Electronic Voting Exposes Sovereign Elections to Scalable Cyber Hacks

Tom Scott

Digital voting poses an existential threat to national democracy because computing systems cannot reconcile voter secrecy with public auditability while allowing foreign adversaries to manipulate millions of ballots at minimal cost.

AI-assisted summary of Why Electronic Voting Is Still A Bad Idea — original source. Check the original for full context.

Source published: 2019-12-09

Key ideas

Elections require balancing absolute voter anonymity against transparent public trust—two fundamental requirements that work directly against each other and collapse under electronic voting implementations. (0:00)
Physical paper balloting features a built-in scaling defense: rigging an election manually requires coordinating thousands of conspirators across physical locations, making detection nearly unavoidable. (1:59)
Remote online voting shifts national election security onto compromised consumer devices, enabling state-sponsored cyber warfare teams to alter millions of votes as cheaply as changing one. (7:50)
Emerging technologies like blockchains fail to fix electronic voting, as distributed write-only ledgers do nothing to verify the physical input interface between the voter and the terminal. (9:49)

Detailed notes

## Background Published on YouTube by Tom Scott on December 9, 2019, this video revisits the enduring perils of digital elections five years after his previous video on the topic. According to the show notes, the piece explains why electronic voting remains unviable, drawing upon real-world security flaws, hacker demonstrations, and election audit reports.

## TL;DR Tom Scott explains that electronic voting remains fundamentally flawed because democratic elections demand two incompatible requirements: absolute voter anonymity to prevent coercion and transparent, layperson-verifiable trust. While traditional paper voting relies on physical logistics that prevent attacks from scaling covertly, electronic voting machines and internet voting introduce concentrated failure points susceptible to nation-state cyberattacks, undetectable software errors, and asymmetric disinformation. Proposed technological remedies like blockchain or cryptographic receipts fail to fix physical hardware manipulation and alienate non-technical voters. While digital systems may suit low-stakes ballots, Scott warns that physical paper ballots remain essential whenever national outcomes are at stake.

## Atmosphere & style The presentation is lucid, fast-paced, and incisive, pairing Scott's approachable, direct-to-camera delivery with sharp visual diagrams and sobering historical examples. Scott punctuates the technical breakdown with wry humor—such as hackers running Doom on voting machines or counting failures caused by un-scrolled spreadsheets—without trivializing the subject matter. The narrative builds methodically from practical security fundamentals to an urgent, chillingly delivered final warning about protecting democratic integrity while the public still has the power to do so.

## Bulletin - [00:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=0s) Elections require balancing absolute voter anonymity against transparent public trust—two fundamental requirements that work directly against each other and collapse under electronic voting implementations. - [01:59](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=119s) Physical paper balloting features a built-in scaling defense: rigging an election manually requires coordinating thousands of conspirators across physical locations, making detection nearly unavoidable. - [07:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=470s) Remote online voting shifts national election security onto compromised consumer devices, enabling state-sponsored cyber warfare teams to alter millions of votes as cheaply as changing one. - [09:49](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=589s) Emerging technologies like blockchains fail to fix electronic voting, as distributed write-only ledgers do nothing to verify the physical input interface between the voter and the terminal.

## Key takeaways - [00:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=0s) Elections impose two mutually contradictory demands: absolute voter anonymity to prevent coercion or vote-buying, and transparent verifiability so ordinary citizens can trust the tally. - [00:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=0s) Paper ballots have centuries of refined procedural defenses where no single person is ever trusted alone, requiring transparent oversight by opposing political observers. - [01:59](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=119s) Physical voting fraud scales poorly; altering enough physical paper ballots to swing an election requires exponentially more time, money, and co-conspirators, drastically raising detection risk. - [03:24](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=204s) Electronic voting machines replace transparent visual oversight with closed-source code and opaque hardware, forcing voters to blindly trust that the machine is not compromised. - [03:24](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=204s) Voting machine vulnerabilities are demonstrated annually at DEFCON, where researchers routinely breach hardware, alter tallies, rewrite interfaces, and run unauthorized software like Doom. - [03:24](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=204s) Transferring digital vote tallies to central counting facilities relies on vulnerable vectors, including physical USB drive swaps and internet transmission subject to interception. - [06:29](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=389s) Central tabulation servers hide subtle software biases and basic human blunders, such as an unscrolled Excel spreadsheet that nearly distorted a Scottish election result. - [06:29](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=389s) Digital elections are vulnerable to asymmetric disinformation: an attacker does not need to compromise the count, but merely seed sufficient doubt about machine integrity to invalidate the result. - [07:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=470s) Online voting from home relies on unsecured consumer computers and phones, opening sovereign elections to foreign nation-state botnets and remote cyber manipulation. - [07:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=470s) Even pioneering implementations like Estonia's online voting system have been found by independent security audits to carry substantial operational and architectural vulnerabilities. - [09:49](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=589s) Blockchain ledgers cannot solve election security because they only record transactions after the fact and cannot guarantee the integrity of the terminal capturing the voter's choice. - [09:49](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=589s) Receipt-based verification faces an intractable dilemma: plaintext receipts destroy ballot privacy, while cryptographic verification strings are unintelligible to average citizens. - [09:49](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=589s) While electronic voting offers accessibility benefits for low-stakes decisions, paper ballots remain essential whenever the democratic future of a nation is at stake.

## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=0s) The Contradictory Demands of Elections

Five years after releasing an original video for *Computerphile* on why electronic voting is a terrible idea, Tom Scott notes that he still receives incoming emails asking whether recent advancements have finally solved the core problems. The assumption persists that some clever new scheme must have arrived to make electronic voting viable. Scott’s blunt assessment is that nothing of the sort has occurred: “No, it’s really not.” The foundational obstacle is that elections impose two crucial, conflicting requirements that work directly against each other: anonymity and transparent trust.

```mermaid flowchart LR accTitle: The Two Conflicting Demands of Elections accDescr: Diagram contrasting absolute voter anonymity against transparent public trust.

subgraph Req1 ["Requirement 1"] A["Absolute Anonymity"] --> B["Prevents bribery, threats, and coercion"] B --> C["Ballot cannot be linked to voter"] end

subgraph Req2 ["Requirement 2"] D["Transparent Trust"] --> E["Voter verifies tally is accurate"] E --> F["System must be understood by laypeople"] end

Req1 <-->|"Fundamental Tension"| Req2 ```

Anonymity requires that no one can discover how an individual voted, even after tallies are finalized. Without total privacy, malicious actors can bribe voters or use coercion. In the UK, ballots are discarded if signed or marked with any identifying feature, and election officials actively discourage ballot selfies because voters must be prevented from proving how they cast their vote. Otherwise, campaigns or bad actors could enforce schemes like offering discounts, conditioning party invitations, or threatening retaliation based on proof of vote choice: - Anonymity prevents transactional threats: “$10 off for blue voters!”, “Entry to this party only for yellow voters!”, or “vote red or you’ll regret it.” - Trust requires that voters know their ballot was counted accurately and securely, while ensuring that the public—regardless of technical sophistication—can clearly see that the mechanism is trustworthy. - Paper systems accomplish this through open visibility: physical ballots sit inside sealed boxes, watched by representatives from competing political sides, with tamper-evident transport seals so that no single person is ever trusted alone. As Scott emphasizes: “People can be corrupt, or threatened, or incompetent, or all three at the same time.”

[01:59](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=119s) Why Physical Voting Scales Poorly for Attackers

Physical paper elections are far from flawless. In the UK, voter identity can technically be recovered from ballots if ordered by a court, and unauthorized tracking has occurred outside legal frameworks. Nevertheless, physical ballots possess an indispensable structural defense: physical attacks do not scale. Because paper balloting has been refined over centuries, nearly every variation of fraud has already been attempted, cataloged, and met with physical counter-defenses.

Attempting to rig a paper election requires expanding human intervention across physical space. In a standard UK general election, polling happens across hundreds of locations run by official staff and thousands of volunteers. Tampering with enough ballots to shift a national or local outcome requires recruiting more conspirators, spending excessive amounts of money, and dramatically increasing the risk of detection. While small-scale fraud occurs—such as “granny farming,” where political operatives visit care homes to manipulate vulnerable residents into assigning proxy votes—the effort required to sway large-scale outcomes through manual tampering quickly renders the conspiracy unsustainable: “The more physical votes you need to change, the more people you need to influence, the more time and money it takes, and the less likely it is that your little conspiracy will stay secret.”

[03:24](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=204s) The Flaws of In-Person Voting Machines

When voting moves to electronic voting machines inside polling stations—where voters press physical buttons or tap touchscreens instead of using pen and paper—the foundational trust model disintegrates. In an ideal scenario, voting software would be entirely open-source and subject to public review. In reality, polling hardware relies on closed-source code loaded onto machines via unsecured USB drives. These units frequently sit unattended in storage facilities and have occasionally been discovered lingering on open internet connections for years at a stretch, receiving realistic operational testing only on the day of an actual election.

