Would an online voting system using a secure id be more subject to coercion than the current mail in ballot system?

Question

A system which allows each voter to audit his vote in the final result via a unique ID has been suggested. The arguments against seem centered around the secrecy issue and coercion.

For example, a boss wanting his employees to vote for his candidate, and coercing them to provide their unique id so he can verify.

The system would also enable vote buyers demand the unique id in exchange for money.

I don't doubt these could happen, but either would be a serious crime. How would that be different from someone demanding the login for my bank account?

These crimes would be difficult to pull off today with whistlblower methods available.

I think we really need a more reliable means to audit the voting system, especially since more folks will be demanding mail in ballots.

The current methods allow us no means to verify that our vote has been properly tallied in the final result. The ability to locate one's private id and audit one's selections in the final database would close that gap.

ADDENDA 12/12/2020-A number of the questions do not fully consider what I have in mind. I am not a coder, but I do have a lot of data management experience, including mining data from public databases.

I created a simple example in Google Sheets of a ballot form for an election. The form consists of selecting from three candidates, and at the bottom is a form input box where the user makes up his own unique passcode. That passcode is submitted with the form along with the passcode. The selections appear in the database on the same row with the unique passcode. No one knows who that passcode is associated with. In the Google sheet example, Google requires their own login, tied to your email address, and they only allow one vote per a given email. I don't propose using Google for elections, it's just a simple way to make an example. I propose an open source program which can also be mirrored to a read only file available to the public. Any tampering to the software can be monitored publicly.

That brings us to the database. It would contain columns for a timestamp, the secret password and the votes of the user. This database would be secured, and a read only mirror displayed at the end of the election, (and possibly even during the election) A user would either have access to only his information prior to the election using his login (google account in this example, but through the registrar in the real world) If he finds error, or even changes his mind, he can edit his choices right through the close of polls. If he votes, and finds that his entry has been altered, he can notify authorities of the error.

At the end of the election, the full database would become available for public on a read only mirror. You can download the entire database, and find your vote by searching for your unique ID. This database could also be printed and available for viewing at the registrar's office, if you think your computer or the online database is hacked.

If anyone has ever written his congressman about an issue, and received a boilerplate reply, they you learn quickly that the only thing we really have is our vote. Politicians say that all the time, your vote is paramount to democracy. I agree, and so I want to be certain that my vote is counted in the manner I intend. This is of paramount importance.

Beyond that, input from individual voters would become a large wave if enough people find errors, and a serious investigation would ensue. It would probably not be that difficult to find the breach with that many errors. We already have this gap between election day and the seating of the electors, so there would even be time for a redo if we find wholesale problems. Perhaps we could try this in a few locations first and see how well it works, even as a "beta test" with the normal methods being used as a control test.

Answer 1

This is a solution in search of a problem

I think we really need a more reliable means to audit the voting system, especially since more folks will be demanding mail in ballots.

Mail-in voting is not some new thing. The US has been doing it for decades. 24 states do 100% mail-in voting, or had no-excuse mail-in voting prior to 2020.

I live in Oregon which has been 100% vote-by-mail since 2000. Oregon has been watching the fretting about mail-in voting like some anti-Cassandra trying to tell people everything will be fine, but they don't believe us. While many hypothetical ways mail-in ballots can be made fraudulent have been put forward, a lot of them are the same old tired stuff. None have borne out after the extensive scrutiny. The one upside of all the frivolous and evidence-free 2020 lawsuits is to demonstrate that yes, mail-in voting is secure.

One must be very careful and conservative before changing how people vote because any new system will introduce new methods of fraud, disenfranchisement, and voter suppression. While deliberate fraud is almost non-existent, disenfranchisement and voter suppression are very real.

It doesn't solve the problem

How do you know when they say "yes, you voted for A" that they didn't switch it to B, but tell you A?

The whole premise of this question is that we don't trust the voting system, and the vote can be secured if the citizens can individually check their vote. But they're not checking their vote. They're asking the same people they say they don't trust to count their vote correctly to tell them whether they counted their vote correctly.

Consider that any system would be using a copy of the ballot record; there's no way the real record would be exposed online, that's a security nightmare. How do you know this copy is a true record of how you voted?

Elections can be verified without knowing the identity of the voter

The current methods allow us no means to verify that our vote has been properly tallied in the final result.

In Oregon, I am informed that my vote was received, but not how my vote was recorded. This is by design.

