[charliemil4]

We should trust but verify the results. The basis of facts should be settled in the following:

1. Select all ballots that were sent to the same address - or sent to the same Post Office (grouping all PO Boxes by post office). ^ Here you are trying to see if there is systemic voting behaviors out of the ordinary -- i.e. did 10+ ballots go to one address.

2. Select all ballots that were sent to an alternate address than the voter registration. ^ This is a general query -- select a sample set of these and confirm with the registered voter that they did indeed receive a mail in ballot.

3. If above is inconclusive, select all registered voters that requested a mail in ballot against the 2017-2018 Equifax Data to determine if correlations occur.

4. Select all ballots that were the voter did not vote in the last X elections (there are political consultancies that provide information on who NOT to waste your time on because they do not vote), did these people request a mail in ballot? Were these ballots sent to an alternate address?

For clarification [1], if one were armed with a SSN or DL and a previous address, one could request a ballot on behalf of another person AND have that ballot redirected to a location of their choosing... including a PO Box. The form is included here for reference.

[1] https://www.votespa.com/Register-to-Vote/Documents/PADOS_Mai...

EDIT: just so you know, I think both of them did things like this. I want my d%mn democracy back.

[dodobirdlord]

Voting fraud on the scale required to influence a US election is not possible due to voting registration requirements. Registering any significant amount of fake people is not feasible, and if you are trying to cast the votes of any significant number of real people you will quickly have a collision with someone who actually does intend on voting, leading to an investigation and the whole scheme unraveling.

Voter registration + signature checks + investigating duplicate ballots is a robust system for ensuring that systematic voting fraud can only achieve a small result without being overwhelmingly likely to be caught. If the election had actually come down to a margin of a few thousand votes in a single state it might have been worth the resources to do a deep-dive, but with the margins that occurred we can be certain that voting fraud did not influence the result.

[blub]

The claims I've seen were:

* dead people "voted" in the election

* late votes by mail were stamped with a fictive past date

Anyway, I don't see why you're so comfortable with election fraud as long as it doesn't influence the result. There is no way to know if fraud happened and what scale this happened at without doing this so-called "deep-dive" you mention.

[dodobirdlord]

The election boards of each of the 50 States and the District of Columbia do in fact conduct regular audits, and frequently purge voter rolls of registered voters that have been sufficiently inactive as to be suspected of having died or moved out of the state. You may have read about such events in previous months in the national news.

I don’t see why I would care much if there is voting fraud if I can be certain that it did not influence the result. What does it harm me if an election decided by a margin of tens of thousands of votes had some few hundreds or even thousands of illegitimate ballots cast? It’s a tiny amount of noise in a very strong signal. It’s easy for a state to estimate what percentage of the vote could possibly have been fraudulent, and when the signal seems to be at risk of being lost in the noise there is a robust process of signal recovery. But recounts are expensive and a waste of time and resources when they are not needed.

[totony]

Ten thousand votes does not seem to me like a strong signal. If you look at popular vote, there is a 4m discrepency. Asuming all the results are legitimate, that's maybe 2-4% of the voters that agree more with one than the other.

It is grotesque to call 2% a strong signal.

As for voter fraud, I'm curious how you think it is insignificant without an audit. And even if it was, shouldn't the fraudsters be prosecuted?

[dodobirdlord]

> It is grotesque to call 2% a strong signal.

It's a pretty strong signal of who won the election, given that we know that submission of fraudulent ballots doesn't work at scale.

> As for voter fraud, I'm curious how you think it is insignificant without an audit.

In is audited, continuously, by the fact that voters have to be registered and can't vote twice. Voter rolls are regularly audited by state election commissions to remove people who have died and/or moved out of the state, and there's no evidence of a non-negligible number of fake people making their way onto voter registration rolls. When two ballots are returned for the same person, or if a ballot is returned for someone who is known to be dead, etc, it prompts an investigation into how that happened. Not every registered voter votes, but by and large people register to vote because they intend to vote, so it's infeasible for a systematic effort to submit fraudulent ballots to avoid colliding with the real votes of the people being impersonated.

