Hacker News new | ask | show | jobs
by hacker_9 3494 days ago
Why do Americans use voting machines exactly? I mean, it just prints out their choice at the end right? What benefit do they actually gain from having pressed buttons instead of using a pen? It just seems to fuel the hacking conspiracy every time a president is elected.

In the UK we turn up, go into the booth with the paper slip, and tick our choice with a pen. Then we fold it and post it into a container which later gets shipped off to the counting room. I just can't understand why you guys have to physically turn up if you are just going to select your answer on a computer anyway.

9 comments

Hi Hacker_9. In Texas, where I vote, the machines don't even print paper. We just have to trust that the machine correctly recorded our vote. The reasons for the machines are, 1. cost cutting over manual counts, 2. profiteering by well connected companies, 3. And potentially making sure only the "right" votes count, although that part isn't proven.

In California we were able to vote at home with a mail-in, paper ballot and I much prefer that.

If we have to use machines why wouldn't we just source two machines from rival vendors. One machine takes the vote from the voter through whatever method, records the vote and prints a receipt that clearly states that voters choices. Machine two reads the receipt in front of the voter and keeps a second tally of votes. The two tallies are then compared at the end of the night.
For starters, cost. Now you have to buy two machines for every single machine you buy. It also means taking up more room. Now, instead of fitting 10 machines in a single space, you can only fit 5, creating even longer lines. This also increase the chances of failures. A single machine failing means both machines in the pair fail. So, you've gone from 10 machines to 5 pairs of machines for twice the cost. You guy from a single machine putting you down to 90% original capacity (assuming 10 machines) where as a single machine brings you down to 80% capacity (40% of original capacity).

Not to mention the additional level of confusion and potential for errors. All of this so you can buy two machines from two different vendors who might, in the end, still have ties via investors.

All good points, maybe there could be one testing machine per area or zipcode instead of one per room. People wouldn't know which voting booth would be tested. If the test pass potential false positive are still there, but you at least a quantifiable bit of error catching and restricted scoping. Cost still up for sure, but maybe people wouldn't mind paying a bit more instead of 100% for trust in the system. Would probably even motivate some to vote.
I don't think we can prevent fraud, the best we can do is source voting machines according to a spec from multiple vendors, and source software from multiple vendors as well, and do independent inspections of both by multiple 3rd parties. It would be a significant undertaking to compromise everything.

With a paper vote, you place trust in those who collect, store and, count, and you can always recount if needed. With electronic voting you place that trust in those that produce the hardware and software.

Trust it is. But the system has to try to reduce it to a minimum.
Some suggest each party should have a set of machines, so that the interest tension would cancel errors a lot.
Make the number of machines inversely proportional to the number of votes in the last election. Suddenly the next president is from the green party.
Where I voted (Massachusetts) you voted with a paper ballot, then watched a poll worker feed it into a machine which recorded it.
Same in VA but the machine in no way indicates that it read it correctly.
Too logical ;)
this with some crypto-sauce would be mixnet voting :)
>> In Texas, where I vote, the machines don't even print paper. We just have to trust that the machine correctly recorded our vote.

This system just begs for being manipulated.

>> This system just begs for being manipulated.

Paper ballots are not immune from such concerns. The concept of votes being added or removed from a count isn't a new phenomena. So the standard should be whether or not the electronic means are better, rather than them being a perfect counting method.

Yes but that is not the point. You can also add votes to electronic voting by just allowing someone to cast more votes at it. But the difference is that with paper voting, you as a single actor can only influence one voting booth, while as a hacker, you can manipulated thousands of voting machines. So the influence of a single actor could be much bigger. Furthermore, while you can manipulate a paper ballot, you can only do so so long as an investigator is not looking. If he keeps the booth in view the whole time, you cannot add anything or change votes or whatever. A computer can not be surveyed that way because I do not see what happens inside as long as its not open source code and hardware which is signed etc.
>> ...with paper voting, you as a single actor can only influence one voting booth, while as a hacker, you can manipulated thousands of voting machines.

