alt Hacker NewsI know the answer is "you don't", but suppose I vote vote electronically for candidate A. In the end, the candidate loses with 764 votes. How do I convince myself that my vote was counted in the 764 votes, and that it was not a randomly chosen number (with a RNG skewed around "plausible" scores) ?
Replies
In this system: I have no idea.
In any system, I suspect it is possible. There are strategies that allow doing private set intersections (or similar): https://en.wikipedia.org/wiki/Private_set_intersection (i.e. a set with one member is "you", and you can check to see if you're in that 764, without knowing who the others are)
I'm not sure what strategies would also allow you to not reveal to the vote collectors where your vote went, but there might be something.
There is a separate verification tool I've used that lets me confirm who I voted for, and that the server has registered my vote. Also, like in elections in other places, every election has observers take part. OSCE regularly send their lot, their report on the last parliamentary election can be read here https://odihr.osce.org/odihr/elections/estonia/551179.
I think this is an easy enough problem to solve, the issue is that someone else can how force you to reveal who you voted for. Spouse, rouge employers, mafia, corrupt politicians. You can now "sell" your vote.
I think such a system could still work, but just like the voter has to go to the booth alone to vote, they must go the booth alone to verify.
Most likely similarly how you know in regular "paper" elections
You convince yourself the way you do with any elections: you trust the people/system that counts the votes. If you think about it for a second, the requirements of a secret ballot (meaning it's not possible to know who voted who) and the fully verifiability you are asking for are mutually exclusive. You can have either one but not both at the same time.
That being said I think the Estonian voting system does a decent job of being trustworthy. Publishing the source code is a big step to the better as well. As far as I knew the system was written in Java but seems like they have upgraded it in Go. Good job! Probably the best in the world.
To take it one step further: how does the election authority convince everyone that their vote was counted?
Us "computer folks" convincing ourselves is the easy part. Maybe after enough studying of the system, I'd be absolutely sure that my vote was counted, but what would the other 90 % of the population think? This not a "people are stupid" argument, a brain surgeon or nuclear physicist or philosopher isn't going to put in the effort to understand fully homomorphic cryptography, hardware-based security, etc. Why should they?
The alternative works perfectly fine and it's so easy to explain. It's obvious to anyone, no matter their level or field of education, how their vote makes it from their hand into the tally, what prevents it from being misused and what they can do to further reduce that already tiny probability.
You can see, feel and experience the technical measures keeping your vote safe. The people keeping their eyes on the ballot box alp day may literally be your neighbours, as are the people counting. You can reason about their motivations, you can theorise in your head about what lengths you'd have to go to in order to change even a few votes and how unlikely you would be to succeed.
The biggest danger to elections, ultimately, isn't the risk of cheating. It's the risk of losing the people's trust.
(I'm in the local election commission (that's layer 2 out of 4 in our particular election management hierarcy), we just had a big referendum, everyone keeps asking me about online elections so this rant was fresh on my mind)