Public Trust Demands Open-Source Voting Systems
Key topics
The article argues that public trust demands open-source voting systems, but the discussion reveals a more nuanced debate around the role of technology in voting, with some advocating for paper ballots and others highlighting the limitations of open-source software in ensuring election integrity.
Snapshot generated from the HN discussion
Discussion Activity
Very active discussionFirst comment
41m
Peak period
132
0-12h
Avg / period
17.8
Based on 160 loaded comments
Key moments
- 01Story posted
Oct 21, 2025 at 12:01 PM EDT
3 months ago
Step 01 - 02First comment
Oct 21, 2025 at 12:42 PM EDT
41m after posting
Step 02 - 03Peak activity
132 comments in 0-12h
Hottest window of the conversation
Step 03 - 04Latest activity
Oct 28, 2025 at 2:51 PM EDT
2 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
It is possible to do small-scale fraud with paper ballots, you can never fully eliminate that option. But it is exceedingly hard to do larger scale fraud without it being extremely obvious to any observer.
Yes, I know: before computers and other mechanical systems, people had to count ballots by hand. There were many fewer people voting then, and regardless, that's not really the point: they counted by hand because they had no alternative.
Electronic voting certainly brings new problems into the mix. I don't think those problems are insurmountable. The problem isn't the technology itself. It's the legal and social landscape around voting technology. Open source, with reproducible builds and a method to verify that the code running on a machine was built from a particular version of source, is a start. Verification of that software's functionality, on par with the verification done of critical software (medical devices, things that go into space, slot machines, etc.) would be another good move.
Voters can also receive paper receipts, and I'm sure we can come up with some sort of scheme to take a representative sample of the electronically-recorded votes and validate them against the paper receipts, while maintaining voter privacy.
As soon as you try to be more clever than electronic counting of paper ballots, yes they are.
You can either audit the count by replaying the input event stream, or you can't.
Other countries do paper ballots and manual counting without issues. The US isn't that special or unusual.
Remote attestation via trusted execution environments is a thing. It is not a theoretical one either. See, for example, Graphene OS's Auditor app[0]. Solving this for voting machines in particular would be a matter of good design, not of solving fundamentally hard problems.
[0] https://attestation.app/
* Opens Cargo.lock [1] and pnpm-lock.yaml [2]
* Closes Cargo.lock and pnpm-lock.yaml
* Goes to find a Tylenol
At least with open source we can see the sausage getting made...
[1] https://github.com/votingworks/vxsuite/blob/main/Cargo.lock
[2] https://github.com/votingworks/vxsuite/blob/main/pnpm-lock.y...
Watch out that you don't catch the autism :) /s
> [1] https://github.com/votingworks/vxsuite/blob/main/Cargo.lock
> [2] https://github.com/votingworks/vxsuite/blob/main/pnpm-lock.y...
These files are actually cursed and I want all drives that contain their data destroyed with acid. But I have a slight feeling other voting software isn't really any better, even though in theory it should be relatively simple software in the grand scheme of things.
Auditing the software isn't enough if you can't reliably verify that this is actually what's running on the machines, or if the machines weren't otherwise tampered with in some way.
Note that ananymous is also a required part of voting.
• Why Electronic Voting is a BAD Idea <https://www.youtube.com/watch?v=w3_0x6oaDmI>
• Why Electronic Voting Is Still A Bad Idea <https://www.youtube.com/watch?v=LkH2r-sNjQs>
Humans are actually quite bad at hand-tallying hundreds of millions of datapoints. Our eyes go glassy but we press on anyway.
Machines are very good at doing that kind of tedious labor accurately.
Whether human beings will put more trust in a system that we know will be wrong, but it's wrong for comfortable meat reasons, over a system that might be compromised but will be more accurate its more of a psychology question than a technical question though.
The problem with the accuracy assumption of electronic voting is that a) its all coded without errors and b) someone hasn't deliberately but code into manipulate the vote numbers.
If you're saying we should be writing voting machine code in ML and keeping the firmware in Fort Knox, I'm going to make the argument that it's a lot cheaper to do sampled hand-counts to check against machine error or tampering... Which we already do.
It doesn't because even with unit and integration testing, software still fails and get hacked/exploited on a regular basis. What's worse with software voting is that a single good exploit could affect all the votes.
