upvote
The USA threads the needle by simply not having verifiable voting. And it turns out it works pretty well. Despite countless hours and lawsuits dedicated to finding people who voted more than once, only a handful of cases have actually turned up.

It's not that there are no checks. You have to give your name, and they know if you've voted more than once at that station that day. To vote more than once you'd have to pretend to be somebody else, in person, which means that if you're caught you will go to jail.

We could certainly do better, but thus far all efforts to defeat this non-problem are clearly targeted at making it harder for people to vote rather than any kind of election integrity.

reply
This. The process in my precinct is roughly...

- Enter queue

- A front of queue, show ID of some sort (various accepted) to volunteer

- They scratch you from the list and hand you a paper scantron sheet

- Go to private booth, fill out scantron

- Go to exit, scan ballot (it scans and then drops into a locked box for manual tally later, if necessary)

The "easy" ways to vote fraudulently are also easily caught... fake ID documents, voting twice, etc.

For people who forget their ID or have address changes that haven't propagated through the voter roll, there is provisional voting - you do the same as above, but they keep the ballot in a separate pile and validate your eligibility to vote at a later time. IIRC, the voter gets a ticket # so they can check the voter portal later to see if the ballot was accepted.

As noted, the number of fraudulent votes are astonishingly small, given the amount of money spent on proving otherwise. The current GOP has spent 100s of millions or billions on proving wide-spread fraud and so far, all they've managed to prove a few voters, most of whom were actually GOP-leaning, have committed fraud (and most of them were caught day-of already).

reply
> As noted, the number of fraudulent votes are astonishingly small, given the amount of money spent on proving otherwise

How would you even know? The fact that prosecutions for fraudulent voting are rare tells you nothing. Prosecutions for tax evasion are also rare. Does that mean nobody evades taxes? If you have a system that’s insecure, how would you even know when it’s been compromised?

reply
> How would you even know?

The people who have claimed for decades that there is rampant cheating have spent years and millions of dollars and have found so little that it actually proves the case against their claims. Further, it has been shown that what sounds like reasonable checking ends up preventing 100-200 legitimate votes for every one illegal vote prevented.

HN guidelines say not to get political, but it is hard to avoid in this case because it is one party which is claiming widespread voter fraud. Let's start with a simple case. Tell me which of these facts is not true:

    * Donald Trump has claimed and continued to claim millions of illegal votes have been made against him, including millions by illegal aliens. The same claim, perhaps not using such large numbers, has been widely and frequently repeated by conservative media

    * Donald Trump became president in 2017 and had the might and resources of the full federal government to root out voter fraud

    * Donald Trump aggressively prosecutes his self-interests, and millions of illegal votes against him would be against his self-interest

    * As president, it is not just in his personal interest but is part of his duty to ensure voting is fair

    * Trump appointed Kris Kobach (more on him later), the AG of Kansas, to form a commission to get to the bottom of the rampant voter fraud

    * Nothing of note was produced by the commission ... it just kind of petered out
One must conclude one of three things:

    (1) Trump was negligent in his duties by not investigating the issue

    (2) Trump or his subordinates were incompetent in their investigation of the issue

    (3) Voter fraud is not common. I'll leave it to speculation whether this was an honest mistake on the part of conservatives or if they were lying for political gain
Read the wikipedia article about these issues relative to Kobach. Even before Trump, he was banging the drum as Sec of State for Kansas, claiming he knew of more than a hundred cases and asked for special powers to find the thousands of cases he knew were happening in Kansas. He was given authorization to do that investigation. How did it turn out? Start reading here:

https://en.wikipedia.org/wiki/Kris_Kobach#Voter_fraud_claims

Quoting a bit of it:

> At that time, he "said he had identified more than 100 possible cases of double voting." Testifying during hearings on the bill, questioned by Rep. John Carmichael, Kobach was unable to cite a single other state that gives its secretary of state such authority.[153] By February 7, 2017, Kobach had filed nine cases and obtained six convictions. All were regarding cases of double voting; none would have been prevented by voter ID laws.[154][104][155] One case was dropped while two more remained pending. All six convictions involved older citizens, including four white Republican men and one woman, who were unaware that they had done anything wrong.

