Post

Here's the issue in question: 🗳️ As each voter inserts their ballot into the tabulator, the tabulator assigns a random identifier to the digital record. It's random because if the order of ballots cast is known, then someone can correlate that voter check-in times and figure out who voted for what.

😱 Unfortunately, the random identifier used by Dominion voting machines in Georgia isn't so random, and researchers found a way to recover the sequential order of ballots cast from this not-quite-as-random-as-we-would-like identifier.

😱😱 Even more unfortunate, because the record of voter check-ins is public and timestamped thanks to electronic pollbooks, and because cast-vote records are also obtainable as public information, this attack can now be carried out remotely. Almost anyone can do it thanks to AI software development.

💡 But here's the thing: the state already has a plan for redacting those not-so-random identifiers from public records. So this problem, which is worth noting, has already been mitigated. Again, the article should do a better job of highlighting this upfront. Now, let's think longer term.

It's becoming increasingly common for states to publicly release the digital records of cast votes and even full ballot images. As more of this data is released, the threat to ballot secrecy increases. There are two kinds of threats:

(a) using publicly released information, an attacker may determine how anyone voted. This is the most egregious threat and we should mitigate it quickly. We need to actively inspect the digital records we release for re-identification risk. As states release more data, this becomes more urgent.

14/9/26, 10:06 pm0 reposts2 likes

(b) using targeted threats or incentives against specific voters, instructing them to vote a certain pattern or distinctive marking on their ballot, the ballot secrecy of a targeted subset of voters can be violated.

This second threat isn't really on the radar of most election administrators because it sounds too much like like a far-fetched movie plot. There is only a little bit of historical evidence this has happened in the past, so maybe it's fine?

However, with the much broader release of digital ballot records and even ballot images, these kinds of coercion attacks can be carried out remotely, via anonymized channels. So they're still a concern to me.