# How might you hack this voting protocol?

There is a society with about the same technological development as we have today, but they are more civically-minded and more astute when it comes to security issues. They are also democratic and want to ensure their democratic process is secure.

Here's how they vote.

• Voters arrive at a public space in their local area. They present their credentials to an administrator and, if that checks out, reach into a bucket of barcoded tokens and take one at random. Each token activates a voting machine for a single use.

• The list of who has and has not voted is made public at the end and leftover activation tokens are counted in public view.

• The machines are in hooded boothes in the same room. Outside each booth is a prominent display counter which increments each time someone casts a ballot.

• Inside the booth, the voter feeds the activation token to the machine. They enter their preference(s) and the machine prints a paper slip which contains this information.

• The confirmation slip stays within the machine but is visible through a plastic window. It remains in place so the voter can choose to confirm or shred it in case of a mistake.

• If confirmed, the slip falls face-down onto a stack of previous voters' slips. The container is transparent.

• When some number, say 500, of votes have been entered, the box is sealed and the totals are electronically broadcast. An attendant takes the transparent box of slips out into the room and shakes it vigorously to disorder the slips. The full box is left in public view and an empty box is set into the machine for further use.

• When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.

The people in this society have a high degree of confidence in the security of their elections. How might they be caught out?

This system has at least one vulnerability that I can see: the administrators could forge credentials to allow fictitious people to vote, but the population also anticipated this and volunteers run footage of voters through facial recognition software to red-flag similar faces for closer inspection. They know this isn't perfect, but it raises the bar somewhat. Also, the government as a whole is not expected to be so hostile (although individuals within it may be).

How else might an imaginative adversary subvert the voting process?

EDIT Thanks everyone for your insight. I'm not going to nominate a "correct" answer since it's such an open question, but have an upvote :-)

• What is your definition of "subvert?" There's many different levels of subverting an election. Have you looked at existing systems like Punchscan which is designed for end-to-end voter authentication? Your system seems similar, but Punchscan has some advantages (such as the ability to challenge that your vote was miscast after you have left the voting booth). It also invovles a lot less ritual, and ritual is always an opportunity for slight of hand. – Cort Ammon Sep 22 '16 at 16:28
• How is absentee voting handle? – SRM Sep 22 '16 at 16:35
• Visualize the second to last step in your mind. Now visualize that attendant as a magician, showing the audience both sides of the container before making it disappear. When I visualize those two scenarios, it suggests to me that a lot of the ritual you have is exactly the kind of ritual magicians use to hide what they are doing. – Cort Ammon Sep 22 '16 at 19:52
• @Spraff There's many examples where tricks are pulled off with clear containers, giving the illusion that there's nothing up their sleeve. in reality, they still pull slight of hand tricks. In fact, it's often easier to pull them if the audience thinks they see everything. However, the best example I can think of is Space Man by Penn and Teller. It's not done with clear containers, but P&T are willing to show how they did it, and it shows the kind of tricks magicians pull on a regular basis. – Cort Ammon Sep 22 '16 at 22:26
• – MonkeyZeus Sep 23 '16 at 17:44

In modern democracies, voter fraud is no problem. Actual tampering with the voting process is done by more complex mechanisms that can be done openly. It is all about discouraging people to vote who would vote in a majority against your interest or allowing people to vote who will vote for you. Refer for example to Last Week Tonight on the system in the US for inspiration.

You can:

• prohibit, that certain groups of people vote at all: elders, certain types of criminals, poor, you can have age restrictions, restrictions based on income, gender, you name it!
• influence which types of immigrants can vote - This goes both ways, e. g. certain cities in Europe allow EU-citizens to vote for majors if they live in the city, even if they are not citizens of this country
• have strict ID-Laws that require IDs certain groups might or might not have, e.g. drivers license or fishing license.
• make it difficult/easy to vote depending on location. If the people living in rural areas don't vote in your interest, then make it harder for small villages to set up a place to vote.

The best part about these kinds of tampering is, that there is no risk of a scandal, where everything might get revealed to the public. You can always act as if your actions are a way of protecting the democracy! Isn't that lovely?

