WEBVTT
Kind: captions
Language: en

1
00:00:00.089 --> 00:00:03.199
Five years ago, I made a video for a channel
called Computerphile

2
00:00:03.199 --> 00:00:05.680
about why electronic voting is a bad idea.

3
00:00:05.680 --> 00:00:08.600
And I still get emails, occasionally, asking:

4
00:00:08.600 --> 00:00:10.490
things must have changed by now, right?

5
00:00:10.490 --> 00:00:12.910
There’s this new idea,
and maybe it’ll help.

6
00:00:12.910 --> 00:00:16.520
Surely electronic voting is
just around the corner?

7
00:00:16.520 --> 00:00:17.520
No.

8
00:00:17.520 --> 00:00:19.560
No, it’s really not.

9
00:00:19.560 --> 00:00:23.440
Here is why electronic voting
is still a bad idea.

10
00:00:26.520 --> 00:00:29.160
Elections have some very unusual requirements.

11
00:00:29.170 --> 00:00:32.300
There are two key features that are almost
opposed to each other:

12
00:00:32.300 --> 00:00:34.230
anonymity and trust.

13
00:00:34.230 --> 00:00:36.270
So first, your vote should be completely anonymous.

14
00:00:36.270 --> 00:00:39.830
There should be no way that anyone
can find out who you voted for,

15
00:00:39.830 --> 00:00:41.649
even after everything’s been counted.

16
00:00:41.649 --> 00:00:45.489
That way, no-one can bribe you or
threaten you to vote a particular way.

17
00:00:45.489 --> 00:00:48.820
In the UK, if you mark your ballot in a way
that could potentially identify you,

18
00:00:48.820 --> 00:00:53.219
so if you sign it, for example, then
that ballot is not counted.

19
00:00:53.219 --> 00:00:56.340
This is why election officials are
worried about people taking selfies

20
00:00:56.340 --> 00:00:57.660
with their completed ballots:

21
00:00:57.660 --> 00:01:00.300
because you should not be able to
prove how you voted afterwards.

22
00:01:00.300 --> 00:01:04.269
Otherwise, you can have attacks like
“$10 off for blue voters!”

23
00:01:04.269 --> 00:01:06.749
or “Entry to this party
only for yellow voters!”

24
00:01:06.749 --> 00:01:09.960
or “vote red or you’ll regret it.”

25
00:01:09.960 --> 00:01:12.090
Votes have to be anonymous.

26
00:01:12.090 --> 00:01:15.770
The second requirement is
absolute, transparent trust.

27
00:01:15.770 --> 00:01:19.689
The system needs to make sure that your vote
is securely and accurately counted, sure.

28
00:01:19.689 --> 00:01:23.859
But it also needs to be obvious to everyone,
no matter their technical knowledge,

29
00:01:23.859 --> 00:01:26.340
that the system can be trusted.

30
00:01:26.340 --> 00:01:30.359
So if you’re using paper, you place your
ballot in a sealed box

31
00:01:30.359 --> 00:01:34.080
that doesn’t get unsealed until
everyone with a stake in the election

32
00:01:34.080 --> 00:01:36.490
has someone representing them
in the room.

33
00:01:36.490 --> 00:01:40.529
There should always be people from more than
one side guarding it, or at the very least,

34
00:01:40.529 --> 00:01:44.680
witnessing that there's a tamper-proof seal
being used for transport.

35
00:01:44.680 --> 00:01:47.729
Voters need to be able to trust that their
vote will be counted

36
00:01:47.729 --> 00:01:51.329
even though they’ll never see it again and
it can’t be traced back to them.

37
00:01:51.329 --> 00:01:54.599
And at no point is a single person put in
a position of trust.

38
00:01:54.599 --> 00:01:59.649
People can be corrupt, or threatened, or
incompetent, or all three at the same time.

39
00:01:59.649 --> 00:02:02.059
Now, physical voting is not perfect.

40
00:02:02.059 --> 00:02:04.219
It can be attacked, it has been attacked.

41
00:02:04.219 --> 00:02:08.269
The UK’s own paper system doesn’t fulfil
both of those requirements perfectly,

42
00:02:08.269 --> 00:02:12.730
it is possible to identify voters from their
ballots if a court orders it,

43
00:02:12.730 --> 00:02:15.599
and there are stories about that being done
outside the law too.

44
00:02:15.599 --> 00:02:20.159
But the key point is not that paper voting
is perfect: it isn’t.

45
00:02:20.159 --> 00:02:23.459
But attacks against it don’t scale well.

