[rdedev]

Does having a paper trail generated exactly after voting help? This is the system that's followed in India. I tried to think of ways it could fail but it seemed pretty fool proof as far as I can think. I'm pretty sure I might have missed some corner case

[Lukineus]

If you're going to have a paper trail for an electronic system, then why not just use the paper system?

It's like there's a pro-electronic movement that's looking for every excuse to move to electronic...

Ok, so we go electronic. We put in all these extra checks and balances to account for it's downsides. It runs well. People start questioning the need for the checks and balances, since it's so full-proof. So we remove the checks and balances. <anakin-fun-begins.gif> <shocked-pikachu.gif>

For the people that complain about the staffing requirements for a paper-based election: it's a feature, not a bug. The sheer number of people involved make it virtually impossible to rig an election.

[rdedev]

In India at least there is a lot of votes to manually count. Electronic just makes things smoother. As for people questioning the need I didn't hear anyone raising the during the last election I followed. Besides I'm pretty sure either the election commission of India or the various opposition parties will point out the problems with having just electronic vote records. As far as electronic voting with paper trail goes I see it as just a normal paper based voting system with an automated counting system that can be easily verified

[somenameforme]

> "For the people that complain about the staffing requirements for a paper-based election: it's a feature, not a bug. The sheer number of people involved make it virtually impossible to rig an election."

There are two ways to rig an election. The first is miscounting or changing votes but I think the other is the real risk and likely dates to the very first time we as a species ever started having votes by anonymous ballot: ballot stuffing. If, at any time in counting process, an individual could successfully insert a single valid but fabricated ballot into the process, the entire system is vulnerable.

And the number of votes required to change elections tends to be shockingly low. In the 2020 election, more than 155 million people voted, but the outcome of the presidential election itself was decided by a total of less than 43,000 votes [1]. That's a margin of victory of 0.03%. So a system that was 99.9% accurate at ensuring that each ballot was completely legitimate would be insufficient.

[1] - https://townhall.com/tipsheet/mattvespa/2021/02/10/wapo-the-...

[Lukineus]

Here in Australia, ballots are (initially) counted at the place they were cast. Every ballot issued has a corresponding (but unlinkable) person on the roll (electors are crossed off the roll prior to a ballot being issued). The count of names crossed corresponds to the number of ballots issued which will correspond to the number of ballots counted at the end of the day. Virtually impossible to "insert" a ballot as then your final count would exceed ballots issued.

As the count is completed at the polling place, of which there are multiple per electorate, the total number of votes is substantially lower than 43,000 even, and so the % accuracy is much higher. No publicised figure (that I know of) for how many "missing" ballots there can be before questions are raised, but I suspect its in the single digit range. Ballots are generally counted a couple of times but, even more if there's any ballots missing.

[arlort]

> If, at any time in counting process, an individual could successfully insert a single valid but fabricated ballot into the process

This varies by jurisdiction obviously, but where I'm from the procedure for counting must be done in an area which the public can access and it begins with a single person taking ballots out of the box one by one and giving it to a chain of 2-3 other people.

This way you can count how many ballots were taken out of the box and check with the totals at the end

And obviously the box is always in the presence of observers from various stakeholders

> less than 43,000 votes

Unless you can predict where these tiny margins will manifest with perfect accuracy you'd need to add a lot more fake votes, or at least have thousands of conspirators ready to add them at a moment's notice, that's ridiculously hard to organize discreetly

[filoeleven]

I’d argue that gerrymandering is a far bigger issue than ballot stuffing. Its sole purpose is to ensure that elections go in favor of the party who draws the map. If that ain’t rigging an election, I don’t know what is.

[uoaei]

I presume costs (wages vs computers) are a significant factor.

[arlort]

> then why not just use the paper system?

One reason is efficiency, if you have the machines counting you get results faster and then you can audit only a random sample of machines records and get statistical guarantees of the election integrity. (The machine can't know before that it will be audited so if you test thousands of machines and find no discrepancy it's highly unlikely a significant portion of the others did cheat)

A second is that it allows one more level of trust. With a paper ballot you have to trust that the poll workers are going to notice/stop/not help ballot stuffing etc. In most cases that's a good enough guarantee, but with voting machines you can also trust the people who programmed audited it

If the poll workers are trustworthy, because of the paper trail, you don't have to trust the auditers of the machines, but if you don't trust the poll workers then you can gain a modicum of trust from the auditers

https://www.brookings.edu/blog/techtank/2019/12/06/how-elect...