The rest of it is similar, and all confirmed only that voter fraud is rare. But worse than that is his tactics, which have been adopted by many states, disenfranchises 100x more legal voters than illegal voters it catches. And statistically, it disenfranchises Democrats in far greater proportion than Republican voters (35% vs 23% of the affected voters).

Here is another useful quote, along with a citation, on this topic from that same wikipedia entry:

> A Brennan Center for Justice report calculated that rates of actual voter fraud are between 0.00004 percent and 0.0009 percent. The Center calculated that someone is more likely to be struck by lightning than to commit voter fraud.[156]

reply
There have been numerous efforts to scrutinize the voting. In 2020 there were 62 lawsuits; none of them succeeded.

Tax evasion is rarely prosecuted because nobody is looking very hard. People looked very, very, very hard for fraud in 2020 and found zilch.

reply
> You have to give your name, and they know if you've voted more than once at that station that day.

So you go to other stations, duh. It's called "carousel voting" [0], if done on a large, organized scale.

[0] https://en.wikipedia.org/wiki/Carousel_voting

reply
Limit voters to one polling location. Problem solved.

That's what we do in the US. You are assigned a polling location based on your home address. You can't vote anywhere else. If you try, they turn you away.

You can do a provisional ballot (for people who recently moved, and poll data isn't updated, etc) and they validate your ID/address/etc later.

reply
And in Russia, it is. That's why they call it "карусель".

In the United States, it hasn't been. The article you link to doesn't even mention the United States. To do it on a large scale requires cooperation from the people running the election, and the US isn't (yet) that corrupt.

The US system isn't completely robust against it, and perhaps some day it will be a problem. But right now there is no evidence that it is a problem, and all of the attempts to "fix" it are clearly aimed at preventing some people from voting.

reply
Interesting. In Canada, for federal elections at least, you're assigned to a specific location and station. You can't vote anywhere else. There's a separate process for mail in ballots to confirm you didn't vote in advanced voting or on election day as well.
reply
Same in the US.

You can try voting again at other stations, especially since they don't require ID. You just need the name of somebody assigned to that station, who hasn't already voted. There is a signature check if there is a suspicion, but that's rarely done.

But that's practically never done. The risks are too high, and to have a significant impact would require enough votes to make it certain you'd get caught.

reply
At least in NY, you would have to know the name of someone else assigned to the 2nd polling site, since your name is only on the list of 1 polling location?
reply
This is of course a very high bar to clear, as data such as people's names is highly confidential and almost impossible to get unless you're any one of these 750+ data brokers: https://privacyrights.org/data-brokers
reply
You'd also need a fake ID. And be willing to risk a felony conviction to add a single vote. It just doesn't happen here, despite the GOP trying to prove otherwise for decades.
reply
> You'd also need a fake ID

For what? In my state there's no requirement to show ID. When I first moved here I attempted to show mine at the poll and the poll worker told me to quickly put that away and she didn't want to see it. I'm not even sure it's legal for them to ask for ID here, given her panicked reaction to me trying to show it.

Since then I've voted in this state for around 10 years and it's always the same. I could say I'm whoever I want, and just be given a ballot.

Edit: I don't live in NY either, as the other poster used as an example. ID should be an obvious and necessary requirement, but it isn't in many states.

reply
Yeah, it's inconsistent between states. I'm in VA and an ID is required. Despite being a bleeding heart liberal, I'm ok with that safe-guard (despite much of the left being against the notion). I'd also prefer an actual national ID (not the half-baked RealID programs, which some states still haven't adopted).
reply
I've only ever seen one time it was tried. The experiment was wildly successful: https://www.nationalreview.com/2014/01/voter-fraud-weve-got-...
reply
Looks like those were in states that don't require ANY ID to vote, which I find ridiculous, so I guess we agree. I live in VA, we require ID, so the problem shown in NY shouldn't be possible.

And again, you still have to be willing to commit a felony to move the needly by ONE vote, which is not likely to be very common. The risk/reward simply isn't there.

reply
It only works if the people working at the polling station are in on it, because you can't normally get an absentee ballot more than once.
reply
Have you considered that in a system where proving cheating is so difficult, even weak evidence is powerful?