```mermaid flowchart TD accTitle: Attack Vectors on Electronic Voting Machines accDescr: Flowchart showing vulnerabilities in hardware, transport, and central tabulation.

subgraph PollingStation ["At the Polling Station"] A["Closed-source Machine"] -->|"Tampered USB or OS"| B["Altered Tallies / Ballots"] B --> C["Untrusted Visuals: DEFCON hacks / Doom demo"] end

subgraph Transit ["Data in Transit"] C --> D{"Transit Method"} D -->|"Physical USB"| E["Sleight-of-hand Swap"] D -->|"Internet Upload"| F["Man-in-the-middle Interception"] end

subgraph Central ["Central Count"] E --> G["Central Counting Server"] F --> G G --> H["Hidden Flaws: Software bugs / Spreadsheet errors"] end ```

Even if ideal open-source software could be deployed, everyday voters have no mechanism to verify that the binary running on the hardware matches the approved source. Employing cryptographic checksums merely shifts the point of failure, forcing non-technical voters to blindly trust an abstraction they do not comprehend. Scott points out that at the annual DEFCON Voting Village convention in the United States, independent hackers routinely breach real-world voting terminals, modifying tallies, rewriting ballot interfaces, and in one notable instance, forcing a machine to run the classic first-person shooter *Doom*. Scott summarizes the absurd faith required by this design: “That’s basically what’s happening with an electronic voting machine. You just have something that says: trust me. I’ve counted your vote and I have absolutely not been compromised. Honest.”

Moving machine-collected votes to a central tally introduces further failure points: - Transporting physical machines to the counting center is logistically cumbersome and rarely done. - Transferring tallies via removable USB flash drives leaves elections vulnerable to simple sleight-of-hand drive swapping. - Transmitting totals electronically over the internet introduces direct network attack surfaces and man-in-the-middle vulnerabilities on both ends.

[06:29](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=389s) Central Counting Failures and the Disinformation Risk

Central tabulation systems—whether tallying direct digital submissions or scanning physical paper forms—suffer from identical verification problems, exacerbated by the fact that only a tiny group of technicians ever see the servers. Software inside electronic tabulators can contain subtle, undetectable biases, much like how Volkswagen secretly engineered its engine software to bypass emissions tests for years without detection.

Simple human incompetence also undermines electronic tallying. During a Scottish election trial with electronic voting, an incorrect result was caught in the nick of time only because a keen observer spotted figures that did not make sense; investigators discovered a worker had neglected to scroll all the way across an Excel spreadsheet containing the final data. Crucially, digital systems are uniquely vulnerable to asymmetric reputation attacks: - “To break an electronic election, you don’t actually need to break it: you just need to cast enough doubt on the result.” - An operative can shatter public confidence simply by photographing an unapproved USB drive plugged into an election machine—or even by circulating a doctored image of such an event—an exploit that is far harder to manufacture against transparent, physical ballot containers.

[07:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=470s) Remote Online Voting and the Estonian Example

The push to let citizens cast votes remotely from personal smartphones or home computers introduces catastrophic system-level vulnerabilities. While tech-savvy users might keep their personal hardware secure, millions of consumer devices run outdated operating systems or harbor latent botnet malware. Against these consumer vulnerabilities, state-sponsored cyber warfare divisions wield immense leverage: “Find the one hole in the system, and suddenly it costs roughly the same to change one vote as it does to alter millions: and your conspiracy stays very, very small indeed.” Foreign attackers would not even need to set foot inside the country they are destabilizing.

Advocates often counter these warnings by pointing to Estonia, which pioneered internet voting in 2005 across local, national, and European Parliament elections, with over 40% of its electorate (approaching 250,000 citizens) casting digital ballots by 2019 using national smart cards and mobile SIM authentication. However, independent security audits revealed substantial operational and procedural security flaws in Estonia's infrastructure. Its underlying architecture has aged over a decade, leaving it vulnerable to nation-state cyberattacks aimed at either harvesting credentials from compromised personal hardware or breaking trust in the central tabulation servers. Scott notes that whenever these fundamental pitfalls are established, proponents inevitably pivot to the next buzzword: blockchain.

[09:49](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=589s) The Flaws of High-Tech Solutions and the Final Verdict

Proponents often suggest emerging technologies like blockchains to fix electronic voting, but framing a write-only database as a magic bullet completely misunderstands the core vulnerability. Asking the public to place their faith in novel distributed ledgers fails to address the fundamental problem of trusting the underlying software and physical hardware. A blockchain does nothing to change how the voting machine operates at the physical booth; the critical interface between the voter pressing a button and the system recording that intention into the database remains entirely vulnerable to manipulation. Furthermore, attempting to make digital voting verifiable via paper receipts introduces an intractable paradox: if a machine prints a human-readable receipt displaying your vote so you can verify it later, voter anonymity is destroyed; if it instead prints cryptographic hashes or seemingly random strings of numbers, public trust collapses because virtually no ordinary citizen understands how that math works.

Tom Scott acknowledges that electronic voting is not without merit, emphasizing that accessibility is a massive, genuinely vital advantage for many voters. In low-stakes scenarios—such as student council votes, internal committee ballots, or small community decisions—electronic systems are perfectly fine to use. However, the calculus changes completely when the stakes reach an existential scale. Delivering his closing warning with grim finality, Tom Scott insists: “But when the future of nations rests on the result: electronic voting is still a bad idea, and you should still vote against it.” He pauses before adding a chilling parting thought: “While you can.”

- **The blockchain fallacy:** A write-only distributed ledger does not secure the physical interface where a voter inputs their choice into the hardware. - **The verification dilemma:** - *Plaintext receipts:* Enable vote-checking, but completely compromise ballot secrecy and open voters up to coercion or vote-buying. - *Cryptographic / randomized receipts:* Protect secrecy, but alienate ordinary citizens who cannot independently audit or comprehend the underlying cryptography. - **Appropriate use cases:** Electronic voting is acceptable for low-stakes, small-group elections where convenience outweighs existential national security risks.

[10:40](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=640s) Dashlane Password Manager and Digital Security

Transitioning to the video’s sponsorship, Tom Scott offers a candid justification for endorsing Dashlane, joking that the first reason is obvious: they paid him. More earnestly, he notes that anyone technical enough to watch an in-depth breakdown of election cybersecurity to the very end is precisely the kind of person who ought to be using a dedicated password manager. The ideal security practice requires generating lengthy, complex, symbol-laden passwords that are entirely unique across every single app and website. While this prevents credential-stuffing attacks across compromised services, human memory cannot reliably retain dozens of random strings, and manually entering them across devices is an exercise in frustration.

Tom Scott explains how a password manager resolves this friction by bridging robust security with day-to-day usability. As Tom Scott argues: “Being able to use a single master password, or the biometrics on your phone, is great: you’ve got one thing to remember.” He outlines Dashlane’s zero-knowledge cloud architecture, which synchronizes login credentials across operating systems and browsers without ever exposing the unencrypted master passwords to Dashlane's servers.

