Defining the perfect voting machine

[ZOmegaZ]

There are obviously many levels of flaws with our systems of elections. Ballot access, voting method (yay approval voting!), the electoral college, monied interests, incumbent advantage, gerrymandering...

But today I'd like to talk about voting machines! I've always found voting machines problematic. Ballots can be mismarked, lost, faked, people can vote multiple times, there's no paper record, the machine design can't be inspected for flaws, voter anonymity can be compromised...

So [url=http://saladeggs.blo...ng-machine.html]here's[/url] what I'd do about it.

Ballots must be physical. The ballot should exist as a physical medium, allowing for recount by multiple independent parties.

Ballots must be machine-readable. The ballot must be marked in such a way that it can be counted by machine, for speed, efficiency, and repeatability.

Ballots must be human-readable. The ballot should be marked in such a way that an average human can read it, in case the counting machines are called into question or unavailable.

Ballots should be marked by machine. This prevents human error in ballot-marking in such a way that the ballot becomes invalid. It also allows for different human interface styles for voters with disabilities.

Ballots should be confirmed by the voter before final casting. Before the ballot is counted and stored, it must be read by the same machines that would count the votes in a recount. This ensures that the ballot is readable, and reduces the possibility of both mechanical and human error marking the ballot.

No machine, document, or person besides the voter should possess both the voter's identifying information and ballot contents. The ballot must not be marked with any potentially identifying information such as the user's name or a timestamp with precision finer than one hour. No person should see the marked ballot after it is marked besides the voter. Neither the printing nor reading machines should have any knowledge of the voter.

Ballots must be impossible to counterfeit. Exactly as many valid countable ballots should exist as votes are cast. Voters must be prevented from walking in with a pocket full of blank ballots; similarly, false ballots should be impossible to insert after the election ends. Practically, this means all ballots must be marked on-site with unique information that can be confirmed valid, but which is different on every ballot. As a first-guess suggestion, perform a one-way encryption on a timestamp. Then perform a two-way encryption on that, plus GPS coordinates, using an encryption key that is known only to a few high-level election officials. This ensures every valid ballot is unique, and allows each ballot to be tracked to the polling location it was marked, while maintaining timestamp (and thus voter) anonymity.

Ballots should only be issued to registered voters. It should be impossible to issue a ballot without also marking the name of a single registered voter off the roll. Similarly, it should be impossible to mark a name off a roll without issuing a ballot. Each registered voter should be issued a voting card before arriving at the polling location, containing cryptographically unique information to that voter. Only with the presence of that card will a ballot be issued.

Only one ballot should be issued to each voter. After a voter is issued a ballot, their name is marked on the roll. If that voter determines that their ballot was mismarked, they must turn it back in to receive a replacement. No replacement ballots can be issued without the original being returned.

The design and firmware of all machines involved must be open and inspectable. Maintaining voter trust in the system is paramount. Open-source and open-hardware systems ensure that no back doors or remote access is possible, and allow review for flaws by many thousands of coders and engineers.

It should be impossible to lose ballots without being noticed. The to-the-minute vote count should be constantly shared via network with the central election office. This creates a check against large numbers of ballots suddenly "disappearing" before being counted.

So here's the process.

1) I receive my voter card in the mail. The card is marked with a crypto-hash of my personal information, making it effectively impossible to fake.

2) I arrive at the polling location and present my card. My card is scanned, marking me from the roll as having voted. (Optionally, some biometric identification/photo check may be performed here, to prevent people from voting with others' voting cards.) A ballot is printed with spaces for all races in my district, plus a unique code identifying the ballot as legitimate and from this polling location.