If cheating is difficult to prove then we would expect only minimal evidence even with material amounts of cheating.

reply
Also, most crimes aren't uncovered by lawsuits. They're uncovered by law enforcement. The reason people resort to lawsuits is because law enforcement does not rigorously investigate or monitor. Voting laws vary by state / municipality, and they're mostly run by well-meaning volunteers acting in good faith.

When we're not sure how well the TSA is doing, we try to send prohibited items through, and infamously get abysmal results [1]. IMO the reason we don't see more election fraud cases is because *we're not looking for it*, so we just see the obvious cases like when dead people vote or people brag about voting twice publicly.

Until we actually do some "red teaming" of elections, we won't ever know. But the reality is, if we actually did, the results would reduce credibility of numerous prior elections.

[1] https://abcnews.com/US/tsa-fails-tests-latest-undercover-ope...

reply
Red teaming, yes. But also, what other signals of fraud are we able to detect? What measures of validity (or signals that sending was attempted) are there? How are they distinguishable from honest voter errors?
reply
It's going to be difficult with our current policies because we've erred on the side of making it as easy as possible for everyone to vote. We don't have a complete whitelist of citizens, it's against the law to require proof of citizenship to register to vote (unless that changed recently) and address verification in most jurisdictions isn't done more than the first time unless it's challenged.

To be clear, though, I don't think non-citizens are voting en-masse. My concern is that if you aren't even verifying they're citizens, you probably aren't really verifying that they are a real and unique person that isn't already registered.

Honestly I think if we actually wanted secure elections, we'd start with the red teaming and go from there. The signal to noise ratio of fraud is too meaningless to resolve without tightening up rules, which the results of the red teaming would give you the political capital to do.

reply
Sure. And the weak evidence still isn't powerful, because so much effort had to be expended to gain it. If cheating were widespread it would have been detected much more easily.

Instead, efforts to clean up the voter rolls never cause people to get caught. But they do cause many legitimate voters to lose the ability to vote.

reply
Except people are actually getting caught.

https://www.dhs.gov/news/2026/03/09/ice-arrests-criminal-ill...

reply
THEY FOUND THE GUY! WOW!!!!!!!
reply
Nice goal post change, I see you got a friend to downvote all my comments too. Always nice talking to liberals. You gonna shoot me in the neck next?
reply
> If cheating were widespread it would have been detected much more easily.

This is a ridiculous assertion.

reply
Since we’re just considering things without providing any evidence, have you considered that we don’t have such a system?
reply
Sure you can, you just need an anonymous voting mechanism that's sufficiently naive. You use the verifiable process to restrict access to that anonymous mechanism.

In Canada, at both federal and provincial levels, you walk up to a desk and identify yourself, are crossed off a list, and handed a paper ballot. You go behind a screen, mark an X on the ballot, fold it up, take it back out to another desk, and put it in the box. It's extraordinarily simple.

> At some point, you have to give someone access to a database and they can change that database.

Well, that kind of fraud is a different issue from someone reading the database and figuring out who someone voted for (you just... don't record identities in the database).

reply
There will never be a technical or operational process that excludes cheating. The only deterrence that seems to work on humans and even then only most of the time is severe capitol punishment and that will only be as effective as people believe it happens thus requiring live streaming of the removal of cheaters heads without censorship. The current legal process of each country would have to be by-passed or people would just sit in a cage for 30 years. Even in such cases there will be people that sacrifice themselves if they think that bribe money can go to their family but that is at least a start.
reply
Also cheating with paper ballots is much harder to scale and remain undetected than cheating by altering records in a database.
reply
remain undetected than cheating by altering records in a database.

Absolutely. Any time something is centralized it becomes an irresistible target for unlimited numbers of bad actors and the bar to entry for remote anonymous access makes it a much easier target. Anonymous access to paper ballots means someone is going to be on at least a handful of cameras and has to bypass many security systems so if cheating happens it is because the people gathering the votes want it that way. Such cities or states should be excluded from the voting process.

reply
I agree with your point that attempts at cheating are inevitable, the rest is confusing though:

We have a long and storied history of coming up with extremely disturbing capitol punishments performed in public, and yet those punishments coexisted with much higher rates of criminality then now.