> no software or programmable hardware
That's obviously too stringent. Consider:
1. Precinct hand-counts every single paper ballot bubble sheet.
2. Precinct hand-counts every single paper ballot bubble sheet, then confirms the hand count by feeding all the ballots into an electronic bubble-sheet reader.
Your claim is that #1 is more trustworthy than #2. That's an extraordinary claim that requires more evidence than two youtube links!
Edit: to be clear, I want the requirement that all voting must be paper ballots like the human-readable bubble sheets mentioned above. But saying that no software or programmable hardware can be used "in the election process" is so extreme that it sounds like a parody of my own position.
More seriously, even though some cars are programmable, I did not mean that nobody could use cars to transport ballot boxes. I obviously meant that the official results should be the manually-counted one; machines could conceivably be used to get interim results faster, and/or to double-check a count to see if it needs to be counted again. But I was serious about requiring absolutely no machines involved in the counting of the official results.
In addition, most states have a mechanism by which a candidate can formally challenge the results in a precinct, forcing a hand-recount. This usually has some kind of onus on the requester (I believe in PA for example you have to put up a bounty and if the hand recount results come out to the same result as the previous tabulation the state keeps the bounty as payment for the added cost of the forced audit). However, it is an option (and, most notably, not an option that anyone who claimed shenanigans in 2016 or 2024 exercised).
The problem of election integrity doesn't exist in a vacuum and didn't pop up overnight in 2016; states have been working the issue for a couple centuries and have a pretty good system. But it's a system that requires some detailed statistics and process control theory to understand, so I'm not surprised the median voter doesn't get it. There is, perhaps, a case to be made that for that reason alone we should go to manual, but someone's gonna have to spend the money on that if we're going to do it; it's going to be drastically more expensive than electronically-facilitated counting. And, indeed, people will have to accept that human counters will be less accurate than machine counters (because they're human; we don't train "computers" anymore as a discipline).
This places a lot of trust in that “random” selection.
Not sure why you're scare-quoting random. Do you have reason to believe it's not random?
proven for the private market(s) != proven (or even acceptable) for governments
do the risk analysis. what happens when an industry-standard quality control measure fails in whatever way for a private company? some hit to their reputation, stock price, market share, maybe they even fail. these are perfectly acceptable outcomes for a private organization. they are not acceptable outcomes for governments. governments demand (much) higher standards and more stringent processes. slowness is a feature, not a bug.
We've been using mechanical, semi-mechanical, and electronic systems for decades at this point. The new concern for accuracy is pretty unfounded (and, it is worth noting, was heavily drum-beat into existence by a Presidential candidate who then went on to win an election).
If we want to talk problems with electronic systems, I'm a lot more concerned about how people don't actually know how to use touch screens (and I am myself in favor of pencil-and-paper ballots for that reason alone) than I am about people being able to sneak a super-double-secret modification to an electronic tabulator in against all the ways that attack could fail (including "The county can just decide to hand-count the pencil and paper ballots anyway, which would discover the deception").
Fully electronic, no-paper-output systems are past my personal trust threshold.
The main benefit of manual tallying is that election tampering at scale becomes a rather labor-intensive and physical process that is more likely to leave detectable traces. Compare that to the the last US presidential election that has statistical oddities in machine-tallied voting results of kinds that have historically been shown to correlate with election fraud. If this was indeed caused by fraudulent voting software, it happened without leaving any other obvious traces of tampering.
When and where was this?
- in New York there is statistical anomaly correlated with a couple small-town polling stations. Those towns are small enough that they have a huge population of one religion, and one explanation is that the Democrat party's perceived "soft on Israel" stance tilted 100% of voters in those locations away from supporting the Democrat presidential candidate.
- in Pennsylvania a standard statistical analysis tool used to detect vote disruption suggested disruption occurred. The form of the disruption could be fraud, but it can also be things like voter intimidation (which was observed and reported in Philadelphia) and sudden discontinuity in voter behavior (the aforementioned "soft on Palestine" issue).
Correlation does not imply causation, and the lack of evidence of tampering of the machines in the audit logs is lack of evidence of tampering of the machines, not indication that the audit logs were compromised.
People who think it's not safe should really spend some time learning how it works. It's impossible to cheat at scale. Each ballot is verified to be correct my multiple eyes. A person is reading, one is writing down the name, one is verifying and some other things I don't remember.