• The only trouble is passing the legislation to do these things. You've merely reduced your voting pool from the citizens to the legislative body, and then even if you can convince your legislative body, if there's a judicial body and a Constitution of some kind, you've got even more problems. – SethWhite Sep 22 '16 at 21:33
• +1 for John Oliver! Also the rest of the answer. But mostly Last Week Tonight. – Cody Sep 22 '16 at 22:29
• @SethWhite often you don't need to pass legislation (or mess with the constitution) to do these things. Often the legislation (or constitution) is sufficiently broad and general, and it is left in the arm of the civil service/bureaucrats of the electoral office to implement the specifics. Eg the legislation may say "Each person may only vote once." and the civil service implements some rules about "You need X type of ID to show you are who you are so we can mark you off the list." Or "There must be at least 1 voting station per district." but the civil service decides where and when it will be – Lyndon White Sep 23 '16 at 8:46
• "We don't want this religious group to vote, so let's hold the election at the same time they have their own predetermined meetings" – John Dvorak Sep 23 '16 at 17:30
• What about with compulsory voting? (like they have in Australia) – Jezzamon Sep 24 '16 at 1:57

## Purge the electorate

Start with the registered voter lists. Find some way of purging the people most likely to support the wrong person. As an example, write letters to the illiterate and elderly telling them to reregister online to confirm their address or they'll be removed from the lists.

## Gerrymandering

Moving the electoral boundaries to favour your desired outcome.

In the process of setting electoral districts, gerrymandering is a practice intended to establish a political advantage for a particular party or group by manipulating district boundaries. The resulting district is known as a gerrymander (/ˈdʒɛriˌmændər/); however, that word can also refer to the process. The term gerrymandering has negative connotations.

In addition to its use achieving desired electoral results for a particular party, gerrymandering may be used to help or hinder a particular demographic, such as a political, ethnic, racial, linguistic, religious, or class group, such as in U.S. federal voting district boundaries that produce a majority of constituents representative of African-American or other racial minorities, known as "majority-minority districts". Gerrymandering can also be used to protect incumbents. Wikipedia

## Placement of polling stations

Now that you have very few poor, elderly, or vulnerable people on your electoral roll, you don't need to place polling stations where they can access them. Only placing them on the far side of town where all these people would have trouble accessing them will be fine.

At this point I've already pretty much won the election and I haven't needed to find a weakness in your polling system yet. Unfortunately all these methods are par for the course even in our "free" "modern" western democracies.

Gerrymandering is a favourite in the US, in the UK the Labour party has just run a massive soviet style purge of, ironically, the communists on their voting lists.

• This does not answer the question - the question wants to know how to induce fraudulent votes into the system. This answer would be applicable in any voting system -disenfranchise the votes for your opponent so they don't cast theirs, lowering the opponent's vote count. With your solution, the vote count would legitimately, accurately reflect the votes of that day. – X-27 is done with the network Sep 24 '16 at 13:29
• @X-27 to use a metaphor, the question is asking about a £1000 lock, I'm saying the lock is all well and good but the door you're putting it on is made of cardboard. – Separatrix Sep 24 '16 at 13:44
• even then, the question wants to know how to pick the lock, not how to cut a hole in the cardboard door. – X-27 is done with the network Sep 24 '16 at 13:48
• Perhaps asking this on Security.SE would get more hack/exploit based answers – X-27 is done with the network Sep 24 '16 at 13:48
• @X-27, it does in fact answer the question if you read it again, it's not just about the voting but the whole election process – Separatrix Sep 24 '16 at 13:58

## Liberal democracy

Voters arrive at a public space in their local area. They present their credentials to an administrator and, if that checks out, reach into a bucket of barcoded tokens and take one at random. Each token activates a voting machine for a single use.

• public space - limited amount of people are able to implement that publicity - buy them
• barcoded tokens and take one at random. - weakens system, not strengthen it, you can't predict it, you can’t validate results in fraud investigations because of it. You can give false sense of randomness - see card tricks.
• compromise voting machine, like it is done with cache machines today (reading cards and pincodes, backdoors for agencies etc.)

The list of who has and has not voted is made public at the end and leftover activation tokens are counted in public view.

• is made public - no one can validate that information, it adds nothing to security
• public view - limited amount of peoples can utilize that public view - buy them.
• buy those who counts - see card tricks, casino token tricks - pure magic

The machines are in hooded boothes in the same room. Outside each booth is a prominent display counter which increments each time someone casts a ballot.