- **Trial & Offer:** A 30-day free trial of Dashlane Premium is offered at `dashlane.com/tomscott`, with promo code `tomscott` providing a 10% discount. - **Core features:** - Automated password generation, cross-platform autofill, and encrypted cloud synchronization across all devices and browsers. - Zero-knowledge encryption architecture ensuring the host company cannot read user passwords. - Autofill storage for payment details and credit cards to avoid retyping financial data during checkout. - Bundled extras including an integrated virtual private network (VPN) and one gigabyte of secure encrypted storage.

## Notable quotes > [06:29](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=389s) To break an electronic election, you don’t actually need to break it: you just need to cast enough doubt on the result. — Tom Scott

> [01:59](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=119s) The more physical votes you need to change, the more people you need to influence, the more time and money it takes, and the less likely it is that your little conspiracy will stay secret. — Tom Scott

> [07:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=470s) Find the one hole in the system, and suddenly it costs roughly the same to change one vote as it does to alter millions: and your conspiracy stays very, very small indeed. — Tom Scott

## Mentioned Tom Scott, Computerphile, DEFCON Voting Village, Doom, Volkswagen, Microsoft Excel, Estonia, Dashlane, Sean Elliott, Tomek, Mooviemakers, Haerther Productions

## Video description We still shouldn't be using electronic voting. Here's why. • Sponsored by Dashlane — for free on your first device @ https://www.dashlane.com/tomscott

MORE BASICS: https://www.youtube.com/playlist?list=PL96C35uN7xGLLeET0dOWaKHkAlPsrkcha

REFERENCES:

Computerphile video: https://www.youtube.com/watch?v=w3_0x6oaDmI

Stories about voter identification happening outside the law: https://www.theguardian.com/notesandqueries/query/0,,-1051,00.html

Voting machines left connected to the internet: https://www.vice.com/en_us/article/3kxzk9/exclusive-critical-us-election-systems-have-been-left-exposed-online-despite-official-denials

Hackers getting voting machines to play Doom: https://www.salon.com/2019/08/14/hackers-can-easily-break-into-voting-machines-used-across-the-u-s-play-doom-nirvana/

"Small, well-funded team backed by a national government": https://www.nytimes.com/2019/07/25/us/politics/russian-hacking-elections.html

Scottish election: https://www.theguardian.com/politics/2007/jun/20/scotland.devolution and http://news.bbc.co.uk/1/hi/scotland/6627657.stm - with the Excel detail on page 50 of https://www.openrightsgroup.org/wp-content/uploads/org_election_report.pdf?page=50

Report on e-voting in Estonia: https://estoniaevoting.org/

Written with Sean Elliott https://twitter.com/SeanMElliott/ Directed by Tomek Graphics by Mooviemakers https://www.mooviemakers.co.uk/ Audio mix by Haerther Productions https://haerther.net/

🟥 MORE FROM TOM: https://www.tomscott.com/ (you can find contact details and social links there too) ❓ LATERAL, free weekly podcast: https://lateralcast.com/ https://youtube.com/lateralcast/ 👥 THE TECHNICAL DIFFICULTIES: https://youtube.com/techdif

[Source](https://www.youtube.com/watch?v=LkH2r-sNjQs)

中文简报

电子投票使主权选举面临可规模化的网络攻击风险数字投票对国家民主构成了生存威胁，因为计算系统无法调和选民匿名性与公众可审计性，同时还会让外国敌对势力以极低成本操纵数百万张选票。汤姆·斯科特（Tom Scott）解释说，电子投票存在根本性缺陷，因为民主选举需要满足两项互不相容的要求：绝对的选民匿名性以防止强迫，以及透明且便于外行核验的信任机制。传统的纸质投票依赖于能够阻止攻击被隐蔽规模化扩展的实体物流，而电子投票机和网络投票则引入了集中的故障点，容易受到主权国家级网络攻击、无法察觉的软件错误以及不对称虚假信息的威胁。拟议中的区块链或密码学收据等技术补救方案，既无法解决实体硬件被篡改的问题，也会让非技术背景的选民感到疏离。尽管数字系统或许适用于低风险的投票，但斯科特警告称，只要涉及国家层面的重大结果，实体纸质选票仍然至关重要。选举需要在绝对的选民匿名性与透明的公众信任之间取得平衡——这两项基本要求完全相互对立，并会在电子投票的推行下土崩瓦解。 (0:00) 实体纸质投票具有天然的抵御规模化作弊的防御机制：手动操纵一场选举需要在不同实体地点协调成千上万名共谋者，使得作弊行为几乎必然会被察觉。 (1:59) 远程在线投票将国家选举安全的重担转移到了存在安全隐患的消费级设备上，使得受国家资助的网络战部队篡改数百万张选票的成本与篡改一张选票一样低廉。 (7:50) 区块链等新兴技术无法解决电子投票的问题，因为分布式只写账本根本无法核验选民与终端之间的物理输入界面。 (9:49)

Reading summary

Tom Scott argues that electronic voting remains fundamentally unsuitable for national elections because digital technologies cannot reconcile absolute ballot anonymity with transparent, layperson verifiability. While paper elections naturally resist mass fraud through physical friction, computerized systems introduce scalable attack vectors that can be exploited remotely to alter tallies or subvert public trust. The Contradiction Between Anonymity and Trust (0:00) Democratic elections require two mutually conflicting conditions: absolute voter anonymity and transparent public trust. Total secrecy ensures that no one can discover how an individual voted, eliminating transactional threats such as vote-buying, partisan commercial discounts, and voter coercion. To preserve this, jurisdictions like the UK invalidate ballots with identifying markings and actively discourage ballot selfies. Conversely, trust requires that every voter can independently verify that tallies are accurate, using an open system that laypeople without technical training can comprehend. Paper balloting balances these competing needs through physical visibility. Ballots are marked privately, placed into sealed containers in full view of observers from competing political factions, and transported under tamper-evident seals. Because no single participant is ever trusted alone, physical systems account for human corruption, threats, and incompetence without demanding blind faith in an unobservable process. Physical Scaling Limits Versus Digital Leverage (1:59) Although paper elections remain vulnerable to localized fraud—such as "granny farming," where operatives manipulate proxy votes in care homes—manual interference cannot easily scale. Altering a national outcome requires recruiting thousands of co-conspirators across geographically dispersed polling places, which exponentially raises financial costs and the risk of exposure. Because physical voting procedures have been refined over centuries, most manual attack vectors are well cataloged and constrained by physical logistics. Digital systems invert this security dynamic by removing physical constraints. Consumer hardware is routinely compromised by malware or outdated software, giving state-sponsored cyber warfare units disproportionate leverage. In a digital environment, finding a single exploitable vulnerability costs roughly the same to change millions of votes as it does to alter one, all while keeping the conspiracy exceptionally small and remote. Even Estonia's pioneered internet voting framework, where over 40% of the electorate voted online by 2019, has faced independent security audits citing severe operational flaws and aging infrastructure. Polling Machine Insecurities and Perception Attacks (3:24) In-person voting machines replace observable procedures with closed-source code and unsecured USB data transfers. Machines frequently sit unattended in storage facilities or linger on open networks, leaving regular voters unable to verify whether an approved software build matches the binary running on the hardware. Independent security researchers at the DEFCON Voting Village routinely exploit real-world voting terminals to alter tallies, rewrite user interfaces, and run unauthorized software such as the video game Doom. Centralized electronic tabulation also introduces concentrated points of failure, ranging from undetectable algorithmic bias—analogous to Volkswagen's emissions testing bypass—to simple human error, such as a Scottish trial where an incorrect tally was nearly certified because an operator failed to scroll across an entire spreadsheet. Furthermore, digital balloting is acutely vulnerable to perception warfare. An operative does not need to compromise the actual vote count to disrupt an election; circulating a photograph of an unapproved USB drive plugged into a terminal can be enough to permanently shatter public faith in the outcome. The Limits of Blockchains and Paper Receipts (9:49) Technological fixes proposed by proponents fail to resolve these structural vulnerabilities. Blockchains function merely as write-only databases, doing nothing to secure the physical input interface between the voter and the voting terminal. If the local machine or operating software is manipulated, fraudulent votes are simply written directly into the ledger. Similarly, attempts to verify digital voting through physical receipts trigger an intractable trade-off. If a machine prints a human-readable receipt displaying the voter's candidate selection, ballot secrecy is destroyed, reintroducing coercion and vote-buying. If the machine instead issues a cryptographic hash or randomized string to maintain secrecy, the verification process alienates ordinary citizens, who cannot independently evaluate cryptographic proofs without placing blind trust in technical specialists. Scott concludes that while electronic systems provide valuable accessibility and remain suitable for low-stakes environments like student councils or internal committees, they pose existential security hazards for national elections. He advises citizens to actively vote against electronic balloting while paper ballots still afford them the secure means to do so.

