Just one little catch...

October 3, 2006 11:30 PM

A new voting protocol from Ron Rivest [pdf] "We present a new paper-based voting method with attractive security properties. Not only can each voter verify that her vote is recorded as she intended, but she gets a “receipt” that she can take home that can be used later to verify that her vote is actually included in the final tally. Her receipt, however, does not allow her to prove to anyone else how she voted." Another interesting property is that all ballots are scanned and put online, so everyone can perform their own count, if they like.

The only downside: People have to fill out three ballots with special rules on how to do it. Ron Rivest [wiki] is one of the inventors of public key cryptography
posted by delmoi (39 comments total)

That's a hell of a downside to overcome. "Simplicity" should really be the first concern for anyone seriously expecting to reform American voting procedures.

(Hmm. Having read the abstract, I see that the author has said that the "...paper should thus be viewed more as an academic proposal than a practical proposal," though this modification is not due to the voting protocol's impractibility but rather due to its vulnerability to a vote-buying attack. Fair enough.)
posted by Pontius Pilate at 11:48 PM on October 3, 2006

It's an interesting idea but way too complicated for the proles in Florida who can't even figure out how not to leave a hanging chad.

• You have here three optical scan ballots arranged as three columns; you will be casting all three ballots.
• Proceed row by row through the multi-ballot. Each row corresponds to one candidate. There are three “bubbles” in a row, one on each ballot.
• To vote FOR a candidate, you must fill in exactly two of the bubbles on that candidate’s row. You may choose arbitrarily which two bubbles in that row to fill in. (It doesn’t matter, as all three ballots will be cast.)
• To vote AGAINST a candidate (i.e., to not vote FOR the candidate, or to cast a “null” vote for that candidate), you must fill in exactly one of the bubbles on that candidate’s row. You may choose arbitrarily which bubble in that row to fill in. (It doesn’t matter, as all three ballots will be cast.)
• You must fill in at least one bubble in each row; your multi-ballot will not be accepted if a row is left entirely blank.
• You may not fill in all three bubbles in a row; your multi-ballot will not be accepted if a row has all three bubbles filled in.
• You may vote FOR at most one candidate per race, unless indicated otherwise (In some races, you are allowed to vote FOR several candidates, up to a specified maximum number.) It is OK to vote AGAINST all candidates.

posted by Rhomboid at 11:54 PM on October 3, 2006

I think if this were implemented, you would also need to implement mandatory voting, because it's such a pain. But it's a lot less of a pain then filling out tax forms, which everyone needs to do.

But reading the whole paper, the idea is brilliant; it really does give you every thing you want and then some. I mean, not only can every person verify that their vote was counted, everyone can do their own count of all ballots, whereas today counting has done be done in private, and only by the state.
posted by delmoi at 12:01 AM on October 4, 2006

Three copies? What about carbon copies?
posted by banished at 12:01 AM on October 4, 2006

Rhomboid: the only requirement is that the voter be able to tell the difference between the numbers one and two.
posted by delmoi at 12:02 AM on October 4, 2006

Three copies? What about carbon copies? They're not copies, the ballots are all different from each other
posted by delmoi at 12:03 AM on October 4, 2006

oops I didn't italicize or otherwise demarcate banished quote in my last comment.
posted by delmoi at 12:09 AM on October 4, 2006

If you can't teach someone how to use a brand-new voting system in less than 50 words, it doesn't bode well for the likelihood of wide acceptance of the new system. This proposal involves a significant - and non-intuitive - departure from the traditional and very intuitive approach to voting (i.e., the process where you make some sort of mark next to the name of the person you are voting for), which seems to be fairly difficult to explain concisely and yet effectively.

I happen to think that this is an interesting proposal that at the very least deserves major kudos for doing what it does using only plain old paper ballots, but as a realistic proposal for revamping voting, it is thoroughly lacking.
posted by Pontius Pilate at 12:12 AM on October 4, 2006

They somehow fucked up the "take this thing and push it through the hole next to the one you want", so I really don't see that having to explain 2 vs 3 bubbles is going to fare any better.
posted by Rhomboid at 12:14 AM on October 4, 2006

I imagine that the perfection of this implementation will come in a simple machine with a simple "Punch the hole" type interface that spits out all the paper copies for you to keep and hangs on to what it needs. I imagine that this could be done simply enough to keep it mechanically inclined.

