How would you design an secure online voting system?

> How would you design an secure online voting system?

You don't. Anything done "online" simply verifies that "some human at a keyboard" has the requisite "secret" -- but cannot verify that the correct human who should legally have the secret is indeed the one entering the secret.

I.e. Bob gives Joe his "voting secret" and now Joe can log in as "Joe" and vote his legal vote, and also log in as "Bob" and cast a second vote, all while the online system believes "Bob" is casting that second vote.

Also, if you want to maintain the secrecy of the ballot then you simply can not perform online voting, because with the machines there can always be some trail to trace between "ballot X" and "Fred" to show who cast that ballot.

I would look at works in other countries and see how we can adopt or improve on that and our existing system.

Some things that come to mind: - National voter ID card. Countries like Mexico and India have this for everyone. You can’t vote without it. - Fingerprint of some sort. Either retina or fingerprint scan to verify identity. This opens up a civil liberties can of worms but we would need to secure this somehow. - I’ve read of some startups looking to us blockchain, but not sure how that would work. - I read an article about a company called Unum ID that was looking to address this problem. You sign up, give an address, they mail you a card with verification of your address to put into their app. The app then has a unique QR code that gets scanned. Similar verification setup to Nextdoor or buying ads on Facebook. They verify your identity by mailing you a unique code that needs to be entered into an app or page to verify your address and who you are.

I think the key components are, verify the address of the person, confirm it, secure/uniquely store the identity in a service.

The biggest problem we face is fraud. Double votes, voting for others, voting as dead people. California had to purge their roster after being sued for the data being inaccurate. I think 300k names were removed or asked to verify. 300k wrong voters can swing a local or state election. That’s big.

The process is actually quite straightforward:

- Every citizen is issued ID that includes a hardware embedded public/private key pair. A YubiKey essentially. This step is optional, but allows ballots to be assigned remotely.

- Election commission creates and maintains their own key pair.

- Ballots are assigned remotely to eligible voters by encrypting with citizens public key, or assigned in person. Ballots themselves are key pairs, and the commission throws away the private keys after assigning them. The list of ballots is published signed by commission’s key.

- Votes are the position + a secret encrypted by a voter’s private key, signed with the ballot. Votes sent to the commission and published.

Everyone can see which ballot voted which way, verified by the ballot public key. Voters can verify the commission didn’t keep the private key by verifying their encrypted secret. Votes are anonymous, cryptographically verified, and if a citizen ID system is used ballots can be assigned remotely so the entire election is remote.

No blockchain or specific applications are required for this system, just agreed upon key algorithms. The downside is keeping private keys secure is difficult compared to watching over physical ballots.

A system similar to this was used in the recent Hong Kong protest election, with the ballots issued in person.

Estonia’s system is insecure, relying on private closed systems to store, transmit, and tally votes. They have made changes, but AFAIK they don’t provide a way to publicly cryptographically verify votes or vote counts, and voting has to be done through a specific app.

"Online voting" is a solution in search of a problem. A pencil and paper does the job better, cheaper, and more securely.

I wouldn't design it but I could contribute to it. I would look for the proverbial pony express friendly features and check if they actually make sense in 2020. For example: remove the requirement for it all to happen at the same time. This is clearly a feature that makes paper voting work. In 2020 we should be able to change our vote when we like and have a threshold at which a candidate or party is replaced. (This also gets rid of the election circus and make election promises more binding (rather than the "say whatever you like" paradigm) If you need to make decisions that are unpopular you will just have to work harder to inform and educate people about the logic behind it.)

If it is not in real time voting in person is not a problem. A secure room (phones and cameras not allowed) where no one can see what you've voted. (a bus would do fine)

4 separate systems with a 5th that checks if they all got the same vote from you. At the regional level the votes are counted continuously, if one of the 4 system produces a different result an investigation is triggered and huge prison sentences may follow.

I started thinking about this a few months ago when I voted by email as an overseas voter. Essentially, our state has an online-to-offline process to convert digital votes to a PDF that can be emailed or faxed, then printed and processed like any other vote.

We could immediately open this system up to every American with a small number of technical & legal changes.

Most of my thoughts about a more complex system are probably not unique, but thinking about this generated a few details that may be interesting.

The obvious final conclusion (for me) was that we could digitize our entire system in a few election cycles, without throwing out the entire system and starting over.

Just 1. Set minimum requirements federally for voter registration systems, 2. Create digital tools for creating and tabulating votes (form to PDF software, public ledgers), & 3. Allow everyone to cast a digital vote which can be converted to a normal paper ballot.

Then, at some point in time, you reverse the system, and make your digital ledger your source of truth, instead of your paper ballot counts.

The biggest problem with voting systems (online or otherwise) is absolute secrecy. If you give up on this requirement, which I believe is antiquated [0], you can easily come up with a system where most fraud could be fixed and punished. You can have reasonable privacy, but you have to have the ability to audit votes if need be.

A system in which all votes are fungible after a certain point only encourages fraud. As long as you execute it well you can have a high degree of certainty that you won't be punished.

[0] First, behind this requirement is the premise that political repression is to be expected. I'm sure that's true in some places, but you want to fix this in other ways. Second, you already don't have perfect secrecy in many systems and people don't seem to mind.

Here is a great video from Computerphile about why this is a hard problem

https://www.youtube.com/watch?v=w3_0x6oaDmI

Long story short voting needs to be secure and anonymous to be fair.

Hard to get all things at once.

Estonia has online voting. Approximately 30% of votes are cast via that medium. There have been past concerns about the security, but they are supposedly resolved now. They use a smartcard and blockchain as part of the system. I don't remember the rest.

So if I were building a system for voting online, I would audit that system and improve on any security deficiencies.

E2EVIV - end to end verified internet voting, is an open field of research. there's a company out of Portland that is working on implementations from publications called Free and Fair. The IVF internet voting foundation has some good documentation on this as well.

I'd keep it offline but allow for online lookups to make sure your vote is cast.

For example, at the end of the process the election counters release a file called "results.txt".

Inside that file is a data structure like: { huid: "123-456-789-ABC", vote: "Biden" }

Then you grep for the secret huid that you wrote on your paper ballot and that make sure that your vote was counted correctly.

This is a simplified concept without eg. PK crypto. Microsoft's ElectionGuard is an actual cutting edge implementation of how to do it well: https://github.com/microsoft/electionguard

The first problem is identity. The voting part is easy, the politics are impossibly expensive to navigate though.

It already exists! HTTPS://Vocdoni.io HTTPS://Docs.Vocdoni.io

--->Online. I wouldn't.

But to take a stab, welcome blockchains ^_^