精炼阅读摘要

Tom Scott 认为，尽管技术不断发展，电子投票在涉及国家治理的高风险选举中仍然是一个糟糕的主意，其根本原因在于选举体系对“选民绝对匿名”与“公众透明信任”存在不可调和的矛盾冲突。匿名与透明信任的根本对立 (0:00) 传统选举必须同时满足两个彼此冲突的要求：一是选民的绝对匿名性，防止贿赂、威胁以及强制投票（例如以金钱购买特定选票或要求提供投票凭证作为准入条件）；二是透明且可信的计票过程，让普通公民无论技术水平高低都能确信计票真实可靠。在英国等地的纸质选举中，任何带有签名或标记的选票都会被作废，以阻止选民自证选票去向。纸质选票之所以能够在漫长历史中维持信任，是因为物理选票保存在透明可见的密封箱中，由相互竞争的党派代表与工作人员共同监督，并使用防篡改封条。整个流程的设计前提在于承认“人可能会腐败、受胁迫或能力不足”，因此没有任何单一个人能够掌握完整的篡改权力。这种依靠直观物理机制建立的信任，是难以用复杂的数字抽象来替代的。实体选票的规模防御机制 (1:59) 纸质投票并非完美无缺，在英国历史上曾存在法庭下令恢复选票身份或非法的追踪尝试，也会出现走访养老院诱导弱势群体签署代理投票的欺诈现象。然而，实体纸质选票具有一项无法替代的结构性安全优势：攻击手段无法无成本地规模化扩展。在全国大选中，投票分散在成百上千个由正式员工和数千名志愿者管理的投票站。攻击者若想通过物理篡改选票来扭转选举结果，就必须在地理空间上大量招募共谋者、投入巨额资金，这会导致串通暴露的风险呈几何级数增加。这种人力与物理操作的制约，使得任何企图大规模操纵实体选票的阴谋都极其难以长期隐蔽。投票机与中心计票的致命脆弱性 (3:24) 在线下投票站采用电子投票机破坏了直观的信任模型。现实中的投票终端大多使用闭源专有代码，通过未受保护的 USB 驱动器加载数据，常年缺乏监管并存放于库房，甚至有设备被发现长时间直连开放互联网。即使采用开源软件和密码学校验和，普通选民也完全无法验证硬件上运行的代码是否合规。在 DEFCON 投票村大会上，白帽黑客屡次成功攻破投票机，篡改计票结果或将界面改装为运行《毁灭战士（Doom）》游戏。在将数据汇总至中心计票系统的过程中，无论是物理运输投票机、使用 U 盘倒换数据，还是通过网络传输，都极易遭受掉包或中间人攻击。电子制表软件内的隐蔽偏差和漏洞极难被肉眼排查，且简单的操作失误就可能造成系统性混乱（例如苏格兰电子投票试点中因工作人员漏看 Excel 表格而险些导致误判）。更为危险的是非对称声誉攻击：攻击者无需真正攻破系统，仅需一张包含非授权 U 盘插入投票机的照片或伪造图片，就足以摧毁整个社会对选举结果的信任。远程网络投票与区块链神话的破灭 (7:50) 允许公民通过智能手机或个人电脑进行远程网络投票，会将国家关键基础设施暴露在庞大的漏洞网络中。普通用户的设备充斥着未修复的安全漏洞和恶意僵尸网络程序，而外国国家级黑客团队只要找到一个核心漏洞，就可以用极低的成本批量篡改数以百万计的选票。以爱沙尼亚为例，尽管该国自 2005 年起推行基于智能卡与 SIM 卡的数字投票并在 2019 年达到逾 40% 的电子投票率，但独立安全审计依然指出其底层架构存在严重的操作与流程安全缺陷，极易遭遇凭证窃取和信任危机。引入区块链等新兴技术同样无法解决问题。区块链本质上只是只写式分布式数据库，完全无法保障投票人输入意图与机器记录之间物理界面的安全性。试图通过打印纸质回执来解决验证问题更会陷入悖论：若回执打印明文选票，选民隐私即被剥夺，给买票和强迫投票打开方便之门；若回执打印加密哈希值或随机字符，绝大多数普通公民根本无法理解数学逻辑，公众信任依然会荡然无存。 Tom Scott 总结指出，电子投票在便利性和无障碍访问方面具有不可否认的价值，在学生会选举、内部委员会投票或社区事务等低风险场景中完全可行；但当面临决定国家前途命运的最高风险政治选举时，其带来的不可控安全威胁依然致命，公众应当在仍有选择权的时候坚决反对推行电子投票。

