Secrecy of Voting Machines Ballots At Risk 256
JimBobJoe writes "On Monday, Cnet published the findings I made as an Ohio poll worker regarding a major oversight in my state's election's system: Using a combination of public records, plus the voting machine paper trails, you can figure out how people voted. Though most agree that voting machine paper trails are a necessity, they can cause privacy problems which aren't easily mitigated. 'It's an especially pointed concern in Ohio, a traditional swing state in presidential elections that awarded George Bush a narrow victory over John Kerry three years ago. Ohio law permits anyone to walk into a county election office and obtain two crucial documents: a list of voters in the order they voted, and a time-stamped list of the actual votes. "We simply take the two pieces of paper together, merge them, and then we have which voter voted and in which way," said James Moyer, a longtime privacy activist and poll worker who lives in Columbus, Ohio.'"
Hah (Score:5, Funny)
Try and combine my vote and a date together in a database you b*****rds!
Re: (Score:2)
For reference: http://video.google.com/videoplay?docid=-25798330
Why do you need a list in the order they voted? (Score:3, Insightful)
It looks like they need to save paper because election machines are so expensive and now they just record voters data in the order they appear in the voting office.
Re: (Score:3, Insightful)
I'm thinking the best you can do with a system like this is point
Re:Why do you need a list in the order they voted? (Score:5, Informative)
This was my thought as well; I suppose it depends on how the system determines "order in which you vote". I've never personally used anything but a paper ballot that is read by a scanner (yay for "backwards" states), but the way it works everywhere I've been is:
1. You come in, they simply highlight your name in the Big Book of Names and give you a ballot. I don't even think they write down the ballot number next to your name in the book.
2. You go fill out the ballot and stick it in the machine.
That's it. No timestamps, nothing.
Re: (Score:3, Interesting)
What you describe is what happens here in my area of Michigan as well.
Re: (Score:3, Interesting)
Otherwise what happens if somebody half-fills an oval, or fills in one heavily and one lightly? The validation machine might pass the ballot, and upon later recounts there could be issues.
I'd have the paper audit trail be computer-generated, so that all ballots are valid. Then have the paper ballot be inspected by the voter, and put into a ballot box for counting. Voters wouldn't write on the paper (ideally I'd have the ballots coate
Re: (Score:3, Informative)
You know that John Doe voted, and you know that someone voted for candiate X at 12:30 - but there is no way to tie the two together.
Unless, of course, he was the only person to vote!
Re: (Score:2)
This could be a cause for concern, but I don't see it being an eminent threat to my privacy.
Re: (Score:2)
However removing the timestamps from the votes is a perfect way to solve this. That happens with traditional paper ballots.
Re: (Score:2, Insightful)
The whole paper trail issue is mitigated by using a paper ballot that is marked with a pencil in the
Re: (Score:2)
Re: (Score:2)
And this is what most voting districts in the U.S. do. It seems that the people who put together the voting system were trying to screw up. First, the ballots printed out by the machine should not be timest
Why timestamps (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:Why timestamps (Score:4, Insightful)
Or, say, negative votes. Or more people voting than exist in the district. Coz that'd look a little suspect too.
Re: (Score:2, Interesting)
A voting precinct has 1000 voters. At fine minutes to closing time 500 have voted. A timestamp precludes a corrupt precinct boss from entering a couple hundred votes for his chosen candidate in the final minutes, or at least provides evidence that the polling place became very efficient right at the end there.
Re: (Score:2)
So the bad guys have to inster then on an 8 hour interval?
I fell we are dealing with the wrong problem here...
Why are these records even KEPT AT ALL in Ohio?? (Score:3, Insightful)
IMO there is no difference in the privacy of who you voted for, and the privacy of if you even voted. It is your right to vote or not to vote. I mean - imagine a week after the election, your local busybody comes by your house and asks why you didn't vote. WTF? Whose business is that?
Obviously someone could just watch for you at your local polling station, but they would have to know who you were in advance for that to work.
The
Re:Why are these records even KEPT AT ALL in Ohio? (Score:2, Informative)
It is a no win situation and the answer is probably going to be not to change anything.
