E-Voting System

Akrasia

oscarBravo wrote:

I don't think it does. I didn't think I had suggested it did - if I did, apologies. A paper audit trail would certainly help, but only if correctly implemented. There are many potential pitfalls associated with the idea: first, the audit trail would have to be recorded in such a way as to prevent an individual's vote from being identified, so a continuous paper roll couldn't be used. Second, the voter would have to be given the opportunity to verify that the paper version corresponded exactly to the ballot as cast - and what's the procedure if it doesn't? Third, the voter must be prevented from removing the paper ballot from the polling station - this complicates the previous requirement. Fourth, under what circumstances are the paper votes counted? Fifth, if there's a discrepancy between the paper votes and the electronic votes, which version is authoritative?

Those are just off the top of my head. Given the huge increase in complexity all this adds to the electoral process, I find myself wondering exactly what the benefits are that justify all this?

the paper audit trail solution is really very simple. A receipt is printed and displayed behind a glass case for the voter to inspect where it remains for a short period of time, lets say 25 seconds and then it is dropped into a sealed ballot box where it stays until there is a challenge to the voting result or if an audit is to be carried out. This means the voter can verify their vote and they can't interfere with the audit procedure by taking the receipt or by altering it somehow.

Akrasia

Avns1s wrote:

To me there seems to be a very simple solution to this, in principle at least.

Why not have the evoting machine print off a "ballot paper" that the elector would place in a normal ballot box before leaving the polling booth, then you have the benefit of the e voting and the backup of the paper system oin case of errors or in a tight poll that merits a recount.

this is fine except for one important point. The voter should never be allowed to physically touch or handle their paper ballot. The audit trail should automatically be printed and deposited in the ballot box whenever an electronic vote is cast. Otherwise the audit trail would be meaningless if some people forgot to deposit their votes (the number of paper ballots and the number of electronic votes would not match up)

oscarBravo

Akrasia wrote:

the paper audit trail solution is really very simple. A receipt is printed and displayed behind a glass case for the voter to inspect where it remains for a short period of time, lets say 25 seconds and then it is dropped into a sealed ballot box where it stays until there is a challenge to the voting result or if an audit is to be carried out. This means the voter can verify their vote and they can't interfere with the audit procedure by taking the receipt or by altering it somehow.

Allowing the voter to inspect it implies that they're checking it for accuracy. What happens if they reckon it's inaccurate? Is there an "I've changed my mind" button? What if they wait until the last second to push the button, but it's too late and the vote gets cast anyway?

Layers of unnecessary complexity introduced.

Hotblack Desiato

I think the argument that the present system is open to abuse by being coerced to provide a picture of your ballot paper to be spurious. Worst case scenario (family held hostage with guns to their heads, etc.) the most anyone can do is force you to spoil your vote. Write 1 beside the thugs' candidate of choice and take your pic, then spoil your vote, or scrunch it up into your pocket and throw it in the bin outside, or change the 1 to a 10 and vote for your nine preferred candidates, whatever. So even in this highly unlikely scenario, there are easy ways to defeat the abuse attempt.

Switzerland. Comparisons of participation rates between there and here are irrelevant tbh. Their model of democracy is totally different to ours (power devolved to cantons and frequent referenda.) We have a very highly centralised government, local authorities with very few powers, no means for citizens to call a referendum, and at general election time many people say "all the parties are the same" and "none of the candidates represent me". Right or wrong, if this is what they think, e-voting will make no difference at all.

bk

oscarBravo wrote:

Layers of unnecessary complexity introduced.

I disagree, I think it is very necessary. I'm not just worried about fraud, as a Software Engineer, I know that anything but the most trivial computer program contains bugs and a complicated piece of software like this probably contains many bugs. I'm very worried that these bugs will cause an inaccurate count or even lose votes. I'm not the only one, talking to my colleagues about this, they all agree that it is just too risky, in fact the most vocal people against e-voting seem to be people who work in the tech industry.

E-voting can work but it must have:

1) A paper audit trail to verify the vote if there are accusations of irregularity or if the result is way off the exit polls.

BTW OscarBravos concern about this breaking anonymity of the vote can easily be fixed. Rather then use sequential numbers on the paper trail, simply use unique random id's, relatively easy to do.

2) The source code should be made open source or made viewable by people like me and my colleagues.

This will help fix bugs, but doesn't necessary protect against fraud (how do we know the software we have reviewed is actually on the machine).