To cheat you need to have everyone in on it. A whole town involved to cheat and to at best win one polling station. It's safe because anyone can attend the counting, so each party can send someone to check no shenanigans is going on.
So the more votes you want to be winning by cheating the more people must be brought in the conspiracy. That's impossible to be unnoticed at the scale of a city, much less at the scale of a country.
[1] https://en.wikipedia.org/wiki/Carousel_voting
Every single vote must be checked against publicly available lists of voters. Every ballot can only be given somebody whose identification is checked against this publicly available list and marked. The lists must have multiple copies some in the hands of opposition observers. They need to be published.
Yeah, do that by hand please, without relying on electronic means.
Paper ballots with "honour" based out of circumscription participation is not secure. My country also suffered from this issue and it's not an authoritarian regime. They fixed it by adding and checking IDs on a ballot participation list. Nobody explained how that works to the average voter.
What I was trying to underscore is that even for something that's presented as simple and fool proof as paper ballots one can find vulnerabilities, especially when you're dealing with nation level threats. So in my opinion we shouldn't ask electronic ballots to be more security than what is already in wide use.
And in fairness, electronic ballots don't need to be more (or as) secure as paper ballots, but 'mail in' ballots. If we can come up with a method that's as secure as mail ballots I'd call it a success, despite what Tom Scott says.
I really recommend people volunteer for it, if you're American and you're concerned. All you have to do is call your county elections office; they always want more people. You get paid near-minimum wage and it takes two days a year, but that's it.
What you will discover is that most of what people are asking for in this thread is stuff the states of the United States already do.
If a person is deeply concerned how the election is run? Go get involved. It's your country and your election system.
Elon did it, and they both bragged about it, publically.
Why do we believe the liar on this topic?
Having a paper trail and an observable counting process is worth a small error margin.
Humans just need to be able to separate a few hundreds of ballots into a couple of piles. When introducing double checking this makes an incredibly rigorous process, which can be open to the public. This is the case here in Germany.
Everything after that can be done by computers as all the data after that is published.
And the other related issue is that in 2025, it simply should be possible to vote from your phone in a way that verifies your identity, if you'd like, using the faceId/fingerprint biometrics that most smartphones from recent years have.
And if anyone can make up a reason to doubt the outcome of the election, it will fail it's objective: Peaceful transfer of power.
The usual way to try to solve this is the ability to override previously cast votes, in secret. But the combination of that and the ability for all interested parties to independently verify the count is not trivial. But not impossible either, much has been written on the subject since e-voting was all the rage in the 90s. One would do good to study this work before designing yet another voting system.
Paper ballots are fine. It is not complicated at all and an election is the one thing you just cannot get wrong in a representative democracy. It can cost a bit and you only do it once every few years.
They can see whether another candidate's ballots are piling up faster than yours, they can estimate whether a table counting ballots for a district you're expected to dominate is being given way fewer ballots to count than you'd expected...
Yes, they would obviously spot if some election worker is like adding a pile of pre-marked mass produced ballots to a pile or something, or if they were just putting half of your ballots in the wrong pile - but stuff like that basically never happens, whereas somebody will win and it'd be nice to know before it's announced if that's achievable.
Sounds like externally verifiable logic systems is an upcoming need.
E.g. You as a Citizen walk around with your own System Verification toolkit and can at any time Verify that the voting system tabulates your vote. Something fantastical like that.
Trust is hard to maintain with human. Digital trust is not a human concept, the way I think at least. So this area is tricky.
Software and hardware is still magnitude more vulnerable to intentional misbehavior, and even accidental mishaps has a higher risk of massive negative consequences, and its harder to discover failure compared to boxes of votes that has a physical presence.
This complicates a formerly intuitive subject, introducing radical change hidden within an often literal black box .. and nowadays that box is in 'the cloud' .. making it difficult for humans to retain a mental model, which can then reduce the sense of trustworthiness of that subject!
Corruptible humans are here to stay, forever. We are alive until we are not, and we are a successful species, so we "get it done, whatever it takes" in order to survive. That includes grifting.
People are motivated to resource-hog (power, money, votes in favor of their own interest) by brain chemistry / structures. "Feels good to win."
So - in my view - regulation is key to ensure that shared values win, over personal values.
Technology doesn't care, and can be crafted to add "guardrails" that prevent corruption.