All that being said - I really like this idea, an impressive amount of thought has gone into it, and I like the result. I don't think it should be dismissed so easily, as this could very well solve many of our vote counting, and verification, woes.
posted by jeresig at 12:42 AM on October 4, 2006 [1 favorite]

This might be workable if it was more automated. For example, on the voting machine you enter your ordinary (single balot) vote, as well as what you want your receipt ballot to indicate (these are completely independent choices). The machine spits the ballots out, and you're done. Checking that your "vote was counted" could be done later by a similarly automated process. Note this is only a statistical check, in the sense that random ballot replacement on a large scale could be detected with high probability. The downside is that most voters will not understand this system, and hence their confidence will not be increased. But this is probably true for any secure verifiable voting system, which for the average dummy will always come down to trusting the green light on some kind of black box.
posted by metaplectic at 12:47 AM on October 4, 2006

Rhomboid: the only requirement is that the voter be able to tell the difference between the numbers one and two. posted by delmoi

Oh, so it's binary.
Hey wait, what about third parties?

/humor
posted by hal9k at 1:51 AM on October 4, 2006

Every time I'm of a mind to complain about the imperfections of the Australian electoral system, I have to keep in mind that 90% of our population (and 95% of the voting population) votes correctly for the national lower house every three years even though they have to number each and every box.

Also, here's my favourite ballot paper: the NSW 'tablecloth' ballot paper for one of their recent Senate elections... Remember, if number any of the boxes below the line you have to number them all! It's fun!



This would cause a civil war in the US.
posted by A Thousand Baited Hooks at 2:37 AM on October 4, 2006

It's not hard to do voting right.

Vote into a machine.
It prints out a ballot that is simultaneously machine and human readable.
Either the machine, or an onsite reader reads your vote and sends it upstream for instant aggregation.
Some random and unpredictable proportion of machines get manually audited, to make sure the reported proportions match actual votes.

That's it. I've heard this reinvented over a dozen times. Everyone *knows* how to do this right.

Rivest's system is just another mechanism that sponsors vote-buying. People just don't vote freely if they think their vote can be tracked back to them.
posted by effugas at 2:51 AM on October 4, 2006

mQGiBDnirDkRBADCTL/iUTeZKb0tiAcKdZdsUP/KSnrGGjlinolUAsUC0D6/hUB1
RdCpJOOERTIEr1yvehqDM7veRhNMoxJNQxa/sSrkywey5qc8uaskUNEqenimq/70
bahWJeoWXjad68mQFh65lULnHQrrioeJnh9UpyGJppNb/yIjdnymH9aYEwCglgP7
UegBzH22h8NVQEK2PWWbyUUD/jQA4lI0wRWcL9HpkYkHcH0LTKRB9zYpQYtyvzJi
yTGwJyFMfYNXy0RT11dICeLkf3HMR84hkPERKMhALobLxVUbfc7j2AygmzGphWGy
DH/xjptQP/zrsq87ylYRONK18w1J42cm+yZa4XThMDPJMrb9/l8qnxU1JnW7W1al
posted by srboisvert at 3:35 AM on October 4, 2006 [1 favorite]

It's too complex? I don't get it. People are expected to do complex things, like, read and write, take drivers tests, file IRS forms.. for the really incapable have a 10-minute class on-site every hour or so. Whoever said voting was supposed to be simple? It's a complex problem.
posted by stbalbach at 4:14 AM on October 4, 2006

I live in Florida and, ya know, there was nothing wrong with the old punch card voting system we used here. There is something horribly wrong with the Diebold machines we have now.

People who were bewildered by the "butterfly ballot" don't have a prayer of understanding this system. I doubt they understand the Diebold machines either.

What the hell is wrong with a paper "fill in the dot" type ballot? I was taking standardized tests using them in the 1960's
posted by lordrunningclam at 4:17 AM on October 4, 2006

No matter what, some people would want to fill in three bubbles per row (because they wouldn't want to leave their ballot incomplete, expecially if they got it in their head that this was a system that allowed them to bring home a copy of their vote), and others would fill in only one bubble for the candidate they wanted (because that's what they have always done), meaning that they would actually vote AGAINST the person they wanted.

This is a very clever system, but in its current version, it's not a very sensible system because of the counter-intuitive requirement that voting for someone means selecting 2 out of 3 bubbles. The Australian system where people have to number each box may be time-consuming, but it doesn't seem to be as counter-intuitive as this one.

