Note: This is basically a long version of this excellent xkcd comic about electronic voting.
Voting is the cornerstone of democracy, including the USA’s representative democracy.
If our voting breaks, then our democracy breaks (or at least has a much higher chance of breaking).
If you agree with me on that idea – which I think is uncontroversial – then we want to make sure our voting system stays healthy. There are lots of ways for it to break, but since I spend a lot of my life thinking about computers & technology, I’d like to focus on the ways it could break with electronic voting.
Electronic voting could be compromised in ways that would change votes without leaving any kind of trail.
We wouldn’t even know the votes were changed.
Votes could theoretically be changed by people thousands of miles away.
Someone outside of the USA could change electronic votes cast in the USA. That means law enforcement may not be able to pursue consequences against the person breaking the law, since they don’t live there.
There are lots of other ways electronic voting could go wrong (poor quality or miscalibrated touchscreens, broken physical buttons, confusing user interface design, etc.), but those at least have manifestations that other people can see.
I’m instead going to focus on the much more invisible behavior (but that leaves very lasting changes on a country) of someone changing electronic votes without any record that the votes were changed.
And this, surprisingly, brings me to Apple.
Apple has a lot of money & resources
Apple’s market value is currently the biggest in the world: US$961 billion.
In the third quarter of 2019, Apple posted US$53.8 billion of revenue, and US$10billion of profit. The third quarter is typically Apple’s lowest-selling quarter of the year, too.
Apple has US$210 billion of cash (or marketable securities) on-hand, ready to spend at a moment’s notice.
Is it clear that Apple has the resources to do things in the best way possible, and acquire the best and brightest talent in the world?
Yet it was just reported this week that Apple’s iPhones had some security flaws that were exploitable in the wild for years.
How were these exploits triggered? An iPhone owner simply had to visit the wrong website to be a victim.
What were the consequences of visiting a website exercising this flaw? Your private information – including contacts and text messages – could be sent off your phone to the attacker.
The biggest company on earth couldn’t make an unhackable system
Apple makes hundreds of billions of dollars from iOS and iPhones, and Apple tries very hard to have top-notch security.
Yet even Apple could not prevent some massive security flaws from being in the wild for iPhones. (Android has plenty of issues, too, and arguably worse ones – I’m just focusing on Apple, the world’s biggest company, right now)
This is not surprising news to anyone who builds software and has to think even slightly about security.
Software security is wildly difficult
Success in the world of keeping software secure is pretty much impossible.
Apple, and anyone else trying to build secure software, must get it right every time, forever, fighting attacks from potentially everywhere on Earth, to reach success.
People trying to break into a system only have to break it once to reach success.
Can you do something right forever?
Has any single person, or any group of people, in the history of Earth, gotten something right forever?
Because getting something right forever never happens, it shouldn’t shock us that Apple, Google, or any other software company sometimes has a breach. It sure would be nice to know who did the breaching, but that’s sometimes impossible to tell, too.
The latest reports don’t say who might have taken advantage of these Apple security vulnerabilities. However, they could have been used by people who did not put themselves into any sort of harm.
Virtual crime is less risky
Before computers were so central to so many of our lives, crime typically required someone risking their physical safety or other consequences.
Stealing a loaf of bread or a car required being physically present to take it away, risking physical punishment or direct arrest by law enforcement seeing you committing the crime.
Robbing someone’s wallet requires some level of physical risk for the robber. In the USA, a robber never knows if the person they’re stealing from may have pepper spray or even a stronger weapon on their person. There is physical risk to the person, not to mention the risk of the legal system’s consequences if they get caught by law enforcement.
But now computers run the world, and stealing from them involves a whole lot less risk.
There are certainly still potential legal system and criminal justice consequences… but when you can commit the crime from the comfort of your couch, that risk drops a lot. If you’re a savvy computer criminal, you may be able to delete a lot of the traces that you were ever there. Plus, the legal arguments and precedent for computer crimes consequences are young. There’s jurisprudence for physical stealing and battery and robbery dating back hundreds of years, but computers haven’t even been around a hundred years, and haven’t truly been central to the world until the last couple of decades.
So if you want to create a little havoc but keep yourself at a low risk of facing any significant consequences, computer crime seems like a low-risk way to achieve it.
Minimize voting’s vulnerability to less risky crime
Voting shapes government, & government has massive power.
The world’s biggest company can’t build an unbreakable system.
The companies and government agencies tasked with state or local elections are nowhere close to the size of Apple, and have nowhere close to their money and resources.
What if I told you there’s a simple, low-cost step every state in the nation can take to put a high degree of certainty that votes cannot be falsified by someone sitting in the comfort of their house on an entirely different continent?
Use paper ballots.
Like we did in the 1700s, 1800s, 1900s, and today in many states.
That’s it.
Yes, paper ballots could still be subject to fraud, but that’s pretty darn difficult to pull off at scale, and a recent attempt failed. The effort to do that requires:
- more people to pull off (likely a lot more people, all working in concert)
- more potential for physical harm to someone, or to be physically stopped from doing it
- more potential for legal consequences (you had to have been physically present in a voting place to change the votes, and to do that means you likely live in that neighborhood, so you’ll likely not leave the country the very next day)
Just use paper ballots.
I am not the only one to have this idea. I am just repeating it so there’s one more voice out there.
What can you do right now?
- Check here to see if your state says it is “without paper trail”
- If your state has no paper trail, call your state senators and representatives and tell them to change that.
A simple, single phone call will help some.
Finding out if there are any laws in your state legislature for switching to a paper trail, and then going to the state capital and testifying on that, will help more.
Getting involved with your local election board can also help, and will amplify your voice in the voting process.
How many states have no paper trail?
As of this writing, 12 states (25% of the USA’s states) appear to have no significant paper trail:
- Delaware*
- Florida
- Georgia*
- Indiana
- Kansas
- Kentucky
- Louisiana*
- New Jersey*
- Oklahoma
- Pennsylvania
- South Carolina*
- Tennessee
- Texas
Those states combined have 102 million people.
Roughly 1/3 of the US population has their votes unnecessarily vulnerable to fraud.
Every single one of these states that has no paper trail is putting our democracy at risk.
States with an * are particularly at risk, as noted in this article.
Electronic voting is no panacea for the democratic process; it may require fewer people to count votes, but do we want fewer people involved in the voting process, or more? More people means less chance that any small group of people can be bad actors, falsifying voters or doing other questionable things in person.
Get paper ballots in your state. Technologists everywhere will thank you.