The trick, again in my view, is maintaining those guardrails as anti-guardrail technology is developed by self-interested grifters!!!
What a world! (ncr100 sprays chrome spraypaint on mouth an drives off into the desert ...)
Arguments against electronic voting: 1) one person can change millions of votes 2) vulnerable even outside the country 3) even if you audit the software, it's hard to verify that the audited software is what is actually loaded on the machines 4) even if you check hashes of the software, how do you check the software that checks the software (this is a restatement of the Ken Thompson Hack) 5) proprietary software 6) USB sticks are insecure 7) final computer tallying everything is owned and located in a single place 8) XSS attacks on e-voting pages.
Arguments for physical voting: 1) centuries old, many attacks have already been tried and failed 2) no identifying marks on ballot = no opportunity to pressure voters to change their vote 3) multiple people involved in each stage of the process
I realized after typing that out that YouTube has a "Show Transcript" function, so try that for the second video.
These are fair criticisms.
And I personally feel that electronic voting can be made secure and trustworthy, in the human sense of trust and the digital sense. Looking at this from a 'voting accuracy advocate' position, one could add verifiability at all stages, allowing external validation by the invested party .. the citizens could count their own votes and vet the State's tabulation.
I could be wrong, though. As far as I know, hardware companies nowadays cannot even be reasonably sure that the chips they use don't contain backdoors.
If you can not independently verify election results, what good does published source code do?
Elections are a process, not a result.
The huge takeaway for me was not the technology (or lack thereof). Ultimately all existing (and proposed) systems have flaws. The key was public trust in the result.
The first step to sidestepping democracy is to attack the legitimacy of elections. One can attack the process, software, hardware, ballot security, eligibility, and so on. It doesn't really matter what you attack - it doesn't matter if your gripe is legit or not. It only matters that you erode trust in the result.
If you can make people think the elections are rigged, then you can bypass them and move straight to authoritarianism.
Quibbling over open-source or not is irrelevant. We can cast doubt on the software either way. Quibbling over electronic or paper voting is equally irrelevant (there are plenty of paper-only elections worldwide that are very suspect.)
Naturally the Open Source company promotes Open Source voting machines. But in truth being Open Source has no (real) benefit. Software is easy to tweak, Open or not.
In the US for example, distrust is very high. Promoted by accusations of mail-ballot fraud, of illegals voting, by anything at all. This continues despite winning the 2024 elections.
But that's not the truth though. Open source software is not easy to tweak when it's deterministically compiled using reproducible builds and there are provisions for on-demand inspection of executables and hardware.
Firstly, inspection of code is a very technical skill, so there's a certain amount of reliance on a tiny group here. That tiny group then simply declares whatever they like. Understanding a complex C program, looking for obfuscated behavior is a very specific skill.
Secondly, given the tens of thousands of machines in play it becomes impossible to guarantee the code inspected is the code that runs. The GCC compiler itself, used to build the software could be altered. The kernel of the machine could be altered, and so on.
Yes, ultimately given enough time, it would be possible to detect problems. But getting a report years after the election is fruitless. Also, no doubt, with time, security issues in the OS and code will be retroactively discovered. There will be no way to determine if those flaws were used or not.
In short, you cannot determine veracity or correctness of the machine, in reasonable time. Making the code Open Source does not change this.
And again, it doesn't matter if the code is honest or not. It only matters what people believe. If anything having the code Open just means more opportunity for malicious actors to claim they've "found issues" without being specific.
The issue is not the software. And its not the software license. It's the environment of mistrust coupled with the willingness of people to accept obvious and blatant misinformation. (See vaccines etc).
Independent testing laboratories exist that do specialize in the specific skills you're talking about. Pretty much all of the software involved is certified and saved, source is saved, compiled binaries are saved, hashes are logged of the compiled binaries. Binaries run from EPROMS or write-protected partitions making it very difficult to change them once installed. Cabinets have tamper-apparent sealing.
The machines are designed so that an auditor can inspect a machine on a casino floor in under 5 minutes, verifying that the software that's installed is the one that's supposed to be and that the physical seals haven't been broken.
I'd imagine there are a lot of similar processes for ATMs.
Don't put all eggs into a single basket.
Electronic voting is fine. Why can't we just have a printer in the polling booth? I run my ballot, then hit print, then I can manually verify it, and then drop the printed ballot in a box.