That depends where the person is. The people managing the process, those doing the counting, have plenty of opportunity for large manipulations. There are safeguards, but the possibility remains and must be accounted for.

As I know it, you have 2-3 persons that count together one urn. That's not one person doing it. And you can do recounts. And adding large numbers of ballot papers is not easy because its marked how many there are in a ballot. (What is more effective is declaring a number of ballots invalid if they are not the right candidate but still, we are speaking about in extrem cases 100 votes, not possibly millions as would be possible in hacking an electronic voting machine)
One fake vote can be enough if winner takes all.
Using paper ballots you can at least re-count the votes and validate the results of the election. With the electronic system like this you can not validate the results. Does it use an open source firmware? How can you make sure that there is no

IF vote = Clinton AND random <= small error limit not making cheating oblivious THEN vote = Trump;

line in the code?

Yep, you can recount fake paper votes, but how you will distinguish fake votes from real ones? Remember, votes are anonymous, so you cannot track vote back to live being to ask. And even if you will be able to do so, live being can lie you about his vote, to protect himself, or just to not look dumb in eyes of others.
>>> ... but how you will distinguish fake votes from real ones?

Easy. Serial numbers. Like any other anonymous system (paper money, raffle tickets etc) you assign a number to every valid ballot. Should the same number appear twice, or not appear, then you know something fishy is happening. Any extra fake ballots should be discovered, so long as the originals are not removed from the systems. Throw the numbers around randomly and creating undetectable fakes become very difficult.

> Yep, you can recount fake paper votes, but how you will distinguish fake votes from real ones?

You already have a log of who showed up to vote. Compare the number of shows S with the number of ballots V which must be <= S due to poorly marked/unreadable ballots. Simple.

Edit: and this all statistically correlates with exit polls. It's very, very hard to fake all three of these in order to rig an election.

Explain "fake paper votes". I'm not sure that this is a real problem with normal auditing -- record all voters that come into a precinct, what time they appear, and compare to the number of received ballots. Comparing signatures of voters to the file signature is common for absentee voting. It's just far harder and riskier to mess around with compromising paper ballots than a mistake (or "mistake") in a line of code.
As is frequently attributed to Stalin:

What counts is not who votes, but who counts the votes.

"You know, comrades," says Stalin, "that I think in regard to this: I consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this — who will count the votes, and how."

Original in Russian:

Каменев. стараясь снизойти до уровня Сталина, говорит: "А вот по вопросу, как завоевать большинство в партии". - "Знаете, товарищи, - говорит Сталин, - что я думаю по этому поводу: я считаю, что совершенно неважно, кто и как будет в партии голосовать; но вот что чрезвычайно важно, это - кто и как будет считать голоса". Даже Каменев, который уже должен знать Сталина, выразительно откашливается.

На следующий день Сталин вызывает к себе в кабинет Назаретяна и долго с ним совещается. Назаретян выходит из кабинета довольно кислый. Но он человек послушный. В тот же день постановлением Оргбюро он назначен заведующим партийным отделом "Правды" и приступает к работе.

В "Правду" поступают отчеты о собраниях партийных организаций и результаты голосований, в особенности по Москве. Работа Назаретяна очень проста. На собрании такой-то ячейки за ЦК голосовало, скажем, 300 человек, против - 600; Назаретян переправляет: за ЦК - 600, против - 300. Так это и печатается в "Правде". И так по всем организациям. Конечно, ячейка, прочтя в "Правде" ложный отчет о результатах ее голосования, протестует, звонит в "Правду", добивается отдела партийной жизни. Назаретян вежливо отвечает, обещает немедленно проверить. По проверке оказывается, "что вы совершенно правы, произошла досадная ошибка, перепутали в типографии; знаете, они очень перегружены; редакция "Правды" приносит вам свои извинения; будет напечатано исправление". Каждая ячейка полагает, что это единичная ошибка, происшедшая только с ней, и не догадывается, что это происходит по большинству ячеек. Между тем постепенно создается общая картина, что ЦК начинает выигрывать по всей линии. Провинция становится осторожнее и начинает идти за Москвой, то есть за ЦК.