3) I take that ballot to the marking machine. I insert my ballot, manipulate a touchscreen, and the machine marks my ballot for each race as I indicate

4) I take my marked ballot to the reading machine. I insert my ballot, and it tells me who it thinks I voted for. This machine also confirms that my ballot is properly marked with a valid crypto-stamp indicating a legitimate ballot.
4a) I confirm that my ballot is printed correctly, both visually and by machine. The machine keeps my ballot and counts my vote. I get a sticker and leave.
4b) I find an error in my ballot marking. I return to the poll worker, who inserts my ballot into the ballot-printing machine. The machine confirms that my ballot was valid, marks it with information which renders it invalid (including a human-readable timestamp), and issues a new one with new markings. Return to step 3.

What attacks are possible against this architecture? Obviously we have a problem with running out of ink. Perhaps we mark everything with high-power lasers? What else am I missing?

[TronPaul]

1) I receive my voter card in the mail. The card is marked with a crypto-hash of my personal information, making it effectively impossible to fake.

I'm not sure what you mean by crypto-hash. Do you mean hashing (a la sha256 or others) the information stored on the card? I'm not sure this would make it "effectively impossible to fake". More information is needed to verify that statement.

2) I arrive at the polling location and present my card. My card is scanned, marking me from the roll as having voted. (Optionally, some biometric identification/photo check may be performed here, to prevent people from voting with others' voting cards.) A ballot is printed with spaces for all races in my district, plus a unique code identifying the ballot as legitimate and from this polling location.

Unique code as in unique per ballot? How exactly will this code identify legitimacy and polling location?

[General Zod]

I think you're trying too hard to solve a problem that doesn't really exist on any significant scale.

Why not tie your voter record to thumb-prints? You give your name at the ballot box, they take a print and link it to a centralized database. If there's any significant change in the name associated with the thumb-print, or unusual behavior, they run an investigation to figure out what's going on. Anything else strikes of trying too hard to reinvent the wheel.

[ZOmegaZ]

1) I receive my voter card in the mail. The card is marked with a crypto-hash of my personal information, making it effectively impossible to fake.

I'm not sure what you mean by crypto-hash. Do you mean hashing (a la sha256 or others) the information stored on the card? I'm not sure this would make it "effectively impossible to fake". More information is needed to verify that statement.

Hashing is the wrong word, my bad. I meant two-way asymmetric encryption, digitally signed by the election department with a well-secured private key.

2) I arrive at the polling location and present my card. My card is scanned, marking me from the roll as having voted. (Optionally, some biometric identification/photo check may be performed here, to prevent people from voting with others' voting cards.) A ballot is printed with spaces for all races in my district, plus a unique code identifying the ballot as legitimate and from this polling location.

Unique code as in unique per ballot? How exactly will this code identify legitimacy and polling location?

Unique per ballot, yes. Again, a digital signature, so the ballot is stamped with the location of the machine, but in such a way that whoever stamped it must have had the private key. Also salted, so that you can't just get a valid ballot from a location and print that same stamp on home-printed ballots. I don't know why the phrase "digital signature" eluded me while writing this.

I think you're trying too hard to solve a problem that doesn't really exist on any significant scale.

The problem of having voting machines nobody trusts?

[General Zod]

The problem of having voting machines nobody trusts?

What's wrong with paper ballots?

[Maraxus]

I think you're trying too hard to solve a problem that doesn't really exist on any significant scale.

Exactly. SDN has this argument every time TimothyC gets his undies in a bunch at the thought that someone somewhere might somehow incorrectly cast a ballot. Voter fraud with intent to subvert an election basically doesn't happen in any significant way, certainly not enough to alter an election. There are many more important things that we should change if we want to make elections more equitable. Keeping turnout at national levels is a huge problem, one that either won't get fixed under this plan or will be made worse. That said, I can think of two things that this proposal needs to take into account.

1. What about same-day voter registration? Something like 15 or 20 states have same day voter registration, and more are planning on implementing it in the next few years or so. The problem is twofold. How would you get your unique ballot if you register to vote on election day? Since this would be (likely) impossible, how do you determine whether the added security is good policy? I don't think these new and improved ballots are necessarily a bad thing, but we definitely don't need to have lower turnout on off-year elections than we already do. These ballots seem like a great way of keeping turnout relatively low.

