Is automated and digitized ballot processing inherently more dangerous than manual pencil and paper?

Question

This is on a somewhat layman's level. I'm not a security guru.

Looking at this in very, very broad and general terms:

Election fraud is definitely a serious issue that needs to guarded against pretty heavily, ideally by many third-party officials and monitors. If you have random people working at the polling stations, some may be tempted to throw away ballots or to fill out extras. You have a lot of random people, each being a potential, partisan security risk.

Therefore to reduce the risk, as well as to speed up counting, a given jurisdiction makes everything completely digitized (no paper ballots), and they fully automate the vote counting.

Just looking at this vaguely, some issues I see are:

1. Genuine bugs in the software. Not all issues are malevolent.
2. The organization that produced the software was indeed malevolent.
3. Even if they weren't malevolent, completely outside hackers can still try to get in and interfere.
4. Hackers from within the jurisdiction's staff and officials can also try to get in and interfere. Or even if they don't hack in the most literal terms, they can still find other ways to revise the final results after they've been produced, but before they've been presented to another party or the general public.
5. The whole entire system works as an opaque, black box. This means trying to monitor the ballot collection, as well as the counting itself, has the same issues as trying to debug a software defect in a black box, third-party item. Logging information helps, but it is not the same as having a clear/white box.

Even if the software were developed by the jurisdiction itself internally, it's still just a small subset of that jurisdiction (which can still be corrupt) that would be immediately familiar with the code and how to analyze it for potential issues. The corruption issues and black box issue are still somewhat at play.

On the other hand, imagine another jurisdiction chooses to avoid computers entirely for the purposes of collecting ballots and counting the votes. This other jurisdiction still uses computers for things like verifying someone hasn't already voted or sending internal communications between staff, for obvious reasons. However the ballots are all paper ballots, they are all collected manually by hand, and the votes are counted - and aggregated together - by hand.

That means there is no hacking, and it also means that we are now dealing with something at least somewhat closer to a clear/white box. If you have corrupt individuals collecting the ballots and counting them by hand, you can also have security and monitors, both from within the jurisdiction and from third parties, watching them. And if they miss something in real time, video cameras can sometimes provide footage of an incident. And if both of those fail, you still have A set of physical ballots, envelopes, and anything else. It may not be The set that is genuine (ballots missing or added corruptly - or by innocent mistake), but having A set, heavily derived from the genuine set of votes cast, is often better than having none at all.

Altogether it is potentially much easier to monitor.

Now that said, the first jurisdiction may still very well be much more secure in its election process than the second, but this would depend on things like the resources invested in security, and more importantly, how well they each manage things.

However is the first jurisdiction inherently running an extra risk by relying on computers to collect the votes and/or to tally the votes? Is the first jurisdiction, compared with the second, doing the equivalent of using HTTP instead of HTTPS, writing data access code that blatantly omits SQL parameters, or leaving the car defrosting and unlocked for 10 minutes while they're getting ready in the morning?

UPDATE: A lot of good answers here. I think there were at least a couple that more or less tied for 1st place, so I would've liked to accept at least a couple of different ones.

Answer 1

Great answers already about supply-chain attacks, complexity, transparency. I'll give an answer in a different direction: accountability and auditability (basically; how easy is it to do a from-the-ground-up recount?).

With a paper-based system, in the case of disputes, as long as boxes aren't physically lost or destroyed you can always go back to the paper source-of-truth and do a recount. For example, if the voting machines physically screwed up, you can go to the supreme court to get a ruling on whether "hanging or dimpled chads" count, and then go back to the paper and do a recount.

With a computerized system, if something goes wrong and the votes are recorded incorrectly in the database (either by accident or malevolently), there is a much greater risk that that data is just lost and it's impossible to reconstruct voter's original intent compared to a paper system.

---

TL;DR given the amount of value we place on free and fair elections, and the amount of effort we assume attackers might be going to to try and subvert them, our tolerance for risk here is very low. Paper has fewer things to go wrong, and is easier to go back to the source-of-truth and do a recount.

Answer 2

Most answers seem to focus on why automatic systems aren't used or aren't considered a good idea. I'll try to address the core question of what makes them inherently less/more secure. The central trade-off here is: Breach Risk vs. Breach Impact

Breach Risk: Here software systems win if we look at them in isolation. Taken a random person, software systems are arguably harder to overcome than paper voting. I.e. everyone knows how to fake a paper vote: just stuff a few more ballots in the box (and take out some others if you're a tad smarter). To overcome a software system you (should*) need at least some basic specialist knowledge. So the initial hurdle is typically higher with a software system. There are a few ways to get around that if the whole voting process is ill-designed, e.g. if it is easy to have people vote against their intend by "helping" them. Note that this only considers the "local" breach risk, i.e. given a random person, can they overcome the system. Using software system processes can however widen the target surface, i.e., an attack (or preparations) can happen easier from another country (yet still by specialists), meaning it does not necessarily require residents of the attacked country to be involved (or at least fewer). So the overall risk assessment is less clear and depends on what attack scenarios you consider more likely.

