It's easier to restore the security of elections run with paper ballots because people can get involved locally. It's not possible to steal numerous paper-based elections in a row -- at some point the thieves' energy/funding runs out and security can be restored. With a digital system, if the system is changed to be vulnerable, or if it always was, then there is no way to recover.
I don't agree with this statement. If the system is corrupt (take for example Russia), then the voting system doesn't simply matter. Having absolute access to millions of votes, either digital or on paper, allows any dictator to decide the outcome.
Millions of slips of paper are very easy to burn, and print...
E-votes just make it cheaper/easier to vote in free countries. I don't think we have invented a truly dictator-proof voting system available yet.
> It's not possible to steal numerous paper-based elections in a row
Why not? Estonia had paper ballot voting for the entire soviet occupation of about half a century, didn't have any effect on the amount of rigging though. Same with Russia today, they use paper ballots, but results still don't matter.
Paper vs electronic voting is just a small component in election fairness and there are upsides and downsides to both.
Because there's no theoretical room for fraud if you design the paper ballot system correctly so that the process is observed by independent and opposing parties and everyone is doing their job.
The key point being "everyone is doing their job". You need to make the system so transparent and involve so many observers/auditors that there's nowhere for corruption to hide.
If you threaten the opposition with prison (or worse) if they tell anyone about your fraud then you don't have a democracy to begin with. The only way to preserve any semblance of legitimacy is if you manage to keep thousands to tens of thousands of people quiet on all of this.
In the GDR the 1989 voting was an important trigger for the revolution. The citizens counted the votes too and could thus published election results independent of the official ones. So in effect it does stop that the rigging can be hidden.
> having the voting source code public and auditable seems like a good way to build trust
It's not the source code that matters. It's the whole architecture, design, supply chain, and implementation as in down to object code _including_ firmware.
Yes. But I'm slightly less worried about deliberate mishaps (which tends to leave trace or organisation) than pure mistakes (which go unnoticed, except for malicious actors who are better at hiding their trace.)
> Still, if you had the authorities to announce a product of large primes - whatever that means - how do you know they announced the correct primes and not something they made up? I'm afraid any clever cryptographic scheme you come up with falls the victim of the same dilemma: if you can check that your vote was counted right, you lose anonymity. Also how do you check no fake votes were added?
My take is that one should be able to check that a blockchain has not been altered/substituted, and the way to do that is by being able to record encrypted running tally blockchain heads, but this gives you no indication that the published blockchain faithfully represents the cast votes so you have to add paper ballots and an immediate partial manual audit of the paper ballots checked against the digital cast vote record.
Logic tests only show that the machines worked correctly as of the logic test. It's easy enough to design them to behave correctly in all cases except actual elections.
> It's easy enough to design them to behave correctly in all cases except actual elections
How? Any possible scheme I can think of that could theoretically allow a tabulation machine to behave differently on audit ballots than it does on real ballots, can also theoretically be mitigated via audit procedures.
> How? Any possible scheme I can think of that could theoretically allow a tabulation machine to behave differently on audit ballots than it does on real ballots, can also theoretically be mitigated via audit procedures.
An audit will only mitigate that if a) you have paper ballots you can check, b) the audit happens very soon after the closing of the polls. If an audit takes place a month later, that's a lot of time for the elections administration to create all new ballots to replace the originals with, so the audit has to come very soon after the election.
But updates are promised, so GP's question is valid: where are they, and since they're not there, why? Is this the final product's source code and it has not been modified since?
Parliament elections in Estonia happen once every 4 years so don't expect frequent updates. Next one should be in 2027 so there are still ~5 months for them to publish next update. There was also a municipal election in 2025 and European parliament in 2024 which matches last 3 updates in git history. No elections in 2026 so no updates this year.
If I understood correctly they make updates elsewhere, then update this repository only when elections happen, thus making the repository in the exact state it was used for that election.
In practice too. Elections are worth up to trillions of dollars. That means that agencies like state-level actors, and private actors with the necessary resources, will be tempted to mount supply chain and other attacks, and likely will succeed.
Faking paper ballots is totally doable, but you can take various precautions to make that very difficult. For example, you can deliver ballots to polling locations in sequentially-numbered packs and shuffle them at the voter sign-in desk: by shuffling the packs before delivery, by having the elections judges record which packs they got and which numbers went unused, by making them sign ballots prior to placing them on the sign-in table, and so on, you can make it very difficult for elections administration staff to later replace those paper ballots. But you're going to need timely, partial or full hand-count audits in order to make it necessary to replace paper ballots in order to replace results.
Election security is pretty expensive, but compared to the _value_ of elections, it's nothing.
> Elections are worth up to trillions of dollars. That means that agencies like state-level actors, and private actors with the necessary resources, will be tempted to mount supply chain and other attacks, and likely will succeed.
I think that is the essential point. How much is it worth for Russia or China or even Iran to change an election outcome? It could be existential. How about to a corporation, or of course a political party or well-resourced individual? Do you think some of those individuals might have the ability and resources, and the amorality and lust for power?
Remember that the task is not changing tens of millions of votes across the country; you only need to change a small proportion in the right localities to swing the electoral college. And you don't necessarily need to even change numbers there; just create errors that dissuade enough people from voting or add votes of registered voters who didn't show up to the polls. (And you can get ahead of these tasks with disinformation.)
Defending against them are relatively small manufacturers - i.e., this isn't Apple securing iPhones - and local election operations. Can Savannah, Georgia handle these attackers? Imagine being the national CSO for US elections (if there was one) and being asked to secure this absurd, distributed, decentralized system. All I would say is, 'we're switching to paper'.
> Private set intersection is a secure multiparty computation cryptographic technique[1] that allows two parties holding sets to compare encrypted versions of these sets in order to compute the intersection. In this scenario, neither party reveals anything to the counterparty except for the elements in the intersection.
Revealing even elements in the intersection, if that means revealing individual votes, breaks ballot secrecy.
Exactly, it means someone you could prove to someone else how you voted, which is the sine qua non condition for creating a vote economy. That's actually the main reason behind trying to keep the vote secret, much more than threats of intimidation for opposing parties voters, etc...
I mean, kinda. There are likely some blinded algorithms possible[1] in voting systems, and some crypto-systems allow you to falsify entries/queries so you can lie[2] (i.e. you can provide "proof" that you voted for anyone, so you can appear "on their side" if needed).
Are there any voting systems that have both of those qualities? I'm not sure, but I hope so, and the relatively-widespread existence of both seems like there's at least some possibility that one could be built.
reply