The excuse about the need for the software to be proprietary is complete BS. You can easily create a contract for those looking at the code that says you can read it but not copy it. This is how Java is protected, anyone can look at it, but they don't have the right to copy it. They know they can do this, so I believe the real reason why they don't want to open the software up to general evaluation is that they know that there are a large number of bugs in it or afraid that people will find lots of bugs.

Akrasia

oscarBravo wrote:

Allowing the voter to inspect it implies that they're checking it for accuracy. What happens if they reckon it's inaccurate? Is there an "I've changed my mind" button? What if they wait until the last second to push the button, but it's too late and the vote gets cast anyway?

Layers of unnecessary complexity introduced.

There's no complexity. If the paper ballot is different from the electronic ballot you cast ie, you vote for FF electronically but the paper ballot records a vote for FG) then you inform the supervisor that the machine isn't working properly, and if enough people report a problem, then the supervisor can allert the returning officer who can take appropriate action

lostexpectation

Akrasia wrote:

the paper audit trail solution is really very simple. A receipt is printed and displayed behind a glass case for the voter to inspect where it remains for a short period of time, lets say 25 seconds and then it is dropped into a sealed ballot box where it stays until there is a challenge to the voting result or if an audit is to be carried out. This means the voter can verify their vote and they can't interfere with the audit procedure by taking the receipt or by altering it somehow.

even with e-voting these printed paper trails should also be counted no matter what, and the opponents should be prevented from conceding the win till all votes are counted.

speaking of which whats happened with mexico, that was e-voting wasn't it ?

Schuhart

bk wrote:

1) A paper audit trail to verify the vote if there are accusations of irregularity or if the result is way off the exit polls.

I thought that any paper trail would be irrelevant without changing our system of STV voting, as transfers operate on the basis of moving a physical block of votes which introduces a random element. (I also thought that our e-voting system, as it stands, simulates this random element as far as is possible with a machine.)

So if we really want an audit trail (and if we really want e voting) do we not have to consider changing PR STV.

oscarBravo

bk wrote:

I disagree, I think it is very necessary.

It's only necessary if you operate from the premise that electronic recording of votes is necessary, which I don't think has been clearly demonstrated.

bk wrote:

BTW OscarBravos concern about this breaking anonymity of the vote can easily be fixed. Rather then use sequential numbers on the paper trail, simply use unique random id's, relatively easy to do.

I wasn't talking about sequential numbers; I was talking about the relatively easy process of printing the audit trail on a continuous roll of paper. A requirement for secrecy is that the ballots be printed on individual cards or sheets of paper, or cut completely from a roll. I don't see a reason for the printed ballots to be numbered at all.

oscarBravo

Akrasia wrote:

There's no complexity. If the paper ballot is different from the electronic ballot you cast ie, you vote for FF electronically but the paper ballot records a vote for FG) then you inform the supervisor that the machine isn't working properly, and if enough people report a problem, then the supervisor can allert the returning officer who can take appropriate action

There's no complexity in any system, if you describe it at a high enough level.

The procedure needs to be refined much more carefully than your description allows. If the paper ballot is different from the electronic ballot, you inform the supervisor. What does he do? What happens to your electronic vote? What happens to your paper vote? Was your vote recorded? Do you get to vote again? How do you make sure the supervisor doesn't get to see how you voted? If enough people report a problem to the supervisor, the returning officer can take appropriate action. What appropriate action? Take the machine out of service? What happens to the votes that are in it? Are there votes in it? How do you know?

These are not minor nitpicks, these are the details that have to be worked out in detail in order to have a functional electoral system. Our current system has procedures in place for the things that are likely to go wrong. For example, if you accidentally spoil your vote, you fold it, bring it back to the supervisor, tear it in two and drop it in the ballot box. Then you get a blank ballot and start again. Simple, effective.

Electronic voting as proposed has many, many more failure modes than the paper system it's supposed to replace, and I'm far from convinced there are adequate procedures in place to recover gracefully from them.

oscarBravo

Schuhart wrote:

I thought that any paper trail would be irrelevant without changing our system of STV voting, as transfers operate on the basis of moving a physical block of votes which introduces a random element. (I also thought that our e-voting system, as it stands, simulates this random element as far as is possible with a machine.)

So if we really want an audit trail (and if we really want e voting) do we not have to consider changing PR STV.

No. The random element is a feature of a manual count of paper STV ballots. It would take too long to count all the votes and transfer an accurate fraction. A computer count doesn't have this limitation, and an accurate transfer value can be calculated.