Re: (Score:2)
You could take the name and DOB of the voter, plus a password entered at the time and do an md5 hash then publish the hashes on the web alongside the candidate voted for (in the clear). Anybody wanting to check would simply have to hash their name, DOB and password and could then look up the hash in the list and check the vote was recorded correctly.
Because the candidate voted for is in the cl
Re: (Score:3, Insightful)
There may be ways around the problem, but none of them involve publishing the results on the web in any form.
Re:Why are these records even KEPT AT ALL in Ohio? (Score:2, Insightful)
Re:Why are these records even KEPT AT ALL in Ohio? (Score:5, Interesting)
The reason that data is public is because it's useful for politicians and their campaigns. For instance, if only 20% of registered voters show up to vote for the odd-year city council races, then the data of which 20% show up is invaluable. The city council candidates only need to send out campaign materials to those voters who reliably vote at those elections and can ignore people who only show up for the presidential elections.
Another example is that the poll workers (at least here in Ohio) maintain several lists of voters who voted during the day (it's a slight pain in the ass actually because someone has to be assigned to the boring job of checking off on two or three lists who came in to vote.)
Those lists are posted periodically during the day...I want to say the first one is posted at 11am.
So at 11am, a list of all the registered voters in the precinct is posted, with check marks next to the names of the voters who voted.
During the presidential election, people working for the campaigns come down and look at the lists. If they know that John Smith is a registered Republican voter (party registration is another public record) and they see he hasn't voted by 11am, they might give him a call to make sure he comes by. If he hasn't voted by 4pm (which I believe is the posting of the last list) then they might send someone over to his house because they know he is an older gentlemen who has voted consistently Republican for decades now and his vote will be invaluable.
I find those voter lists postings a terrible pain, particularly because they're an obligation of the poll workers but their purpose is to help the candidates themselves, not the integrity of the voting process itself.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Can somebody explain to me why votes need to be done with a machine? What the hell is wrong with a simple piece of paper where you list the candidates, and the voter checks the box next to the candidates he votes for, and he puts the piece of paper in an urn. Total anonymity (unless you begin taking fingerprints on the ballots), almost immune to fraud (you physically count the ballots, and if you want a recount, you physically recount them, with
Trivial solution (Score:3, Interesting)
Umm... Just don't store the list of who voted in any particular order.
We don't need to record voters for the purpose of matching them against their votes, we only need it to stop people from voting more than once.
I'd even go further - Mail every registered voter a bearer-coupon redeemable for one vote, then let them use those in total anonmity. That not only avoids the problem of guaranteeing anonymity, it solves a few other problems as well (for example, you could grant people the right to a proxy vote on your behalf simply by giving them your coupon).
Re: (Score:3, Insightful)
Give me your vote or I'll brain ya.
Re:Trivial solution (Score:5, Insightful)
Or your boss could demand your coupon as a condition of keeping your job...
Or your union leader could hint that it was in your best interests to turn over your coupon to the shop steward...
I don't think you've thought your plan all the way through.
Re: (Score:3, Interesting)
Those can (and do) already happen. And we have laws against them.
Giving people a coupon to vote doesn't change the threat of people trying to "influence" you to vote their way. It just changes the dynamics of enforcement
Re: (Score:2)
There is no way to enforce that you are going to vote the way I tell you to vote with my ticket. so there is this thing called an absentee ballot. If your really concerned about me not being able to vote, get me one and I will use it. It is the same concept, you get a ticket (in this case a ballot) I fill it out and send it in.
Re: (Score:2)
What if you find a $20 bill? Would you rather money lose their anonymity to become recoverable?
You did not earn the found money either. So be it — it may be lesser evil then the manipulations and/or intimidation, that the proposed method will prevent.
In fact, I'm quite certain, it is a lesser evil, because it can not be exploited systematically — just as nobody makes a living looking for droppe
Re: (Score:2)
I don't think a coupon system would be any better. Just because you cannot think of a way to exploit it right now doesn't mean on won't come around. And it probably wouldn't be one person changing a vote. Usually we have less then half of the registered voters actually show up to the polls. So if I can get half of their coupons
Re: (Score:2)
And you could do exactly the same with the found coupon.