> And even if it was, shouldn't the fraudsters be prosecuted?

They are prosecuted.

https://www.washingtonpost.com/news/the-fix/wp/2016/12/01/0-...

And really, "grotesque"? That seems pretty rude.

[totony]

>And really, "grotesque"? That seems pretty rude.

Did not mean it that way, my apologies. It was meant to be an hyperbole

>They are prosecuted.

You were suggesting not conducting an audit so they could not be prosecuted if we don't know who they are

>Not every registered voter votes, but by and large people register to vote because they intend to vote, so it's infeasible for a systematic effort to submit fraudulent ballots to avoid colliding with the real votes of the people being impersonated.

From what I have seen, only ~65% of registered voters usually vote. I am not convinced that impersonating part of that 35% is infeasible. There are also other ways to manipulate votes than to submit a ballot and hope the person does not vote, e.g. you could collude with UPS to lose ballots, buy votes, replace valid ballots/votes, etc.

EDIT: Take Wisconsin as an example. There is a 20k difference between the two candidates. 20k is ~0.6% of the 3.2m voters that voted (whereas the parent post stated 10k which is a very small signal)

[nemothekid]

No one is comfortable with election fraud. Election Fraud is a well researched problem (by republicans too), and it's been shown again and again that it is an incredibly small problem. You are talking about a couple thousand confirmed cases [1] in elections where tens of millions of votes were cast. Claims of election fraud are not new.

A bigger problem is voter suppression, through ever growing extraneous requirements (such as Harris County, a population of 5 million, only have 1 ballot drop off, due to a law to prevent more than one drop off per county). Voter supression however does not get anywhere near the same amount of attention.

[1] https://www.heritage.org/voterfraud

[nogglet]

Both of those claims are likely based on this Steve Bannon funded study of voter fraud: http://g-a-i.org/wp-content/uploads/2017/07/Voter-Fraud-Fina...

Data analysis would indicate that the DOB for many voters are over a 100 years old. Even as mentioned in this very report, that's because of a technical bug. DOB wasn't required, and when it was, the system used something like 0000 as the birthdate. The report dismissed these findings, but it seems either the media or general public has still been running with it.

Finally, it's worth noting the study itself is highly inaccurate: https://electionupdates.caltech.edu/2017/09/11/report-on-vot...

(edit: updated original link of study to g-a-i, this study is also mirrored on whitehouse.gov)

[charliemil4]

Great — so let’s just run the queries so I can go to sleep

[dodobirdlord]

It’ll happen, but nobody’s going to hold up on calling the election, certifying results, and choosing electors in the meantime.

[charliemil4]

Yep. That's what scares me a bit - you don't want to find this out after all the endorphins and emotions solidify sides.

[dodobirdlord]

Well, there aren’t going to be any surprises. It’s not like voter fraud is an actual problem in the United States.

[hosteur]

Because you say so?

[thingsgoup]

Your answer shows a lack of imagination in regards to how fraud might be perpetuated in this situation.

As our election systems come to depend on electronic solutions the attack surface increases significantly.

[dodobirdlord]

Sure, sure, but that's a completely separate topic from voter fraud. And it's also not something I've heard anyone alleging happened in the 2020 election.

[sparkling]

> Voting fraud on the scale required to influence a US election is not possible due to voting registration requirements.

Im not from the US, but my understanding of the alleged fraud is that due to coronavirus many states sent every registered voter a blank ballot (where in the past they explicitely had to request a ballot) and that, again allegedly, some people would habe been able to obtain such blank ballots and vote for their prefered candidate?

[dodobirdlord]

I’ll lead off by mentioning that some states already voted by mail and have for many years. So if there were a problem with this approach that enabled mass voter fraud we would be well aware by now.