(Stalin faked election by printing reverted votes in «Pravda»).

Paper ballots at least leave a paper-trail.
How do you distinguish between a real ballot and a fake ballot?

How do you know if someone decided to throw away some of them?

(While also ensuring voters remain anonymous and allowing voters to verify their votes.)

Scrutineers : https://en.wikipedia.org/wiki/Scrutineer

You have a number of differently affiliated persons watching the proceedings, and having at the end a rough idea of the number of votes that were returned per polling station. Then (with some coordination that should be trivial for the smallest of political parties) those results can be independently reckoned and compared back to the official totals. Any irregularities should be quite obvious. Recounts are probably the Achilles heel of paper ballots, as you need a way to verify that they were not tampered with in the meantime

> In California we were able to vote at home with a mail-in, paper ballot and I much prefer that.

I guess you trust the mail service and the people on the receiving end to properly record your vote.

I prefer the day of (also in CA), where you get to put it into the counting machine yourself—at least then I know it was counted at my polling place.

"At least then I know that I put it in a machine physically, which gave me psychological comfort, but no actual verification that my vote was counted."

^-- Fixed that for you.

But seriously, at some point, unless everyone sticks around to watch everyone else's votes being counted, there has to be some level of trust with the system. The only thing we can do better is to make vote counting machines' code open sourced and have the code signed with a trusted Public Key Infrastructure of some sort.

In my country some people stick around in the voting place to watch how the votes are counted. As long as somebody from your preferred political party stays, you don't have to stick around.

The paper system is very open source already. So open that even non-developers can understand it.

When you do mail-in voting, your ballot has a tab you pull off with a number on it. You can check on a government website whether or not your ballot was counted using this number (though it won't show how you voted).
In the U.K. the ballot staff are volunteers and cheap/free venues are used (schools, church halls, etc.)
(I'm not defending the method you describe from Texas where there's no physical proof to audit against)

I was listening to something specifically talking about California counting mail-in ballots. They said California took longer than most states because it's big, it has liberal laws about eligibility (counting provisional ballots) and citizens are pretty sloppy about filling in mail-in ballots. They described coffee and spaghetti stains obscuring the choice. They will fill out "clean" ballots in pairs with their best guess. I'm sure that's a small number of ballots.

When I've voted in person they deliberately have me feed my ballot into a machine to confirm it was valid.

Mail-in ballots are the devil, they allow vote-buying. It happens with regularity that elections are annulled in ethnic enclaves in the UK over that. Elections don't have to be convenient, first of all they have to be safe.
I find it curious that you don't think this also happens in middle-England Tory stronghold constituencies, or certain middle-class London Labour ones for that matter.
Which elections were annulled?
There was a fairly well publicised incident in Tower Hamlets (part of London) where a local mayoral election was declared void for reasons including "Voting fraud: ballots were double-cast or cast from false addresses" [1]

[1] http://www.bbc.co.uk/news/uk-england-london-32428648

Was this guy https://en.wikipedia.org/wiki/Lutfur_Rahman_(politician)#Fal...

The one I was thinking about was probably this one from Bradford: https://www.theguardian.com/politics/2010/sep/06/men-jailed-...
The whole Luftur Rahman BS is (I think) more to do with the fact that he's a totally dodgy c&nt (as are quite possibly some of his close associates - juicy 'gossip' in Private Eye), not his ethnic or religious background. The long line of DodgyC&nts™ at TH has yet to be broken, even going back to "The-Good-Old-Days".
Haha, keeping with tradition then. The conservative choice: a Dodgy C&nt. :)
In America we prefer the Clinton "walking around money" type of vote buying?
> In America we prefer the Clinton "walking around money" type of vote buying?