• as usual, limited amount of people can use that information, just because surface area available around that place. It is more limited space of places where you might have connection by observing consequences between who enters and changing number

When some number, say 500, of votes have been entered, the box is sealed and the totals are electronically broadcast. An attendant takes the transparent box of slips out into the room and shakes it vigorously to disorder the slips. The full box is left in public view and an empty box is set into the machine for further use.

• replace box, like dat
• shakes it vigorously - adds nothing to security, adds some to anonymity and makes more difficult to investigate in case of fraud.
• public view - limited amount of peoples can utilize it, no one can validate the boxes, that they are the boxes, but not other boxes. Max distance you can do it is 1m, if they have way to validate, more information they have more information they have to falsify this validation process. More people tries to validate, easier it is to exchange boxes. Seal is not a problem - see false money, it might be good enough that without instrumental control you have no way to tell difference.

When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.

• limited space
• confirmation slips are anonymous - no one can confirm that it was his voice and everything is right
• count should be exact. compromise voting machine by shaking it and disrupting process, in regions where you less likely to get what you wish
• count should be exact. compromise result buy buying who counts, let him take few tokens (card tricks, money stealing - lost the link there criminal not very well in english in handcuffs(?) shows to police(I guess) and steals banknote in process of counting them, by folding it, and you see no clue he does it. If some one saw - feel free to remove description and put link here)

The people in this society have a high degree of confidence in the security of their elections.

Yhea, totally false sense of security, which actually makes things easier to do, as they probably will not try to see everything and sniff for any possible problem.

There are big history of exploiting different machines in casinos, cash machines, different security systems in hardware in software in society. Most high level trick are done because of fine details, most people have no idea about. Different tricks in psychology when it comes to humans, etc. They have detail or combination of details they exploit - so even your description is not enough, but sure exact implementation of your system will have different possibilities.

Who or what counts tokens which are not open by coin toss request - sure it can be exploited.
Which system shows results - sure it can be exploited, at least at some degree, but you may not need much 0.5% 1% might be enough. Who conducts decision, Who rise suspicion of possible falsifications, Who investigates ....

You use word everyone - who are those everyone, are they everyone everyone - so we talking about small group of peoples - just rising hands is enough in such cases, to make decisions.

Main problem those who vote have no ways to validate results. If they knew decisions of their relatives and friends and possible some random person - and could check if their voices are counted in the way they claim - it could way much reduce possibility of fraud, at least percentage wise, and those who suspect fraud could verify and validate information up probability of their desire.

So if they are so concern with their voting results - they should make their choose available to anyone who interested in knowing that information - which decisions or selection they have maid. (And it is done so in US senate as example - votes are not anonymous)

Public view, public access - obstruct that access for any valid reason, and cheer your supporters - this will change outcome percentage wise, because some opponents may leave if they are not totally dedicated to wait for unknown for 1-2-3-4-6 hours. See dat.
Make sure your supporters are observers, favorable outcome will be less suspicious for them, and if they decide by voting is_or_isn't, more likely to get desired results in suspicious cases. (You do not have to have all observers to be yours)

Every system have flaws, no exception, even this one. And more valuable are combo's of details to exploit. Weakest part of any system is humans.

P.S.
By accident, hit that video The art of misdirection | Apollo Robbins, it highlights kinda interesting inside in public attention, which is intensifly used by OP. Highly recommend to watch, just for fun.

• +1 because this answer specifically addresses the things that are horribly wrong with OP's ideas rather than just general means of manipulating election outcomes like many other answers focus on. – R.. GitHub STOP HELPING ICE Sep 24 '16 at 4:16
• Like dat, see dat: do you mean that? – JDługosz Sep 24 '16 at 21:49
• @JDługosz kinda, Like Dat . times to times I need some slang expression, and it max of my capabilities to mimic that in english)) . Just to say "like that" is too boring in that case, I saw it for first time, have not expected such level of impudence and that it might just work. That expectancy is a thing which is used a lot by criminals. So I needed some expression, short - I'm Iron Man(it was intended), in that case. Not all my error are intended trough. – MolbOrg Sep 24 '16 at 22:26
• It would make more sense if you did the whole thing in African-American Vernacular with spelling to indicate pronunciation as-spoken. See the scene with the nuns translating for the black passengers in the movie Airplane!. – JDługosz Sep 25 '16 at 10:09

This is susceptible to many traditional forms of fraud, but you don't want fraud, you want Hack. Ok, I'll give you some security advice. Because that what (white hat) hackers do.

Voters arrive at a public space in their local area.