The “blank ballots” are not blank in the sense that they are interchangeable. Each ballot sent out is the specific ballot of a specific person. It’s certainly possible that some ballots were stolen from their intended recipients and mailed back with forged signatures, but what’s important is whether this could have been done on a mass scale to influence the election result. And the answer to that is no. A coordinated effort to fraudulently return enough ballots to matter would require large-scale raiding of mailboxes to steal ballots, or stealing ballots in mass quantity soon after they were put into the postal system by each state’s election commission. The former is impossible, as it would require an organization comparable in size to the postal service to be able to go house by house stealing ballots as they were delivered, and it would be obvious that it was occurring. The latter is easy to detect and trivial to rectify.

In both cases, the fraud would be detected as soon as anyone who hadn’t received their ballot went to their state’s election website and requested another ballot and were informed that their ballot had been delivered and returned.

[charliemil4]

I'll post this scenario here again just to get your opinion on it -- you have good thoughts.

Here's the scenario as it plays now: many 'grassroots' movements are reified when a bus comes to pick a group of people up, hands them a template ballot of who to vote for, then brings them to the polls to vote, and finally ends the ride with a dinner and party back at the place.

First, this is legal, at least where I'm from, and is a common way to 'get out the vote.'

Second, this implicitly has a built in rate-limiter because I need the physical voter to be present and to go into the booth alone.

However! This time, I don't have to bus you to the polls... I can host a party at my house to request all of your ballots come to me, where I fill them out and copy your signature from the party / event. OR I do this over the course of a few months, and still have all the ballots directed to me, still copy your signature from the form we filled out together. Or even worse, I use hacked data to request a ballot on your behalf because you never show up to the polls anyway.

To me, that's an extreme vulnerability -- that means beyond it not being rate limited, the physical person is no longer needed to fill out their own ballot. Not only this... there was always the chance someone could go 'off script' and vote for who they wanted for and just get the free meal. Now, they are guaranteed to be the way you wanted because you filled them out.

^ I've known people go on buses to get meals and vote 'off script'

And finally, the reason 'this hasn't happened until now' is because most mail in voting was for absentee voting (in the battle ground states) and never done at this scale where you could have a whole community request ballots to one address almost undetected. (yes this is detectable post-fact, but damage is done and intent is there on both sides.)

[dodobirdlord]

Oregon, Washington, Colorado, and Utah have voted by mail and sent a ballot to every registered voter for years. No signs so far that this has been abused to facilitate the sort of coordinated large scale fraud that you’re concerned about. Though there’s some evidence that it leads to closer matches between the votes of married partners compared to in-person voting, which is very concerning for for similar reasons! But spousal vote coercion is not new and by most definitions is not a form of voter fraud. I dream that someday we will be able to introduce a voting system that can ensure ballot secrecy even in these scenarios, but sadly the technology isn’t there yet. (Side note - this is why taking a picture of your ballot in a voting booth is illegal. It prevents being able to prove how you voted.)

Ballots are delivered to the legal address of each registered voter. A state election board is going to notice (and maybe call the fire marshal haha) if 1,000 people all suddenly announced that they are moving into the same house. The premise that neither the state nor the people having their legal address surreptitiously changed would notice isn’t a realistic cause for concern.

[jimmygrapes]

It is hard to find evidence of abuse when practically every attempt to look into it is met with refusal and/or claims that it is not probable.

[justin66]

When it comes to fraud, obtaining a ballot is as easy as obtaining a bank check, for example. It's legal (in my state, anyway) for various parties to distribute them, and you could print your own, if you had the right paper. (You'd be in hot water if your ballot wasn't the exact document the state distributes - it's a crime to distribute a ballot that's prepopulated with the user's data, for example)

The security features of the process do not depend on mail-in ballots being unique or scarce.