Is it just me or does this sentence not make sense?

It kind of makes sense to me, I think the poster is trying to say Clinton buys votes but in a way we prefer/tolerate.

That way being "walking around money" in the sense of mingling with wealthy people at expensive events funded by other wealthy people in an attempt gain favor (and votes) from the people who can afford those events.

I think it's being purposely dramatic, but the English (kind of) adds up.

That's not walking around money.
It doesn't, it sounds like something that a Markov chain would say. It sounds vaguely critical of Clinton, but doesn't quite parse as English and is devoid of actual information or analysis. I fear that Markov chains aren't just a way to replicate things that people might say, but might actually model human cognitive processes in some way. :(
It is legal and common in the US [1]. It's typically done by the democrats because in general more people voting is good for democrats and bad for republicans.

[1] https://en.wikipedia.org/wiki/Street_money

>Why do Americans use voting machines exactly?

It was a knee jerk reaction by Congress to the 2000 presidential election recounts in Florida. They passed a bill that funded the purchase of new voting machines called the Help America Vote Act[1]. It provided a fat pile of federal funds to states for the purpose of replacing voting equipment. Of course, throw a mountain of money in front of federal contractors, and several will rush out poorly designed systems quickly to claim the prize. Secure voting was the last thing on their minds. Diebold actually sued the state of Massachusetts for "wrongful purchase" of competitor systems.[2] Slashdot covered the fiasco generated by HAVA for years. Just search for Diebold or Sequoia in relation to their domain.[3]

[1] https://en.wikipedia.org/wiki/Help_America_Vote_Act

[2] https://yro.slashdot.org/story/07/03/26/1431258/diebold-sues...

[3] https://duckduckgo.com/html/?q=diebold%20site%3Aslashdot.org

A former co-worker of mine wrote software for voting machines in Brazil. He described to me a few reasons why electronic voting machines are important. To be honest I forget the majority, but one story that stuck with me:

One common scheme electronic voting machines help prevent is forced votes. A bad guy gets their hand on a single empty ballot and writes the name of the candidate he wants to win on it. He then comes to you and threatens you and your family. Says hand in this pre-filled ballot and bring me back your empty ballot, or else... You comply, he fills out the empty ballot again, and repeats.

The electronic voting machines protect your identity. They allow you to vote anonymously. They provide data integrity that is harder to spoof than paper voting methods. I explicitly asked why they don't just vote on paper ballots like they do in Canada (or the UK as you describe). His response was that we take for granted the inherit trust our societies have to allow us to vote in such a fashion without it being tampered.

Voter coercion is something to be concerned about but the scenario you describe won't keep me up at night. The number one problem is it's hard to scale up to a level that would actually sway an election. It only takes one hero to call the police while they're at the polling station or after their family is released and the sequence is broken. There's no need for the victim to actually submit the pre-filled ballot, they can throw it out or do something to it to make it invalid then come back with the blank one. The ballots where I vote are on a heavier stock paper that are not trivial to conceal bringing in and taking out; most could do it but one victim slips up and the scheme could fail.

Where I vote, my paper ballot in no way identifies me. I identify myself upon entering the polling station, they find my name on the list of registered voters and mark it. When I'm turning in my completed ballot, I again identify myself and my name is marked on a separate list. So there's a record that I voted but not for whom I voted. How would an electronic voting machine improve upon this?

BTW, where I vote, the paper ballots are the bubble scan kind and the voter feeds it to the machine themselves. This provides very fast tabulations with a paper record for security and recounts.

> How would an electronic voting machine improve upon this?

I am just theorizing here: Someone now takes the box of paper votes and runs it through the scanner machine. And passes this number along to someone. What is stopping them from tampering at this step? I think this is precisely what my co-worker was describing. There is an inherent trust that your paper ballot is scanned and recorded in a fashion that matches your vote.