There is no need for me, a private citizen, to know how my individual vote was tallied to audit the election. The paper votes can be audited and recounted en masse without needing individual identities. What protects the US election system is its decentralized and visible nature. To alter enough votes to change an election requires a wide number of people from multiple parties and organizations (volunteer ballot counters, partisan and independent observers, county and state officials) to all be in a conspiracy together.

Each ballot has its own unique ID to prevent double voting. All the audit needs to know is yes, this an official ballot and it was counted only once.

Ballot secrecy is very important

A system which allows each voter to audit his vote in the final result via a unique ID has been suggested. The arguments against seem centered around the secrecy issue and coercion.

Ballot secrecy is extremely important to free and fair elections. As mentioned above, disenfranchisement and voter suppression are very real. Voter ID laws to prevent imagined fraud often result in real voter suppression.

For ballot secrecy to work, once the voter is identified their vote is separated from their identity. In Oregon vote-by-mail this is done by signing the envelope, not the ballot. After the signature is matched the envelope and ballot are separated. The ballot has its own unique identifier to guard against double voting. This all worked as designed in Georgia.

Your proposed unique ID could be implemented by allowing voters to keep their ballot's ID and look up the vote based on that ID. This opens up many ways in which ballot secrecy can be violated. It can be lost, stolen, or coerced without their even knowing.

Right now, the secure chain of a mail-in ballot happens after I've filled out the ballot, put it in its security envelope, and signed and sealed it. If I don't want to put it in the mail, I can drop it off at any number of official, secure drop boxes. Prior to that point, I can happily leave my ballot sitting out. There's no secret information in a ballot until I fill it out.

If I can see how I voted based on the ballot ID, the secure chain begins when the ballot is placed in an envelope with my name on it. This increases the "attack surface"; the number of places where my ID could be stolen. Before I even open it, what if someone peeks inside and reseals it? Now they must be delivered in security envelopes. Once delivered and opened I must keep it secure. What if an unscrupulous housemate, partner, or visitor peeks at my ID and later checks on my vote?

Hundreds of millions of voters must understand these risks and mitigate them. Even if it was 100% safe, for some just the idea that someone might find out how they voted will cause them not to vote; usually people who are more vulnerable. Since individual voter verification is not necessary to audit the election, don't even take the risk.

Such a system risks exposing how everyone voted

Ballot secrecy is secured because someone has to both know what your ballot ID is, and how that ballot ID voted. If those two pieces are kept separate and difficult to access they're easier to secure.

I don't know if a database of ballot IDs to individual votes exists; it's not necessary to tally the votes. Creating one makes security and privacy problem. If stolen, and if it's online it will be stolen, the attackers can expose one half of how everyone voted. If someone gains access to the poll books mapping people's names to their ballot ID, they have the whole record.

Ballot secrecy works because there are firewalls preventing any one person from gaining access to all the pieces, and this crumbles one of them.

If making stealing the ID a crime is good enough, why not all voter fraud?

I don't doubt these could happen, but either would be a serious crime. How would that be different from someone demanding the login for my bank account?

Or how would that be different from stealing someone's ballot?

All voter fraud is a crime. If you feel making stealing someone's unique ID a crime is good enough, then that should be good enough for any perceived insecurity in mail-in ballots.

Online voting systems are a security nightmare

Obligatory XKCD.

The idea opens up holes when implemented with paper ballots. When combined with online voting, the whole thing is a nightmare. Trust me, I'm a software engineer.

Paper is pretty simple and paper systems are transparent. Commercial software is a black box. Even if we required voting software to be Open Source, Australia does, software is ludicrously complex. Even without intentional fraud, a single mistaken line among thousands by a single developer could throw elections and nobody would ever notice. Voting software must be re-tested and re-certified after every change.

That's just software. One of the nice things about paper ballots is they require locality to be attacked. You have to physically be at the same place as the pieces of paper. This alone makes it very difficult to implement significant fraud without involving many, many, many people, each of which is an opportunity to get caught.

Putting voting online invites the entire world to attack your voting system invisibly and anonymously.

To use an analogy: If someone wants to break into your house they can. Keyed locks can be picked pretty easily, or forced, or break a window, drive a car through the wall... yet we still use keyed locks and they work if law enforcement is functioning. All the ways I mentioned are physical. They all require a person to go to your individual house and put themselves in danger of being caught. They're limited to how many houses they can visit. Each visit increases their exposure.

