This reminded me of an idea somebody else had of publishing everybody's votes in a federal or state election to the web. Everybody would get a unique, secret key right after voting with your voting choices. The machine would publish that key and the vote, but not your identity. You would then be able to, in the privacy of your own home, confirm that your vote has not been altered, while keeping your vote secret unless you choose to make your secret key public. Assuming enough people found discrepancies, a major revolt could be created in the event of the elections officials altering results in closely contested elections.
If only we could get a transcript of legislators' or government officials' conversations with influence groups...
This reminded me of an idea somebody else had of publishing everybody's votes in a federal or state election to the web. Everybody would get a unique, secret key right after voting with your voting choices. The machine would publish that key and the vote, but not your identity. You would then be able to, in the privacy of your own home, confirm that your vote has not been altered, while keeping your vote secret unless you choose to make your secret key public.
If you can prove you voted a certain way, that's a big problem in itself.
Estonia (which has internet based voting) solves this by letting you check your vote on a different device but for only a short time period.
The thinking is that even if someone has managed to compromise, say, your laptop (e.g. through a specially constructed virus) to secretly switch your vote to a different party, then they'd also need to be able to compromise your phone too to persuade an entirely different piece of software to also report your vote back to you wrongly. Not impossible, but a much harder task (especially as you'd need to manage to do it for everyone, or else there'll be a big outcry from the large number of people who notice a discrepancy).
Being able to prove you voted that way during that time period doesn't really matter, as the system already allows you vote as many times as you like, with only the last one being counted. (i.e. if someone tries to coerce you, or buy your vote, you simply vote their way, and then, when they head off to the next person, log back in again and vote the way you originally wanted.)
For those that wonder why: Imagine organized crime saying things like, "You will prove to us that you voted this way, or we will burn down your house".
Actually, when talking about possibilities for election fraud in contested places, threats seem much more common and plausible than simple votes-for-cash trade. It's more widespread in places with less democratic traditions, but USA history has also a fair share of examples.
The most common current method worldwide for "vote buying" seems to be done by large regional employers organizing voting as such for their employees (time schedules, transportation, lunch/party after voting), sometimes that can be very effective as strategic voting (i.e., bussing large numbers of voters to a different district). If the votes would be actually verifiable, then even without any illegal violence it'd simply mean near-permanent unemployment in that town for "wrong-party" people.
And that's about ordinary elections. For a different example, the recent referendum for Crimea joining Russia, according to their official results, had ~32000 people voting against. I'm not informed about what's happening in Crimea now, but I'm very sure that if I was one of them, I wouldn't want that vote to be verifiable - the hypothetical risks far outweigh any possible benefits.
Even "ordinary" elections have a similar risk to Crimea in some parts of the world - if I lived in the Basque Country in Spain, and voted for the (mainstream, right wing) Partido Popular I wouldn't necessarily want that to be published.
You don't even need to go to organized crime; there's your parents, boss, church, friends, help group (e.g. AA), etc. Essentially everyone that holds some influence over you.
Such a system should obviously only allow a voter to prove to themselves
that their vote was counted incorrectly. Some part of the secret would have to be retained in the voters memory in such a way that the voter can claim to others that they have voted in any way that they choose.
The goals "voters should be unable to prove their vote to vote-buying politicians/violent gangs" and "voters should have indisputable evidence they can take to the press if their vote has been miscounted" seem fairly contradictory to me.
I think the reason we don't do something like that is that an adversary (say, an unethical employer) could require you to provide your secret key to check that you voted a certain way.
Besides, we already have quite good protocols to ensure verifiability of votes: Put what you voted for on a piece of paper, and drop it in an urn. Allow observers to follow the urns everywhere, and observers from all parties to be present and take part in counting.
It's so effective that the first thing people do when they want to rig votes is to try to take away the paper and/or the observers, sometimes with threats of violence.
If people want quick results, while retaining the benefits of paper ballots with a proven provenance, we have the easy solution: Electronic voting where the machine prints out what you vote for, and ask the voter to confirm what was printed is what they voted on, and have the voter put that printed receipt in an urn like before. Then you can have near instant results from the machines, and can still more slowly verify a sufficiently large random sample of urns of paper receipts to ensure the numbers match.
It doesn't seem to be in any way related - the system described in your link tracks the ballots and "proves" (actually, reports) that they were counted.
It, at least as described, doesn't in any way allow to verify if that vote was counted as you intended, it's a proper closed vote with all the related assumptions about trust and need to physically monitor the voting and counting to prevent fraud.
the votes are prime numbers that are multiplied into a composite number. to verify your vote, divide the published composite by your prime twice. If it shows up with an integer remainder after the first division, your vote was counted at least once. After the second division, it was counted multiple times. Non integer for the second division, only counted once.
Comments
This reminded me of an idea somebody else had of publishing everybody's votes in a federal or state election to the web. Everybody would get a unique, secret key right after voting with your voting choices. The machine would publish that key and the vote, but not your identity. You would then be able to, in the privacy of your own home, confirm that your vote has not been altered, while keeping your vote secret unless you choose to make your secret key public. Assuming enough people found discrepancies, a major revolt could be created in the event of the elections officials altering results in closely contested elections.
