<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">On Tue, 15 Nov 2016 15:07 Natanael wrote:<div class=""><br class=""></div><div class=""><blockquote type="cite" class="">In the model of paper and pen, 3-ballot already fixes it. Omission of votes<br class="">is provable, and voting is easy, yet anonymity is preserved even if<br class="">somebody gets your voting receipt paper (it alone doesn't reveal what your<br class="">vote was).<br class=""><br class=""><a href="http://rangevoting.org/RivSmiPRshort.html" class="">http://rangevoting.org/RivSmiPRshort.html</a><br class=""><br class="">You don't need to trust the counting machines, because the result is<br class="">auditable.<br class=""><br class="">If you're really paranoid, put votes on a conveyor belt under glass and let<br class="">multiple independent machines photograph them. Hash and timestamp the<br class="">images and checkpoint them in public (Bitcoin blockchain?).<br class=""><br class="">Of course the votes would be sealed after filled in, then scrambled once<br class="">put in the box (lottery style), then only get unsealed and counted in<br class="">batches (resists timing attacks to some degree).<br class=""></blockquote><br class=""></div><div class="">Thanks for the link to the interesting Rivest & Smith proposal. Putting aside the difficulty of getting voters to understand it and the challenge of building the complex voting machines needed sans any computer elements, I see a couple of problems with the 3-ballot approach:</div><div class=""><br class=""></div><div class="">1. What happens when a voting receipt is produced that doesn't match a posted ballot? I’ll buy for the moment that this proves some fraud has occurred. Now what? Re-run the election? </div><div class=""><br class=""></div><div class=""><div class="">2. What prevents people from forging ballot receipts? There are no computers to create an electronic signature and anyway electronic signatures require trusting someone to hold and protect the signing key. If a single forged receipt can cast doubt on the legitimacy of an election, there is a huge incentive for the losing part to do so. This past election is a perfect example. Imagine if Hillary could challenge the vote in a few key states. One requirement for a voting system that is not often mentioned is finality. </div></div><div class=""><br class=""></div><div class="">I don't see the advantage of this system over the scanned paper ballots we have here in Cambridge, Massachusetts. Poll watchers from the political parties can supervise the handling of the paper ballots. It is a process people understand and trust. Privacy? There are many threats to the privacy of voting besides jiggered voting machines. Our cell phones already track us and the data can tell when we voted. Video cameras are almost undetectable and can watch voters make their selection. Cameras can be put in the ceiling overlooking the voting booths, or in the booths themselves. (The complex mechanical voting machines that Rivest & Smith posit would have many places to insert a camera. The camera could be removed at the end of election day.) And a sufficiently coercive group can influence the vote merely by spreading rumors it knows how you voted. Whack a few citizens for voting the wrong way; it doesn’t matter if they did or not. </div><div class=""><br class=""></div><div class="">Arnold Reinhold</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>