Detailed notes — zh

## Background 该视频由知名科普博主 Tom Scott 于 2019 年 12 月 9 日发布在 YouTube 平台上。页面简介指出，这是继五年前在 Computerphile 频道探讨该话题后的一次全面跟进，旨在从技术与信任机制等多维度阐释为何在国家级选举中仍不应采用电子投票，本期内容由 Dashlane 赞助播出。 ## TL;DR 视频深入探讨了选举赖以生存的两大核心基石——匿名性与公众信任，指出传统纸质投票虽不完美，但其物理防篡改机制让作弊手段极难横向规模化。相比之下，无论是投票站的电子投票机（EVM）还是居家网络投票，都面临闭源软硬件无法自证清白、传输网络易受国家级网络攻击、以及只要制造怀疑即可彻底摧毁系统公信力的致命缺陷。此外，爱沙尼亚模式的固有隐患与区块链技术无法解决前端输入造假的两难悖论，进一步印证了高风险选举中电子化的高危属性。Tom Scott 最终强调，除部分低风险场景或无障碍辅助需求外，只要涉及国家前途，大众就应坚决反对电子投票。 ## Atmosphere & style 全片充盈着 Tom Scott 标志性的清晰、严谨与务实科普风格，叙事节奏紧凑干脆且毫不拖泥带水。尽管内容聚焦于复杂的计算机安全与密码学信任难题，但他运用了极具画面感的生动比喻——例如“投票隔间里坐着的陌生人”，使深奥的技术困境瞬间具象化。在冷峻剖析技术脆弱性与体制危机的过程中，他的态度从冷静的逻辑论证层层递进，直至在片尾发出掷地有声、近乎警世预言般的严正告诫，带给观众极强的警醒感与现实压迫力。 ## Bulletin - [00:26](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=26s) 选举机制的核心矛盾在于匿名性与公众信任的不可调和：既要保证选票完全无法溯源以防贿选与胁迫，又要让不具备技术背景的普通大众确信整个计票流程未被篡改。 - [02:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=120s) 传统纸质投票虽然存在缺陷，但实体攻击在物理层面极难横向规模化，而电子投票及远程网络投票一旦暴露单一漏洞，黑客篡改一张选票与篡改数百万张选票的成本几乎完全相同。 - [09:49](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=589s) 区块链技术无法拯救电子投票，其作为只写数据库无法保证前端软硬件忠实记录选民意图，且任何密码学回执都会在‘暴露选民身份’与‘脱离公众理解认知’的两难困境中二选一。 - [10:17](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=617s) 电子投票虽然在无障碍辅助功能方面有其适用场景，但事关国家政治前途的关键大选必须坚决抵制电子投票，避免国家安全暴露在低成本、高收益的网络攻击威胁之下。 ## Key takeaways - [00:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=0s) 时隔五年后技术虽有进步，但电子投票在重大政治选举中依然是一个极其糟糕且不成熟的主意。 - [00:26](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=26s) 匿名性是选举的基石之一，任何事后能够证明选票投给特定候选人的手段（如选票签名或拍照）都会滋生贿选与人身胁迫。 - [01:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=60s) 公众信任必须建立在直观可理解的透明度之上，整个计票和运输流程绝不能将信任完全寄托在单独某一个人身上。 - [02:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=120s) 纸质投票并不完美，但针对其实体舞弊手段（如哄骗老人代投的“祖母圈地”）的扩展成本呈指数级上升，几乎无法在大选规模下隐秘实施。 - [03:27](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=207s) 投票站内的电子投票机（EVM）多采用闭源系统，软件、硬件黑箱让选民只能被动接受机器未被篡改的单方面保证。 - [04:40](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=280s) DEFCON 安全测试表明现役投票机极其脆弱，黑客能够轻易改写计票、篡改界面甚至在投票机上运行《毁灭战士》（Doom）。 - [05:35](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=335s) 通过物理整机运输、USB 闪存盘转存或互联网在线上传等三种选票传输路径，均存在严重的中间人攻击或调包隐患，超出大众认知范围。 - [06:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=410s) 中央计票服务器同样存在信任危机，甚至类似 Excel 滚轮未翻页或插入未知优盘拍照造谣等人为失误与舆论战，就足以摧毁选举的合法性信任。 - [07:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=470s) 基于个人电脑或手机的在家互联网投票风险极高，普通民众设备漏洞百出，根本无力抵御国家级黑客部队的规模化网络攻击。 - [08:40](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=520s) 爱沙尼亚推行十余年的网络投票系统在运维与架构上严重过时，独立安全审计指出其同样暴露在严峻的境外渗透威胁中。 - [09:49](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=589s) 区块链技术只能充当只写数据库，根本无法解决前端机器是否忠实记录选民真实投票意愿的信任鸿沟。 - [10:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=600s) 投票回执面临两难悖论：打印明文会破坏匿名投票原则，而提供加密哈希代码又超出普通大众理解，导致公众信任崩溃。 - [10:17](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=617s) 电子投票仅适用于低风险、小规模及有无障碍辅助需求的非关键选举，在决定国家前途的严肃大选中必须坚决予以反对。 ## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=0s) 电子投票依然是个坏主意五年前，Tom Scott 曾在名为 Computerphile 的频道上制作过一期视频，专门探讨为何电子投票是个糟糕的想法。即便过去了五年，他依然会时不时收到观众的来信询问：技术肯定已经进步了吧？是不是有了能解决问题的新点子？电子投票是不是指日可待了？对于这些期待，Tom 斩钉截铁地回答：“不，真的不是。”他开门见山地指出：“Here is why electronic voting is still a bad idea.”（这就是为什么电子投票依然是个坏主意。） ### [00:26](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=26s) 选举的两大矛盾基石：匿名性与公众信任选举具有极其特殊的制度要求，其中包含两个彼此几乎对立的核心特征：匿名性（Anonymity）与信任（Trust）。首先，投票必须是完全匿名的，哪怕所有选票都计票完毕，也不应有任何手段能够追查到某个人究竟投给了谁。只有这样，才能杜绝通过行贿或人身威胁来强迫他人投票的现象。在英国，如果选民在选票上留下了任何可能暴露身份的标记（例如签名），该选票将直接作废；选举官员之所以对选民在填写选票后自拍感到警惕，也正是因为事后选民绝不能有办法向外界证明自己的投票选择。一旦打破匿名，就会滋生各种政治操弄，比如“投蓝党立减10美元”、“仅限黄党选民入场聚会”或是“投给红党，否则后果自负”。第二个要求则是绝对且透明的公众信任。系统不仅要在技术上确保选票被安全且准确地清点，还必须让所有人——无论其是否具备技术背景——都能一目了然地确信整个系统是值得信赖的。在纸质投票中，选民将选票投入密封的票箱，直到所有选举利益相关方都在场派出代表见证时，票箱才会被开启；在运输过程中，也会有不同立场的监督人员共同守卫，或共同确认防篡改封条完好无损。选民必须相信自己的选票会被计入，即使他们再也见不到这张选票、且选票无法溯源到个人。Tom 强调：“And at no point is a single person put in a position of trust.”（在整个流程中，没有任何一个环节会把信任完全寄托在单独一个人身上），因为任何单独的人都有可能被收买腐化、受到威胁、自身能力不足，或者三者兼具。 ### [02:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=120s) 纸质投票的缺陷与不可扩展的作弊成本实体纸质投票绝非完美无瑕，它曾遭受过攻击，也存在漏洞。即便是英国现行的纸质系统，也未能百分之百满足这两项严苛要求：在法院发布命令的特殊情况下，技术上仍有可能根据选票追查选民身份，现实中也有关于非法调查选民身份的传闻。然而纸质投票的核心优势在于，针对它的攻击手段极其难以横向规模化（scale）。实体投票制度已经历了数百年的演进，人类几乎尝试过所有能想到的舞弊方式，并且针对性地建立了防御机制。在现实中，想要篡改的实体选票越多，必须拉拢和影响的人就越多，耗费的时间与资金就会呈指数级上升，而阴谋败露的几率也会无限放大。以英国大选为例，全国遍布着数以百计的投票站，工作人员由大量全职雇员以及成千上万名志愿者共同组成。企图通过实体手段篡改足够左右大选结果的海量选票，难度登天。虽然历史上有人尝试过，并且有极少数人被定罪或局部得手，例如不法掮客利用所谓的“祖母圈地”（Granny farming）手段——跑到养老院哄骗弱势老人签署代理投票协议（proxy vote），让别人代为投票。