Literally the easiest thing to do.
Your comment here, for example, would be fine without the last bit ("you've missed the point entirely").
If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
Printing paper is cheap. Shipping it is cheap. Checking it is cheap and obvious. Reprinting is cheap. You don't even need to ship them. Most of the cities are close to industrial areas which has big printers and paper mills.
Making stamps or buying pens is cheap. You validate ballots at the polling stations which is scalable and cheap. It is the members of public who validate it. You don't need to pay most of them. They are just local constituents! It is their vote!
You are not aware how far away you are from the point!
If you want this, the next step would be to get involved at your county or state level (depending on how your state makes voting technology decisions).
You didn't define how paper ballots are better. Given that many electronic systems print paper ballots, I'm not sure how they could be said to be universally better.
Electronic ballots can be much better than paper in two ways. Firstly, they are faster to count. I'm not sure why that matters, but it's true and seem people seem to think knowing the outcome quickly is important.
Far more importantly to me: they are easier to use. In Australia we have compulsory voting. A lot of attention is paid to how many votes are invalid. It currently runs at 5%, but ranges up to 10% in areas with lower education levels or non-English speaking. Voting machines can tell you verify if the vote is valid, help you if they aren't, provide information from the candidates if you want to know more.
One the downside, a poorly designed voting machine can be far less secure than out current paper system. Sadly, I don't think I've seen proprietary voting voting machine that didn't have significant design flaws. Making the situation worse is the voting machine companies like to keep their flaws well hidden (flaws aren't good for sales). In Australia, we've had examples of the Australian Electoral Commission perusing academic researchers in the courts for revealing flaws. [0] Mandating open source mandate is a solution to that.
https://www.unimelb.edu.au/newsroom/news/2019/november/flaws...
What a farce.
Terrible people just corrupt the qualification-mechanism instead. That evil tactic tends to be more-effective and longer-lasting than trying to appeal to the lazy-stupid vote.
You think this is a fair characterization of what I wrote? That it not being worth sacrificing the security of a voting system to get the most disinterested and incapable to vote, is equivalent to some unstated "qualification" test?
It depends on what you are after I guess, but it's almost certain that if the USA has compulsory voting Trump would not have won the last election. The people who don't usually vote; the feeble-minded as you call them, pull the vote toward the centre. Whatever Trump may be, he doesn't represent the centre of politics.
If the current USA polls are any indication, most USA voters are now wistfully thinking what might have been, had a system that forced those feeble-minded voters to get off their arses and vote been in place back in November.
Enjoy: https://en.wikipedia.org/wiki/The_Economist_Democracy_Index
Our elected representatives have tried to add a paper trail to the machines twice now and it was ruled unconstitutional for total bullshit reasons. Our former president was banned from future presidential races because he questioned the machines. We have a judge loudly proclaiming that the machines are UNQUESTIONABLE with such unwavering pride you'd think he'd have the balls to start a billion dollar bug bounty and post it here on HN. He only allows you to "audit" the system by appointment behind closed doors and the only tools you're allowed to bring with you is a pen and a piece of paper. People found issues even with these restrictions. There are people protesting to this day, laymen asking for source code, completely unaware of the existence of supply chain attacks and the fact the source code would prove nothing and serve only to humiliate them. We have former US president Biden's top CIA guy telling our former president to stop questioning the machines, wouldn't be surprised if they had access to this shit.
Germany did it right: voting machines are unconstitutional because citizens do not understand it. Elections must be fully auditable by the average person. This is the correct stance.
Bolsonaro didn't question the electoral process, in fact, I doubt he even understand it himself. He questioned only the results, because in his mind he should have won by a lot.
Not dissimilar than Trump's "stop the count!" on US paper ballots.
He did. For years, and during his mandate. I was there. Out of every stupid thing he said and did, they cited his perfectly valid criticism of the voting machines as the reason for his banishment from politics until 2030. I submitted news of that event to HN.
> Not dissimilar than Trump's "stop the count!" on US paper ballots.
Completely different matter. I'm very skeptical of claims of election fraud in the USA because it uses paper ballots. I have no trouble at all believing that our Magnitsky sanctioned judge literally named Lula president. They broke the guy out of prison to run against Bolsonaro for a reason.