Online security is different. Anyone can try to break in to any house, at any time, from anywhere, anonymously, as often as they like, with little risk to themselves. They could be in another legal jurisdiction. They can test millions of doors at the same time, repeatedly. They can be as noisy as they like. If a fault is found, all houses with that vulnerability are immediately at risk.

Paper ballots are like keyed locks. They work because they are physical objects. Their attack surface is limited. Attacking exposes the attacker. The attack can be seen with a glance: hey, there's someone at my front door. There's only so many an attacker can reach. Altering paper ballots leaves a literal "paper trail".

Online security and online voting cannot get away with what paper ballots and keyed locks can. They need to be far, far, far more secure. Their attack surface is the entire planet. The attacker is not exposed. The attacks can be invisible unless you know what you're looking for. Attackers can run millions of attacks in parallel 24/7. There is no paper trail, the attacker can destroy electronic logs.

And that's why we don't vote online.

Answer 2

Three different questions here, really:

• Is an electronic system with some sort of personal password more or less secure than a paper absentee ballot?
  Depending on how it is implemented, it could be more or less secure. skeptics.stackexchange.com: Does United States have no technology to allow Internet voting in a secure way?

  • An electronic system could be organized so that different parts of the key are delivered by different means. This might be better than a traditional paper absentee ballot, which could be intercepted by a third party with access to the physical mailbox of the recipient. (Scenario: A neighbour knows that a potential voter will not vote and never checks the mailbox before lunch, and requests an absentee ballot in his or her name.)
  • An electronic system might be attacked by malware on the computer where the vote is entered. A paper-based system is less vulnerable to these automated mass attacks. (Scenario: Some clever exploit installs a background process. Once the voter tries to vote, a fake site is displayed and the input of the key is captured.)
  • A paper-based absentee ballot request has a field for the signature of the voter. In theory, this signature could be compared to any other signatures of the voter the parish has on file. (How much trust do you have in the actual comparison of handwritten signatures?)

• If any part of the voting process is out of plain sight of election officials, how can they be sure there is no coercion?
  Just about anybody has a phone with a camera these days. How do you stop them from filming their own voting process, either in their home or even in a polling station? Voters could be coerced/bribed to show the video of the process. Nobody suggests to strip-search all voters. (Scenario: "If you don't want to be fired, take a video from the time you enter the polling booth to the time you leave.")

• Is there a need for absentee voting reform?
  Attempts to prevent fraud through surveillance also make it harder for legitimate voters to cast their absentee ballot. From most credible news reports, disenfranchisement through bureaucratic hurdles is much more common than voter fraud.
  skeptics.stackexchange.com: Is voter fraud practically non-existent in the United States?

A last point regarding audits, that's a really good reason to keep paper ballots, ideally with ink marks rather than hanging chads. Election officials and later judges can look at the shape of the mark as often as they want without fear that chads will move. And counting might be organized so that members of the public are able to witness the whole count.

The obvious drawback is the manual effort, with risks of manual mistakes, and the need to store ballots securely for any recount.

Answer 3

No. In all of the relevant ways they are functional equivalents of each other.

It is no different than the difference between a system where ballots are delivered by prepaid postal service envelopes and a system where ballots are delivered by prepaid FedEx envelopes.

Answer 4

Theoretically, a fully electronic voting system that is reasonably foolproof could be developed. After all, we have credit card payment systems that handle billions of transactions without major incidents of fraud. And, most federal income tax returns are processed electronically today without widespread fraud.

DoD and State Dept operate very secure systems... when someone too important to critique doesn't bypass those restrictions.

Since a person's vote is supposed to be anonymous, an employer trying to impose a political agenda upon its employees would have a hard time figuring out who voted for who. One would assume that any electronic voting system would keep the voter->vote association confidential, at least legally.

We have to keep in mind the context that the pandemic and lockdowns are somewhat unprecedented, at least in recent history. That they happened in a presidential election year amplified the consequences of problems.

This was an unusual situation. States had to handle a potentially huge volume of mail in votes, that current absentee ballot systems were ill equipped to handle. And they had to do it while wrestling with their own employees under a lockdown. Even under optimal circumstances, they would make mistakes, and these weren't optimal circumstances.

Point being: an electronic voting system can be developed that is reasonably secure. But, it can't be developed during a pandemic, with only a few months to make it foolproof.