I teach adults for a living. I know that this method is, on the face of it, something that would take less than 10 minutes to learn. But I can see a lot of resistance and confusion nonetheless.
posted by rosemere at 4:25 AM on October 4, 2006

stbalbach writes "It's too complex? I don't get it. People are expected to do complex things,"


It's hard to get experienced at or confident with something you do once every two years.
posted by orthogonality at 4:36 AM on October 4, 2006

I think the open-ended "fill in ANY two" bubbles could also confuse people. They must follow a certain routine, they're even being taught in mini-classes at the voting site -- but now they have an open choice re which bubbles can be filled in? Trouble.

To the author's credit, he already suggested at the end of the paper that the ballot be pre-printed with a single bubble marked off in each row in order to minimize confusion. However, it would still be easy for the voter to complete all three bubbles in each row, spoiling the ballot. The ballot checked would catch that, but this would still increase the time and frustration per cast vote. I would modify his suggestion slightly:

* Have the first column automatically filled in and the other two blank, which means the default state is a vote against every candidate. Shield this first column so the voter can't see it or mark on it.

* Shield the final column so the voter can't see it or mark on it. This column will always be empty.

* Display the middle column, which the voter must mark in order to register a vote.

This means that all candidates are not voted for by default, and the voter can mark the single available button for each candidate by filling in a single bubble, as usual, but they would actually be filling in a second bubble on that row.

The voter could still accidentally vote for more than one candidate per race, but this seems to be a bug in any voting system.
posted by rosemere at 4:56 AM on October 4, 2006

(Or, pre-complete the first column, and shield the first and second columns. It would be easier to build that shield for the booth rather than a two part shield.)
posted by rosemere at 4:58 AM on October 4, 2006

Rosemere, you realize you've just created the regular, single ballot, right? The two screened ballots are the same for everyone, and the ballot the voter marks contains all the information regarding their votes. If a voter takes a copy of the ballot they marked, they take a record of their votes in each race. It defeats the purpose of the whole system.
posted by wilsona at 5:18 AM on October 4, 2006

No, this could still be the perforated ballot. The voter could take any three of the ballots in the original system, even one where they didn't make a mark. Once the voter has made their mark in this system, they flip up the shield, bring the full three part ballot to be checked, and then take any one of the pieces as their receipt.

They may prefer to take the portion they marked themselves, but this is also a possibility in the original system. How do you safeguard against that?
posted by rosemere at 5:27 AM on October 4, 2006

I'm thinking the people who are criticizing this so heavily haven't read the paper properly (it could be expressed more clearly).

By having one of the bubbles automatically pre-filled in (randomly), the voter experience is simply as follows:

1. Fill in either one of the two empty bubbles on the line corresponding to the candidate you want to vote for

2. Put your ballot in the checker. Press button 1, 2 or 3 (it doesn't matter which) for your receipt.

3. Take your (now split) ballots from the checker and cast them.

That's it.
posted by unSane at 5:45 AM on October 4, 2006

metaplectic is right, this is a briliant idea, not for direct use, but for a simple *mechanical* implementation. And one should note that a mechanical implementation likely defeats its vote buying attack, either inherently or by allowing more complex algorithms.

No doubt the dead vote & mechanical machine tampering are always possible. But both are far easier to detect & trace.

rosemere, No, your trying to defeat vote buying, i.e. you must assume that the voter *wants* to prove how he voted, say cuz her husband will beat hur up otherwise.

Luckily, vote buying ain't a major issue with any cryptographi system, as most vote buyers really are stupid obnoxious religious husbands, although cult priests are problematic too.
posted by jeffburdges at 6:11 AM on October 4, 2006

I like the idea but the catch is not that you have to vote three times but that Diebold doesn't get rich.
posted by JJ86 at 8:25 AM on October 4, 2006

One way to make it easier would be to add a second automated system where the user selects their candidates with a touch screen, then sticks their ballot into the machine, which randomly fills out the three part ballot using the Rivest system.

People who are paranoid about touch screens can fill out the pencil.
posted by delmoi at 9:29 AM on October 4, 2006

Can a losing party mount a false protest to nullify the election? What will stop them?
posted by Brian B. at 9:38 AM on October 4, 2006

Another thread brought to you by Al Gore. Thanks Al.
posted by tadellin at 9:46 AM on October 4, 2006

Can a losing party mount a false protest to nullify the election? What will stop them?