It's one of the arguments in favour of electronic vote counting. I don't accept that it's a good enough argument to offset the disadvantages that would be introduced.

Schuhart

I don’t doubt you are right to say that a computer can do a full count (although I have a dim memory of reading the Powervote system tries to follow the manual process as far as possible). But the thought on my mind is more how a paper backup would actually help validate the result of an electronic PR STV count.

Presumably the reason that the manual count process involves taking a random physical batch of votes to transfer is because its not regarded as practical to carry out a full count of all later preferences by hand. Surely this consideration would come into play if someone demanded confirmation by ‘paper’ recount of an electronic result. The computer may well have done a full count to determine the result. But to validate that result using the paper backup would presumably take ages.

Alternatively, if the computer tries to simulate a ‘random’ selection of ballots for later transfers its equally hard to see how the paper backup can actually be put to use. Even if there is some way of identifying the exact ballots contained in the ‘random’ selection, it would seem hard for count staff to identify the equivalent paper ballot.

This is really the point on my mind. I can picture any amount of ways that voters might get a paper receipt confirming how they voted. But I cannot see how count staff could take boxes of those receipts and use them to validate a result – whether the computer simulates the ‘random’ manual process or not. Also, the requirement to have count staff on call to do this seems to bid away a lot of the benefits of e voting.

lostexpectation

Schuhart wrote:

This is really the point on my mind. I can picture any amount of ways that voters might get a paper receipt confirming how they voted. But I cannot see how count staff could take boxes of those receipts and use them to validate a result – whether the computer simulates the ‘random’ manual process or not. Also, the requirement to have count staff on call to do this seems to bid away a lot of the benefits of e voting.

yeah im bit unsure myself, but this is the thing the result should remain unofficial for atleast a week, (if this was normalised it wouldn't cause a crisis), when does an election result become 'official'.There is alot of vagueness about it, I presume its the prime minister that calls the government, as they confirm a deal over a coalition say, so the type of tds elected in each constituency is the defining point of election.

DublinWriter

Unbelievably, the DMBS on the voting machines is the MS-Access engine!

oscarBravo

...more precisely, on the counting machines. AFAIK, the voting machines don't use a DBMS.

Macy

oscarBravo wrote:

It's one of the arguments in favour of electronic vote counting. I don't accept that it's a good enough argument to offset the disadvantages that would be introduced.

However, Cullen chose to keep the random element of the voting system rather than make transfers truely proportional. The only possible reason for this is so that they could make a paper audit trail irrelevant in an attempt to prop up the software he was responsible for purchasing.

Schuhart

In practical terms, the paper trail would look irrelevant either way without changing to another form of PR. Its a practical impossibility to manually conduct a full count, while indeed the maintenance of the random element makes a manual count hard to envisage in theory or practice.

I'm not suggesting we should change our system of PR just to facilitate e voting. Just that, regardless of whether it is automated with or without the 'random' element, our current PR STV system does not lend itself to a manual cross check.

Bards

Macy wrote:

However, Cullen chose to keep the random element of the voting system rather than make transfers truely proportional. The only possible reason for this is so that they could make a paper audit trail irrelevant in an attempt to prop up the software he was responsible for purchasing.

Dempsey was responsible for purchasing.... He had a pilot process first like any IT project and once this proved successfull (Which all parties agreed at the time) the decision was made to purchase. After the general election dempsey was moved from environment and Cullen was appointed therefore he continued with the decision to purchase based on the successful pilot.

So it is Mr Dempsey's fault for choosing the Nedap system in the first place.

oscarBravo

I think there's plenty of blame to go around. At the time of the original pilot (which the political parties agreed was successful, yes) there were relatively few people aware of the potential issues. By the time Martin Cullen was ready to make a decision, the problems had been well and truly publicly highlighted.

Dempsey introduced a concept and trialled it. Subsequent to the trial, serious concerns were raised. In the face of those concerns, Cullen went ahead and spent the big money anyway.

I know who I'd be mostly blaming.

Bards

oscarBravo wrote:

I think there's plenty of blame to go around. At the time of the original pilot (which the political parties agreed was successful, yes) there were relatively few people aware of the potential issues. By the time Martin Cullen was ready to make a decision, the problems had been well and truly publicly highlighted.

Dempsey introduced a concept and trialled it. Subsequent to the trial, serious concerns were raised. In the face of those concerns, Cullen went ahead and spent the big money anyway.

I know who I'd be mostly blaming.

