The current business model of elections is that the vendors have no requirements for open source, but they do have the requirement that their systems are subject to certification and testing. The certification process requires the vendors to share their source code with the testing labs.

For what it's worth, there have been a number of attempts at doing an open source voting system that could be commercially viable in the U.S. market, but none of them have achieved significant market share to date, except perhaps the Los Angeles VSAP system, but the source code isn't actually open yet (article from 2018, but I don't think anything has changed since then).

(I do consulting with another open source vendor, VotingWorks.)

Part of the issue is that elections are managed by municipalities. States have different rules and inside of states many counties have their own rules.

For a long time, hiding source code was thought to improve security. Voting machines are expected to last 10-20 years so it takes time to move to more modern notions of what makes something "secure."

Just use paper ballots FFS.

To be absolutely clear, there is no evidence of any tampering with the 2020 presidential election. We have high confidence that the election outcome was correct.

Here's the crazy part: there's nothing inconsistent with the above statement and saying that there are a number of security weaknesses in our election systems that we need to improve. We'd love to see more states adopt risk-limiting audits (the topic of this post!), which would improve our confidence in their elections. Similarly, it's great that the older generation of paperless electronic voting systems are being replaced with newer machines that use paper ballots. This helps mitigate against the worst risks of malware or tampering with voting systems' software.

For starters, the modern Dominion equipment uses a printed paper ballot. This means that every voter can (and should!) take the time to read the paper ballot that the machine produces and, if something is wrong, they can "spoil" their ballot and do it again. This is an important defense against any hypothetical tampering or malware with the software inside the machines.

After that, you're not being asked to trust machines. You're being asked to trust process. Those paper ballots travel in ballot boxes that are suitably sealed. Election officials tabulate the paper ballots with election observers and the press watching what they do. Georgia also did a risk-limiting audit (the topic of this Reddit post!) during the 2020 election which confirmed the result in the presidential race. (More details: Carter Center report, Georgia SoS's page)

As you might imagine, there's a lot more to it than I can summarize in a few paragraphs, but you should have some comfort that the combination of certification & testing, plus the use of the right kinds of policies & procedures, are where we gain confidence in our election systems.

The purpose of a risk limiting audit (the topic of this thread!) is to efficiently determine if the tallying process gets the correct outcome. That's an important defense against hacking.

Social engineering / misinformation / disinformation is an important topic as well, but that's outside of the election system, in the sense that we can't fight misinformation by improving how our voting machines work. That said, fighting misinformation is a huge challenge that election officials now face. (Summary of the issues from the Brennan Center.)

With paper ballots as a backup and protected from tampering, it's pretty hard to mess with a competent audit and not get caught.

U.S. elections are quite unusual relative to most other countries. Of particular note, we're often asked to vote on a huge number of contests. My ballot in Houston, Texas has I think 93 contests or propositions on it. This means that we require automation in order to get timely and accurate results. And therefore we must have computers around, but we need processes like risk limiting audits (the topic of this post!) to mitigate against the risks of malware or tampering with the computers.

Several countries are currently experimenting with Internet voting (Estonia, Switzerland, Canada, and more). This creates a variety of new risks that are harder to mitigate. What do you do to prevent malware on a voter's computer from tampering with their vote? What do you do to protect the servers against denial of service attacks? For contrast, consider that a paper ballot, whether marked by hand or by machine, once it gets into a ballot box, is beyond the reach of even the most sophisticated Internet attacker. There's nothing a foreign nation-state adversary can do over the Internet to modify ink on paper!

Of course, the real world is never quite so simple. I had the chance once to speak with Swiss officials about this, and they pointed out how 40% of Swiss nationals are physically outside the borders of Switzerland at any given time. And they might vote five times per year. Perhaps unsurprisingly, there's a strong demand for Internet voting, and an ongoing challenge to see if they can mitigate against those risks.

The earlier generation of paperless electronic voting systems, adopted in the early 2000's, have been widely studied and have been found to have significant security flaws (examples: California "top to bottom" review in 2007, Ohio EVEREST 2007). (I was one of the co-authors on the California review.)

As a consequence, all the new voting machines involve paper in one form or another. The two most popular forms are ballot marking devices, which have some sort of computer interface and produce a printed ballot, and hand-marked paper ballots, which are typically scanned by a computer, often bolted to the top of the ballot box ("precinct count optical scanner").