An electronic voting machine could potentially communicate votes in real time over a secure connection. Or in the case of Brazil's machines, I believe stores it locally, encrypted, with a verifiable cryptographic signature of some sort.

I'm sure we all know the multitude of other attack vectors this introduces. I guess I am just not convinced that paper makes things more secure.

I worked on the 2002 model. It stored the signed voting data on a removable CF card which was under a tamper proof seal. After installation the machines were kept physically secure and, during the election they are never under the supervision of a single person. After the election the machines are returned to local elections authorities (if they are too late, they are invalidated) where the memory card is read and totalized.

We designed a vote printer that would allow the voter to see a paper copy before storing it, but it was never used.

There are many steps along the chain that have to be secured in both electronic voting (which has a variety of meanings) and paper ballots. Paper ballots enable audibility, which is a separate issue that's also important for voting.

Given the number of comments you've made on this thread, it seems this is an area of interest to you. I encourage you to look though the previous HN discussions on this topic. Here's a list of some of those from the past month or so:

https://news.ycombinator.com/item?id=13032743

Thanks!
Depends, different places have different problems. Consider: it only takes one hero to call the police, get beaten to a pulp by the responding LEO, for the chain to continue. Depends who is friends with who and how "civilized" the corruption is.
While I fully agree with your take:

Doesn't scale is a concept that only developers and entrepreneurs understand. Sadly, that makes it an invalid argument for the other 98% of the population.

Color me unsurprised that a person who wrote software for voting machines also finds them useful.

The problem I have with this particular scenario is that it imagines a reality in which someone can afford to collect votes one by one with impunity but can't force these same bunch of people (and one or two simply aren't enough to matter) at the voting station itself.

In Canada, after you fill out your ballot in secret, you fold it up and hand it to the poll worker, who tears off a stub and then hands the ballot back to you, and then you insert it into the ballot box yourself in plain view.

I don't know if this is the current case (or perhaps your scenario is one of the reasons for the current procedure), but they can just put a serial number on the stub so that the poll worker can verify that the ballot that was handed out was the one just filled out.

This is a good low-tech solution!
I am not sure how you vote but in my country, you could not pre-fill the ballot because you only get it at the voting booth. You have a voting registration that you bring to the booth, there you exchange it for the ballot which you fill out in a closed cabine and the pass right into an urn. (Which is basically like a voting machine, you only fill out your vote at the place you are voting). Honestly, not a very good reason for voting machines, only maybe against mail voting.
In the UK, you could just go to the desk and ask for a blank ballot in exchange for your "mistake".
|A bad guy gets their hand on a single empty ballot and writes the...

I am sure there are many reasons to prefer electronic voting, but that just seem logistically impossible when you are talking about millions of people. No way that wouldn't go unreported or undetected.

Whereas, with voting machines, if compromised has much more reach and would be difficult to detect.

Bad guy is easily defeated. "I'm sorry, I've accidentally spoiled my ballot and marked the wrong candidate, may I have a new one to fill?" Bad guy's ballot goes in the trash, you fill the spare new one, you still have the original blank one to hand back to him. Bad guy wasted his time.
Bad guy's friends are likely to be in there watching as the voter does what you suggest.
Don't shoot the messenger! I am just passing along the one story I remembered / found interesting.

I'm not saying this scenario is plausible for swaying the outcome of a presidential election (which is what I am sure is on many of your minds right now). But for locally elected officials? Seems at least plausible to me.

At the end of the day I imagine electronic voting is all about speed. A quick wiki search brings up the following anecdote:

> The voting system has been widely accepted, due in great part to the fact that it speeds up the vote count tremendously. In the 1989 presidential election between Fernando Collor de Mello and Luiz Inácio Lula da Silva, the vote count required nine days. In the 2002 general election, the count required less than 12 hours. In some smaller towns the election results are known minutes after the closing of the ballots.

Each polling place can provide free "stump the chump" ballots that you can give back. So you throw the one they gave you away, fill out and submit your own, then hand them back a dummy ballot that won't get counted.

