alt Hacker NewsYou can have e-voting systems that protect ballot secrecy and are verifiable.
You can use homomorphic encryption or mixnets to prove that:
1) all valid votes were counted
2) no invalid votes were added
3) the totals for each candidate is correct
And you can do that without providing proof of who any particular voter voted for. A few such systems:
https://en.wikipedia.org/wiki/Helios_Voting
Authentication to these systems is another issue - there are problems with mailing people credentials (what if they discard them in the trash?).
https://www.cbc.ca/news/canada/ontario-municipal-elections-o...
Estonia (a major adopter of online voting) solves this with the national identity card, which essentially is government issued public/private keys.
https://en.wikipedia.org/wiki/Estonian_identity_card
Lots of cyber risks with the use of online voting though, especially in jurisdictions without standards/certification. I outline many in my thesis which explores the risks to online elections in Ontario, Canada (one of the largest and longest-running users of online voting in the world)
https://uwo.scholaris.ca/items/705a25de-f5df-4f2d-a2c1-a07e9...
Replies
> You can have e-voting systems that protect ballot secrecy and are verifiable.
In these systems the voter cannot verify that their vote was secret as they cannot understand, and much less verify the voting machine.
> And you can do that without providing proof of who any particular voter voted for.
Which is good for preventing the sale of votes, but keeps things obscure in a magical and correct box.
How can I tell the machine didn't alter my vote if it cannot tell me, and just me, who I voted for? The global sanity checks are worthless if the machine changed my vote as I entered it.
Why are you lying?
from https://en.wikipedia.org/wiki/Helios_Voting
> The centralized server must be trusted not to violate ballot secrecy,[7] this limitation can be mitigated against by distributing trust amongst several stakeholders.
> The ballot auditing/reconstruction device must be trusted to ensure successful ballot auditing (also known as cast-as-intended verifiability),[7][16] this limitation can be mitigated against by distributing auditing checks amongst several devices, only one of which must be trusted.
So neither secure nor anonymous...
If it's a completely binary choice of "election was valid" and "election was invalid" without any partial verifications of results, I think it's still a massive step back.
By which I mean: paper ballots have problems. But a fault in a handful of ballots doesn't mean the rest of the ballots need to get tossed out.
I do not believe that a system managed by humans can be faultless.