Make fake IDs, the check system could be relaying on a backend database. There is no need to hack the database if you can make a counterfeit ID of another - but valid - person.

As per hacking the database, it got to be stored somewhere. If it is working on a local copy, it is harder – it would be an inside job. On the other hand, if the database is remote, there has to be a connection. Intercept the signal, stablish a man-in-the-middle attack, and provide fake ID info.

Although the ID hacking could fool the machines, but the guards would recognize you enter one too many times.

Security advice: Do not query the remote database with the ID, query with a hash of the ID. This makes it harder to know for which request to fake the response. And the answer needs a digital signature. This means that the attackers need to steal the private key of the database server to fake the response. An all that done over a ciphered connection because why not?

The machines are in hooded boothes in the same room. Outside each booth is a prominent display counter which increments each time someone casts a ballot.

About hacking the counter… from the voting machine there must be a signal (wired or wireless) going out to the counter. The minimum viable implementation of the signal would be a pulse each time a vote happens.

If the connection is wired, it would require sabotage of the voting station – doing it on site could be viable, but problematic, as the next person to enter the booth won’t count. Instead it would be safer to repair it… then again; you would have to be too fast and too silent. Yet, insider job makes it easier.

If the developers are paranoid, the signal works backwards, it counts when the pulse is interrupted. In this case hacking can be done by inducing a current that mask the interruption caused by the machine when your vote.

If the connection is wireless… oh, if the connection is wireless, it would be harder to cut and plug, because it could be an antenna buried deep in the machine. But you can fake the signal! This gives the chance for another kind of attack: DoS. Send a fake signal all over the voting area, all the counters go up by one, the organizers notice something is going on, and they close the voting session – to chase you, if they can spot you.

If the developers are paranoid they make the wireless signal could be some authentication code. It is a matter of matching the pattern, that is: intercept prior signals and decipher how to send the code.

Security advice: Make the connection wired, and shield the cable. The protection of the cable must be: 1) strong enough to shield any signal that may disturb the connection. 2) Compact enough to avoid using it to hide some device. 3) Evident enough, so that when broken, everybody notices.

Inside the booth, the voter feeds the activation token to the machine. They enter their preference(s) and the machine prints a paper slip which contains this information.

The confirmation slip stays within the machine but is visible through a plastic window. It remains in place so the voter can choose to confirm or shred it in case of a mistake.

Hmm… shred it in case of a mistake. How does that work? If I shred it, did the vote count? Does the machine shred it on command? Why did it print it if I didn’t confirm?

If confirmed, the slip falls face-down onto a stack of previous voters' slips. The container is transparent.

Can the attacker bribe the person watching over that?

Security advice: get rid of the paper thing. Instead make the two steps counter. Once the person enters the booth it allows for the counter to increment by one... once the person votes, the counter do actually increment by one. If the person tries some mockery to try to vote again, the counter can't register the vote because the person didn't enter again (so no more increments have been allowed). And if the person leaves to enter again, guards notice.

When some number, say 500, of votes have been entered, the box is sealed and the totals are electronically broadcast. An attendant takes the transparent box of slips out into the room and shakes it vigorously to disorder the slips. The full box is left in public view and an empty box is set into the machine for further use.

Oh, you don’t send votes in real time. Muahahahaha!

Fake the signal; people believe the 500 votes have been reached, the votes in the fake signal counted.

If they notice that the 500 votes have been reached, they could close the box, and nobody else can vote. Of course they would notice discrepancy between the counter and the fact that the signal was sent. If the counter is wired, that is, because if it is wireless we hack it remotely too.

Let's say the attacker can't buy people to enter each booth and install a wireless receiver connected to the counter cable (If the attacker can do that, the attacker can do traditional fraud). Instead the attacker needs to use the cables as receivers. That requires a very power transmitter... one that would give away its location once the attacker used it.

Security advice: Wire the vote reporting via the counter. So the counter is no longer dumb, but a smart device (if the counter doesn’t go up, the vote isn’t sent). Now, the votes need to be ciphered. The voting machine generates a private and public key pair at the start of the vote session. Then it uses its private key and the public key of the server that open the votes for counting. The private key of the server that open the vote would be needed to decipher. In other to count votes, the public key of the machine is extracted; this allows verifying that the votes come from that machine. Any vote that can't be deciphered is an invalid vote. Any vote that can't be verified to come from the private key of the voting machine it claims to come from is an invalid vote. A robust protocol must be in place to ensure that the votes were received correctly.