This link talks about the benefits in the indian election, specifically a software lock on the amount of votes per minute that can be cast

It also shows that in 2013 they audited "only" 20k machines out of almost millions yet found no discrepancy. Statistically that's probably good enough if the choice of machines audited was random

One last way it might be useful, though this is an abstract scenario, is if you want to deploy a more complicated to count voting system to large areas. In some voting systems counting can't be done in parallel, you need to do one round of counting, wait for everyone else and then do a second round and so on.

Similarly some voting systems might benefit from a digitized interface (for instance ballots in austria look like this: https://cdn1.vienna.at/2013/09/zettel.jpg and there are systems which would lead to even larger forms) which outputs a paper trail with only the actual information the voter inputed (in the case of the ballot I showed it'd pretty much just show a party name and a list of candidate names)

In these cases a machine outputting an auditable digital model of the votes cast would greatly simplify counting procedures. You could have every polling station just publish a signed file with the votes in their station and everyone could run the election algorithm

The votes can then be audited same as in the indian system

[f1refly]

> The machine can't know before that it will be audited so if you test thousands of machines and find no discrepancy it's highly unlikely a significant portion of the others did cheat

> It also shows that in 2013 they audited "only" 20k machines out of almost millions yet found no discrepancy. Statistically that's probably good enough if the choice of machines audited was random

So how do you protect against the corrupt actor manipulating every machine except the percent that will be checked?

> With a paper ballot you have to trust that the poll workers are going to notice/stop/not help ballot stuffing etc

There's a simple and straight forward solution: Have people from opposing political parties count the vote and check each others result. If you have members of the far left, far right and everything in between sitting there, checking each others results, theres about a 0% chance any vote will be miscounted.

> In these cases a machine outputting an auditable digital model of the votes cast would greatly simplify counting procedures. You could have every polling station just publish a signed file with the votes in their station and everyone could run the election algorithm

There is no difference between a machine publishing the counted votes and the poll workers publishing the counted votes, is there?

[arlort]

> how do you protect against the corrupt actor manipulating every machine except the percent that will be checked?

According to this: https://timesofindia.indiatimes.com/india/count-vvpat-slips-...

India checks 5 machines randomly selected in each voting "segment", no clue what that is but it's smaller than a constituency so I guess it's a polling station

From what I understood that's done locally right away after polls close. So that means that you'd need a way for the conspirators to identify the non tampered machines and for them to randomly select exactly those machines and you'd need them to be present in almost all polling stations and no one to challenge the choice

At that point it's essentially the same level of trust needed for paper ballots

> Have people from opposing political parties count the vote and check each others result

Yeah, but apparently that particular attack vector was a problem in India and this feature helps mitigate it, electoral solutions need to account for the practical situation they're in. For instance I don't support any form of electronic voting machines in my polity because the electoral system works fine with paper ballots and there aren't issues of ballot stuffing

> There is no difference between a machine publishing the counted votes and the poll workers publishing the counted votes, is there?

Yeah, but I was talking, for lack of a better term, about non additive electoral systems, in which the information conveyed in multiple ballots cannot be easily compressed

For instance in the FPTP system you can compress all the information in a polling station by counting how many votes for X how many for Y etc. And you can simply add up these numbers to other stations

The complexity scales linearly with the number of candidates

In a system like, for instance, IRV, where the voter ranks the candidates and the rank is an important part of the ballot itself you can't easily transpose all this information into a single number

The most you could do is build a tree data structure where the first level nodes are the first preferences and each node points to other nodes based on the successive preferences.

In this case the complexity of the process is exponential/factorial because you need a field for every possible combination of preferences, including cases in which not all candidates are ranked

My point was that going from a ballot to that structure is probably more error prone and time consuming to do manually than having a machine do it and that could conceivably be a reasonable justification to use electronic voting machines

The auditing will still be time consuming but that's mitigated by the fact that you audit only a portion of voting machines

But to clarify, I'm of the opinion that paper ballots and manual counting are preferable in every electoral system used at the national level that I'm aware of

India's electronic system is just not worse than paper ballots, which for electronic voting systems is a huge success