Breach Impact However, on the other end of the spectrum, a breach can be much more severe, because

1. It is harder to detect (it needs also experts to detect a breach, whereas many manual breaches can be detected with both eyes open, e.g. watching the ballot box with 4 eyes catching those nasty hands exchanging votes).
2. Therefore it is also harder to convince the public of a) the presence of a breach or b) the absence of a breach
3. Once a breach is found, it's possible to have a far wider effect: If the same software counts half the votes of a country, a single breach can change the outcome of every single voting district (and if the breach is somehow online executable with a very small number of people involved). Thus both the risk to get detected stays low as there is a very limited amount of interaction needed and the impact can be huge.

And especially because it potentially requires only a small group of highly trained / well paid experts this seems so anti-democratic and thus so unsuited to handle voting, because it would play into the hands of any "bad elite" or an existing authoritarian government to manipulate votes without anyone ever finding out.

A high breach impact for individual breaches also means those are very valuable and thus everyone in the line that has some level of access is also a valuable target and you only need to successfully bribe a small set of people rather than multiple ones.

Also note that the overall risk (either breach risk or impact) increases with the benefits we want to have: We typically prefer automatic voting because it's supposed to be faster/more convenient to vote and to get the votes counted. But nearly all measures to make it more fast and convenient typically increase the breach risk or the breach impact. Voting from your personal computer/mobile? Much less secured environment and a common trojan can manipulate your vote (not to speak of the whole verification process, just wait until 10 seconds before vote ending and then submit votes for all the people who haven't voted yet). Automatic counting without proper(!) paper trail (or without looking at it every time): high impact risk.

*should, because the system and process around it can always be totally crappy and have the weaknesses of both worlds; example: use paper to collect the votes, stuff them into a ballot box, then the next day upload them into a cloud based system with the admin interface to check the count and the debug feature to change individual votes online on www.voting.com, and after the upload directly auto-burn the paper ;)

Answer 3

The point here is trust and control.

If you can trust the digitized voting system, the risk of fraud and errors is much weaker than in a manual procedure. But... if you can trust...

In a manual procedure, the risk of fraud is mitigated by having observers representing the candidates. It is of course far from perfect, but it could be used for centuries without major problems - here I assume that the part organizing the vote is fair enough to accept observers trusted but all the candidates. That means that it is not perfect but it can be controlled by all interested parties.

In a digitized procedure, only experts could control anything and a bug or a flaw allowing attackers to take the control could lead to a true disaster with little to no way for candidates or their representants to mitigate the risk.

What follows is only my opinion.

Nevertheless, I think that we are on the way to digitized elections, because of the cost of the manual procedure in human being time, and because younger people are more inclined to trust automatic systems than older ones which always tried to have a manual emergency solution.

Answer 4

Whether it is digitally automated or manually operated by hand, supply chain attack works in both cases regardless of the voting method used. Therefore, some level of trust has to be established with election commission else nothing can be verified. Both EVM and ballot box open up to different attack vectors and most of the time it's insider threat that is in the position of tampering with votes.

The problem with EVM is that there is no way to know whether it is already compromised by the manufacturer. So the commissioning body has to verify assembly of every EVM in the supply chain. But then the trust has to be put on engineers verifying the hardware and firmware. Security by promise is not a secure design.

With ballot box, trust has to be put on the verifying authorities which can be as corrupted as the EVM manufacturer but their counting can be verified and monitored by the observing authorities which gives some level of assurity of fairness.

Higher the number of delegate authorities involved, the harder will it become to monitor everything and this is where supply chain attack becomes stronger. It comes down to who can be trusted in the process as security by design requires some level of trust at the bottom.

Answer 5

tl;dr– Voting requires a mix of privacy and publicity. Simple solutions fail to provide both, while robust solutions would likely confuse voters.

---

I'd split possible electronic voting systems into three categories based on their privacy model:

1. Simple privacy.
   Voters vote privately. A central system adds up the votes and reports sums, but individuals' votes aren't (usually) exposed.

2. Public voting.
   Voters vote publicly. Everyone can see how everyone else voted in an online database.

3. Crypto-based privacy.
   Many different possibilities in this space, but the overall gist is that voters aren't fully exposed while we leverage crypto-based tricks to selectively expose things we want exposed, e.g. evidence that can be used to verify nothing was tampered with.

Reasons these aren't adopted:

1. Simple privacy relies on an honest, centralized infrastructure. A malicious actor might be able to corrupt it; even when results are legitimate, folks may not trust them.