2. What about vote-by-mail elections? Like same-day registration, a couple of states have either mostly or all vote-by-mail elections. This system would royally fuck up election processes in Washington and Oregon, and would probably do the same in California and other states with large vote-by-mail blocks. And what about permanent absentee votes? How would the new ballots deal with them? If you can't have permanent absentee voters, do you have justification for getting rid of them?


Like OP said, there are a lot of flaws with the election system. Diebold isn't as much of a threat to American democracy as, say, one party pretty explicitly wanting to restrict ballot access. This proposal seems like a Rube Goldberg machine in the truest sense of the phrase.

[Maraxus]

The problem of having voting machines nobody trusts?

A problem so significant that voter turnout has gone up since those dastardly voting machines lost the public's trust

[TronPaul]

Honestly the only thing I really want out of voting machines is for them to be open source. Both the hardware and software. After that point, I stop thinking I know more than others around the logistics of a national/state election.

[Steel]

Honestly the only thing I really want out of voting machines is for them to be open source. Both the hardware and software. After that point, I stop thinking I know more than others around the logistics of a national/state election.

Ok, so if the software is open source, how could anyone possibly verify that what the machines are running is actually that software? You would need to compare binaries, and even then someone could inject something at runtime. This is not something that could be feasibly done to the machines before during or after voting.

Then at the next level, how do you know that where your machines send the vote respects the data sent to it?

[bilateralrope]

Why do you need voting machines ?

Lets compare a pen and paper ballot against those requirements:

Ballots must be physical.
They are

Ballots must be machine-readable.
Ballots must be human-readable.
Use the pen to fill in a box on the form.

Ballots should be marked by machine.
This prevents human error in ballot-marking in such a way that the ballot becomes invalid.
Educate the voters on what constitutes a valid ballot. Should they spoil a ballot before they put it into the box, there should be means to destroy the spoiled ballot and issue an unmarked one. Which only needs the person to go back to the polling staff and say it's invalid. The staff then put the old ballot into a shredder and issue a new one.

If the machine can't read it, pass it to a human to read. Or maybe multiple humans. If it's clear that there was an attempt to fill it in correctly, include it. Otherwise, discard it.

It also allows for different human interface styles for voters with disabilities.
Building a machine to mark the paper ballot seems feasible. A machine that only marks the ballot. It does not count the votes.
You could even reduce costs further by having those machines only at some locations and give the disabled free transport to them.

Or just allow someone who is unable to fill in the ballot themselves to bring in a human helper of their choice with them to the polling booth to fill in their ballot for them.
Ballots should be confirmed by the voter before final casting.
They can look at the paper ballot before they fold it in half and put it into the box.

No machine, document, or person besides the voter should possess both the voter's identifying information and ballot contents
Easily done. The identification is checked when they get the ballot paper. But only the vote goes on the paper.

Ballots must be impossible to counterfeit.
What's important is not preventing counterfeiting. But preventing the counterfeits getting put into the box. This can be handled by observers* who watch every part of the vote, except the actual marking of the ballot.

*Maybe trusted, independent observers. Or maybe multiple observers, so that each party has an observer they trust.

Ballots should only be issued to registered voters.
Polling location has a list of registered voters. When they issue a ballot they cross the name off their list.
Lists are checked after the polls close to make sure each person has only been crossed off one list.

The design and firmware of all machines involved must be open and inspectable.
The only part that might not qualify is the machine to mark the ballots of the disabled. But, as long as it's marking the square on the ballot that the user specifies, the internals do not matter.

It should be impossible to lose ballots without being noticed.
Rely on multiple human observers. Sure, one observer might overlook something that benefits their party. But the other observers, who support a different party, will speak up.

If that's not enough to satisfy you, add cameras that record everything.

[ZOmegaZ]

^So you're going to need thousands of observers per election, even for a middle-sized city. They have a hard enough time getting basic poll workers.

