At 11:05 AM 4/9/04 -0400, Trei, Peter wrote: ...
1. The use of receipts which a voter takes from the voting place to 'verify' that their vote was correctly included in the total opens the way for voter coercion.
I think the VoteHere scheme and David Chaum's scheme both claim to solve this problem. The voting machine gives you a receipt that convinces you (based on other information you get) that your vote was counted as cast, but which doesn't leak any information at all about who you voted for to anyone else. Anyone can take that receipt, and prove to themselves that your vote was counted (if it was) or was not counted (if it wasn't). (This is based on attending a presentation of David's scheme at George Washington a few months ago, a conversation I had with a VoteHere guy, and some conversations and documents given to me by each. I haven't tried to verify the protocols or proofs, but I'm convinced that all this is possible, modulo various assumptions. There may be a dozen other people doing similar things, that I've simply not heard of.) ...
1. How does this system prevent voter coercion, while still allowing receipt based recounts? Or do you have some mechanism by which I can personally verify every vote which went into the total, to make sure they are correct?
The way I understood these schemes, you can see the initial encrypted ballots (they're published), and then there are several rounds of publically verifiable shuffling and decryption by different TTPs. After the last round of shuffling and decryption, you have raw votes. So anyone can verify the count, assuming the set of initial encrypted ballots are legitimate. And anyone can produce a receipt that can be shown to be one of those encrypted ballots, if it was counted. That doesn't keep someone from stuffing the ballot box, but it does mean that anyone who throws away unfavorable votes is going to leave behind evidence, which can potentially call the whole vote into question. The way I saw these schemes described, there was no recount capability, but the count was done in a completely public way. It seems to me that this kind of scheme has a lot of potential for disruption attacks, since one compromised voting machine can be used to call any election into question. But I could be missing something, as this is really not something I've spent a lot of time on....
2. On what basis do you think the average voter should trust this system, seeing as it's based on mechanisms he or she cant personally verify?
I see your point, but there's an awful lot of any voting system that isn't being closely observed by the voters, or that isn't really well-understood by most of them. It's not so clear to me that the average voter is going to walk away convinced that a voter-verified paper ballot, or a mark-sense ballot, or whatever other thing isn't going to somehow be subject to attack. Or that if they do walk away convinced, that this has much to do with whether they *should* walk away convinced.
3. What chain of events do I have to beleive to trust that the code which is running in the machine is actually and correctly derived from the source code I've audited? I refer you to Ken Thompsons classic paper "Reflections on trusting trust", as well as the recent Diebold debacle with uncertified patches being loaded into the machine at the last moment.
Yep, this is a big issue. Which is why I think everyone with any sense agrees that we need some kind of independent audit trail, regardless of whether we're doing voting with computers, or with pens for punching out holes. There are a bunch of ways to do this, one obvious and pretty easy-to-field choice being voter-verified paper ballots.
This last is an important point - there is no way you can eliminate the requirement of election officials to behave legitimately. Since that requirement can't be done away with by technology, adding technology only adds more places the system can be compromised.
Huh? Do you think the same is true of payment systems? Those also ultimately require some humans to play by the rules, but it sure seems like a well-designed payment system can remove a lot of the ambiguity about who has violated the rules, and can outright prevent other kinds of rule violations. And it seems to me that this is very similar to the situation with voting. Touch screen voting (with the audio extensions) has at least one huge advantage over pen-and-paper schemes, because blind people can vote with them. The VoteHere and Chaum schemes provide other benefits (a lot of kinds of misbehavior by the authorities are prevented by the design, though of course, not *all* possible misbehavior), at various costs in system complexity, dependence on lots of interacting systems that might not be all that reliable, ability to recover from some low level of fraud, etc. Paper ballots printed behind glass provide a different set of tradeoffs. And you could design twenty other sets of tradeoffs. I'm not at all convinced that the way we optimize for best security is to minimize technology. I agree that it's easy to get carried away by the elegance of your mathematics, or by the really spiffy blinking lights on the computer, and forget the essentials. But technology and math aren't somehow inherently bad things to introduce to voting systems. It just has to be done in a way that makes sense, right? ...
I do think electronic voting machines are coming, and a good thing. But they should be promoted on the basis that they are easier to use, and fairer in presentation, then are manual methods. Promoting them on the basis that they are more secure, and less subject to vote tampering is simply false.
Less subject to vote tampering than the old machines with mechanical counters and levers? That's not too hard. Less subject to vote tampering than paper ballots marked by hand, that may be a little more of a challenge. I think it's more fair to say that the attacks and threats will be different, and that the risk of a class break (work out the details of the attack once, then change votes all over the country) is seriously scary. But it's sure not clear to me that adding computers to the mix must decrease security, or even must leave it unchanged.