2. Public voting might cause people to feel like they can't vote freely. For example, people might be afraid that their boss would look up how they voted and then treat them differently for it.

3. Crypto-based privacy with open-source, auditable designs could be great if everyone understood how it worked and was able to fact-check assessments of the system themselves, but suffers from many of the public-trust problems of a simple private system if most of the population doesn't understand it.

A future, more technologically literate population would probably favor a crypto-based solution, but that might be a bit off yet. And the public/simple-private solutions have serious drawbacks.

Answer 6

Digital ballot processing is inherently worse because of the complexity and lack of the transparency compared to the good old paper and pencil approach. If paper is replaced with a fully digital system, a voter can't understand what happens to the vote afterwards and how it's secured from lost or tampering.

However, I've been thinking of a system that would have the best of both worlds. If the vote is given digitally and printed out on paper, anyone can double check that the paper has the correct contents, but it also enables automated vote counting using optical recognition, making it a lot faster. Furthermore, it would enable recounting the votes manually in case of doubts, and also remove rejection of votes due to ambiguous handwriting.

Answer 7

Other jurisdictions have different systems and here in England it would be all-but impossible to interfere with the counting of paper ballots, because it's so simple.

Tellers are invited from various sources: bank clerks because they're trustworthy and have experience counting valuable paper; police because they're trustworthy and duty-bound to fight fraud; journalists because they have a clear interest in exposing anything suspicious; various other groups for equally valid reasons.

Administrators and interested political parties have swarms of people watching every stage… literally peering over everyone's shoulder, or into everyone's face.

It would be possible to dispose of a few papers… but "few" would be the operative term.

Hacking an electronic system might easily be 100 times harder and wouldn't the potential rewards come 1,000-fold?

Answer 8

A very important aspect of the elections (and the democracy as a whole) is that the general public (or electorate) should be able to understand the whole process.

You don't need them to be actually understanding it, most of them don't bother if the whole thing looks transparent and understandable. Everyone can volunteer as an election observer or a pooling booth clerk, everyone knows someone who actually did and shared some experience.

That's how people see the connection between them voting and the officials ruling afterwards.

That's where the computers fail first. The confidence.

Computers are complex themelves (as if democracy itself was a simple thing). Computers need trained people to work with them. They sometimes fail spectacularily. And when they fail, one needs even more qualified people to fix the mess in a manner that few people understand. And then again, the computers sometimes fail silently.

On the other hand, ballots, boxes and bags are simple and reliable. Virtually everyone can read and count. Few people count them, aggree on the numbers, sign the protocol, report the results and secure the bags. If something fails, few other random people can check the results.

Answer 9

IMO there's two separate issues here. Voting, and counting votes.

For the actual voting, there's a few things that are vitally important.

1. The voter needs to express their intent, and have a high degree of certainty that intent was conveyed.
2. That voter intent should be clearly able to be read manually (if necessary), by another human being without other layers getting in the way.

To me this means that the vote recording system should be pen and paper, or something just as simple. Any software layer that gets in between the voter, and voting record can (and will) be buggy. Software, no matter how well examined, adds complexity. Complexity is the last thing you want in an election.

The COUNTING system, however is entirely separate. Technology to count votes from paper is decades old. Anyone that's through a school system in the past 40 years has used scantron, and there's several systems that use a similar optical technology to count votes.

The counting system doesn't have to be 100% accurate, and 100% bug-free it only has to be accurate enough to account for the majority of elections.... say an error rate of 1/1,000 votes? If the election is closer than the machine count can provide, you can always examine the ballots individually, have both sides examine each an every ballot for challenges, and then have the court system rule on any of these challenges.

This is exactly what happened in my state of MN in 2008 in a US Senate race. Out of 2.4 million votes cast, the election was decided by 312 votes. There were several court battles that went to the MN supreme court. The courts ruled unanimously, and eventually a winner was declared.

The reason you could even do this was that everything the voter expressed was on the ballot and not interpreted first by machine, but able to be fully interpreted by a human. The system isn't perfect, and "voter intent" isn't always perfectly clear, but it was a lot better than using a software intermediary that creates the mark. Some ballots were thrown out for various legal reasons, but in the end, humans decided, not machines. If we had a system where a software layer sat between the voter and the vote, we might still be fighting court battles 12 years later.

Answer 10

People keep an election secure

With a paper based system everyone can understand how it works. Everyone can spot stuffed ballot boxes or differences between polling station counts and published counts. You have lots of competent observers watching the election.

As soon as you introduce computers you've got a black box that people don't understand. Your average election official or observer does not understand the attack vectors against an electronic vote counter. This means that people have to trust a bunch of nerds to keep the election secure. Most counting centres don't have anyone who really understands the risks with electronic vote counting.

When only a minority understand how the count works it's much easier for a bad actor to rig the election.