[dodobirdlord]

The important thing that has to be avoided if you want to perpetrate voter fraud is accidentally submitting a ballot for someone who actually votes themselves. Given that most registered voters do in fact vote it's not a workable approach to just print out ballots and submit them, you also need a reason to believe that the targeted voter isn't going to vote, such as having intercepted their ballot.

[justin66]

In principle you could inconvenience a lot of people by sending in fake ballots randomly, lots of them, and forcing those people to cast provisional ballots when they try to vote in person. And whoever didn't show up, you'd have a decent chance of getting the vote in if you could approximate their signature.

In practice this doesn't happen, I just assume because it's easy to detect, it's a felony that comes with a prison sentence (and a lot of people would be looking for you) and because it actually creates a lot of problems for whichever candidate receives the votes.

I think an alternate scenario, where ballots are sent to a lot of people with the voter's name and address information "helpfully" prepopulated on the form, incorrectly, is perhaps slightly more of a threat. In this case people are at risk of casting a ballot that will be rejected and their board of elections might or might not notify them there's a problem. Sending prepopulated ballots is illegal where I live because an organization trying to be helpful in this way could inadvertently disenfranchise people by mistake with a bad list, but there's the other risk as well.

Again, easy to detect and a crime, and I don't think it's been a problem here.

[ed25519FUUU]

This election came down basically to three counties in two states.

It would also explain irregularities with those counties when compared to other counties with very similar demographics.

[tiziniano]

Voting in the USA is such a joke for it being a first world country. One would expect blockchain based systems or at least a cryptographically based system to exist. The fact that they don't even have a national voter ID. Like seriously how much does it cost to have one and give it for free to every person? Poorer countries have done so with more success. The calls arguing voter suppression are the dumbest, if you are not smart enough to get a card and vote, then maybe that vote should not count.

[dodobirdlord]

It is certainly true that the US is frequently behind the curve of other first world nations on government deployment of new technology. This is largely because of 2 reasons. Reason #1, the US historically is frequently the first place technologies are deployed on a wide scale, and as a result the US generally has the earliest and thus the worst version of everything. Reason #2, the US system of federated States introduces great friction into any system requiring a central authority.

The absence of a national voter ID program perfectly exemplifies this. The US has an election system that works sufficiently well, so there’s no major impetus to overhaul how voters vote. And the US Federal government doesn’t even have a list of all US citizens. In fact, no such list even exists. Moreover, a lack of any existing documentation that a person is a citizen does not necessarily mean that they are not a citizen due to birthright citizenship or citizenship automatically inherited from parents.

Concerns about voter suppression induced by the introduction of a national voter ID are completely legitimate. The US Federal government lacks the capacity to ensure that every eligible voter is delivered an ID (lacking a list of all citizens), so the burden to acquire one falls on the individual. If this costs money, then it constitutes an unconstitutional poll tax. And in any case, since the Federal government is incapable of handling such a responsibility it would fall to the individual states, some of which have demonstrated historically that they will act to make the process arbitrarily difficult for individuals that the sitting state legislature would prefer do not vote.

[willis936]

Schoefield’s third law of computing. Elections need to be long, painful, effortful processes. Automating it is a bad idea. An optimal robot-slave humanity would minmax to humans’ only jobs being checking ballots and saying hello.

[throwaway5752]

This just doesn't happen. This has been a cause celebre of one party in the use for more than a decade and they have found on the order of a dozen proven examples of voter fraud.

https://www.brennancenter.org/sites/default/files/analysis/B... has hard data.

The problem, which doesn't require citation as it has been in the news for weeks, is partisan voter suppression, disenfranchisement (DC, Puerto Rico, Guam), and gerrymandering.

Every single thing you have suggested has been investigated and have found something on the order of 1* 10^-4 % rates of occurrence.

To remind everyone, there was a lawsuit to disenfranchise over 100,000 voters in Texas because of disagreement in how their ballots were submitted. Not recounted, not rechecked. Summarily tossed out. > 1000 times more people would have been effected by this one incident than there were provable instances of voter fraud (most of which was based on confusion by elderly). Limited voting hours, closures of voting stations so common they are accepted now but they are outrageous.