[Grumman]

Why not tie your voter record to thumb-prints?

Because it undermines the purpose of a secret ballot if your ballot paper is inevitably going to be marked with your ID?

[Purple]

You want to stop people voting twice? Here is a quick and easy solution. Adopt a nation level voter ID system. Each voter gets a number and is entered into the central database. When you come to vote, they ask your number and check if you have already voted. If not, they hand you a ballot and mark you in the database. Not only would it be much cheaper and easier to implement than the insane machinery proposed here but it would also give you nigh perfect turnout statistics.

[ZOmegaZ]

I want to stop people from voting twice, people from "losing" huge numbers of ballots from districts they don't like, ballot stuffing, elections decided by hanging chads, election machines designed by people who have a clear and publicly stated interest in a specific outcome...

[General Zod]

I want to stop people from voting twice, people from "losing" huge numbers of ballots from districts they don't like, ballot stuffing, elections decided by hanging chads, election machines designed by people who have a clear and publicly stated interest in a specific outcome...

"Voting twice" is such a rare occurrence that you're essentially trying to fix a problem that doesn't really exist. Frankly gerrymandering and voter suppression tactics are bigger, more relevant problems. Has the "hanging chad" even been an issue since 2000?

[Purple]

I want to stop people from voting twice, people from "losing" huge numbers of ballots from districts they don't like, ballot stuffing, elections decided by hanging chads, election machines designed by people who have a clear and publicly stated interest in a specific outcome...

All of that is sorted by having a centralized database. You can't vote twice because they crossed you off. You can't lose ballots from a district because the system counts how many people voted where. You can't stuff ballots because again the system counts how many people voted where. And because there are no election machines there is no way to tamper with the machinery.

All you need is SQL Server Express, the internet, a bunch of interns with a laptop for each and a list of all your legally eligible voters.

[General Zod]

Why not tie your voter record to thumb-prints?

Because it undermines the purpose of a secret ballot if your ballot paper is inevitably going to be marked with your ID?

No more than the current system undermines the purpose of a secret ballot.

[bilateralrope]

^So you're going to need thousands of observers per election, even for a middle-sized city. They have a hard enough time getting basic poll workers.

So increase how much you're offering to pay them until you can get enough people. Train the poll workers to also be on the lookout for problems. Democracy is worth the cost.
Maybe run the polls on the weekend. Not only will it be more convenient for everyone to vote, but you can get poll workers who have a regular job during the week.

Even if you go with voting machines you will still need observers to prevent anyone tampering with the machines. So I don't see how machines + observers can be cheaper than just having observers. And that's before considering the expenses of:
1 - Going over every line of code to make sure the machine doesn't have any intentional vote manipulation.
2 - Testing for any bugs that could affect the outcome
3 - Verifying that the code tested in 1 and 2 is the code that's installed on the machines.
4 - Providing some means to keep people voting even if the machines fail 3.
5 - Provide some means to keep voting even if the power goes out.

Tell me, what is your solution to problems 4 and 5, and why is that not suitable to be the method everyone uses ?

The only use I can see for voting machines is for the disabled (meaning not for everyone) or so whoever making them can adjust the results.

What's wrong with just looking outside the US, find a country which manages elections without the problems the US has, then copy whatever they do ?

[Simon_Jester]

Having had bitter experience with the logistical difficulties of using electronic testing in a facility where the infrastructure and power are... imperfect... I agree. There is a lot to be said for a system that continues to work no matter what goes wrong.

[madd0ct0r]

the uk just uses paper slips and human counters.

[Korto]

I imagine a machine where you have your touchscreen, or buttons (whatever, doesn't really matter), and it holds your hand through the voting process. It will warn you if you're about to create an invalid vote, but wont actually stop you. (Damn machine should know its place.)
Once you're finished your voting, and you press the "Finalise" button, it then prints out your ballot on paper, in a way completely understandable not only to a reader machine (which the form has been designed for, so there's no excuse), but also to a normal human being. This paper ballot is the real, official, vote. A unique ID is printed on the vote, and the vote and ID is also recorded by the machine electronically.
This ID only identifies the vote, not the person, who could have been anyone.
The voter can then check his paper ballot, and if it's correct he can stick it in the ballot box. If it's wrong, he can take it to an official, who'll stamp it "Cancelled" (saving it if the voter insists it was machine error), and the voter can have another go.