Stealing from the church in history carried some pretty gruesome deaths, and yet plenty of people still stole from the church, etc.

People are chronically bad at transferring future risk to their current decision making. Any consequence that relies on people being able to model a future problem against their current desires/needs is always going to have a lot of transmission losses. You end up trying to make ever more horrible punishments to overcome the losses in transmission.

I think the goal should be the smallest possible functioning consequence, which is possible by being close to the 'crime'. The very best way is when community can do it immediately. Like if someone does something fucked up, but then their buddies go 'that was fucked up dude', I am very confident this will prevent then from doing it again much more efficiently then a distant jail sentence. (among all the other ways too, there's never one clean action to take to solve problems on a societal level)

reply
[flagged]
reply
deleted
reply
> you walk up to a desk

I think the day I _must_ walk go a desk to vote is the day I'll give up. Voting by mail is one of the best things occuring here (in Switzerland). You get the voting stuff by mail, make your crosses, put it back into the postal box and it's delivered for free (as in beer) to the government.

reply
It's completely normal here. People get federally mandated time off to go vote; 3 hours IIRC, which is way more than would ever ordinarily be necessary (and polling stations are open well past typical work hours). I typically walk a few minutes from home, and never experience a significant lineup.

Relying on the postal service here would make it much worse, honestly.

reply
deleted
reply
> paper ballots and requiring IDs

isn't that racist? i've heard it repeated but i'm not so sure

reply
Depends on what qualifies as an ID and how hard it is to get one. But unless you're actively providing them to people that need them with no extra work or travel on their part then you're going to be discriminating against people with less money or time.

In the case where disproportionately more poor people are of a certain race then it can be seen as racist (as it affects the population of that race differently). If the reason that disproportionately more poor people are of a certain race is because of racism, then a policy that disenfranchised the poor would effectively extend economic discrimination into political discrimination.

Though I tend to think that even if we remove the economic effects of racism such that disenfranchising the poor couldn't be called racist, they would still be classist and should be avoided where possible.

reply
Americans who make this link to racism are welcome to explain why the same argument gets zero traction in Canadian politics, even among the most left-wing parties.
reply
I have to imagine the Canadian ID situation is different. Here, simply obtaining a copy of your birth certificate can be a long trip to a different state.
reply
birth certificate is not the only form of ID
reply
>Depends on what qualifies as an ID

how about the ones accepted by the police when they ask "show me your ID"?

if it's enough to ID you to cops it should be enough to ID you to enter the voting booth, no?

>and how hard it is to get one.

you can get one at the DMV

reply
It's been a talking point specific to the voting system in the US, strangely no other country seems to think it's an issue and as soon as the topic changes no one in the US has an issue requiring IDs for things.
reply
No other country is quite as heterogeneous as the US. And there is a significant history in the US of using restrictions around voting to disenfranchise certain ethnicities. That makes any restriction around voting a sensitive topic in the US.

Proponents of voter ID claim it is needed to prevent fraud, while opponents point out that there's not enough fraud for it to be worth the cost.

Note that countries such as Australia, Canada, and New Zealand also didn't require voter ID. First-world countries that do require ID to vote have systems in place to ensure that getting that ID is easy even for poorer people - such as automatically sending the ID to the voter by mail if the government requires you to report your residence or filing out the necessary forms once, before turning 18.

reply
> No other country is quite as heterogeneous as the US.

there's no scientific link between race and the ability to go to a DMV once every 10 years

reply
Voting is a civil right. We need to have a system that allows everyone who is allowed to vote, to vote. Many people don't have IDs and it is an onerous process to get one. Any system that requires IDs for voting suppresses these people's civil rights.
reply
> Many people don't have IDs and it is an onerous process to get one.

I have seen this constantly claimed, and never reasonably evidenced. It's also hard to believe the kind of American exceptionalism that supposedly causes these problems that everyone else can easily solve, despite an environment that is clearly heavily politically invested in solving it (because that also avoids the appearance of racism).

Meanwhile, American proponents of voter ID can readily find people including among the supposedly discriminated-against groups who will testify to the contrary.

reply
There's a trivial solution to this: IDs should be provided by the government for free.
reply
You can have e-voting systems that protect ballot secrecy and are verifiable.