This is leaving aside the well documented actions of DeJoy during his time with the USPS. I would also like to see an investigation with subpoena of communications of of the company that caused delays in the printing/mailing of PA absentee ballots https://www.wkyc.com/article/news/politics/elections/clevela... and tracing the threatening robocall campaign in swing states: https://www.washingtonpost.com/technology/2020/11/03/robocal...

The US doesn't have a voting integrity issue, it has a voting suppression issue.

edit: just another example of the egregious attempts at disenfranchising voters: https://ktar.com/story/3681236/elections-officials-lawyer-ca...

[charliemil4]

> The US doesn't have a voting integrity issue, it has a voting suppression issue.

While I whole heartedly agree, I’m concerned how we arrived here. There have been no new additional controls put in place to ensure a dramatic shift in the voter culture (from majority in person to mail in), did not expose vulnerabilities previously unused.

[jpgvm]

The amount of votes submitted via a given method hasn't changed that methods vulnerability. Given how much money is invested into elections to propel a candidate to victory you can be almost guaranteed that any weakness that could have been exploited has likely already been identified, exploited and patched or is sufficiently difficult prove (i.e it's not ballot based) as to be continue to be used.

i.e the ballot counting system is like iOS and a reliable way of getting fraudualent ballots counted is an iOS sandbox 0day. It's so insanely valuable that everyone is hunting for it and huge resources are deployed to protect it.

On the other hand other attacks like voter suppression, propaganda, social media manipulation are sufficiently hard to prove or patch they continue to be used.

[0x00000000]

The vendors do not inspire confidence. Some machines in Michigan crashed due to a bad update on Election Day. Why do we allow secretive, proprietary machines where untested and unaudited updates can be pushed at any time? To be clear, I don’t think there was any foul play, but it just reeks of incompetence and we are putting all the trust on them.

https://www.politico.com/news/2020/11/04/georgia-election-ma...

[charliemil4]

Interesting frame -- I see your point.

Very quickly, I'm not speaking to the Ballot Counting System - I'm speaking to the Ballot Request System. The Request requires information that could be obtained from an individual and rerouted to a centralized operation to fill in the ballot for the person.

It is akin to what happens in some states where some folks are bussed to the polls and given a ballot pre-filled by a trusted member in their community and told to follow the ballot template and we will all go get dinner afterward.

However, in the case of the mail in ballot, the physical voter is no longer required, leveraging the efforts of one person beyond the previous systems limitations: i.e. bus size, trip time, etc.

^ Real life example of the previous exploit -- that is legal if done correctly.

Back to the point: the BRS had an implicit control in place previously... as in, if we see a ton of mail in requests in one location, we should probably check that out. Now that control is invalidated because of the pandemic... thus removing an implicit control without recreating a control to achieve parity (the recreated control for me is the queries I laid out above).

[jpgvm]

I am not seeing how the request system is vulnerable. As I understand it there is a register of absentee voters, ballots are generated (sometimes with privacy sleeves/envelopes etc) and printed with barcodes that tie ballots back to a specific voter ID up until the point that information is separated for counting.

Given knowledge of how that system works and controls put around it I doubt any such vulnerabilities could exist that could be found by statistical analysis that isn't already being done...

I also think you missed the point of my last sentence which is that you could consider the actual ballot system a lot like AES or any other cryto system you might be familiar with.

Cracking the crypto system is stupidly hard because a ton of time was invested making that so. Instead attacking the stuff -around- the crypto system is likely to prove much more fruitful. i.e social engineering, side channel attacks

In the same way the attacks I listed above elicit the desired effect (a certain candidate having an unfair advantage) but without attacking the actual ballot system itself (which is likely far too difficult).