When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.

This is not good. If there is a problem what do you do? Do you consider all the votes of the machine invalid? That means that tampering with the vote once defeats 499 potentially valid votes. That sounds like a good avenue to attack.

Security advice: Remember that about a robust protocol? Here it is: store it in two hard disks (mirror copy) and ship the hard disks. This means that "intercepting the signal" is attacking the truck that carries the hard disks, it also means that Anonymous won't be launching any DoS attack to the server that open the votes for counting, because it won’t be open to the internet.

• Yes. This one. This answer is the best one that actually answers the question. – X-27 is done with the network Sep 24 '16 at 13:32

A few things:

If you don't control the voting machines:

• Complain that the machine printed out the wrong output, and submitted the vote when you asked it to shred it. Get a lot of others to say the same. There is (and can be) no proof that this didn't happen.

If you control the voting machines:

• Put the word out (anonymously) that people should follow the plan described above; then, make your machines do that exact thing.

• People high up on the ballot get many more votes. If you control the voting machines, you control the order they are displayed. The fair thing would be to have them randomized, so make them all ordered with your preference at the top, and say they are randomized. You can't tell if a list is randomized, without a large sample.

• Occasionally vote for the wrong person (the one you want), some people will not check their vote, won't shred it as they should.

In all of these cases, make sure to include a clock/calendar in the device, to make sure it doesn't happen in pre- or post-election testing

• You don't mention how the voting boxes are added up, so: add "phantom" vote boxes to the tally.

• Limit the observers in each voting station, then (somehow) juggle things so all observers in a given voting station are on the same team. You can then fix this particular voting station.

Other:

Bribe someone in the company that makes the voting machines to break the software e.g. so 10% of the votes are contrary to the voters selection. In this case, there will be riots. This will not let your preferred person get into power, but will cause chaos. Perhaps combine with a platform to remove the voting machines, so a re-run of the election will benefit you.

The voter registration can be made easy for likely supporters of one side and difficult for likely supporters of the other side. That can be done by individual administrators without a conspiracy. "That ID photo seems out of date. Do you have any other photo ID? Can come back and bring it?" A significant percentage might not come back after all.

There needs to be some provision to cast absentee ballots. That can probably be abused, specially if the voters are elderly and almost (but not quite) senile. "She has good days and bad days. Yesterday she was clear enough to fill the forms and cast her ballot."

Face recognition could be spoofed by multiple voting in multiple precincts, perhaps after a shave and a haircut. How many false positives if you run an entire nation through the matching?

If the election officials can be subverted, why not the volunteer election watchers?

Voters could wait until after the counting and then claim that they had voted a combination that isn't in the box. "There should be a ballot with yes on proposition 1, 3, 4, and 7, no on proposition 2, 5, and 6, Ed for mayor, Jane for the legislature."

• Besides trying to cast doubt on the system, what does the voter lying about their vote hope to accomplish? – Ranger Sep 22 '16 at 15:41
• If there are multiple voters casting doubt on the same precinct, they might get all votes from that precinct tossed out. Possibly that precinct would have favored one candidate. – o.m. Sep 22 '16 at 15:43

Your system has the same faults in it as the Diebold voting machines in Ohio in the US about a decade ago. These machines were a touch screen that counted votes electronically but also presented a receipt in a clear box for the voter to view. They did not have the shred-rejection option that you describe. My last exposure to these machines in Ohio was in 2006. I do not think they have changed, but I cannot confirm it.

When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.

The tallies in your system and the Ohio system are counted electronically. The slips are only counted in the event of a legal election challenge or an error or a spot check.

This opens up two options:

1. I can still focus my attacks on the machines to shift the election the way I want. Make the machine print the receipt with the voter selection but tally it electronically in a different way. This assumes that I can avoid the random check enough to get away with it.
2. Even with the random check I can simply start skewing the electronic results and make them not match the manual check. This would swiftly erode confidence in the system. As a bonus I can make it look like my opponents are the bad guys and not me.

Why bother with attacking the strong parts of the system, when there's a much weaker area?

Simply bribe people to vote in your favor.

If you tell a bunch of people who don't care about the vote that you'll give them 50 dollars if you vote for candidate X, many of them may simply do it just for the money (amount is changeable) - and if you're afraid that they'll just lie about who they voted for, simply require that they do a polygraph test afterwards (and probably pay them more for their trouble but that's up to you.)