Well, I was just shutting down your exploit, not claiming, there can't be others :)
"If". So far the only examined way to get them is by finding the lost ones on the streets. This does not happen
Re: (Score:2)
<groan> No. People can try to influence the way I vote, and I can tell them I'm voting the way they want me to, I can even take their money, but then I walk into the booth and still vote the way I want. Your ticket idea opens the door to a way to verify which way I voted (since they can just demand to vote for me). Anytime you allow third pa
Re: (Score:2)
So... We need anonymity so we can lie? Of all the reasons there are to support privacy and anonymity, that sounds like the worst one I think I've ever heard.
Some people need to grow a spine and stand up for themselves. If your boss threatens you if you don't vote a particular way, he has broken the law. Contact the relevant authorities and help them in a sting t
Re: (Score:2)
Difference is, you can "influence" me all you like, I'll vote for whoever I want to vote, and I'll tell you I voted for your candidate, you have no choice but to believe me (unless of course your candidate ends up with zero votes). Now, if you can have a proof that I lied to you,
Re: (Score:2)
Yes, but being forced to choose one -- and there's no reason we would have to if we just went back to pencil and paper -- electronic voting is a greater threat to democracy than vote intimidation.
In fact, this situation in Ohio
That's the worst idea I have ever heard (Score:2)
A citizenentire life. I wish people would take it more seriously and realize that they do not havwe the right to an anonymous vote and that post-facto verification of te votes impacts them in no way what
Seems I posted too quickly (Score:2)
Re: (Score:2)
The fact that is is made out to me, personally, and I have to identify myself before I vote?
I'm not suggesting this as a hypothetical, this is actually how I vote.
In the UK, polls aren't really secret either (Score:2)
Re: (Score:3, Interesting)
Re:In the UK, polls aren't really secret either (Score:5, Interesting)
Re: (Score:2, Informative)
Re: (Score:2)
Without wishing to appear racist, most of the fraudsters were Asians who perhaps aren't fully aware of how people in a civilised country are supposed to behave but this just makes it all the more important to ensure that postal and electronic voting are very carefully considered for their security before being put into full
Re: (Score:2)
Dunno about the UK system, but in Canada, each paper also has a unique number printed on it. However, while there is a list of "who voted", the list does not mention "who voted when", or in what order people voted. Therefore, the unique number printed on the paper cannot be traced to a single voter.
Other states (Score:2, Interesting)
Re:Other states (Score:5, Interesting)
Imagine somethings like this that could happen if people knew how you voted.
Lets say your landlord found that you voted for the property tax increase to fund the schools. So he raises your rent and only the rent of people who voted for it. (or raises your rent 6 months in advance of everyone else's because of it)
What about you boss finding out that you voted from someone who was going to raise taxes on them and increase regulation in the field your job covers. So now you are the first to be let go when business slows down because of it.
How about a problem with crime in your neighborhood and nothing is getting done about it because no one in your neighborhood voted for the current mayor. But other neighborhoods seem to have extra patrols and so on.
How about when you get pulled over for something minor like a tail light being out or something. The deputy find you voted for the current sheriff or mayor or whatever and gives you a warning but when he finds out you didn't vote for his guy gives you an $90 ticket.
If some people who have a little bit of power over you knew who you voted for or against, they could use that for other then honorable reasons.
Re: (Score:3, Insightful)
The difference computers make... (Score:2)
Now we introduce computers and all of the sudden we have paper trails invading privacy.
Computers themselves have been proven hackable.
OK, so lets remove the computers.
Certainly by getting accurate votes and bringing the real winner forward, we won't likely lose the one hell of a lot more by the acts of the wrong person psuedo-elected.
Re: (Score:2)
Re: (Score:2)
Old Problem (Score:4, Funny)
A bishop was celebrating a major aniversary with society friends. He was at one end of the table and was asked what was the first sin he ever had confessed to him, to which he replied "Adultery". A lady at the other end of the table said "I was the first person ever to confess to him".