In the end it's irrelevant. Bolsonaro's ordeal has revealed the deep truth of Brazil to the masses: the real power is in the supreme court. Discussing elections is utterly pointless since these judges are not elected. Elections are just a game they play to give this shithole a veneer of democracy.
https://www.bbc.com/news/articles/cj9w43p7741o.amp
Things have always been iffy. No one knows for sure.
Edit: That link is the most recent example. Googling for voting machines themselves would bring more examples. Every election cycle we go through reports of malfunctioning, no audit, audit not matching, extra machines appearing, machines being taken around by politically connected, even things like pressing any button on the machine voting for the same party…etc., but ECI has been pushing it aside and refusing to open up. This recent one became an issue because the manipulation (allegedly) went a layer deeper into the voter rolls themselves and they are public data.
We don’t know what’s up with the machines.
They don’t have stellar democracy grades from The Economist’s index: https://en.wikipedia.org/wiki/The_Economist_Democracy_Index and both seem worse off in the last ten years than the ten years before.
The cost of human labor to count all ballots by hand will be enormous. Probably worth it I suppose, but this really is something that should be primarily automated. But again, trust in software. Sigh, why can't we just have nice things?
In Taiwan, this is how it's done. Every ballot is counted by human. It's completely public: you can just walk in any polling station during the counting process and watch they count.
In actually democratic countries the elections are done on holidays(Sunday) and the polling stations are in where you live.
It is your vote you silly. It is your democratic duty, right and responsibility to guard it if you don't trust the observers by becoming one. Everybody should be able to watch the process and the count!
Losing one day of revenue would not hurt. Especially on a holiday.
What's important is being able to segment the population in enough voting places so that each voting place is maneaganle just by a small number of people. The Chilean system is scalable because you can always just add more voting places as the population grows.
Usually these voting places are civic centres, stadiums, schools.
It's a good system and generally for a presidential election we get the results in about 4 hours after voting ends.
The US casts 10 times as many votes - so it seems reasonable for the US to hire 10 times as many poll workers? Hand-counting is O(n) i.e. constant per-capita, and it scales horizontally.
Local and state ballots in the US can feature tens of elected positions and propositions, I could imagine hand-counting them to be quite expensive.
Every problem Tom mentions can be worked on and overcome. Maybe not today, maybe not by the next big election, but we should still start now, rather than later. We need to do everything possible to increase participation in the democratic process, especially for the demographics that are currently not very involved, which are also the demographics that are more likely to adopt electronic methods of voting.
Do we? Participation should be made easy for those eligible and inclined to do so, but I don't see the benefit of encouraging participation from people who can't be bothered to put some effort into it, or are ignorant of the issues and candidates and are easily swayed by trashy campaign ads. I've seen the statistic thrown around that less than half of americans can even name the 3 branches of government, and if that's true I think those people have a civic duty not to vote.
Seeing the constant barrage of campaign ads every couple years made me think about it- Why does campaign financing matter, how do they turn money into votes anyways? The answer apparently is ads, but I see these bottom-of-the-barrel slop political advertisements and wonder how that trash could possibly have a measurable effect on the outcome of an election. But it must work, otherwise they wouldn't spend so much money on it. And the fact that elections can be meaningfully influenced by the amount of ads a campaign can run is a signal to me that the democratic process is broken in some fundamental way. The votes of well-informed constituents are drowned out by the more numerous cohorts of partisans, reactionaries, and the apathetic just going through the motions to fulfill their 'civic duty', so it seems to me that increasing voter participation without changing anything else is only going to exacerbate the problem
That's probably rational ignorance. It's hard to get people to investigate the details of policy and their consequences when theirs is just one vote out of millions. It's too much work. But that leaves the voters susceptible the kind of ads you mention.
Or stated more simply: getting informed doesn't scale, but mass advertising does.
Athenian-style democracy might handle this problem better. Randomly select, in some unbiased manner, a smaller number of people who then decide. But I suspect sortition is a little too unusual and feels a little too chancy for people to accept as a serious proposal.
Democracy means that everyone gets a vote, uneducated, bigoted, communist, fascist, everyone. If you don't accept that, you don't accept democracy.
It would certainly be exhausting to share an opinion on every single resource you want to share with someone.
In fact, I'd argue that having 50 different voting systems with 50 different ways to prove eligibility makes our elections more resilient to large-scale voter fraud, even if it makes it more difficult to verify voter rolls wholesale.