46
00:02:23.459 --> 00:02:25.049
Physical voting is centuries old.

47
00:02:25.049 --> 00:02:29.900
And in that time almost every conceivable
fraud on the system has been tried,

48
00:02:29.900 --> 00:02:31.650
and defences have been found.

49
00:02:31.650 --> 00:02:33.849
The more physical votes you need to change,

50
00:02:33.849 --> 00:02:35.680
the more people you need to influence,

51
00:02:35.680 --> 00:02:37.340
the more time and money it takes,

52
00:02:37.340 --> 00:02:41.260
and the less likely it is that your
little conspiracy will stay secret.

53
00:02:41.260 --> 00:02:45.400
In a UK election, there are hundreds of polling
stations across the country,

54
00:02:45.400 --> 00:02:49.030
with staff made up of scores of employees
and thousands of volunteers.

55
00:02:49.030 --> 00:02:51.980
The job of changing a
significant number of votes,

56
00:02:51.980 --> 00:02:56.200
enough to sway an election,
becomes very, very difficult.

57
00:02:56.200 --> 00:02:59.140
People have attempted it,
some people have been convicted,

58
00:02:59.150 --> 00:03:01.740
a few have probably gotten away with it
on some scale.

59
00:03:01.740 --> 00:03:05.160
“Granny farming” is the term that
shady operatives use

60
00:03:05.160 --> 00:03:07.510
for going round all the retirement homes

61
00:03:07.510 --> 00:03:10.900
and getting vulnerable elderly people to sign
a proxy vote,

62
00:03:10.900 --> 00:03:13.249
a paper saying that someone else can vote
on their behalf.

63
00:03:13.249 --> 00:03:16.749
And yeah, on a small scale,
that has worked.

64
00:03:16.749 --> 00:03:19.030
But once you start scaling up that attack

65
00:03:19.030 --> 00:03:21.250
it becomes extremely difficult and time-consuming

66
00:03:21.250 --> 00:03:24.390
and the chances are you’re going to get
found out.

67
00:03:24.390 --> 00:03:27.670
With electronic voting, that’s not the case.

68
00:03:27.670 --> 00:03:30.150
So first, let’s talk about
electronic voting machines.

69
00:03:30.150 --> 00:03:32.340
That’s where there’s a computer at the
polling station:

70
00:03:32.340 --> 00:03:33.920
so voters still go into a booth,

71
00:03:33.920 --> 00:03:37.000
it’s just that they are pushing buttons,
or tapping things on a touchscreen,

72
00:03:37.000 --> 00:03:39.269
not writing on paper.

73
00:03:39.269 --> 00:03:43.489
Problem number one:
trusting the software and the hardware.

74
00:03:43.489 --> 00:03:47.110
In theory, our voting computer could be running
open source software

75
00:03:47.110 --> 00:03:50.319
where anyone can see and
check the source code.

76
00:03:50.319 --> 00:03:52.230
In practice, that doesn’t happen:

77
00:03:52.230 --> 00:03:54.879
it’s probably going to be closed source,

78
00:03:54.879 --> 00:03:57.340
it's probably going to be loaded off
an easily-compromised USB stick,

79
00:03:57.340 --> 00:03:59.689
on a computer that’s been sitting unguarded

80
00:03:59.689 --> 00:04:05.510
and sometimes just idly and inexplicably connected
to the internet for years.

81
00:04:05.510 --> 00:04:09.920
And those systems only ever get a full-scale
test when an election actually takes place.

82
00:04:09.920 --> 00:04:14.480
That in itself should be enough to stop
electronic voting ever being a thing.

83
00:04:14.480 --> 00:04:16.539
But, okay, let’s say that we do, magically,

84
00:04:16.539 --> 00:04:20.440
have the most stable, secure,
open source software possible.

85
00:04:20.440 --> 00:04:24.260
How does a voter know and trust that the correct
software is actually installed

86
00:04:24.260 --> 00:04:26.260
on the machine they’re using?

87
00:04:26.260 --> 00:04:29.340
Maybe we could use some sort of checksum or
some other system

88
00:04:29.349 --> 00:04:31.580
to make sure the voting 
is running correctly.

89
00:04:31.580 --> 00:04:34.150
But then you’re just moving the problem,

90
00:04:34.150 --> 00:04:36.830
now you have to trust that checksum hasn’t
been forged.

91
00:04:36.830 --> 00:04:40.590
And almost no voters actually will understand
what that check even means,

92
00:04:40.590 --> 00:04:42.970
or why they should trust it.