这种手法在极小规模下或许奏效，但一旦试图将其放大到足以影响大选的规模，不仅成本极其高昂、耗时费力，而且几乎必然会暴露。针对实体与电子攻击的本质区别，Tom 总结道：“The key point is not that paper voting is perfect: it isn’t. But attacks against it don’t scale well.”（关键并不在于纸质投票完美无瑕——它确实不完美；而在于针对纸质投票的攻击无法轻易规模化。） ### [03:27](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=207s) 投票站电子投票机（EVM）的信任危机与 Defcon 破解电子投票的第一大形式是在投票站设置的电子投票机。选民依然走进投票隔间，但不再是在纸上划勾，而是按物理按键或点击触摸屏。这种机器面临的首要困境是：软件与硬件均不可信。理论上，投票机可以运行开源软件供全社会审查代码；然而在现实中，绝大多数采用的都是闭源软件，往往通过极易被植入恶意程序的 USB 闪存盘加载，运行在无人严密看管的计算机上，有些机器甚至常年莫名其妙地直接连接在公共互联网上。最致命的是，这些系统通常只有在正式大选当天才会接受一次真正的全负荷实战检验。退一步讲，即便奇迹般地开发出了最稳定、最安全的开源软件，普通选民又如何验证自己眼前这台机器上装的就是那套正确的软件？即便引入校验和（Checksum）机制，也只是将信任链条推移了一步，选民又不得不去信任校验和没有被伪造，更何况绝大多数普通选民根本搞不懂什么是校验和，更谈不上建立无条件的信任。在美国，每年黑客大会 DEFCON 的“投票村”（Voting Village）都会对现役投票机进行民间安全测试。黑客们轻而易举地改写了机器内部存储的计票总数、篡改了显示给选民的选票界面，甚至在一台投票机上成功运行了经典射击游戏《毁灭战士》（Doom）。这正如 Tom 的比喻：这相当于投票隔间里坐着一个陌生人，你只能趴在他耳边说出你的选择，对方嘴上信誓旦旦保证会准确记录并转交，你既看不到他记在哪里，也无法核实他的行为。面对台机器，选民只能被动接受它单方面的承诺：“You just have something that says: trust me. I’ve counted your vote and I have absolutely not been compromised. Honest.”（你面对的仅仅是一台冷冰冰的设备对你说：相信我吧，我已经记录了你的选票，而且我绝对没有被黑。真的。） ```mermaid flowchart TD accTitle: 电子投票机的单点信任黑箱问题 accDescr: 展示了选民投票给电子投票机时，由于硬件、闭源软件与USB传输均处于不可见状态，导致选民只能盲目信任设备的过程。 subgraph UserStage["选民操作"] V["选民做出选择"] end subgraph MachineStage["黑箱投票机 (EVM)"] M1["屏幕与触控界面"] M2{"闭源系统与硬件<br/>(是否存在后门/恶意代码?)"} M3["本地存储与内存统计"] M1 --> M2 --> M3 end subgraph TrustDilemma["信任断层"] D1["普通选民无法验证校验和"] D2["DEFCON黑客攻破先例<br/>(改票/运行Doom)"] end V -->|"输入投票"| M1 M2 -.->|"无法自证清白"| D1 M3 -.->|"结果易被篡改"| D2 ``` ### [05:35](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=335s) 选票传输路径与中央计票服务器的致命软肋第二个难题在于“传输中的选票”（votes in transit）：如何将各个投票机上的数据汇总到中央计票中心？现实中仅有三种可能路径： 1. **整机实体押运**：将全国所有投票机打上物理封条，整体运往计票中心。这种做法极其笨重低效，现实中根本无人采用。 2. **移动介质转存**：将每台机器的计票数据导出到 USB 闪存盘上带走。然而只要稍有调包或掉包的小动作（sleight-of-hand），整套选举结果就会被彻底篡改；同样，任何基于加密校验的方案都超出了普通选民直观理解与信任的认知范畴。 3. **互联网在线传输**：直接通过互联网远程回传数据。这种设想过于乐观，在两端终端软件本身都无法自证清白的前提下，中间人攻击（Man-in-the-middle attacks）完全有机可乘，更意味着主动将关键投票设备暴露在公网上。第三个难题则是位于流程终点的中央计票服务器。最终汇总所有选票并计算总结果的中央服务器，继承了单台投票机所面临的全部信任与验证危机，更糟糕的是，物理上能接触到这台服务器的人少之又少。类似的隐患同样存在于读取纸质选票的电子读票机上——大众根本无法核实机器是否在暗中修改选票统计，正如大众汽车（Volkswagen）多年来利用精心编写的软件在尾气排放测试中瞒天过海一样。即使不考虑恶意黑客攻击，仅人为失误就能引发灾难。在苏格兰一次电子投票试点中，一位观察员在最后一刻叫停了结果宣布，因为票数明显反常；事后调查发现，原因仅仅是操作人员在查看存放选举结果的 Excel 表格时，忘记向右滚动滚轮去读取被遮挡的列数据。更有甚者，瓦解系统根本无需真正破解它：“To break an electronic election, you don’t actually need to break it: you just need to cast enough doubt on the result.”（要摧毁一场电子选举，你根本不需要在技术上真正攻破它；你只需要在选举结果上制造出足够的怀疑就够了。）攻击者只需把一个来源不明的优盘插在投票机上拍张照片发到网上，甚至伪造一张照片，就足以彻底击碎公众对整场选举的合法性信任，而纸质票箱极难被这类低成本流言撼动。 ### [07:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=470s) 在家网络投票的灾难性风险与爱沙尼亚案例的反思相比在投票站使用机器，让选民通过个人手机或电脑在家远程投票（Internet voting）更是一个灾难性的构想。即便个人能保证自己的设备没有病毒且系统及时更新，也绝无法保证亲戚邻里乃至整条街道上所有人的设备都是安全的。现实中有海量个人电脑常年感染恶意软件，无数手机运行在过时且漏洞百出的操作系统上。日常针对普通人的往往只是黑客用于搭建僵尸网络（botnet）或进行小额敲诈的简单病毒，而一旦面对由国家政权支持（nation-state-backed）、资金充足且技术顶尖的精锐网络部队，局面将完全失控。针对网络投票的攻击具备极高的可扩展性，黑客只要在系统架构中挖出一个漏洞，“Find the one hole in the system, and suddenly it costs roughly the same to change one vote as it does to alter millions”（在系统中找到一个漏洞，篡改一张选票的成本与篡改数百万张选票的成本几乎完全一样），而且幕后操纵者甚至无需踏入被攻击国家的国境半步。对于电子投票支持者经常抛出的两个反驳论据，Tom 逐一进行了拆解： - **“爱沙尼亚模式”真的万无一失吗？** 爱沙尼亚早在2005年就成为全球首个引入互联网投票的国家，从地方选举逐步推行至全国及欧洲议会选举。到2019年，已有超过40%的选票（接近25万人）通过网络提交。选民通过政府发放的智能身份证卡或手机 SIM 卡完成身份验证，表面看似坚不可摧。然而独立的安全评估报告指出，该系统在操作流程与运维安全上存在严重漏洞。其整体底层架构已有超过十年历史，早已严重过时，完全暴露在外国势力的网络威胁之下——黑客既可以通过渗透控制选民的个人手机进行篡改，也可以直接摧毁公众对中央计票服务器的信任基础。 - **“区块链技术”能拯救电子投票吗？** 当面对“引入区块链（blockchain）等新技术是否能解决问题”的盲目提问时，Tom 甚至暂时不想去展开说明向大众普及区块链工作原理是多么困难，便直接切入了技术与信任本质的更深层冲突。 ### [09:49](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=589s) 区块链技术的局限性与电子投票的固有困境针对部分人提议使用区块链等新兴技术来解决选举信任问题，Tom Scott 指出这种思路根本没有触及核心矛盾。区块链在本质上不过是一个“只写数据库”（write-only database），它丝毫不能解决选民对投票机软硬件本身的信任危机。整套系统最关键的环节依然是投票机的运作机制——即选民的真实投票意向与最终被写入数据库的数据之间，必须保持绝对一致且不受篡改，而区块链对此无能为力。更为棘手的是投票凭证（Receipt）带来的两难悖论。如果投票机打印出一张明确写有选民投票结果的回执以供日后核对，这就会直接摧毁投票的匿名性，使选民面临被胁迫或贿选的风险；但如果它打印的是一串看似随机的数字或加密哈希值以供查验，又会彻底破坏普通公众的信任。正如 Tom Scott 所言：“If it prints a receipt of seemingly-random numbers you can check later, it breaks trust, because hardly anyone will understand what’s actually going on there.”（如果它打印的是一串看似随机的数字供你日后查验，这就会破坏信任，因为几乎没有人能真正搞懂那背后到底是怎么回事。） ```mermaid flowchart TD accTitle: 电子投票凭据的两难悖论 accDescr: 展示选民获得明文回执与加密回执分别面临的严重信任与安全后果。 Start["选民完成电子投票"] --> Choice{"提供何种核对凭据？"