Essentially it's a case of lower hanging fruit, you don't need voter fraud to "steal" an election.

[charliemil4]

Thanks for having such a great conversation on this --

> I am not seeing how the request system is vulnerable.

Here's the scenario: I obtain your SSN, Name and Address to request your ballot to my address (either in the bussing example through your explicit permission or through the nefarious example like using Equifax 2017-2018 Data), then I fill it in at my address, and then mailed it in.

(Edit: to be clear, you have only provided the information to start the ballot process, or I obtained it nefariously, and submitted a ballot without your presence and pen to paper)

That's not a vulnerability? I guess I have a weird definition... I'm saying that's not what I expect when I hear someone 'voted.'

[drewbug01]

> Select all ballots that were the voter did not vote in the last X elections

I don’t think there’s anything inherently suspicious about voting for the first time in a long time (or ever). This election was incredibly charged, so you would expect to see more people voting than usual.

I just want to push back strongly on the idea that a vote is suspicious just because that voter doesn’t typically vote. It’s a soft form of voter suppression, in a way - and we should be conscious to encourage everyone to vote, regardless of how long it’s been.

—

As an anecdote - I encouraged my family to vote, and some of them did: some of them for the first time in a very long time. I also served as an election judge and registered more than one person to vote on Election Day, including one person who told me they’d never bothered to vote before. But their votes were valid, and don’t deserve to be treated as suspicious.

[charliemil4]

So yeah, totally agree there will be outliers, but it’s definitely a focused sample set that tests the hypothesis well.

It’s complex, with a ton of fractaled placed to hide (day of registrations, first time voters etc)

[willis936]

The actual scale of the audit of 100 million ballots is an insane cost with extensive time. The verification is built into the system. Key features include: states conducting their own elections, paper ballots being required, ballots need to have a chain of custody to be valid, and counting is done in a transparent and continuously audited manner.

Making lists and centralized techniques are a Bad Idea and exactly what authoritarian regimes go about doing.

[baby]

There's no way to have a safe voting system without trust in the government and how states operate. There's just no way that, as a citizen, you can verify your vote. It's all in sybil attacks: how do you identify one person in the first place? You need strong cryptography tied to each citizen, and you need to trust the government that they are not creating fictive citizens.

[sg47]

Did you ask for this in 2016, 2012 or 2008 too? Just curious. Shouldn't we also make sure that certain Republican voters did not vote in multiple states or counties?

[charliemil4]

I don’t think your question is serious, right? Were we in a pandemic that statistically shifted the voter habits of a large amount of Americans from in person, physically gated process to a highly leveragable, mail in ballot process in those years?

As for 2008, 2010, 2012, 2014, 2016, 2018, and 2020 (there is much power outside of a presidential election) — the bus example is the current status quo and has been used for ages and accepted as the norm — that’s been the “worst/best (whatever your virtue signal tells you) way to influence an election.

If you’d like to have an honest discussion about it - I’d love to, I’m very seriously in the camp that votes are votes and every single one should be counted no matter how they arrived to the polls.

[thomastjeffery]

> highly leveragable, mail in ballot process

It isn't. Mail in ballots have been the status quo in many states for decades.

The most common problem with mail in ballots has been rejection from unverified signatures, which in some cases is arguably an instance of voter suppression.

[charliemil4]

> Mail in ballots have been the status quo in many states for decades.

Let’s focus on the battle ground states - not all states - and let’s specifically look at PA for a moment. Because of the electoral college, the statement that nationwide and some states we have used mail in ballots before is irrelevant.

So in 2018 PA had 200k absentee ballots - the mail-in ballot process [0].

In 2016 PA, and specifically Philly, had fewer absentee ballots requested than 2008 or 2012 [1] with around 18k for that metro.

In 2020, 2.6 million mail in ballots were requested 3 weeks before the election [2].