If only we could get a transcript of legislators' or government officials' conversations with influence groups...
This reminded me of an idea somebody else had of publishing everybody's votes in a federal or state election to the web. Everybody would get a unique, secret key right after voting with your voting choices. The machine would publish that key and the vote, but not your identity. You would then be able to, in the privacy of your own home, confirm that your vote has not been altered, while keeping your vote secret unless you choose to make your secret key public.
If you can prove you voted a certain way, that's a big problem in itself.
Estonia (which has internet based voting) solves this by letting you check your vote on a different device but for only a short time period.
The thinking is that even if someone has managed to compromise, say, your laptop (e.g. through a specially constructed virus) to secretly switch your vote to a different party, then they'd also need to be able to compromise your phone too to persuade an entirely different piece of software to also report your vote back to you wrongly. Not impossible, but a much harder task (especially as you'd need to manage to do it for everyone, or else there'll be a big outcry from the large number of people who notice a discrepancy).
Being able to prove you voted that way during that time period doesn't really matter, as the system already allows you vote as many times as you like, with only the last one being counted. (i.e. if someone tries to coerce you, or buy your vote, you simply vote their way, and then, when they head off to the next person, log back in again and vote the way you originally wanted.)
For those that wonder why: Imagine organized crime saying things like, "You will prove to us that you voted this way, or we will burn down your house".
Or, perhaps more plausibly: confirmable voting makes it much more tractable for corrupt candidates to buy votes.
Actually, when talking about possibilities for election fraud in contested places, threats seem much more common and plausible than simple votes-for-cash trade. It's more widespread in places with less democratic traditions, but USA history has also a fair share of examples.
The most common current method worldwide for "vote buying" seems to be done by large regional employers organizing voting as such for their employees (time schedules, transportation, lunch/party after voting), sometimes that can be very effective as strategic voting (i.e., bussing large numbers of voters to a different district). If the votes would be actually verifiable, then even without any illegal violence it'd simply mean near-permanent unemployment in that town for "wrong-party" people.
And that's about ordinary elections. For a different example, the recent referendum for Crimea joining Russia, according to their official results, had ~32000 people voting against. I'm not informed about what's happening in Crimea now, but I'm very sure that if I was one of them, I wouldn't want that vote to be verifiable - the hypothetical risks far outweigh any possible benefits.
Even "ordinary" elections have a similar risk to Crimea in some parts of the world - if I lived in the Basque Country in Spain, and voted for the (mainstream, right wing) Partido Popular I wouldn't necessarily want that to be published.
You don't even need to go to organized crime; there's your parents, boss, church, friends, help group (e.g. AA), etc. Essentially everyone that holds some influence over you.
Would it be okay if you could verify the whole process, but couldn't prove which way _you_ voted? One such scheme is outlined at https://www.schneier.com/blog/archives/2006/10/new_voting_pr...
Such a system should obviously only allow a voter to prove to themselves that their vote was counted incorrectly. Some part of the secret would have to be retained in the voters memory in such a way that the voter can claim to others that they have voted in any way that they choose.
The goals "voters should be unable to prove their vote to vote-buying politicians/violent gangs" and "voters should have indisputable evidence they can take to the press if their vote has been miscounted" seem fairly contradictory to me.
I think the reason we don't do something like that is that an adversary (say, an unethical employer) could require you to provide your secret key to check that you voted a certain way.
Very good point Spoom. I wonder which is worse: adversaries or corrupt organizations, or corrupt election officials / a tyrannic government.
I think it depends on the ability you have to defend yourself against either, either as an individual or as a society.
Confirmable votes happily wins you the worst of both worlds, and so can be dismissed easily.
Besides, we already have quite good protocols to ensure verifiability of votes: Put what you voted for on a piece of paper, and drop it in an urn. Allow observers to follow the urns everywhere, and observers from all parties to be present and take part in counting.
It's so effective that the first thing people do when they want to rig votes is to try to take away the paper and/or the observers, sometimes with threats of violence.
If people want quick results, while retaining the benefits of paper ballots with a proven provenance, we have the easy solution: Electronic voting where the machine prints out what you vote for, and ask the voter to confirm what was printed is what they voted on, and have the voter put that printed receipt in an urn like before. Then you can have near instant results from the machines, and can still more slowly verify a sufficiently large random sample of urns of paper receipts to ensure the numbers match.
Well, there are auditable voting protocols which don't suffer from this problem (David Chaum has done lots of work on this), so you don't have to choose. https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy...
You're describing part of a system tried in Washington State in the 90s. https://news.ycombinator.com/item?id=4771264 is where I wrote it up.
It doesn't seem to be in any way related - the system described in your link tracks the ballots and "proves" (actually, reports) that they were counted.
It, at least as described, doesn't in any way allow to verify if that vote was counted as you intended, it's a proper closed vote with all the related assumptions about trust and need to physically monitor the voting and counting to prevent fraud.
the votes are prime numbers that are multiplied into a composite number. to verify your vote, divide the published composite by your prime twice. If it shows up with an integer remainder after the first division, your vote was counted at least once. After the second division, it was counted multiple times. Non integer for the second division, only counted once.