93
00:04:42.970 --> 00:04:47.340
In the United States, voting machines are
regularly tested every year...

94
00:04:47.340 --> 00:04:51.789
at the Voting Village at DEFCON, one of the
world's largest hacker conventions.

95
00:04:51.789 --> 00:04:53.550
It's not an official thing.

96
00:04:53.550 --> 00:04:56.389
Hackers there have managed to alter the stored
vote tallies,

97
00:04:56.389 --> 00:04:59.350
change the ballots displayed to voters,
and in one case,

98
00:04:59.350 --> 00:05:02.669
have got a machine to run
the video game Doom.

99
00:05:02.669 --> 00:05:06.630
Imagine if, instead of a machine, there was
just a person in the voting booth,

100
00:05:06.630 --> 00:05:09.610
and you had to whisper your vote to them,
and they promised, oh, yes,

101
00:05:09.610 --> 00:05:13.030
you can absolutely trust them to
accurately record your vote

102
00:05:13.030 --> 00:05:15.590
and pass it on to the people
who are doing the count.

103
00:05:15.590 --> 00:05:19.009
No, you can’t see how or where they’re
writing it down,

104
00:05:19.009 --> 00:05:23.020
you can’t actually call and find out where they are or what they're doing,

105
00:05:23.020 --> 00:05:24.650
but they absolutely promise.

106
00:05:24.650 --> 00:05:27.460
That’s basically what’s happening with
an electronic voting machine.

107
00:05:27.460 --> 00:05:29.850
You just have something that says:
trust me.

108
00:05:29.850 --> 00:05:33.580
I’ve counted your vote and I have absolutely
not been compromised.

109
00:05:33.580 --> 00:05:34.600
Honest.

110
00:05:35.900 --> 00:05:38.300
Problem number two is votes in transit.

111
00:05:38.310 --> 00:05:41.699
How do you get the votes off that machine
to the central counting place?

112
00:05:41.699 --> 00:05:42.720
There are three possible ways.

113
00:05:42.720 --> 00:05:45.930
One, you could take all the voting machines
to the count.

114
00:05:45.930 --> 00:05:48.760
You could seal them all up,
and transport them physically

115
00:05:48.760 --> 00:05:51.820
from where the voting took place
to where the counting takes place.

116
00:05:51.820 --> 00:05:53.380
No one does that.

117
00:05:53.389 --> 00:05:57.270
So, you could download all the results from
each machine onto a USB stick and take that.

118
00:05:57.270 --> 00:06:00.680
One bit of sleight-of-hand and you’ve got
a completely different set of results.

119
00:06:00.680 --> 00:06:04.550
If you’re about to propose some system where
the results are checksummed and trusted:

120
00:06:04.550 --> 00:06:09.460
please explain that to the average voter in
a way they can understand and implicitly trust.

121
00:06:09.460 --> 00:06:14.889
Okay, so, maybe we could transmit the votes
electronically over the internet.

122
00:06:14.889 --> 00:06:16.330
Which is… optimistic.

123
00:06:16.330 --> 00:06:18.259
Man-in-the-middle attacks
are more difficult now,

124
00:06:18.259 --> 00:06:19.440
but they’re not impossible,

125
00:06:19.440 --> 00:06:22.300
particularly if you can’t trust
the software on either end.

126
00:06:22.300 --> 00:06:27.020
And now you’re connecting the voting machines
directly to the internet.

127
00:06:27.020 --> 00:06:28.660
Deliberately.

128
00:06:29.320 --> 00:06:33.660
Which brings us to problem number three:
the central counting server.

129
00:06:33.660 --> 00:06:36.700
Right at the end of the process
there is the server

130
00:06:36.700 --> 00:06:40.069
that tallies the votes and gives the
final count.

131
00:06:40.069 --> 00:06:43.120
Which has all the same problems
with trust and verification

132
00:06:43.120 --> 00:06:45.400
as the individual voting machines,

133
00:06:45.400 --> 00:06:49.060
but now only a few people can
even see that computer.

134
00:06:49.069 --> 00:06:51.550
That’s also true about
electronic counting machines:

135
00:06:51.550 --> 00:06:55.409
ones that take stacks of paper ballots
and return totals.

136
00:06:55.409 --> 00:06:57.879
How do you trust they aren’t quietly changing
some votes?

137
00:06:57.879 --> 00:06:59.830
We live in a world where Volkswagen
got away with

138
00:06:59.830 --> 00:07:05.510
specifically designing their cars to cheat
on emissions tests for years.