} Choice -->|"明文记录投票选项"| Plain["可读的明文回执"] Choice -->|"加密哈希/随机代码"| Encrypted["不可读的加密数字回执"] Plain --> BreakAnon["破坏匿名性<br/>（易滋生贿选与人身胁迫）"] Encrypted --> BreakTrust["摧毁公众信任<br/>（普通大众无法理解技术细节）"] ``` - 核心矛盾：底层的数据库技术再先进，也无法保证前端硬件与软件能忠实反映选民的操作意图。 - 匿名性 vs. 可验证性：可直接读取的回执剥夺了秘密投票的保护伞，而密码学方案则因门槛过高而脱离了公众的直观理解。 ### [10:17](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=617s) 电子投票的适用边界与坚决反对的立场 Tom Scott 澄清自己并非全盘否认电子投票的所有优点。他承认电子投票确实存在显著优势，其中最关键的一点就是无障碍辅助功能（Accessibility），这对于有特定生理障碍的选民而言极其重要。因此，在那些低风险、规模小、影响有限的非关键选举或团体投票中，完全可以采用电子投票方式。然而，一旦面对事关国家前途和重大政治走向的正式大选，电子投票带来的灾难性安全隐患就绝不可接受。在视频结尾，Tom Scott 极为严肃地给出了最终告诫，正如他坚决强调的那样：“But when the future of nations rests on the result: electronic voting is still a bad idea, and you should still vote against it. While you can.”（但当国家的未来系于选举结果之上时：电子投票依然是一个糟糕的主意，而且只要你还能投出反对票，你就应该坚决投票反对它。） ### [10:40](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=640s) 赞助环节：Dashlane 密码管理器的安全性与实用价值在视频尾声的赞助环节中，Tom Scott 幽默而坦率地说明了他为密码管理器 Dashlane 代言的两个原因：其一是对方支付了赞助费，其二则是他发自内心地认为，只要观众的技术素养足够支撑他们看完整期严肃的计算机安全视频，就绝对有必要使用密码管理器。在网络安全实践中，为每个网站和应用设置互不相同且包含长字符、符号的复杂密码是最理想的方案，但这超出了人类记忆的极限，手动输入也极其痛苦。Dashlane 能通过单一主密码或手机生物识别解决这一痛点，支持跨设备、跨浏览器和跨操作系统的自动填充与云端同步，且在同步过程中绝不会将实际密码泄露给 Dashlane 官方。此外，服务还整合了信用卡信息安全自动填充、内置 VPN 以及 1GB 的安全加密存储空间。观众访问指定链接即可获得 30 天的高级版免费试用，结账时输入专属优惠码还可享受折扣。 - 推荐理由：“I’m endorsing Dashlane for two reasons: one, they’ve given me money. Obviously. But two, because I genuinely believe that if you’re techie enough to watch to the end of this video, you should absolutely be using a password manager.”（Tom Scott 坦言：“我代言 Dashlane 有两个原因：第一，他们给了我钱，这很显然。但第二，是因为我由衷地相信，如果你懂技术到能把这个视频看到最后，你就绝对应该使用密码管理器。”） - 功能特性：跨平台密码生成与自动填充、信用卡数据安全存储、内置 VPN 与 1GB 加密存储。 - 优惠信息：通过 `dashlane.com/tomscott` 可获取 30 天 Dashlane Premium 免费试用，使用代码“tomscott”购买可享 9 折（10% off）优惠。 ## Notable quotes > [05:35](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=335s) To break an electronic election, you don’t actually need to break it: you just need to cast enough doubt on the result. — Tom Scott > [02:00](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=120s) The key point is not that paper voting is perfect: it isn’t. But attacks against it don’t scale well. — Tom Scott > [07:50](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=470s) Find the one hole in the system, and suddenly it costs roughly the same to change one vote as it does to alter millions — Tom Scott > [10:17](https://www.youtube.com/watch?v=LkH2r-sNjQs&t=617s) But when the future of nations rests on the result: electronic voting is still a bad idea, and you should still vote against it. While you can. — Tom Scott ## Mentioned Tom Scott, Computerphile, DEFCON, Doom, Volkswagen, Dashlane, 爱沙尼亚, 苏格兰, 英国, Excel ## Video description We still shouldn't be using electronic voting. Here's why. • Sponsored by Dashlane — for free on your first device @ https://www.dashlane.com/tomscott MORE BASICS: https://www.youtube.com/playlist?list=PL96C35uN7xGLLeET0dOWaKHkAlPsrkcha REFERENCES: Computerphile video: https://www.youtube.com/watch?v=w3_0x6oaDmI Stories about voter identification happening outside the law: https://www.theguardian.com/notesandqueries/query/0,,-1051,00.html Voting machines left connected to the internet: https://www.vice.com/en_us/article/3kxzk9/exclusive-critical-us-election-systems-have-been-left-exposed-online-despite-official-denials Hackers getting voting machines to play Doom: https://www.salon.com/2019/08/14/hackers-can-easily-break-into-voting-machines-used-across-the-u-s-play-doom-nirvana/ "Small, well-funded team backed by a national government": https://www.nytimes.com/2019/07/25/us/politics/russian-hacking-elections.html Scottish election: https://www.theguardian.com/politics/2007/jun/20/scotland.devolution and http://news.bbc.co.uk/1/hi/scotland/6627657.stm - with the Excel detail on page 50 of https://www.openrightsgroup.org/wp-content/uploads/org_election_report.pdf?page=50 Report on e-voting in Estonia: https://estoniaevoting.org/ Written with Sean Elliott https://twitter.com/SeanMElliott/ Directed by Tomek Graphics by Mooviemakers https://www.mooviemakers.co.uk/ Audio mix by Haerther Productions https://haerther.net/ 🟥 MORE FROM TOM: https://www.tomscott.com/ (you can find contact details and social links there too) ❓ LATERAL, free weekly podcast: https://lateralcast.com/ https://youtube.com/lateralcast/ 👥 THE TECHNICAL DIFFICULTIES: https://youtube.com/techdif [Source](https://www.youtube.com/watch?v=LkH2r-sNjQs)