The people in the middle of the table, who could hear both conversations, put the two snippets of information together
I don't think so. (Score:5, Informative)
Then, you stand at the booth, mull over your unknown, least-hated, or no-competition candidates. It's actually quite rare that people walk away from the voting booths in the exact same order that they went into them.
So yeah, you can use the timestamps + registration to determine who voted how....+/- maybe a half dozen voters, which makes a great deal of difference.
Now, if the voting station turnout is slow when you voted? Then yeah, you are probably identifiable. But this isn't nearly the story it's made out to be, and would be less of a story if more people voted.
Re: (Score:2)
In France, you're signing a register (sorted alphabetically) when you vote, so at the end of the day there is no way to know in what order people came or voted.
Re: (Score:2)
Re: (Score:2)
Same in New York. I live in a fairly rural community, and there are three voting booths at the voting station (the local firehouse). There's one check-in line when you enter, then you just line up at whatever booth you want to use. I think it would be very unlikely for someone to correlate the sign-in sequence with the voting sequences.
Re:I don't think so. (Score:4, Interesting)
This is exactly what's happening in Ohio but I contend the accuracy is still high. Remember, the "opening" time stamp is printed when the poll worker opens the machine for the next voting session. It so happens that the ES&S machines have a cartridge that the poll worker inserts in the front of the machine which makes it ready for voting so typically that opening time stamp is printed before the voter even stands at the machine.
Once that happens, it doesn't matter how long the voter takes to mull over their choices, thanks to the closing time stamp, which is printed once the voter presses the "vote" button. (If there were only an opening time stamp, then yes, the time it takes for the voter to vote would muck up the accuracy.)
If voter #10 took half an hour to vote then the timestamps will indicate that and you know to look for the next voters on the other machines which weren't monopolized by the slow voter.
Re: (Score:2)
Perhaps technology isn't always the answer... (Score:3, Insightful)
Inability of laypersons to scrutinize computer voting -> demand for audit trail -> loss of privacy.
You can filddle around with the details, but ultimately its pretty inescapable. People won't accept a computerized black box - which is a bit of a bummer when a black box is exactly what you're trying to replicate.
You can't suddenly parachute technology into a system without completely re-evaluating the whole system.
Of course, here in the UK we just have to put one X in one of half-a-dozen boxes - I appreciate that, in the US, the zeroth amendment ("if some is good, more is better") applies to democracy, and if you're also electing the school board, agonizing over who to choose as second assistant dog-catcher and whether to support propositions 4096-8192 inclusive then you may need a voting machine...
(Here, though, the fun is over postal - and maybe internet - voting, which some politicos seem to think will encourage people to vote but - surprise surprise - has proven vulnerable to ballot stuffing...)
Re: (Score:2)
Federal oversight? (Score:2)
parking lot (Score:2)
go out into the parking lot and read the bumper stickers.
Fight Planned Obsolecence with an 'X' (Score:2)
Re: (Score:2)
The problem with paper ballots is they are terrible for long ballots common in the US, and they never really worked. Paper ballots are prone to extra marks, wrong marks, etc. It was just that this was always accepted and it was known that a percentage of votes would be tossed because they cou
This is an Ohio Problem (Score:5, Informative)
The privacy issue he's discussing could possibly be limited only to Ohio. I've voted in Ohio and they're checking ID and manually writing down on a sheet of paper who votes in the order they walk in the door. The machine spits out vote results in the same order. Duh.
This "problem" has nothing to do with a "machine paper trail". It's not even related. I hope this argument isn't used to stall the progress we're making in fixing the vote system.
In Georgia where I'm at now a list of voters, in the order they vote, doesn't exist. In my county they check your ID then line through your name on a print-out. Who voted in what order cannot be determined. A machine paper trail wouldn't change that.
This is an Ohio problem not a voting machine paper trail problem.