Peter Trei
--John Kelsey, kelsey.j@ix.netcom.com, who is definitely speaking only for himself. PGP: FA48 3237 9AD5 30AC EEDD BBC8 2A80 6948 4CAA F259
One area we are not addressing in voting security is absentee ballots. The use of absentee ballots is rising in US elections, and is even being advocated as a way for individuals to get a printed ballot in jurisdictions which use electronic-only voting machines. Political parties are encouraging their supporters to vote absentee. I believe that one election in Oregon was recently held entirely with absentee ballots. For classic polling place elections, one strength of an electronic system which prints paper ballots is that there are two separate paths for the counts. The machine can keep its own totals and report them at the end of the election. These totals can then be compared with the totals generated for that precinct by counting the paper ballots. This redundancy seems to me to provide higher security than either system alone. Cheers - Bill ------------------------------------------------------------------------- Bill Frantz | "There's nothing so clear as a | Periwinkle (408)356-8506 | vague idea you haven't written | 16345 Englewood Ave www.pwpconsult.com | down yet." -- Dean Tribble | Los Gatos, CA 95032
John Kelsey wrote:
At 11:05 AM 4/9/04 -0400, Trei, Peter wrote: ....
1. The use of receipts which a voter takes from the voting place to 'verify' that their vote was correctly included in the total opens the way for voter coercion.
I think the VoteHere scheme and David Chaum's scheme both claim to solve this problem. The voting machine gives you a receipt that convinces you (based on other information you get) that your vote was counted as cast, but which doesn't leak any information at all about who you voted for to anyone else. Anyone can take that receipt, and prove to themselves that your vote was counted (if it was) or was not counted (if it wasn't).
The flaw in *both* cases is that it reduces the level of privacy protection currently provided by paper ballots. Currently, voter privacy is absolute in the US and does not depend even on the will of the courts. For example, there is no way for a judge to assure that a voter under oath is telling the truth about how they voted, or not. This effectively protects the secrecy of the ballot and prevents coercion and intimidation in all cases. Thus, while the assertion that "Only if all the trustees collude can the election be defrauded" may seem to be reasonable at first glance, it fails to protect the system in the case of a court order -- when all the trustees are ordered to disclose whatever they know and control. Also, the assertion that "All of this is possible while still m aintaining voter secrecy and privacy essential to all public elections" is incorrect, for the same reason. Moreover, the assertion that "Vote receipts cannot be used for vote selling or to coerce your vote" is also incorrect, for the same reason. These shortcomings do not depend on any specific flaw of a shuffling process, a TTP, or any other component of either system. Rather, it is a design flaw. A new election system should do "no harm" -- reducing the level of voter privacy and ballot secrecy should not be an acceptable trade-off for changing from paper to electronic records, or even electronic verification. Court challenges are a real scenario that election officials talk about and want to avoid. Without making voter privacy inherently safe from court orders, voter privacy and ballot secrecy are at the mercy of casuistic, political and corruption influences -- either real or potential. When the stakes are high, we need fail-safe procedures. Now, you may ask, is there any realistic possibility of a court order for all trustees to reveal their keys? Yes, especially in a hot and contested election -- and not only Bush vs. Gore. Many local elections are very close and last year an election in California was decided by *one* vote. For example, the California Secretary of State asked this as an evaluation question, when they were testing voting systems for the 2000 Shadow Election Project. The question was whether and to what extent the voting system could be broken under court order for example, if some unqualified voters were wrongly allowed to vote in a tight election and there would be a court order to seek out and disqualify their votes under best efforts. Perhaps a trustee could be chosen who would be immune even from a US court order? Well, not for a US election, which is 100% under state and/or federal jurisdiction. But there are additional scenarios -- a bug, Trojan horse, worm and/or virus that infects the systems used by all trustees would also compromise voter secrecy and, thereby, election integrity. Cheers, Ed Gerck
I think Ed's criticism is off-target. Where is the "privacy problem" with Chaum receipts when Ed and others still have the freedom to refuse theirs or throw them away? It seems a legitimate priority for a voting system to be designed to assure voters that the system is working. What I see in serious voting system research efforts are attempts to build systems that provide both accountability and privacy, with minimal tradeoffs. If some kind of tradeoff between accountability and privacy is inevitable, in an extreme scenario, I'd still prefer the option to make the tradeoff for myself, rather than have the system automatically choose for me. -- David
At 11:05 AM 4/9/04 -0400, Trei, Peter wrote: ....
1. The use of receipts which a voter takes from the voting place to 'verify' that their vote was correctly included in the total opens the way for voter coercion.
John Kelsey wrote:
I think the VoteHere scheme and David Chaum's scheme both claim to solve this problem. The voting machine gives you a receipt that convinces you (based on other information you get) that your vote was counted as cast, but which doesn't leak any information at all about who you voted for to anyone else. Anyone can take that receipt, and prove to themselves that your vote was counted (if it was) or was not counted (if it wasn't).
At 06:58 PM 4/15/04 -0700, Ed Gerck wrote:
The flaw in *both* cases is that it reduces the level of privacy protection currently provided by paper ballots.
Currently, voter privacy is absolute in the US and does not depend even on the will of the courts. For example, there is no way for a judge to assure that a voter under oath is telling the truth about how they voted, or not. This effectively protects the secrecy of the ballot and prevents coercion and intimidation in all cases.
David Jablon wrote:
I think Ed's criticism is off-target. Where is the "privacy problem" with Chaum receipts when Ed and others still have the freedom to refuse theirs or throw them away?
