and see that no-one sets fire to any ballot until the final count is announced (and compare that with the newspaper report of the official numbers for your electoral district). – cbeleites Nov 21 '16 at 23:15
11

I saw a really cool TED talk on this topic. Using cryptography, it is possible to give voters a code so that they can verify if their vote was counted correctly, but without the government knowing what you voted.

Most people assume that in order to verify your vote, the government would have to have a database listing what everyone voted, instead of just keeping a tally. However, what you can do instead is store a encrypted version of your vote (E). After voting, the voter receives a code that is necessary to decrypt E. It is also possible to design the system so that the voter can not only see what they voted, but actually prove it. ie. the system makes in impossible to create a fake code showing the voted for someone else to frame the government for voter fraud

  • Can you give any more details about the video? It looks interesting, but answers that just link to other sites tend to get deleted – Michael Mrozek Dec 4 '12 at 23:57
  • @MichaelMrozek: I added some more details, but I'm not going to go into the technical details of how you'd implement such a system – Casebash Dec 5 '12 at 0:12
  • 7
    I saw that video too, but there is one small glitch with being able to prove who you voted for. It makes it trivially easy to sell your votes. Without being able to prove the vote, the person trying to buy it would have no choice but to trust that they got their money's worth. – JohnFx Dec 19 '12 at 3:10
4

Desired Features

I think one needs to see what are the features that one wants for an election in general, and see how different systems cope with it.

An election should provide:

  • transparency: all the process of vote, and counting has to be verifiable by any citizen.
  • independent vote: all the citizens can vote according to their opinions, without external pressure.
  • security: each and everyone can only vote 0 or 1 time, and their vote cannot be altered by someone else.
  • universality: the voting process is free and opened to everyone, regardless of age, social status, sex, ethnicity, etc.

I am mostly familiar with Western European votes, so the examples and illustration will represent more what happens there.

The universality is in principle the easiest to comply. You charge no fee, and provide the same access/choice of accesses to every citizen. There are special cases that will be treated further below.

Transparency means that one should check that no votes were done before hand, or that no one votes more than once. In pen and paper, this is done by having transparent ballots, which are empty at first (and can be seen by the first voters), and under the supervision of one of two people (typically representing different political parties). The transparency also implies that the voting process is public. Every citizen can come and see that voting is made correctly. Not counting each vote twice for one party. This is also supervised by different political parties, which (should) ensures a fair process.

Independent and security are hard to get. Because security implies the identification of the voter, and independence, his anonymity. In paper-and-pen, this is done with a two steps process. The person is checked once, but the closed envelope ensures that the content of the vote is anonymous. And the more voters, the more the vote becomes anonymous, as it gets impossible to attribute each envelope to each voter at the end.

And interesting feature of pen and paper is that the result can be challenged and the votes counted again. It slows everything, but it is rarely challenged.

Case for electronic process

I would consider three systems and see what they should provide to fill in the requirements above.

  • Online voting,
  • Electronic voting on-side with ID (EA),
  • Electronic voting with manual ID (EM).

In this section, I would consider only "pure" implementation of those, and not a mixing.

Apart from special cases that will be discussed further below, the universality of those are quite easy to implement. The electronic machines are on the spot, same as paper ballot. Online, becomes limited to "everyone who had internet connection", unless some dedicated (free) internet spots can be organised for the others.

In online and EA cases, the identification of the voters are made with a unique ID given to each voter. It is unclear how one can ensure that the voter do not provide his/her vote to someone else (possibly against money). But in exactly the same way, they may vote themselves according to money received before hand. There is nothing in the current systems that prevents this type of fraud, except the risks it implies. Which would be the same for both Online and EA.

In EM, the identification is done pretty much like the current one. This "as good as it gets", seeing that it is separated from the voting process. A chip or a time constraint may prevent anyone from voting more than once.

