Re: Larry Wall for President! (or at least voting systems in Perl...)

[Ytrew]

So, Monks, how would you use Perl in a voting system?

I'm a fan of the KISS principle. I'd make it drive a graphics engine (assuming I chose Perl for this task) that printed out a machine and human readable ballot. For example, a large X could be printed out in a fixed spot beside one of the candidate's names.

Next, the ballot would be passed through a verifier machine, to be sure that it can be electronically read. If it cannot, it must be shredded, and a new ballot must be printed, to avoid a spoiled ballot.

A large man with a dangerous object in his hands would prevent anyone from putting more than one ballot into the ballot box.

The machine readable ballots would then be quickly counted (say with a big sheet feeder passed through an OCR style process), and then verified by one or more hand counts.

The hardware would be the hard part: ensuring that the printers printed, the scanners scanned, etc. In general, hardware is more reliable than software, so I'd rather put my trust in that. As a voter, I can't tell if the software in the blinking box is working, but I know an X when I see one.

This seems like the most robust way I can think of to:

(a) provide ballot validation, as an improvement over paper ballots. Since each ballot is validated before it is cast, there won't be debates over whether a circled box counts as a X in the box, and so forth.

(b) provide a quick inital count, so that results can be announced quickly (people want to know "who won").

(c) provide a human verifyable recount.

(d) Satisfy the requested conditions

Security:People can't really tamper with the system, because all it does it print ballots. Voters can tell instantly if it breaks, because then the ballot they print isn't the one they wanted. If anyone tries, the large man gets up and hurts them.

Stable/Redundant A generator with power backup for the length of the election could keep the system running. The software is simple, and unlikely to fail catastrophically. If any system fails, it can be reset (one possible strike against Perl, since the right answer is an instant-on ROM image, IMHO). If an EMP pulse takes out the entire system, the cast votes remain in the ballot box, and the remainder of the ballots are cast by hand.

Accessible This is hard, but not impossible. Blind, deaf, and dumb people use computers. A soundproof booth with braille keys and a pair of headphones could assist a blind person. The booth would be transparent, so that no-one could sneak in behind the blind person, out of sight of the scrutineers. The large, dangerous man can also help with the physical security aspects.

The verifier machine would be especially useful for the handicapped, as a second confirmation that they did vote the way they had intended.

(e) Ensure trust in the system, by making it as simple and transparent as possible. Each person, regardless of role, should know as much as possible about the system.

As a voter, I know my vote went into the box. If I want, I can stand around, and make sure no one else is putting more than one vote in the box.

As a scrutineer, I know that nothing was taken out of the box until it was opened. I also know that the box was empty when the election started, and each voter put exactly one ballot in the box. This tends to suggest that the ballots in the box are the ballots that I saw the voters cast. I get to count them as many times as I want to ensure they add up.

While it's technically still possible to rig up a magic trick ballot box (say, with hollow sides that catch the real votes, while the planted votes remain inside the locked door on the front), it's hard to do, and careful examination of the box (say, with X-rays) will catch it.

Writing buggy software is very, very easy. Proving that software is correct is very,very hard. Using software correctly in elections means using as little of it as possible, IMHO. --
Ytrew Q. Uiop

[trammell]

Next, the ballot would be passed through a verifier machine, to be sure that it can be electronically read. If it cannot, it must be shredded, and a new ballot must be printed, to avoid a spoiled ballot.

Egads, no. The last thing you want in a polling place is a shredder. You want a big envelope with big black letters saying SPOILED BALLOTS, and an election judge should supervise the voter as they put their spoiled ballot into it; then the voter is given a new one.

At least that's how it worked last night, when I was an election judge in Hennepin County, MN.

[Ytrew]

Egads, no. The last thing you want in a polling place is a shredder. You want a big envelope with big black letters saying SPOILED BALLOTS, and an election judge should supervise the voter as they put their spoiled ballot into it; then the voter is given a new one.

At least that's how it worked last night, when I was an election judge in Hennepin County, MN.

You must still somehow ensure that no one ever looks in that envelope. Otherwise, it may be possible to determine how someone voted from the spoiled ballots. For example, suppose that there are only 3 spoiled ballots, all of which are for one candidate. Now, everyone who saw those three people put their ballot in the envelope knows how they voted. This violates the right to an anonymous vote.

To prevent this, the invalid ballots need to be destroyed somehow. If they aren't, someone might read them. You could wait until the end of the election, then shred or burn the envelope, but it still needs to be done. However, if the voter is allowed to shred his own invalid ballot, then he doesn't have to hope that no one will look in the envelope when he leaves the room.

The main requirements must be that: (a) no invalid ballot can ever be viewed by anyone other than the voter, and (b) no invalid ballot gets cast as valid.

I'm again relying on the large, dangerous men to prevent elections tampering, including any deliberate shredding of valid ballots. That should be obvious: they're in a separate box, far from the shredding machine.

It occurs to me that a more dangerous issue with all computer/electronic based systems is the risk of a hidden logging system. It would be easy to sneak in a section of code (or a custom set of electronics) that only activated on election day. It could secretly record that a vote took place at a given time, and who was voted for. It could be hidden as part of the debugging code, for example.

With the timing information in hand, you'ld then just need to keep track of what person voted at which time. An observer at the polls with a watch and notepad could do that part. By cross referencing the time with the person, you now know how everyone voted.

--
Ytrew

[trammell]

The solution to this problem used in our precinct is:
1. The envelope is opaque.
2. All election judges agree verbally to and sign a written oath saying that they will follow the election rules and not commit fraud or hinder the election process.
3. We are told not to look in the envelope, so we don't.
4. There are two election judges from different parties present at the ballot table at any time, to reduce the likelyhood of fraud.

It's a low-tech solution, but it works. Destroying any ballots (even spoiled ones) is a bad idea; keeping them allows the total number of ballots issued to be accounted for, which provides a cross-check on any electronic counting or hand counting that is done. It's hard enough accounting for all the ballots without any ballot sinks present!