139
00:07:05.510 --> 00:07:08.849
And that’s before we include user error.

140
00:07:08.849 --> 00:07:11.360
In one Scottish election,
trialing electronic voting,

141
00:07:11.360 --> 00:07:15.600
a result was corrected after one observer
noticed it didn’t make sense,

142
00:07:15.600 --> 00:07:17.750
and stopped the announcement at the last minute.

143
00:07:17.750 --> 00:07:21.080
Turns out that someone forgot to scroll
all the way to the right

144
00:07:21.080 --> 00:07:25.759
to read the columns on an
Excel spreadsheet with the results in.

145
00:07:25.759 --> 00:07:30.090
And even if you can’t compromise the election,
you can still break trust.

146
00:07:30.090 --> 00:07:34.530
You can still cast doubt on a voting
machine, or the entire counting system,

147
00:07:34.530 --> 00:07:38.639
just by leaving an unknown USB drive in it,
taking a picture, and posting it online.

148
00:07:38.639 --> 00:07:40.319
Or just faking a photo of that.

149
00:07:40.319 --> 00:07:43.449
To break an electronic election,
you don’t actually need to break it:

150
00:07:43.449 --> 00:07:46.099
you just need to cast enough
doubt on the result.

151
00:07:46.100 --> 00:07:50.360
It is a lot more difficult to do that with
paper and physical ballot boxes.

152
00:07:50.360 --> 00:07:53.680
And all this is before we get to
the really terrible idea:

153
00:07:53.680 --> 00:07:58.280
that people should be able to use their phone
or computer to vote from home.

154
00:07:58.280 --> 00:08:02.600
Now, I’m sure the device that you, personally, are watching this on

155
00:08:02.600 --> 00:08:04.940
is malware-free and up-to-date.
Of course it is.

156
00:08:04.940 --> 00:08:07.740
But can you trust that for everyone
in your family?

157
00:08:07.740 --> 00:08:09.520
For everyone on your street?

158
00:08:09.520 --> 00:08:12.990
The exact numbers differ depending on
which security firm’s figures you go with,

159
00:08:12.990 --> 00:08:15.840
but it's safe to say that a huge number of computers

160
00:08:15.840 --> 00:08:18.210
are infected
with some sort of malware.

161
00:08:18.210 --> 00:08:21.600
Huge numbers of phones are on old, vulnerable
versions of their operating systems.

162
00:08:21.600 --> 00:08:25.580
And that’s just scammers setting up botnets
and minor extortions.

163
00:08:25.590 --> 00:08:28.020
Imagine the sort of attack that
could be put together

164
00:08:28.020 --> 00:08:32.830
by a small, well-funded team backed
by a national government.

165
00:08:32.830 --> 00:08:35.770
That sort of attack would scale
very, very well.

166
00:08:35.770 --> 00:08:37.660
Find the one hole in the system, and suddenly

167
00:08:37.660 --> 00:08:43.830
it costs roughly the same to change one vote
as it does to alter millions:

168
00:08:43.830 --> 00:08:47.440
and your conspiracy stays
very, very small indeed.

169
00:08:47.440 --> 00:08:51.900
Maybe you don’t even have to set foot in
the country whose elections you’re hacking.

170
00:08:51.900 --> 00:08:55.420
Now, there are a couple of regular objections
I get to this.

171
00:08:55.420 --> 00:08:57.240
First of all: what about Estonia?

172
00:08:57.240 --> 00:09:01.310
Yes, in 2005 Estonia became the first country
in the world

173
00:09:01.310 --> 00:09:06.070
to offer internet voting, first in local elections,
then in national, then in European.

174
00:09:06.070 --> 00:09:09.590
In 2019, more than 40% of votes
were cast online there, which is

175
00:09:09.590 --> 00:09:11.800
just short of a quarter of a million people.

176
00:09:11.800 --> 00:09:15.970
On the surface, the system seems robust.

177
00:09:15.970 --> 00:09:18.180
Voters can ID via their government-provided
smart card,

178
00:09:18.180 --> 00:09:20.870
or the SIM card in their phone.

179
00:09:20.870 --> 00:09:21.870
But there are problems.

180
00:09:21.870 --> 00:09:25.390
An independent report found gaps in the procedural
and operational security.