Or, alternatively, spend tons of money on electronic voting machines that allow the bad guy to game the system on a more massive scale without having to threaten as many people.

> One common scheme electronic voting machines help prevent is forced votes. A bad guy gets their hand on a single empty ballot and writes the name of the candidate he wants to win on it. He then comes to you and threatens you and your family.

I'd be willing to bet money that this scenario has never, ever happened.

This technique is called the "Bulgarian train" and is alleged to have happened throughout the Balkans.

https://insajder.net/en/site/tema/794/

http://www.novinite.com/articles/120632/Bosnians+Name+Vote-B...

he could just force him to make a video of him voting the way he wants with his smart phone (for both, paper ballot and electronic voting machine).
Which is a reason why in some locations it's illegal to photograph or video record voting. Where I vote, you do it in a curtained area so it would be easy to get away with but with setups like where Trump and family voted in New York, you're mostly out in the open with a short partition.
Every state in America (and even different counties within states) vote differently.

I voted on paper and it was put in a box to be counted in a central location. This takes forever and they just now are finishing up counting.

Electronic voting is a lot quicker and cheaper to count. I'd argue that the best system is one in which you vote on paper but it's counted electronically at the polling booth. That way there's a paper trail that can be audited and also quick counting.

In the UK we use paper ballots and manage the count overnight after the election (some seats come back the day after, but the overall parliamentary majority is usually clear by then.)

Our population is only 1/6th yours, IIRC, and you subdivide more heavily into states already.

But why not scan-tron? It seems like that is the best of both worlds. Start with a simple physical paper that everyone can understand and audit as the primary record, but then have each voter feed their own directly into a scan machine that can tally and send counts in quickly?

That's how we do it around me, and it seems like a strictly superior approach. What am I missing?

Scantrons are a big improvement over electronic-only counting, but they can struggle with imperfectly-filled-in ballots... another good alternative, which avoids that particular problem, is to have a machine where you make your selections by button-press - but it prints them onto a physical card, lets you verify the printout through a window, then drops it into a built-in ballotbox.

The machine itself can keep count, or the cards could be designed for scantron-esque machine counting - regardless, in case of a disputed result, the cards can be counted the traditional way (by hand, with observers from each party present, etc).

Not my idea, BTW, but I don't recall where I read it - nor whether it was a description of something actually in use or merely a proposal.

Or just some kind of simple mechanical stamping or cutting machine that assures that each vote is registered in the same way but in an easily understandable and transparent format.
> cutting machine

Do you remember "hanging chads"?

But yeah, that's the crux of the idea: have a machine take the voter's choices, to effectively eliminate accidentally-spoiled ballots (the design of the "hanging chads" machines was sorely lacking on this point); but then have it produce a physical record, visually checked by the voter, to enable auditing & recounts.

Counting the hard copies would be the definitive source of truth, just like traditional paper ballots - any automated score-keeping would just be a bonus for early result reporting (although might also stand in for the manual count in "safe seats" where no-one cares to dispute the expected result).

The key to the system you describe is having the vote-punching machine right next to the vote-checking machine. That way if there's a hanging-chads issue you can catch it before it spoils more than a single vote. And the person just slides the vote down the 'discard' chute and gets a fresh one until they're happy with the results.

Have the checker mark the holes it detects with red ink or something, to make it clear to the user that the system detects their votes properly, and to provide a fallback. In the event another machine fails to count it, the user's intent is double-marked.

And then have the same style of vote-counting, where people manually scrutinize the votes, and have each party's representatives slide the votes into their counting machine. If the machines lose sync, you stop and figure it out at the point of the specific vote that fails to scan.

The scantron machines are expensive and it's not really feasible to have at every polling location. Lots of polling locations are at churches a d such anyways. Additionally, scantrons can be fairly slow depending on the machine.
They do in some counties. I'm a pollworker in Alameda County and every precinct uses an optical scanner (made by Sequoia). At the end of the night the memory pack is removed and taken back to a return center to be counted. The paper ballots are boxed and sealed in case there are any problems with the electronic tally.