You can use homomorphic encryption or mixnets to prove that:

1) all valid votes were counted

2) no invalid votes were added

3) the totals for each candidate is correct

And you can do that without providing proof of who any particular voter voted for. A few such systems:

https://en.wikipedia.org/wiki/Helios_Voting

https://www.belenios.org/

Authentication to these systems is another issue - there are problems with mailing people credentials (what if they discard them in the trash?).

https://www.cbc.ca/news/canada/ontario-municipal-elections-o...

Estonia (a major adopter of online voting) solves this with the national identity card, which essentially is government issued public/private keys.

https://en.wikipedia.org/wiki/Estonian_identity_card

Lots of cyber risks with the use of online voting though, especially in jurisdictions without standards/certification. I outline many in my thesis which explores the risks to online elections in Ontario, Canada (one of the largest and longest-running users of online voting in the world)

https://uwo.scholaris.ca/items/705a25de-f5df-4f2d-a2c1-a07e9...

reply
If it's a completely binary choice of "election was valid" and "election was invalid" without any partial verifications of results, I think it's still a massive step back.

By which I mean: paper ballots have problems. But a fault in a handful of ballots doesn't mean the rest of the ballots need to get tossed out.

I do not believe that a system managed by humans can be faultless.

reply
> You can have e-voting systems that protect ballot secrecy and are verifiable.

In these systems the voter cannot verify that their vote was secret as they cannot understand, and much less verify the voting machine.

> And you can do that without providing proof of who any particular voter voted for.

Which is good for preventing the sale of votes, but keeps things obscure in a magical and correct box.

How can I tell the machine didn't alter my vote if it cannot tell me, and just me, who I voted for? The global sanity checks are worthless if the machine changed my vote as I entered it.

reply
I've worked on some research in this area as well (the experience of people with verifiability systems in real-world elections)

https://link.springer.com/chapter/10.1007/978-3-031-43756-4_...

Beyond this paper, based on my experience working with election officials, political candidates, and voters, I would agree that verifiability is not well understood.

reply
And if it could tell you that then a third party could force you to reveal that you voted "right" as agreed before.

Paper ballots with mutually suspicious representatives of all parties watching themselves during handling and counting is the only way to go for big things like parliament/presidential elections and national referendums where, in the worst case, the greatest of all matters are at stake. And foolproof method for voting is most needed when the levels of trust are at the lowest.

reply
you don’t need to be an aviation expert to trust the plane will fly.

likewise e-voting systems pass through cryptography experts auditing to verify it does what it says it does.

said that the voting solution can also provide cryptographic proof that your vote was unaltered, and accounted for, without need to expose your actual vote.

the claims about database altering, are also false as the vote is cryptographically signed and unalterable.

also there is another feature where you can recast vote on top of your previous one and the last vote will be the valid one. This is crucial for countries where the bad guys can come at your place and under distress (gun) force your vote. you can then recast safely invalidating the forced vote.

e-voting solutions is really interesting and in an alternate reality I think we could have had a mainstream e-voting and more even direct-democracy vs our current democracy by proxy (elected officials)

reply
> How can I tell the machine didn't alter my vote if it cannot tell me, and just me, who I voted for?

Isn't that the whole point of having ballot secrecy ? Even with paper vote you cannot tell which ballot is yours (or at least, a recognisable ballot is voided during the counting).

reply
You should care how much maths and encryption you use [0][1], because this is not only possible, but there are multiple approaches.

[0] https://satoss.uni.lu/members/jun/papers/CSR13.pdf

[1] https://fc16.ifca.ai/voting/papers/ABBT16.pdf

reply
More important than lack of voter fraud is proving to the population a lack of voter fraud.
reply
This. A voting system and it security must be understandable to the average people. You can not do that with electronic voting. (Even if electronic voting can be done securely.)
reply
Why?
reply
I'm sure you could even let every voter verify that their vote has been registered correctly.