Independent vote is not easy. For the EM, as it is independent from the identification, it works simply. You can still coerce people into voting for your candidate, with pressure outside the voting place, no curtain or anything to isolate you, etc. But those problem are already existent today. So, if it does not improve on that, it does not get worse.

Online and EM are harder: the identification and vote aren't really separated. This can be achieved with some crypto algorithms, which encapsulated and encrypted vote in an identification system. That was discussed in another answer (possibly on the related question).

Encapsulated encryption is also a way to provide some level of security on alteration of the vote. This is particularly critical on online system, to avoit MitM attacks. Assuming the EA/EM machines are trustworthy.

This leads to, IMHO, the major issue with any form of electronic system: the transparency. How to ensure that no votes are added/removed? How can the voter ensure that his/her vote was really counted and not modified? Etc.

There aren't any mean for normal citizen to control the voting score: you want to make it protected to prevent alteration. Furthermore, you don't want early voter to influence the later voters so you can't publish the results in real time. Any way, you might consider you loose in transparency compared to the standard paper-and-pen vote. The best is to have independent people controlling that the counts are correct. Ordinary citizen are relying on their judgement.

Released open-source code would offer some form of transparency, which, if it doesn't the same universality in transparency, offers all the IT-educated people to actually check. But in EA/EM cases, you can't ensure that the released code is the one being deployed.

For a correct program, counting error should be greatly reduced compared to paper-and-pen vote. But you can't challenge the output without reorganising the election (at least locally).

Special cases

There are some cases that need to be considered in all systems and I am not sure what are the best solutions for all of them.

  • Old people. Very old people can't move to vote. Using electronic devices and internet seems to be out of the question as well. With increasing age of population in most Western countries, this will be an increasing problem.
  • Sick people. Some people may be sick and forced to stay at home the day of the election. You need to consider some form of remote way to vote.
  • Travels. For business or leisure, more and more people travel, including on week ends. How can they vote?
  • Living abroad. This is an extreme case of travels. People can't be expected to fly from Siberia to Alabama to vote. How are they able to vote, without travelling too long distances?

I am aware of three elements to deal with those. Possibility to transfer the vote. Someone may vote for you, and as you choose who, you can trust that person. Mail. You vote by mail and special ballots are organised to collect those mails. Representation abroad. It is possible to vote in consulates. However, this works fine when you leave in a country with a high number of co-citizens as you would expect to have consulates not too far from your place. But again, in the middle of Siberia, it might be complicated.

Conclusion

As is often the case, no perfect solution exists. Electronic votes usually fail utterly when it comes to transparency. They improve on (honest) issue with counting, and might improve the speed of the voting. Internet/online vote may solve some special cases. But on the whole, they do not improve on the existing system in term of required features, and often get lower.

3

One point that is overlooked by these answers is the relative security of pen-and-paper voting. I recognize that because electronic voting is a departure from the traditional and accepted way of voting today it is inherently viewed more susceptible than electronic voting. However, if the standard is a system that is objectively in principle as secure as pen-and-paper voting, in person electronic voting with a paper backup is as secure for the reasons @MichaelMrozek lays out in his answer.

The standard, however, should be to improve upon the security of pen-and-paper voting, not merely match the same shortcomings it already has.

  • in person electronic voting with a paper backup has the advantage that counting the votes is quicker and more reliable. – gerrit Jan 17 '13 at 15:03
  • @gerrit agreed. But convenience does not equate to security which is the target of this question. – Michael Kingsmill Jan 17 '13 at 15:13
2

An empirical example is Estonia. In this Eastern European country, the government introduced electronic voting (i-voting) in 2005, and it is now the common standard for elections. They also debated the security issues for quite a while and as it shows here at E-Estonia.com, it seems to be quite safe (100 % security is not possible and no voting system can be completely secure) and also look at a recent comment on the Estonian voting system at Forbes.com I find the following statement in the text on vote security quite convincing:

"[...] [O]ne of the most common concerns regarding internet voting is the potential that one’s vote could be changed either by a virus on your computer or as your ballot transits the internet on its way to the central government servers. To address this, Estonia’s evoting system adds a novel twist: the ability to use your mobile phone to separately connect to the electoral servers via a different set of tools and services to see how your vote was recorded and verify that it is correct. After casting your vote using your desktop computer you can thus pull out your smartphone and verify the results that were actually received by the central electoral servers. The results are encrypted so that no government official can see how you individually voted, only you can see your individual voting choices, even as they are aggregated into the national totals."