Hmm, that's a good point. All you'd have to do would be to get a bunch of people to burn their receipts, and there you go.

Actually, the best situation would be, in my opinion, to simply stop trying to prevent vote buying. Just let people keep copies of their ballots.

I mean today, people can either take a digital picture of their ballot before they cast it, or they can even fill out an absentee ballot in front of someone, or scan and save a copy.

So why bother?
posted by delmoi at 11:44 AM on October 4, 2006

Delmoi, it's far more serious than that. The receipt is a contract of sorts, and if enough people conspire to falsely claim their vote was tampered with, then it would need to be addressed as if. Collecting discarded ballots would help this fraud, along with with merely claiming to vote for another person than one voted for. The receipt therefore introduces a separate problem, more trouble than it's worth because it implicitly assumes that a single voter can actually do something about it. That's a lot power among a lot of disgruntled losers. The receipt scenario also assumes we can trust the same officials to fix a problem, after we distrusted them to prevent fraud to begin with. The receipt must go. The voter should "okay" the bulletin board notice of their ballot in real time before they leave the booth and this is copied to other boards. It would be hard to change multiple boards.
posted by Brian B. at 1:45 PM on October 4, 2006

The receipt therefore introduces a separate problem, more trouble than it's worth because it implicitly assumes that a single voter can actually do something about it. That's a lot power among a lot of disgruntled losers.

Not sure this is necessarily true--can't the receipt just hold a unique identifier that represents the vote itself as a logical unit, without providing direct access to any information about the specific details of how the vote was cast? then the voter could even log-on to some website and confirm that their specific vote was counted, and the website wouldn't have to expose any specific details about how the vote was cast. Actually, I think the logical design for something like that would be pretty straightforward.
posted by saulgoodman at 3:46 PM on October 4, 2006

It's hard to get experienced at or confident with something you do once every two years. --orthogonality

That excuse doesn't work with my girlfriend, it won't work with the goddamn voting board.
posted by waxbanks at 5:23 PM on October 4, 2006

marbles?
posted by kliuless at 7:34 PM on October 4, 2006

Filling in bubbles?

What's next, scratching to win?

The best way remains the Aussie way. The USA should use it.
posted by five fresh fish at 11:54 PM on October 4, 2006

does the system come with meaningful elections? if i have to figure this shit out and the only "choice" i get is between a demoncrat (coke) and a republicon (pepsi), what problem does it solve?
posted by mano at 5:15 PM on October 5, 2006

The best way remains the Aussie way.

Are you kidding? You do know who John Howard is, right?

I think the Australian way is not the best way, over there voting is mandatory. This means that the people who care the very least, and who are most likely to be uninformed, still have to vote.

I'm not going to make any claims for better or worse, but I've always been pretty happy with the way it works here in New Zealand. We have to be registered, but we don't have to vote. And we usually know how many votes each candidate got the same day.

Making marks on paper just works so bloody well. (We do a bit of numbering as well for some of the local government elections.)
posted by The Monkey at 5:37 PM on October 5, 2006

I'm in Canada, Monkey, and I think our system is much the same as yours: a voter registration system, ballots with circles-and-x, and a hand count overseen by party reps and people's reps and government reps and the whole damn thing, so it stays honest.

But I'm all for mandatory voting. If you don't mandate it, you end up with poor voting attendance by the smart and caring. Either they think things are going well enough that their vote isn't that important, or they think things are going so poorly that there's no use in voting at all.

And when that happens you end up with the USA.
posted by five fresh fish at 6:33 PM on October 5, 2006

Mind, it helps to have a media that's reporting investigatively. That way even those who don't care about voting will at least likely vote for someone that isn't complete scum. Helps avoid that problem of thieving, lying, incumbent bastards.

In the USA one of the biggest news networks is repeatedly stating Foley's party as "Democrat." It's a blatant, unabashed lie. The station is widely acknowledged as one of the media arms of the Republican party, and it is so important to manipulate the emotions of the lazy and dumb that they're balls-out lying about things.

I don't think its our paper ballots saving us from that future. Mind control, even at our primitive levels of media manipulation, is going to thwart all our dreams of free voting.
posted by five fresh fish at 6:37 PM on October 5, 2006