The magic of a risk limiting audit (the topic of this thread!) is that it provides an efficient process where a post-election audit can prove, to a desired level of statistical confidence, that any errors in the electronic tabulation are small enough that they don't change the announced winner of a contest.

So, RLAs let us have the efficiency benefits of computers, while still having the security properties that we want from hand tallies, without requiring the slow (and error-prone) process of hand counting.

We summarize the adoption of RLAs in the article linked at the top. The idea is about a decade old and is growing in popularity among election officials.

They have been used in Colorado for years, Rhode Island and Georgia in 2020. In addition, they have been used in counties in California, Indiana, and Illinois. Pilots have been done in at least 10 states.

Physical security (or, if you prefer, "chain of custody") is essential to all elections. Even if we're talking about hand-marked and hand-counted paper ballots, we still need to ensure that ballot boxes were sealed properly, transported properly, and guarded properly. Of course, when you add computers to the mix, physical security is even more important. This is an important reason for having post-election audits, like the RLAs we talk about in the linked article at the top of this post. An efficient post-election audit allows for discrepancies to be discovered before an election result is certified.

Physical security remains crucially important for risk-limiting audits as it requires the set of ballots cast by voters not to be altered (reflecting the set of legitimate cast ballots).

There's an entire academic discipline dedicated to the world of election integrity, and an important technique that's crossing the divide from academia to practice is called "end-to-end verifiable elections". Without getting lost in the technical details of how and why different encryption techniques are used, all of these voting systems generally include a concept called a "public bulletin board". If you squint at it, there isn't all that much difference between a public bulletin board and a blockchain. Both use cryptographic hash functions to build linear chains or tree-like structures.

The essential difference is that blockchains are "decentralized", which means that nobody is in charge. Instead, a series of unrelated parties reach a consensus as to what the blockchain means. In an election, however, all the parties are known in advance, and disputes are generally resolved through administrative processes or lawsuits. This means that public bulletin boards don't need consensus mechanisms. Instead, they're generally about publishing encrypted votes in such a way that a voter can verify that their vote was "counted as cast" (i.e., you get a strong proof that your vote was tabulated exactly as you cast it) as well as "cast as intended" (i.e., the machine didn't misinterpret your vote as you cast it). The exciting part of the cryptography is that we can achieve both of these properties without allowing you, the voter, to have enough evidence to be able to prove to anybody else how you voted (so, we don't enable bribery or coercion).

Each of our states have their own rules and procedures, but there are only a small number of equipment vendors for the vast majority of votes cast. This means, in practice, that we can't depend on diversity as much of a security mechanism. Instead, we need better process and procedures (like risk limiting audits!) to help mitigate against some of the threats we face.

Risk-limiting audits (the topic of this thread) are all about how to improve security with paper ballots. So a reasonable question for someplace that has paper ballots is "when are you going to do RLAs?"

Without paper ballots, we're back in the world of paperless electronic voting systems, which have been shown to have a variety of security vulnerabilities (discussed elsewhere in this Reddit). So a reasonable question for someplace that has paperless electronic voting systems is "when are you going to retire these machines and what's the plan to replace them?"

I'm not aware of any systematic voting machine election interference, at least in any U.S. election in anything resembling the modern era. If you go back far enough in time, you get plenty of well-documented messy elections. The story of "Landslide" Lyndon Johnson's victory in the 1948 Texas Senate Race is pretty amazing.

It's difficult to find evidence of this sort of thing. The most persistent rumors generally involve some form of bundling of vote-by-mail ballots. In the Rio Grande Valley of Texas, for example, they're called "politiqueros" or "politiqueras". It's unclear whether the impact of these sorts of activities are sufficient to change election outcomes, but Texas and other states have chosen to make it harder to vote by mail, claiming it would reduce fraud. Of course, whenever you change a policy like this, you'll have unintended effects, like making it harder for legitimate voters who might prefer to vote without needlessly exposing themselves to the risks of COVID.

https://xkcd.com/2030/

This sounds like an attempt at voter intimidation, which can be a violation of federal and/or state laws. Here's the ACLU explainer.

It's not really that simple. I could tell you that Rhode Island is amazing (try the grilled pizza!), but they face very different needs, never mind operating at a very different scale, from California or Texas. Small town elections are often done with hand-counted ballots, which is fantastic, but that would never work in huge cities, where it's just too slow and too error-prone.

> How can we put safeguards in place so that the machines themselves, i.e. their physical security, can be assured?