So, this is not perfect, but it seems to have some merits which should be considered closely in future ideas on electoral and voting systems.

A political science study from 2009 on this could be obtained here (warning, paywall)

  • 2
    Welcome to Politics.SE! I have included the third link from your comment straight in the answer, so you may remove the comment now. Please also consider adding some crucial concepts/ideas from the linked articles straight into your answer, since the links are vulnerable to "link rot". – bytebuster Jun 22 '17 at 20:00
  • Also see the question Why hasn't Estonia discontinued e-voting? – Martin Tournoij Jun 22 '17 at 20:32
1

Pen and paper voting is not secure at all and is much more prone to manipulation than electronic voting.

Its main advantages are that everybody is capable of making basic checks for manipulation, and that manipulations don't scale. The damage you can do to a single ballot, a single ballot box, a single court house and so on require an increasing number of coconspirators without exceptions, with numbers and efforts in proportion to the tampered votes.

That makes paper vote manipulation inefficient. It does occur frequently enough that vote recounts are common, sometimes with noticeable discrepancies which suggest a systematic bias with some individual counters' perceptions. But all in all, the corrections are very rarely game changers.

Electronic voting, in contrast, can do a lot of falsification through a single successful attack vector.

0

I think you are asking the wrong question.

Is it possible to implement an electronic voting system which is believed by most voters to be as secure as pen-and-paper voting?

Is a better question.

A voting system has to be fair and seen to be fair, otherwise the loser’s supporters will not accept the result. No one has yet come up with electronic voting system that 99% of people can understand how it works in enough details to personally know it is secure.

-4

This thread is about voting machines - DREs and opscans - located at polling places. A secure Internet voting system would have no polling places. Long lines and time wasted driving to, and finding parking around, polling places is a more salient problem than the security comparison. However, there have been no convictions in the US of any voter for commiting fraud on voting machines. There are only sensationalized stories used to attract folks to websites and for selling books and newspapers. All the voting fraud cases in US history involve paper. Its obvious which is more secure. See my comment at What challenges remain for online voting? for more on Internet voting.

  • "There are only sensationalized stories used to attract folks to websites and for selling books and newspapers." Do you have evidence to back that up? – Steve Melnikoff Jan 17 '13 at 23:29
  • There have also been many examples of people voting illegally in elections, either because they were inelligible, or because they voted twice or more. – user1873 Jan 18 '13 at 3:52
  • User1873: not "many,' but a few - and this isn't relevant to using DREs for fraud.Brad Blog is a professional fear mongering website that has no facts about – William J Kelleher PhD Jan 18 '13 at 20:59
  • User1873: not "many," but a few - and this isn't relevant to using DREs (or voting machines) for fraud. Steve: Brad Blog is a professional fear mongering website that has no facts about DREs being jiggered to produce fraudulent results. Verified Voting is another one. Book - Gumble’s Steal this Vote – same. – William J Kelleher PhD Jan 18 '13 at 21:07
  • @WilliamJKelleherPhD: I don't dispute that there are websites and books which attempt to scare people away from the idea of electronic voting systems. What I do dispute is the use of the word "only" in that sentence, which makes it sound like anyone who criticises electronic voting is a scaremonger. You may wish to edit your answer to clarify that, and also to expand it to directly address the issues in the original question relating to security and fraud. – Steve Melnikoff Jan 18 '13 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.