-[d]-
Re: (Score:2)
This is partially correct. It's most severe in Ohio because we're numbering the voters, but, hypothetically, an election day observer could just keep track of which voter voted on which machine, and then examine the paper trails at the end of the election and do the comparison with his notes. That could be a problem in any state with voting machines which have continuous roll paper trails and doesn't require the number of voters in order or t
Re: (Score:2)
I call shenanigans (Score:4, Insightful)
Ummm...PunchScan, anyone? (Score:2, Informative)
Links: Recent headline about winning the competition [slashdot.org] PunchScan's website [punchscan.org] original mention on
Why don't we realize... (Score:2)
It's a system where people often have to hand count millions of votes, including sometimes making judgment calls on what the actual votes were. So many things are done by hand that there is tons of potential for mistakes and fraud.
A technical solution to voting would be vastly superior to paper systems...if only people knew how to build the systems correctly...
why bother with voting machines? (Score:2, Interesting)
you walk in, give your name and address (or polling card, if you remember to bring it), you name is crossed off the list of voters for that ward/constituency/region, you get handed your ballot paper(s), walk into a booth - and *using a pen* make an 'X' on the candidate who you want.
the votes are counted by hand (normally it is council workers, bank tellers and post office workers who do the count as they are fast and accurate) - the candidates are allowed to watc
Re: (Score:3, Insightful)
Flawed Assumption in TFA! It's not FIFO! (Score:3, Interesting)
"Once the two documents are merged, it's easy enough to say that the first voter who signed in is very likely going to be responsible for the first vote cast, and so on."
The authors of TFA have never seen people take longer to vote than others? You know, the ones who are standing in their booth when you walk in and still standing there reading the names on the first page, when you leave? Or the person who comes in with small children and spends half an hour juggling them as she marks the ballot. And then there's the small crowd of folk who have signed in, standing with ballots in hands, waiting for a booth to come free, and the ones who have time to spare let the ones in a hurry go ahead of them.
It's not a FIFO buffer in this precinct.
Quick fix, no problem. (Score:3, Informative)
But I'm not aware of any reason that the list of people who voted has to be delivered to the public in voting order.
So, sort the damn list alphabetically before handing it out. There are already going to be security measures around pulling the data, just add a simple sort to those procedures. In fact, I bet the staff who do this just "click on a button" so you can script it in without even changing any existing procedure or depending on humans to care about their jobs. Done, next problem please.
I hereby transfer all my rights to this business process to the public domain!
Re:How long (Score:5, Insightful)
And still you don't understand why people are so afraid of saying who they voted for?
Keeping votes secret is one very important way to make sure any democracy works, since humans can easily be forced to vote for something they do not want to vote for, either by threat of violence to your own person or someone in your family, or by money. Secret votes makes sure that someone can vote how they want, not how peer pressure wants.
Re: (Score:3)
Re: (Score:2)
if a does not equal b then you have a problem.
Re:How long (Score:5, Insightful)
We don't want voting machines. We want nice pens. (Score:5, Insightful)
Here's the way modern voting should work:
1) Show up, 'prove' (in the definition of whatever state you're in) you're an eligible voter, receive ballot.
2) Go to electronic voting machine. Place ballot in machine.
3) Enter your votes in the touch screen.
4) Once you are satisfied with your votes, press the 'Print Ballot!' button.
5) Machine prints your votes on the ballot in human-readable and machine-readable form.
6) Take ballot. Review your votes on the ballot. If your votes are correct, place ballot in ballot box. If not, take your ballot to an election worker, where it is marked void and you get a new ballot and try again.
If you want to be REALLY cool, make it so that each ballot can be filled out by hand as well, so if you have a technical failure in the voting machines, or an insufficient number of voting machines, you can continue the voting the old-fashioned way.
At the end of the election day, feed the ballots through your vote counting machines. In case of doubt, count the ballots by hand.
See, that wasn't that hard, was it?
Re:We don't want voting machines. We want nice pen (Score:5, Insightful)
Why would you hope that? It doesn't matter.
Think of it this way. What if we recorded your vote in English and German (assuming for a moment that an average American can read the english vote record and not the german vote record), and then we had Germans count the German vote record.
So we run our election, give the ballots to the Germans in groups of 1000, and the Germans give us a count of votes for each group.