Edit: But as a comment somewhere else in the tree noted ,,And if it could tell you that then a third party could force you to reveal that you voted "right" as agreed before.`` - I guess everything's trade-offs.

reply
Australia has a system where you are anonymous and can prove that you only voted once:

You have to be registered and must vote within your electorate, so your name appears on a certified list for that electorate and each voting location has that list. When you vote, they strike your name from the list.

After the election, the lists from these locations are compared. Anyone who votes twice has their name struck twice, and are investigated for electoral fraud.

Whether people know if you voted or not is immaterial, as voting is mandatory in Australia.

Works pretty well for a paper system.

reply
Sorry, isn't this dead simple?

Maintain a list of identity hashes. When someone goes to vote, deny them if they're already in the list . Otherwise, add their hash to the list then allow a vote to be cast.

reply
On the US keep in mind elections are run at the state level and below, so we don't have a single voting system, we have 50+.

My state, Oregon, for example uses a very straightforward vote by mail system. They ask if you wanna register to vote when you get/update your drivers license or state id. Your ballot just comes in the mail, you fill it out, send it back. For folks that lack a permanent address or similar, you can get provisional ballots at libraries and similar city offices. The provisional ballots make you fill out enough information to check if you're allowed to vote.

It's simple, convenient, secure, and efficient.

So why don't more states do it this way?

Unfortunately there's a long ugly history of using all sorts of dirty tricks for voter suppression in the US, in particular to keep Jim Crow going. And unfortunately variations of that continue today. I don't have the energy to dig into it fully here, I just want any international readers to be aware there's a whole lot of utterly craven bad faith when it comes to discussions around voting fraud and security in the US.

reply
There's a goverment issued public & private key right here: https://en.wikipedia.org/wiki/Estonian_identity_card
reply
yes you can.

each citizen gets an anonymized private key via a secure channel (eg. postal) and use that to vote.

votes are double enveloped: outer envelop: anonymized id + inner envelop: vote.

mixnet separates the votes and cryptographically shuffles them to decouple relationships.

only at the end the shuffled votes are decrypted using the private key of the election itself that was split using shamir secret sharing (eg 5 out of 7 shares to reconstruct)

the thing that’s not clear from the article and it’s a shame is that it seems the failure was the hardware (the 3 USB keys) not the election software. This could be simply avoided by having redundancy on the hardware (2 USBs per share) or more shares themselves (5 out of 9 shares)

reply
> Until we all have government-issued public keys or something

That's actually pretty common in Europe. The Spanish DNI (national identity card) has a chip these days, which gives you an authenticated key pair for accessing digital services.

In the pilot project for digital voting, that identity is only used to authenticate the user, and then an anonymous key needs generated that can be used to cast the final vote.

reply
What about this? Consider a toy system: everyone gets issued a UUID, everyone can see how every UUID voted, but only you know which one is your vote.

This is of course flawed because a person can be coerced to share their ID. In which case you could have a system in which the vote itself is encrypted and the encryption key is private. Any random encryption key works and will yield a valid vote (actual vote = public vote + private key), so under coercion you can always generate a key that will give the output that you want, but only you know the real one.

reply
Besides the fact that 99% of the general population won't be able to understand this, a $5€ wrench says that you show me proof of the correct private key (either by you showing me the letter you received, me being present when you set it up, or however it is set up)
reply
deleted
reply
> South Africa gets around this by putting ink on your fingernail

This is true, but its used in other countries as well, as it's a simple, effective, low-tech, affordable process.

Most notably in India https://edition.cnn.com/2024/05/02/style/india-elections-pur...

but also in many other countries: https://en.wikipedia.org/wiki/Election_ink#International_use

reply
> At some point, you have to give someone access to a database and they can change that database.

It's the only problem in existence that can be solved by the blockchain...

reply
Ironically most production e-voting systems do not use blockchains. That's because there isn't need for decentralization, just verifiability of a correct result and protecting voting secrecy.
reply
But generally sacrifices that anonymous axis via a reproduceable public ledger
reply
Unless pseudonymized...
reply
South Africa is in a somewhat similar situation of having a gigantic (1-10%, government is too broken to figure out where in that range) illegal immigrant population and poor access to paperwork for many citizens that would make any heavily scrutinized citizenship for registration lean heavily towards disenfranchisement of the poorer segments.
reply