So you tell me, what really looks like the status quo? 2.6m ballots or around 200k. Physics would call this an order or magnitude difference, no? That would directly contradict that mail in ballots for PA are a status quo... and if you looked at the rest of the battle ground states, you will find similar evidence that mail in was never the preferred or dominate form of voting in the metros and battle ground counties.

[0]https://whyy.org/articles/pa-rejected-twice-as-many-absentee...

[1] https://www.phillymag.com/news/2016/11/02/absentee-ballot-re...

[2] https://www.post-gazette.com/local/2020/10/13/Pennsylvania-m...

[thomastjeffery]

My point is that the mail in ballot process itself is proven as not "leverageable", as you insinuated it to be.

The fact that the status quo changed was expected. It was predicted during the very first stages of the COVID-19 pandemic.

Your insinuation is that because Pennsylvania is experiencing a surge of mail in ballots that its mail in ballot process is somehow vulnerable to be heavily abused, even though it is essentially a verbatim copy of what other states have been using - without abuse - for decades.

[op00to]

Do you realize how fucking hard it is to influence elections by ballot shenanigans?

[minerjoe]

Do you realize how much fucking power is at play here?

[einpoklum]

This was not done after the 2016 elections. Why should such a procedure be adopted now? Are there any indications of widespread fraud / miscounting / etc. ?

[anonymouse008]

There was never any “cover” to hide behind — we never really did much mail in voting as a people (absentee mostly).

Now the pandemic is cover enough to hide a few thousand with ease.

[einpoklum]

> we never really did much mail in voting as a people (absentee mostly).

That is false. An official report of the US Elections Assistance Commission:

https://www.eac.gov/sites/default/files/eac_assets/1/6/2016_...

says that, in 2016, 23.7% of ballots were mailed in.

[charliemil4]

Good fellow, are you really going to say the mail in ballot ratio is the same in a pandemic and not in a pandemic?

That fact is selective on a national scale — if you looked at states, the mail in vs in person ratio is standard deviations away from the norm.

[einpoklum]

> Good fellow, are you really going to say the mail in ballot ratio is the same in a pandemic and not in a pandemic?

I didn't say that.

[joshuamorton]

A few states have been all mail-in for years. 10s of millions of votes were cast by mail in 2016 and 2018. There were certainly more this year, but only like 4-5x.

(It helps that the most populous state is mostly mail-in).

HN is throttling me, so here's some more info:

https://www.ncsl.org/research/elections-and-campaigns/absent... and https://electproject.github.io/Early-Vote-2020G/index.html have most of the info you want.

CO, DC, HI, OR, UT, and WA are vote by mail for all elections. CA was sort of doing VBM in 2016, but it's more committed to it now. This year, NJ, VT, and NV were also vote by mail as one time things. So in prior years there were more than 30 million mail ballots, and AZ, CA, CO, FL, MI, OH, OR, and WA had more than a million mail votes cast (though some of those were likely classified as absentee in MI and OH).

[charliemil4]

Can you please cite the states that are all-mail in please? I've been checking SOS websites and have not run across this in the states I've checked...

Edit:

Thank you both (below, too) for the info. Yeah, so for the states that default mail ballots (WA, OR, CO), I don't see an issue as these states have used this method previously.

What I'm focusing on are states that moved from 'vote by mail optional' -- to 'vote by mail, nearly default because of a recent pandemic.' Which changes the nature and security of the Ballot Request System in each of these states.

Normal implicit controls around ballot requests are out of the window in this new 'mail-in majority' culture. Refer to my 'bussing' example above.

[theplague42]

Washington, Oregon, Colorado all have universal mail-in where every registered voter automatically gets a ballot in the mail (though you can still drop off your ballot, or vote in person). California is _largely_ mail-in but I don't think it's universal...

[willis936]

I’m confused. People who count ballots only count ballots they issue. Sending in 50k ballots they didn’t issue would result in 50k ballots they didn’t issue getting thrown out. Where is there room for concern for fraud?