181
00:09:25.390 --> 00:09:29.760
The architecture of the system is a decade
old and it’s now dangerously out-of-date,

182
00:09:29.760 --> 00:09:33.440
and it's open to cyberattacks
by foreign powers

183
00:09:33.440 --> 00:09:35.420
either by exploiting individual phones

184
00:09:35.420 --> 00:09:39.370
or by breaking the trust in the
server that counts the votes.

185
00:09:39.370 --> 00:09:43.090
The other common objection is: what about
new technologies?

186
00:09:43.090 --> 00:09:46.120
What about blockchain?

187
00:09:46.120 --> 00:09:49.700
Look, leaving aside trying to
explain blockchain to people

188
00:09:49.700 --> 00:09:54.160
and asking them to trust this
weird technology is worth using,

189
00:09:54.160 --> 00:09:56.300
it’s basically just a write-only database.

190
00:09:56.300 --> 00:09:58.890
It doesn’t solve the problem of trusting
the software or hardware:

191
00:09:58.890 --> 00:10:00.700
it doesn’t change how
the voting machine works,

192
00:10:00.700 --> 00:10:02.960
the interface between the voter’s intention

193
00:10:02.960 --> 00:10:05.820
and what’s actually written to
the database still has to work.

194
00:10:05.820 --> 00:10:09.720
If it prints a receipt of the vote you can
check later, it breaks anonymity.

195
00:10:09.720 --> 00:10:14.120
If it prints a receipt of seemingly-random
numbers you can check later, it breaks trust,

196
00:10:14.120 --> 00:10:17.230
because hardly anyone will understand what’s
actually going on there.

197
00:10:17.230 --> 00:10:21.690
I’m not saying there aren’t advantages
to electronic voting. Yeah, there are.

198
00:10:21.690 --> 00:10:24.230
Accessibility is the main one, and that’s
really important.

199
00:10:24.230 --> 00:10:29.470
In low-stakes elections, for small groups,
for the little things, sure, go for it.

200
00:10:29.470 --> 00:10:32.760
But when the future of nations
rests on the result:

201
00:10:32.760 --> 00:10:36.220
electronic voting is still a bad idea,

202
00:10:36.220 --> 00:10:38.940
and you should still vote against it.

203
00:10:38.940 --> 00:10:40.140
While you can.

204
00:10:40.140 --> 00:10:44.920
I’m endorsing Dashlane for two reasons:
one, they’ve given me money.

205
00:10:44.920 --> 00:10:45.920
Obviously.

206
00:10:45.920 --> 00:10:49.090
But two, because I genuinely believe that
if you’re techie enough to watch to the

207
00:10:49.090 --> 00:10:50.220
end of this video,

208
00:10:50.220 --> 00:10:53.510
you should absolutely be using
a password manager.

209
00:10:53.510 --> 00:10:58.790
If you go to dashlane.com/tomscott, you can
get a free 30-day trial of Dashlane Premium.

210
00:10:58.790 --> 00:11:00.750
Password storage, generation and autofill
that works

211
00:11:00.750 --> 00:11:03.410
across devices, browsers, operating systems,
everything,

212
00:11:03.410 --> 00:11:09.300
it syncs all your data in the cloud without sending
any of those actual passwords to Dashlane themselves.

213
00:11:09.300 --> 00:11:13.630
If you want to know how that works, see previous
sponsored sections.

214
00:11:13.630 --> 00:11:15.940
Using long, complicated, symbol-filled passwords

215
00:11:15.940 --> 00:11:18.830
that are completely different for
every web site and every app

216
00:11:18.830 --> 00:11:20.660
is ideal for security:

217
00:11:20.660 --> 00:11:24.190
but remembering them is nigh-on impossible
and typing them in is a pain.

218
00:11:24.190 --> 00:11:25.910
Being able to use a single master password,

219
00:11:25.910 --> 00:11:28.070
or the biometrics on your phone, is great:

220
00:11:28.070 --> 00:11:30.180
you’ve got one thing to remember.

221
00:11:30.180 --> 00:11:32.240
Dashlane will also store and autofill
credit card information,

222
00:11:32.240 --> 00:11:35.000
so you don’t have to retype it every time
you buy something online.

223
00:11:35.000 --> 00:11:39.000
You also get a VPN and a
gigabyte of secure storage.

224
00:11:39.000 --> 00:11:44.050
So: dashlane.com/tomscott for a
30-day free trial of Dashlane Premium,

225
00:11:44.050 --> 00:11:46.570
which includes unlimited
password storage and sync.

226
00:11:46.570 --> 00:11:49.750
And if you like it, you can use the code “tomscott”
for 10% off.