Immediate unofficial results of the election can be had from the computer records. The official is from the actual paper ballot count. If there's disagreement between the two, an explanation needs to be found. The ID numbers on the votes can help in this.

What this gives is an end to ballots rendered accidentally invalid or impossible to determine the voter's intentions. It can also help the illiterate by showing pictures on the screen of the different candidates.

[TimothyC]

I was summoned?

I want to stop people from voting twice, people from "losing" huge numbers of ballots from districts they don't like, ballot stuffing, elections decided by hanging chads, election machines designed by people who have a clear and publicly stated interest in a specific outcome...

Two Man Rule, combined with the fact that if you can't provide a two-man chain of custody for the ballots they are considered invalid.

"Voting twice" is such a rare occurrence that you're essentially trying to fix a problem that doesn't really exist.

Because Voter fraud doesn't exist - even when the NYC Department of investigation is able to vote fraudulently with near-trivial effort. I'd also like to point out that the fraudulent test voting was not caught by any of the systems that exist to catch such. If the system can't catch cases where we know fraud is happening, we can't trust it to catch cases where we don't know if there is fraud. This is why I think the systems need to be addressed. Sticking one's head in the sand and saying "The problem doesn't exist" is a good way to frustrate and get ignored by those who can point to such things as the above linked report and say "Here is a problem."

[General Zod]

Because Voter fraud doesn't exist - even when the NYC Department of investigation is able to vote fraudulently with near-trivial effort. I'd also like to point out that the fraudulent test voting was not caught by any of the systems that exist to catch such. If the system can't catch cases where we know fraud is happening, we can't trust it to catch cases where we don't know if there is fraud. This is why I think the systems need to be addressed. Sticking one's head in the sand and saying "The problem doesn't exist" is a good way to frustrate and get ignored by those who can point to such things as the above linked report and say "Here is a problem."

It's almost like you didn't actually read what I said.

[Spekio]

You want to stop people voting twice? Here is a quick and easy solution. Adopt a nation level voter ID system. Each voter gets a number and is entered into the central database. When you come to vote, they ask your number and check if you have already voted. If not, they hand you a ballot and mark you in the database. Not only would it be much cheaper and easier to implement than the insane machinery proposed here but it would also give you nigh perfect turnout statistics.

May I ask why is this not so in the U.S.? I have no less than three valid IDs in my person at all times, and one more at home. (Those being the National ID, Driver's Liscence, my Lawyer ID and a Passport).

For voting I have my Voter's ID that I need to carry alongside one of the aforementioned IDs above.

Also, couldn't you tie this to your social security number somehow?

[General Zod]

You want to stop people voting twice? Here is a quick and easy solution. Adopt a nation level voter ID system. Each voter gets a number and is entered into the central database. When you come to vote, they ask your number and check if you have already voted. If not, they hand you a ballot and mark you in the database. Not only would it be much cheaper and easier to implement than the insane machinery proposed here but it would also give you nigh perfect turnout statistics.

May I ask why is this not so in the U.S.? I have no less than three valid IDs in my person at all times, and one more at home. (Those being the National ID, Driver's Liscence, my Lawyer ID and a Passport).

For voting I have my Voter's ID that I need to carry alongside one of the aforementioned IDs above.

Also, couldn't you tie this to your social security number somehow?

The biggest problem with social security numbers is that right now there's millions of numbers being used by more than one person. There's also the question of how competently a government would actually manage such a database, and whether or not it could easily be used toward malicious ends. (Or at least really fuck over a lot of people without malicious intent.)