Now we want to check that the count the Germans gave us is accurate. So what do we do? We pick a few of those groups of 1,000 and we count the English records on those ballots and make sure they match the count the Germans gave us. Setting aside the issue of whether what's written on the ballots in German matches what is written in English, this audit is the only way to make sure the Germans aren't lying when they give us the final count. And looking at the issue of the German votes matching the English votes, while each voter can't check this, it would be pretty obvious to someone who knows English and German that the ballots were wrong with casual observation.
Now, lets say that instead of having Germans count German vote records, we just had Americans count the votes? Then what would we do to make sure the vote count was accurate? The same thing: We'd give the votes to the counters in groups of 1,000, then pick a couple groups and recount them to make sure they match.
In this analogy, the bar code (or whatever) is the vote record in German, and the Germans are the vote counting machines. It doesn't matter that the voter can't verify that the German written on their ballot is accurate, because the voter can't verify that the Germans themselves are accurate either, just like the voter can't verify that the vote counting machines are accurate. The only way to verify that is to do an audit and make sure that the totals of hand-counted English voting records match the totals of machine-counted machine-coded voting records.
So, it doesn't matter if every voter can verify that the machine-readable record matches their human-readable record, as long as both are on the ballot. A quick check by someone who can read the human and machine readable portions of the ballots will make it obvious if they don't match, and separate from that, you have to do other checking to verify that the counting machines are accurate anyway, and that check will also detect any ballots where the machine records don't match the human-readable records as well.
Re: (Score:2)
It is one thing to ask for a list of voters, but why is it important to know which voter voted in which sequence? Why is such a record even being kept? The paper trail does not need to keep on it the voters ID, that totally undermines the concept of a "SECRET" ballet. As for time stamping when a voter votes; Why? It is enough that we know that the voter, voted.
Re: (Score:2)
Re:How long (Score:5, Insightful)
So, you voted against (candidate that won), huh? Well, you must be evil.
So, you voted independent, eh? You must be a communist, trying to subvert our system.
So, you voted for a known communist, eh? You must be a spy.
Yes, there's not a whole lot of logic there. There doesn't NEED to be, because the people that would put those lists together to see who voted what aren't USING a lot of logic.
Anonymous voted should mean that, not 'temporarily anonymous' or 'anonymous unless we want it not to be'.
Re: (Score:3, Insightful)
Or maybe even worse yet, I says here that you voted for my opponent in the last election, As mayor of this town, I think the new low income subdivision should go in your back yard. Or maybe it is a speeding ticket that turns into a trip downtown with towing your car and everything to get something sorted out and nobody cares because you voted for the other sheriff or the other mayor candidate.
And yes
Re: (Score:2)
Re:How long (Score:4, Informative)
They owned everything and controlled the elections by virtue of negetive actions when they weren't elected.
Re: (Score:2, Insightful)
Re:How long (Score:5, Insightful)
Just because you happen to live in a local and era where you don't have to fear for your life when you voice your support for one person over another doesn't mean it's always been like that or will continue to be like that indefinately.
Re: (Score:3, Insightful)
Re: (Score:2, Interesting)
Re: (Score:2)
See. You do understand why people are afraid of saying who they voted for.
Re: (Score:2, Insightful)
By the way, I encourage everyone to try their hand at working the polls for several reasons:
Re: (Score:2)
You only have the (relatively) uncorrupt system you currently have because the precautions have been in place, and known to be in place, for decades. The ability to trace votes ba
What about the push for absentee balloting (Score:2)
Absentee voting should only be a last resort, for those who cannot cast a secret ballot, such as members of the armed forces overseas or people whose health prevents them from going to the polling place.
Absentee voting is as open to abuse as the electronic voting machines.
Hand me your "correctly" filled out absentee ballot and I will;
Re: (Score:2)
Indeed. So let's take the next step [backwards] to paper.
Sure, screwing with democracy is good ratings for the networks one evening every four years, but has anyone actually back traced where the meme came from that we _MUST_ know who will be our next president the following morning?
Re: (Score:2)
Re: (Score:2)
It's not just distrust of the government, but fear of non-government people that have political motives. If your boss is republican, and feels very strongly about it, then he finds out you voted democrat, don't you think it might hurt your chances of being promoted? If your