Speed-wise, it only takes the machine about 1 second per ballot card.

Just to be clear, you are arguing that that scantron machines are expensive and not feasible at every polling location so instead we should provide dozens of more expensive electronic voting machines at each polling location?
That's how it worked where I voted. We made our selections on a touch screen and it printed a ballot for us to check.
That does sound better, and I left out the rapid counting. Good point.
The UK system wouldn't stop conspiracy theorists because it's not strictly anonymous.

https://www.theguardian.com/notesandqueries/query/0,,-1051,0...

Thanks for posting this, really interesting/terrifying and I hadn't seen it before.
There's a bunch of reasons, probably starting with the voting there being so much more complicated - there are a lot more positions being elected than in the UK. It's hard to say if the machines are really cheaper, but there seems to also be a lack of willingness to adequately fund the process, judging by the queues in many places.

Which is a shame, because it's a fairly effective way to push money back into the economy, at least when a manual system is used.

So there's a couple thing to unravel here. First, each county in the US runs their elections separately so within a single state you might see a couple different systems. Some places like my area in North Carolina use a system like what you describe except the ballots are scanned through an optical scanner then stored in case there's the need to do a recount. There's no central board above the county level that the ballots would be sent to for counting.

Second electronic machines are popular because they speed the election counting and are cheaper to run because the election board doesn't have to print tens to hundreds of thousands of ballots. A good electronic voting machine reports the vote 2 ways digitally to some vote tabulator local to that voting place and with a paper record that can be audited. The paper print out their having printed in this video is the end of the night tally that'll be reported to the county/state board of elections to be combined with the rest of the results.

Third doing it on a centrally located machine instead of over the internet adds a lot of security to the process. Trying to properly secure single purpose hardware like a voting machine that can be kept in a monitored location is a much simpler task than trying to find a way to ensure the Joe/Jane Voter's computer isn't compromised when sending the data to their counties board of elections. Not to mention that by accepting votes over the internet you're opening yourself up to everyone being able to remotely attempt to exploit the system. At least with a voting machine only connected to other election hardware attacks are limited to someone that's physically at the voting location. It's also tricky to prevent double voting while maintaining complete anonymity.

This reminds me about the Russian pencil hoax.
You are still using a voting machine, but you've just introduced a shitty paper input that needs to be scanned into the machine. The counting machine is a voting machine. It can be hacked.

The only benefit is that you have a paper record that can be corroborated if there is evidence of hacking later. But we could do a printout paper record on voting machines too.

You'd be surprised how many of those paper ballots don't get recognized when they are counted. Because the checkmarks don't fill up the box enough or because of optical/scantron error.

> You'd be surprised how many of those paper ballots don't get recognized when they are counted. Because the checkmarks don't fill up the box enough or because of optical/scantron error.

In the UK's 2014 elections for the European Parliament, a Scottish voter wrote against the four parties/candidates listed: "wank"; "wank"; "good guy"; "wank".

The vote was deemed valid as the voter had expressed a clear preference.

(Source: https://twitter.com/JamieRoss7/status/473068708441894912/pho...)

There was another case where the voter drew a penis next to the conservative candidate and it counted as a vote:

http://www.itv.com/news/wales/update/2015-05-08/angry-voter-...

Ballots are counted by hand in the UK.

There are pictures and a description here: http://www.bbc.com/news/election-2015-england-32533064

Yikes that is even worse. Hand counts have been shown to be off by 1-2%.
Actually in the UK votes are counted manually by people in big halls under watch by accredited observers. No voting machine in the process at all.
Sure that happens to a small portion, if the result is close enough though you can go back over them by hand.

The difference is that the voting machine makes it possible to hack the paper trail.

Please post a source or more of an explanation before spreading FUD like this...