• Polygraphs are notoriously unreliable and, besides, the system above would allow you to confidentially connect a voter to their vote (recall that the counter is public and the vote is electronic). Still, bribery as a method of swinging the vote is fairly inefficient. – Nathaniel Ford Sep 22 '16 at 16:41
• @NathanielFord You can use any kind of lie detecting test/"insurance method" - the polygraph was just a thing I pulled out of my ass to fill the gap/show a point. Bribery is more efficient than trying to cheat the system through a different method, as you don't need everyone you've bribed to vote for you. If you bribe enough people, you'll get the results you want. – Aify Sep 22 '16 at 17:29
• Efficiency depends entirely on how much you're paying a party to corrupt the election some other way. If you pay a thousand people one hundred dollars (which seems low) plus the cost to "polygraph" (or whatever other equally unreliable test is used) to vote your way it's more expensive than if the hack costs fifty thousand dollars. Note that there is a history of vote buying in the US back in the day, and it didn't work out well. Also note that the larger the population of bribed voters the easier this method is to detect. – Nathaniel Ford Sep 22 '16 at 17:34
• @NathanielFord It may be more expensive, but it's also way easier to do than trying to hack a system that's designed not to be hacked. – Aify Sep 22 '16 at 17:40
• That is how asymmetric incentives work: a clever hacker will profit from doing the harder work disproportionately more because the corrupting entity will naturally choose the cheaper, more secure hacking over the widespread, obvious and more expensive bribery. All systems are designed to 'not be hacked' and all of them eventually are. – Nathaniel Ford Sep 22 '16 at 17:43

I'm going to address the mechanisms you've listed, not the notion of democracy itself as others have done that already.

• Barcodes - Problem is that the voter gets to pick a barcode. They could take two or more barcodes instead of just one. Sure, if anyone is paying attention they might see the counter go up numerous times per voter, but does anyone actually pay that much attention all the time?
• How is the list of who has and has not voted reconciled, and how are the tokens counted? Either factor could be manipulated by an official
• So a slip is printed and needs confirmation. What happens if someone does not confirm the slip - does it get destroyed? Will confirmation be obviously marked on the slip, i.e. what is preventing the unconfirmed slip for being mistaken as a vote?
• If votes are stored in boxes left in public view, are they being watched, are they sealed? If all of the public who were present were intent on violating the system, boxes could go missing or be tampered with easily.
• There is a 1 in 64 chance of a box being counted - is that significant enough? i.e. only 1.5% of votes will actually be double-checked.
• How are data being transmitted electronically? Is it digital, analog, authenticated, encrypted, signed? Is there a chance that a) someone could interfere with or cancel a transmission, b) someone could imitate or duplicate a transmission, c) someone could record the transmission?
• How are data being stored? Is the system secure, how does it store aggregates, can they be tampered, e.g. if a chaining method was used then every transmission is sealed by the next. But if no such methods are used then a malicious admin could modify data.
• To answer in order: 1) there are mechanical ways to deliver a single random token, 2) I guess the devil is in the details, 3) the machine can't be used by the next voter until the slip is confirmed (dropped down) or destroyed, 4) yes they're sealed, 5) use whatever probability works, 6) plaintext broadcast, people can integrity check the data by reporting from the ground, 7) the ideas is that such tampering wouldn't survive an audit – spraff Sep 27 '16 at 11:22

With the results being electronically broadcast, that could be your solution. If it's a wireless broadcast, sniff it and attempt to break the encryption I assume would be present. Then you can run your own broadcast in the same vein to send false results, as the broadcasts are linked to the tokens and not the people using the tokens.

If it's wired you can do the same, but you can entirely subvert the other votes by putting in a bypass, assuming there is no handshake or you can properly replicate the handshake.

Both these methods would require a physical presence and knowledge of the system, but these would likely not be too hard to get. The hardest part in this is breaking the assumed cryptography, which a foreign state would be able to do, or bribing/otherwise cajoling the system designers into giving you the details.