That's pretty much the problem they were designed to solve no? It's called the double spend problem, and it's crypto's big comp-sci innovation. The whole paper was about it.
At some point, one needs determine whether voting transaction 123 by votecoin address 3456 was made by a valid voter and that the voter has only voted once.
So how do you do that? If a central authority does it by say, issuing votecoin addresses to voters or asks voters for their self-generated addresses, then your ballot is no longer secret since they can see exactly who voted for what.
If a voter shares their votecoin address with anyone, then anyone can see how they voted inviting vote buying and pressure schemes.
I'm not a super expert, but from the little I know, I think it's possible to issue a one time use key that lets you sign a private/public key pair.
So when that public key enter the network with 1 vote and cast it on the distributed ledger, the network can validate the key is signed by the authority.
You know that the authority allowed the key to exist, but not who the key ties back too.
And the user could only sign one key, so they can't create more.
Keys are just numbers, there's nothing inherent to them that prevents their reuse. These one-time-use schemes rely on out-of-band protocols to honor that they should not be reused, for example by trusting in a central authority to check and reject such keys, which defeats the purpose of using the cryptographic scheme in the first place.
> You know that the authority allowed the key to exist, but not who the key ties back too.
That's not the point of ballot secrecy. Under this scheme, I can be coerced into revealing my vote, because you can't create a control to prevent me from storing the signing key or signed keypair; either of which would suffice for a third party to find the public key on the chain which corresponds to my signing key. If you make these actions entirely remote, so I have no access to key material, then you are trusting the remote authority to issue me a secure keypair that can't be reused.
That said, there's no good reason to issue a keypair or use PKI for this, as there is no encryption happening and there's only one subject (the voter). A cryptographically-signed ID in this case can only be useful to tie votes to voters, which we have established violates the secret-ballot constraint.
As for coercion, there are really two types: coercing someone into voting a certain way, and coercing them afterward to reveal how they voted.
I don’t think the second one is much of a problem, because you can just delete your keys after using them if you don’t want to be coerced. It might suck if the coercer doesn’t believe you and you really did delete them, but at that point thugs beating you up is kind of its own separate problem. Similar to if they asked you to take a photo or video at the poll booth and if you didn't they might beat you up.
If the coercion is about making you vote a particular way, some schemes let you vote multiple times and only count the last one, so you can just vote again after the coercer leaves.
And even then, I believe some schemes actually make it impossible to show proof of your vote.
Here's two papers that are promising in all those areas for example:
- https://www.semanticscholar.org/paper/zkVoting-%3A-Zero-know...
- https://www.semanticscholar.org/paper/SmartphoneDemocracy%3A...
- We should know whether you may vote (you are a citizen, over the legal voting age, and haven't been taken away that right because of a crime, etc.) - We should know whether you did or didn't cast a vote (to prevent you from voting twice) - We should NOT know who you voted for - You should be able to know the votes are counted towards the party intended
You can't solve that with crypto, since you need a way of proving your identity, while at the same time making the payload anonymous and not traceable back to you.
> You should be able to know the votes are counted towards the party intended
These requirements are contradictory. If you can verify that your vote was counted toward one outcome or another, your vote can be coerced as that verification can be demonstrated to a third party.
Ballots do not have any identifying information, intentionally. There is no tracking number or possible mechanism to de-anonymize a ballot back to the human who cast it. Notably, there is not even a unique identifier for a single ballot that could potentially be used to identify a person.
Most importantly, there is no value that is unique to the ballot that I can use to verify that I am indeed the person who filled it out, so some nefarious organization could threaten me or my family to produce proof of how I voted. Or pay me, or influence me based on the outcome.
So there is no "identity" that you can record in a blockchain to prevent that identity from casting two ballots in the same election.
Dropping votes is as problematic as allowing too many.
In general, money transactions have failure modes that don't match what we want for other use cases. That's the same trap as using credit card payments for ID verification, it only works if you don't actually care about the ID.
Assuming you can vote from the comfort of your phone or home, that's kind of the whole point, it doesn't matter much if you have to wait even 30 min to get confirmation.