Yes but do you know what contract Dempsey signed.. Cullen might of had no option but to buy the machines following a "Succefull" trial/pilot.

oscarBravo

Bards wrote:

Yes but do you know what contract Dempsey signed.. Cullen might of had no option but to buy the machines following a "Succefull" trial/pilot.

That seems unlikely to me, but feel free to find a source for it.

Why are you so keen to defend Cullen's role in this debacle?

Bards

oscarBravo wrote:

That seems unlikely to me, but feel free to find a source for it.

Why are you so keen to defend Cullen's role in this debacle?

becuase there has been a continued campaign against him in the media.. Considering it is the first time in the history of the state that Waterford has a senior cabinet post.

how about all the money that Michael Martin wasted on reports and expert review groups when he was minister for health.. not a word was spoken.

notinh about dempsey in the media either.

I just want to set the record straight that it was Dempsey that got Cullen shafted

oscarBravo

Bards wrote:

I just want to set the record straight that it was Dempsey that got Cullen shafted

Fair enough. All you have to do so is find some evidence that Cullen had no choice but to purchase a system that Dempsey piloted, despite being made aware of the pitfalls.

I'll wait.

dahamsta

Bards wrote:

becuase there has been a continued campaign against him in the media.

Cullen is incompetent, that the media chooses to highlight this is a good thing. Supporting him just cos he's a Waaaaaterford man represents a major wrong with Irish politics. Denying that he's incomptent represents probable blindness. Please visit an optician.

adam

Bards

Ken Shabby wrote:

Cullen is incompetent, that the media chooses to highlight this is a good thing. Supporting him just cos he's a Waaaaaterford man represents a major wrong with Irish politics. Denying that he's incomptent represents probable blindness. Please visit an optician.

adam

Media is Dublin based and has been biased against him from day one. Michael Martin wasted at lease 3 times the amount of E-Voting with PPARS Which was totally Michael Martin's fault. do you thiunk he got three times the attention.. Answer NO

At the end of the day.. All politics is local

Schuhart

Bards wrote:

Media is Dublin based and has been biased against him from day one. Michael Martin wasted at lease 3 times the amount of E-Voting with PPARS Which was totally Michael Martin's fault.

I thought Michael Martin was from Cork? Or are you suggesting that the Dublin media is biased against Waterford, but holds an unrequited love of Cork.

In any case, there would seem to be a fair amount of agreement that the Health Service is a shambles and that Martin did nothing to bring order to it. So even if we were to allow your convulted logic that Cullen should be given a free ride because he's from Waterford, this is no precedent.

Although the bottom line is he did nothing to prevent a situation where we've spent millions on machines that are at best unneeded and at worst will never be used. The idea that we should all be willing to excuse that because many Waterford people think he's a good man for the constituency is, as a previous poster said, a fair indication of what's wrong with Irish politics. And the problem starts with the limited outlook of a fair portion of the electorate.

Akrasia

Schuhart wrote:

In practical terms, the paper trail would look irrelevant either way without changing to another form of PR. Its a practical impossibility to manually conduct a full count, while indeed the maintenance of the random element makes a manual count hard to envisage in theory or practice.

I'm not suggesting we should change our system of PR just to facilitate e voting. Just that, regardless of whether it is automated with or without the 'random' element, our current PR STV system does not lend itself to a manual cross check.

That's not strictly true, An audit could still be easily carried out, the number of first preference votes cast for each candidate should be exactly the same for the electronic vote as well as the paper audit trail, the same for all the second, third forth etc preference votes cast. If there are differences (eg, the voting machines record 10,000 first preference votes for candidate A, but the audit trail only counts 8,000 votes, then there is obviously a serious problem with the electronic voting system.

Schuhart

You are right that a sort of ‘head count’ of preferences can be envisaged. But it would also sound time consuming. Remember, in a real manual count there is no need to count every preference on every ballot, because of the random selection of physical ballots for transfer.

The ‘head count’ you suggest would seem to involve a considerable amount of effort, and still does not confirm a result. It can only confirm if there is a problem – it cannot confirm the right candidates have been elected.

lostexpectation

whose baby was it?

DublinWriter

oscarBravo wrote:

...more precisely, on the counting machines. AFAIK, the voting machines don't use a DBMS.

Oh yes they did! That's if you can stretch to calling MS-Access runtime a DBMS.

The big problem with the above being the lack of rollback and auditing that you have, not to mention how MS Access databases corrupt themselves for no good reason over time in a multi-user situation.