• Voters with the machine can cross-check the on-the-spot results with whatever was broadcast. No encryption needed. (People can phone each other to share what they see and hear, or meet in person afterwards.) – spraff Sep 22 '16 at 19:59
• Are you referring to broadcast as in put on TV and in the news, or as broadcast in the general term of a signal? – Ryan Lucky Sep 22 '16 at 21:30
• No encryption (as in encryption of the data) is desirable, because the information broadcast is intended to be public. Digital signing would be desirable. As spraff suggests, this fraud would be very likely to be discovered. The broadcasts are not linked to voter tokens; they're for batches of about 500 votes. A well-designed system would include a sequential number in each transmission and a transmission that indicates the final transmission number at the end, thus preventing inserting transmissions but not replacing them in a wired system. – John B. Lambe Sep 24 '16 at 9:59
• I was assuming that the data was being sent to a collection center and then dispersed, and that encryption would be favorable to prevent exactly what I'm suggesting. Being discovered can be effective in and of itself as one of the other answers suggests. I was assuming wireless, because this does not sound like a permanent setup, and a wireless broadcast would be easier to maintain for such a short period. Without knowing the exact implementation, it would be hard to get more technical, and not all systems take everything in to account, especially not ones thought to be foolproof. – Ryan Lucky Sep 24 '16 at 19:37

Step 1: Write the voting machine software so that it records 'Y' for a positive vote. A ballot receipt might look like this:

Mayor:
Smith:
Jones: Y
Green:


Step 2: Figure out how much you need to skew the vote - say you need to skew it 3%. Then every 3 out of 100 votes for a given candidate, you mark their vote with a character very close to 'Y'. Say you choose 'Ƴ'. (Look closely, two different letters.)

Step 3: When displaying tallies, individual boxes count all votes with any response.

Step 4: When calculating the grand winner, the master collecting machine counts all votes with a valid 'Y' response.

Net result: any citizen can examine their voting receipt, and it will look right. Manual audits will match the totals described by the local machines. The master collecting machine will legitimately tally the properly cast votes. And if any of the bad actors get busted, the only fishy thing is the random Y vs Ƴ vote malformer - everything else is plausibly a legit programming error.

• Each machine counts its votes and sends the totals to the collecting machine. The collecting machine can't count individual votes because only the totals are sent by each machine. It's a good point that a fraud by a voting machine supplier could be made to look like an unintentional error, but a thorough investigation would examine the software that was running on the machines (and compare the executable with the source code) and see the logic for what causes the wrong output, and it is unlikely to look unintentional if it did what you're suggesting. – John B. Lambe Sep 24 '16 at 10:27
• Well, the logic on the voting machines would be hard to disclaim, but that's still a far cry from the main system being deliberately compromised. I read something different out of the scenario - I get that the individual machines are broadcasting totals, but I don't know that it's clear they are not sending individual votes. Individual records are an important auditing feature. If only totals are being sent, that seems like it opens a door for a whole fraudulent machine to say "I've got 450 votes for Smith, and 50 for Jones," and it'd be hard to spot a bad actor with just those numbers. – Mark Tabler Sep 27 '16 at 7:51

If people have no faith in the democratic process, the effectiveness for voting to enact real change, or if they believe that the entire process is a sham, then they are less likely to vote.

If you discourage enough of the right people to prevent them from placing a vote in the first place ("one vote doesn't matter"; "both parties are basically the same"), then you have effectively hacked democracy without interfering with the process of voting in the first place. Congrats.

After the box is sealed, it seems very difficult to have any influence on the outcome of the elections. You can't achieve the falsification by corruption as it would require to corrupt the whole polling station which seems really difficult to achieve.

That's why if I had to falsify these elections, I would work on the voting machines. The falsified machines would register false votes and print a false confirmation slip. However, on the top of this false confirmation slip, the true vote would be displayed with self-disappearing ink.

Knowing the high-level of security around these elections, the machines are probably tested before the election. The falsified machine should be able to be switched by a remote device just before the election.

The production of the machines is probably closely monitored but the amount of corruption/coertion needed is much lower and probably doable.

• It would be trivial to prove this sort of falsification because it leaves a preponderance of evidence behind. – Nathaniel Ford Sep 22 '16 at 16:38

Another way to be "caught out" for a given value of "caught out":

team up with a friend, make sure they get in the queue ahead of your target, and you get in behind. They take a photo of the box after they vote, and you take a photo before you vote.

Compare these two photos to figure out what your target voted.

OR:

Go in, with some fake voting slips. Open the box, take actual votes out and replace them with the fake ones. Reseal the box. Update the electronic tally. You will need a security seal, fake votes, and admin access to the device.