The privacy, coercion, intimidation, vote selling and election integrity problems begin with giving away a receipt that is linkable to a ballot. It is not relevant to the security problem whether a voter may destroy his receipt, so that some receipts may disappear. What is relevant is that voters may HAVE to keep their receipt or... suffer retaliation... not get paid... lose their jobs... not get a promotion... etc. Also relevant is that voters may WANT to keep their receipts, for the same reasons.
It seems a legitimate priority for a voting system to be designed to assure voters that the system is working.
As long as this does not go against the 'first law' for public voting systems: voters must not be linkable to ballots. The 'second law' also takes precedence: ballots are always secret, only vote totals are known and are known only after the election ends.
What I see in serious voting system research efforts are attempts to build systems that provide both accountability and privacy, with minimal tradeoffs.
There is no tradeoff prossible for voter privacy and ballot secrecy. Take away one of them and the voting process is no longer a valid measure. Serious voting system research efforts do not begin by denying the requirements.
If some kind of tradeoff between accountability and privacy is inevitable,
There is no such principle.
in an extreme scenario, I'd still prefer the option to make the tradeoff for myself, rather than have the system automatically choose for me.
You don't have this option when the public at large is considered, for a public election. You can do it in a private election for a club, for example, but even then only if the bylaws allow it. Cheers, Ed Gerck
Ed Gerck <egerck@nma.com> writes:
David Jablon wrote:
The 'second law' also takes precedence: ballots are always secret, only vote totals are known and are known only after the election ends.
What I see in serious voting system research efforts are attempts to build systems that provide both accountability and privacy, with minimal tradeoffs.
There is no tradeoff prossible for voter privacy and ballot secrecy. Take away one of them and the voting process is no longer a valid measure. Serious voting system research efforts do not begin by denying the requirements.
You get totals per nation, per state, per county, per riding, per precinct, per polling stion and maybe per ballot box. So there's a need to design the system to have more voters than ballot boxes to conform to your second law.
Yeoh Yiu wrote:
Ed Gerck <egerck@nma.com> writes:
The 'second law' also takes precedence: ballots are always secret, only vote totals are known and are known only after the election ends.
You get totals per nation, per state, per county, per riding, per precinct, per polling stion and maybe per ballot box.
The lowest possible totals are per race, per ballot box. The 'second law' allows you to have such totals -- which are the election results for that race in that ballot box. For example, if there are two candidates (X and Y) in race A , two candidates (Z and W) in race B, and only one vote per candidate is allowed in each race, the election results for ballot box K might be: Vote totals for race A in ballot box K: Votes for candidate X: 5 Votes for candidate Y: 60 Blank votes: 50 Vote totals for race B in ballot box K: Votes for candidate Z: 45 Votes for candidate W: 50 Blank votes: 20 Total ballots in ballot box K: 115 Because only the vote totals are known for each race, a voter cannot be identified by recognizing a pre-defined, unlikely voting pattern in each race of a ballot. This exemplifies one reason why we need the 'second law' -- to preserve unlinkability between ballots and voters.
So there's a need to design the system to have more voters than ballot boxes to conform to your second law.
No. All you need is that there should be more than one voter per ballot box. This is a rather trivial requirement to meet. Cheers, Ed Gerck
David Jablon wrote:
[...] Where is the "privacy problem" with Chaum receipts when Ed and others still have the freedom to refuse theirs or throw them away?
At 11:43 AM 4/16/04 -0700, Ed Gerck wrote:
The privacy, coercion, intimidation, vote selling and election integrity problems begin with giving away a receipt that is linkable to a ballot.
These problems begin elsewhere. Whether a receipt would add any new problem depends on further analysis.
It is not relevant to the security problem whether a voter may destroy his receipt, so that some receipts may disappear. What is relevant is that voters may HAVE to keep their receipt or... suffer retaliation... not get paid... lose their jobs... not get a promotion... etc. Also relevant is that voters may WANT to keep their receipts, for the same reasons.
These are all relevant issues, and the system needs to be considered as a whole. The threat of coercion is present regardless of whether there's a system-provided receipt, linkable, anonymous, or none. For example, I might be told that after I vote I'll come face-to-face with a thug around the corner, who will ask who I voted for, and who has a knack for spotting liars. Or I may be told there's a secret camera in the booth. Or I may think I'm at risk in simply showing up to vote, due to my public party affiliation records, physical appearance, etc. These issues must be addressed, and these concerns show that the integrity of receipt validation must be ensured to at least the same degree as the integrity of vote casting. But *absolute* voter privacy seems like an unobtainable goal, and it should not be used to trump other important goals, like accountability. -- David
David Jablon wrote:
... *absolute* voter privacy seems like an unobtainable goal, and it should not be used to trump other important goals, like accountability.
But it IS assured today by paper ballots. Nothing less should be accepted in electronic systems, otherwise new, easy and silent fraud modes become possible. Coercion and vote selling are just the most obvious. Ed Gerck
participants (5)
-
Bill Frantz -
David Jablon -
Ed Gerck -
John Kelsey -
Yeoh Yiu