We'd still have an old fashioned government employed person validate you can vote and are human.
the core problem with keypair-based systems is that people will lose their private keys, and that has to be accommodated, which requires trust delegation, which blah blah blah we've already worked thru these issues 1000 years ago and the result is representative government
- The Human Identification Problem (not sure if there is a more official name): uniquely identifying a human being. If you solve this, you solve many forms of fraud (anything rooted in identity fraud) and eliminate entire industries dedicated to reducing fraud losses. Best attempt so far has been the Estonian ID system [0]; Sam Altman tried with Worldcoin but that ended up being yet another crypto grift. Incidentally, Estonia uses its identity system for electronic voting.
- Proof of citizenship; citizenship in the US for most people is a birth certificate issued by a hospital or other authority several decades ago, or a proxy to this document such as a passport. Naturalized citizens have it easier here because they have a state-issued document declaring their citizenship.
- Proof of residence: This is also something not verifiable via a blockchain or smart contract, because it depends on the state and relies in part on your physical location and your intent. Legally you can only vote from one voting address, but there are countless people registered with multiple addresses across states as they move residences.
- Secret ballots: You cannot tie votes back to voters in a free election. Blockchains are open and publicly-verifiable, which is good; but cast ballots cannot be verified _even by the voter_. Blockchain doesn't bring anything to the table here over, say, a database; because the recorded ballots must not be tied back to human identities, you cannot use any of the work done to verify the three previous points to verify the election outcome. Blockchain would boil down to replacing or augmenting paper ballots with a provably immutable record, where you still need to place trust in the system recording votes on the chain.
[0]: https://en.wikipedia.org/wiki/Estonian_identity_card
I believe you can do this with crypto. It's still anonymous. The government verify you, then give you a signed key that you use to generate your voter ID locally yourself. The network accepts your voter ID because it's signed. I think there's even ways to allow single use signatures and so on.
Now everyone gets one and only one voter ID (which is like their wallet) but for voting.
You can decide how many years that's valid for.
I live in California, where the voting method is vote-by-mail and you sign your ballot. That breaks anonymity right there, plus there's a barcode that matches address and ballot for traceability, so in theory anyone involved in the election process could look at my ballot, cross-reference against address, and figure out how I voted. In practice I've never heard of anyone being pressured or confronted based on how they voted, so my default assumption is this doesn't happen much or at all.
But even broader, in the U.S. your party registration is public information. That's why whenever there's a political shooting, the media always says "He was a registered Republican" or "registered Democrat" or "was not registered to vote". And this mechanism is actively and publicly being exploited to alter elections. Since the U.S. is a two-party system and party membership is public, you have a fairly good idea how each precinct is going to vote before they vote, and can gerrymander maps to get the outcomes you want.
Plenty of trust issues in physical ballot transfer as well. California is vote-by-mail, but that assumes the postal service is a reliable carrier, while there was just a recent news story [1] about ballots being stolen. Before I lived in California, I was in Massachusetts, where we voted on 1930s-era lever voting machines where you hit a lever down and it marks a paper ballot without you ever seeing the real ballot. Between elections, these were stored backstage at the local middle school, so a mechanically-inclined middle schooler with knowledge of how an upcoming election's ballots would be formatted (and we did mock elections in middle school) could have rigged the machines to deliver the local precinct to their preferred candidate.
The useful points in the video were basically that decentralization and redundancy are what make physical elections hard to rig: you have to hack multiple locations to influence the overall election, and at each point you have multiple eyes watching you. He sets up the contrast with software voting, where you have the same software running on each machine, and even if the software is open-source, you can't be sure that the rest of the stack it's running on is secure (an oblique reference to the Ken Thompson Hack [2]).
But decentralization and redundancy are properties that you can introduce into software systems just as easily as real-wold systems. The KTH can be countered through Diverse Double-Compiling, for example [3]. zkStarks and digital signatures give you ability to prove that you authored something without revealing what that something is or who you are. The importance of client diversity for the security of the network as a whole has been well-known in the filesharing and crypto worlds. And anyone who has worked in Big Tech, aviation, or telecom could tell you that having multiple paths to success that are developed by independent teams is important for any computer system that is in a safety- or reliability-critical area.
[1] https://www.almanacnews.com/election/2025/10/14/ballots-stol...
[2] https://aeb.win.tue.nl/linux/hh/thompson/trust.html
[3] https://dwheeler.com/trusting-trust/
118 more comments available on Hacker News