The most effective safeguard would probably be charging those people with the crimes they committed against the American people.

Why do you think one party or the other is worse about honest elections?

Republicans have been pushing for more observers, more verifications, elimination of mail in ballots, laws against ballot harvesting, etc.

The Democrats are opposing election security. I'm not saying they are necessarily trying to steal elections, but they are not doing investigations into voter fraud, and opposing common sense election security so you can't catch voter fraud if it happens!

This guy is detailing some great ways to ensure nobody (including your Republican and her goods) can mess with the results. Something I applaud. But note none of his solutions work with mail in ballots outside of a monitored polling station.

It's exceptionally difficult (read: expensive, time consuming) to do a forensic audit of the sort you're describing, and the adversary has an advantage in this game, because they could potentially engineer their malware to erase itself after the election is over.

The goal of RLAs and other kinds of election auditing procedures is to achieve a property called software independence, such that we can gain confidence in the correct outcomes of an election without requiring any confidence that the software is correct.

In my county we do L&A (logic and accuracy) testing. Both parties are involved everything is signed off and documented. I know this isn't forensic level, but what more would one want? We complete a test deck using ballot markers, test all races in all precincts. Tabulate them and output a print that checks against the test deck produced. All of this is held in archives and reviewable by the public. Machines are zeroed and sealed and will not be touched until election day.

What do you think? 2020 was the cleanest election in the history of the US…..mmmmmk those suitcases they pulled out after they told everyone to leave because voting would resume the next day and proceeded to frivolous scan document after document was completely normal and rational behavior. 81 million people voted for the big guy, he just doesn’t sell much merch.

Call Diebold

See earlier threads about end-to-end verifiable elections. Many of the same cryptographic techniques are used, but voting is very different from moving money around on a blockchain.

It's not a good match for national elections. It may work for participants within an organization which understand the tech and issues at hand, but there's too many problems for national voting.

For the purposes of this discussion, they're pretty much the same thing. Different equations, same end goal.

What they did was faff around and mess with numbers they didn't understand.

It's really the audit part that's important. Statistics and such topics. On the CS side maybe cryptography, if you want to learn about that part of electronic voting. There's /r/crypto (I'm a mod there) and /r/cryptography where you can ask questions.

Sure the machines are sitting in minimally secured voting places. And usually they are already plugged in and charging. But they cannot be turned on without breaking seals and loading the election by entering passwords. And even if someone went in and ran up one or many votes overnight, when poll workers arrived they would notice the seals were broken and public/protected counts would be off. And in our case, there would be paper ballots in the bins of the tabulator. All red flags that would be immediately investigated. We would see it in the logs and it would be painfully obvious.

It's not a good idea to leave them exposed, but ideally shouldn't bea huge risk. And with paper backups and audits that risk can be minimized.

Because nobody except you should know who you voted for. You vote in private so that nobody has influence over your vote. If there was a chance spouses, employers, or friends could confirm how you cast your votes, your votes would be influenced.

The mules film was debunked in full before it was published.

Why does the name matter?

The wifi thing is a process issue. Local staff messed up. And in other countries they don't even need to mess with machines. If you control the whole thing with no insight and no audits you can just lie about the result regardless how the vote happens.

With paper backups AND independent audits none of that is a problem because the real count can be verified by hand, it would be obvious if it differs from what the machine reports. In western countries there's enough insight into how the voting is run to detect attempts at manipulation.

Not to mention electoral college and gerrymandering. Or the fact that federal elections aren't federally regulated. States can do whatever the hell they want as long as in the end, their electors produce their handful of votes.

The electors aren't even required to vote according to the states outcome!

People vote for the corrupt politicians.

To combat them, you have to get people to stop voting for them.

The current state of things has people wanting corrupt politicians, and the only way to change that is to talk to people and change their mind,

Why do people who were involved in Jan 6 arraignments and cases keep getting delayed? Why is Steve Bannon the only person to go to jail for contempt when so many others have refused to attend congressional hearings? Eric Holder, Bill Barr, Chad Wolf, Henry Kissinger, Lois Lerner were held in contempt yet no one else has gone to jail. It’s called a kangaroo court and the Biden administration reigns supremely over it. I’ve never saw an administration vehemently attack its political adversaries like Biden’s. And the out right lies while they protect the likes of Hunter Biden, Andrew Cuomo, Nancy “The Bull” Pelosi. And btw wth are you even talking about?