Source quotes

[5:35] Tom Scott: To break an electronic election, you don’t actually need to break it: you just need to cast enough doubt on the result. [2:00] Tom Scott: The key point is not that paper voting is perfect: it isn’t. But attacks against it don’t scale well. [7:50] Tom Scott: Find the one hole in the system, and suddenly it costs roughly the same to change one vote as it does to alter millions [10:17] Tom Scott: But when the future of nations rests on the result: electronic voting is still a bad idea, and you should still vote against it. While you can.

Source quotes

[6:29] Tom Scott: To break an electronic election, you don’t actually need to break it: you just need to cast enough doubt on the result. [1:59] Tom Scott: The more physical votes you need to change, the more people you need to influence, the more time and money it takes, and the less likely it is that your little conspiracy will stay secret. [7:50] Tom Scott: Find the one hole in the system, and suddenly it costs roughly the same to change one vote as it does to alter millions: and your conspiracy stays very, very small indeed.

Original transcript

[0:00] Five years ago, I made a video for a channel called Computerphile [0:03] about why electronic voting is a bad idea. [0:05] And I still get emails, occasionally, asking: [0:08] things must have changed by now, right? [0:10] There’s this new idea, and maybe it’ll help. [0:12] Surely electronic voting is just around the corner? [0:16] No. [0:17] No, it’s really not. [0:19] Here is why electronic voting is still a bad idea. [0:26] Elections have some very unusual requirements. [0:29] There are two key features that are almost opposed to each other: [0:32] anonymity and trust. [0:34] So first, your vote should be completely anonymous. [0:36] There should be no way that anyone can find out who you voted for, [0:39] even after everything’s been counted. [0:41] That way, no-one can bribe you or threaten you to vote a particular way. [0:45] In the UK, if you mark your ballot in a way that could potentially identify you, [0:48] so if you sign it, for example, then that ballot is not counted. [0:53] This is why election officials are worried about people taking selfies [0:56] with their completed ballots: [0:57] because you should not be able to prove how you voted afterwards. [1:00] Otherwise, you can have attacks like “$10 off for blue voters!” [1:04] or “Entry to this party only for yellow voters!” [1:06] or “vote red or you’ll regret it.” [1:09] Votes have to be anonymous. [1:12] The second requirement is absolute, transparent trust. [1:15] The system needs to make sure that your vote is securely and accurately counted, sure. [1:19] But it also needs to be obvious to everyone, no matter their technical knowledge, [1:23] that the system can be trusted. [1:26] So if you’re using paper, you place your ballot in a sealed box [1:30] that doesn’t get unsealed until everyone with a stake in the election [1:34] has someone representing them in the room. [1:36] There should always be people from more than one side guarding it, or at the very least, [1:40] witnessing that there's a tamper-proof seal being used for transport. [1:44] Voters need to be able to trust that their vote will be counted [1:47] even though they’ll never see it again and it can’t be traced back to them. [1:51] And at no point is a single person put in a position of trust. [1:54] People can be corrupt, or threatened, or incompetent, or all three at the same time. [1:59] Now, physical voting is not perfect. [2:02] It can be attacked, it has been attacked. [2:04] The UK’s own paper system doesn’t fulfil both of those requirements perfectly, [2:08] it is possible to identify voters from their ballots if a court orders it, [2:12] and there are stories about that being done outside the law too. [2:15] But the key point is not that paper voting is perfect: it isn’t. [2:20] But attacks against it don’t scale well. [2:23] Physical voting is centuries old. [2:25] And in that time almost every conceivable fraud on the system has been tried, [2:29] and defences have been found. [2:31] The more physical votes you need to change, [2:33] the more people you need to influence, [2:35] the more time and money it takes, [2:37] and the less likely it is that your little conspiracy will stay secret. [2:41] In a UK election, there are hundreds of polling stations across the country, [2:45] with staff made up of scores of employees and thousands of volunteers. [2:49] The job of changing a significant number of votes, [2:51] enough to sway an election, becomes very, very difficult. [2:56] People have attempted it, some people have been convicted, [2:59] a few have probably gotten away with it on some scale. [3:01] “Granny farming” is the term that shady operatives use [3:05] for going round all the retirement homes [3:07] and getting vulnerable elderly people to sign a proxy vote, [3:10] a paper saying that someone else can vote on their behalf. [3:13] And yeah, on a small scale, that has worked. [3:16] But once you start scaling up that attack [3:19] it becomes extremely difficult and time-consuming [3:21] and the chances are you’re going to get found out. [3:24] With electronic voting, that’s not the case. [3:27] So first, let’s talk about electronic voting machines. [3:30] That’s where there’s a computer at the polling station: [3:32] so voters still go into a booth, [3:33] it’s just that they are pushing buttons, or tapping things on a touchscreen, [3:37] not writing on paper. [3:39] Problem number one: trusting the software and the hardware. [3:43] In theory, our voting computer could be running open source software [3:47] where anyone can see and check the source code. [3:50] In practice, that doesn’t happen: [3:52] it’s probably going to be closed source, [3:54] it's probably going to be loaded off an easily-compromised USB stick, [3:57] on a computer that’s been sitting unguarded [3:59] and sometimes just idly and inexplicably connected to the internet for years. [4:05] And those systems only ever get a full-scale test when an election actually takes place. [4:09] That in itself should be enough to stop electronic voting ever being a thing. [4:14] But, okay, let’s say that we do, magically, [4:16] have the most stable, secure, open source software possible. [4:20] How does a voter know and trust that the correct software is actually installed [4:24] on the machine they’re using? [4:26] Maybe we could use some sort of checksum or some other system [4:29] to make sure the voting is running correctly. [4:31] But then you’re just moving the problem, [4:34] now you have to trust that checksum hasn’t been forged. [4:36] And almost no voters actually will understand what that check even means, [4:40] or why they should trust it. [4:42] In the United States, voting machines are regularly tested every year... [4:47] at the Voting Village at DEFCON, one of the world's largest hacker conventions. [4:51] It's not an official thing. [4:53] Hackers there have managed to alter the stored vote tallies, [4:56] change the ballots displayed to voters, and in one case, [4:59] have got a machine to run the video game Doom. [5:02] Imagine if, instead of a machine, there was just a person in the voting booth, [5:06] and you had to whisper your vote to them, and they promised, oh, yes, [5:09] you can absolutely trust them to accurately record your vote [5:13] and pass it on to the people who are doing the count. [5:15] No, you can’t see how or where they’re writing it down, [5:19] you can’t actually call and find out where they are or what they're doing, [5:23] but they absolutely promise. [5:24] That’s basically what’s happening with an electronic voting machine. [5:27] You just have something that says: trust me. [5:29] I’ve counted your vote and I have absolutely not been compromised. [5:33] Honest. [5:35] Problem number two is votes in transit. [5:38] How do you get the votes off that machine to the central counting place? [5:41] There are three possible ways. [5:42] One, you could take all the voting machines to the count. [5:45] You could seal them all up, and transport them physically [5:48] from where the voting took place to where the counting takes place. [5:51] No one does that. [5:53] So, you could download all the results from each machine onto a USB stick and take that. [5:57] One bit of sleight-of-hand and you’ve got a completely different set of results. [6:00] If you’re about to propose some system where the results are checksummed and trusted: [6:04] please explain that to the average voter in a way they can understand and implicitly trust. [6:09] Okay, so, maybe we could transmit the votes electronically over the internet. [6:14] Which is… optimistic. [6:16] Man-in-the-middle attacks are more difficult now, [6:18] but they’re not impossible, [6:19] particularly if you can’t trust the software on either end. [6:22] And now you’re connecting the voting machines directly to the internet. [6:27] Deliberately. [6:29] Which brings us to problem number three: the central counting server. [6:33] Right at the end of the process there is the server [6:36] that tallies the votes and gives the final count. [6:40] Which has all the same problems with trust and verification [6:43] as the individual voting machines, [6:45] but now only a few people can even see that computer. [6:49] That’s also true about electronic counting machines: [6:51] ones that take stacks of paper ballots and return totals. [6:55] How do you trust they aren’t quietly changing some votes? [6:57] We live in a world where Volkswagen got away with [6:59] specifically designing their cars to cheat on emissions tests for years. [7:05] And that’s before we include user error. [7:08] In one Scottish election, trialing electronic voting, [7:11] a result was corrected after one observer noticed it didn’t make sense, [7:15] and stopped the announcement at the last minute. [7:17] Turns out that someone forgot to scroll all the way to the right [7:21] to read the columns on an Excel spreadsheet with the results in. [7:25] And even if you can’t compromise the election, you can still break trust. [7:30] You can still cast doubt on a voting machine, or the entire counting system, [7:34] just by leaving an unknown USB drive in it, taking a picture, and posting it online. [7:38] Or just faking a photo of that. [7:40] To break an electronic election, you don’t actually need to break it: [7:43] you just need to cast enough doubt on the result. [7:46] It is a lot more difficult to do that with paper and physical ballot boxes. [7:50] And all this is before we get to the really terrible idea: [7:53] that people should be able to use their phone or computer to vote from home. [7:58] Now, I’m sure the device that you, personally, are watching this on [8:02] is malware-free and up-to-date. Of course it is. [8:04] But can you trust that for everyone in your family? [8:07] For everyone on your street? [8:09] The exact numbers differ depending on which security firm’s figures you go with, [8:12] but it's safe to say that a huge number of computers [8:15] are infected with some sort of malware. [8:18] Huge numbers of phones are on old, vulnerable versions of their operating systems. [8:21] And that’s just scammers setting up botnets and minor extortions. [8:25] Imagine the sort of attack that could be put together [8:28] by a small, well-funded team backed by a national government. [8:32] That sort of attack would scale very, very well. [8:35] Find the one hole in the system, and suddenly [8:37] it costs roughly the same to change one vote as it does to alter millions: [8:43] and your conspiracy stays very, very small indeed. [8:47] Maybe you don’t even have to set foot in the country whose elections you’re hacking. [8:51] Now, there are a couple of regular objections I get to this. [8:55] First of all: what about Estonia? [8:57] Yes, in 2005 Estonia became the first country in the world [9:01] to offer internet voting, first in local elections, then in national, then in European. [9:06] In 2019, more than 40% of votes were cast online there, which is [9:09] just short of a quarter of a million people. [9:11] On the surface, the system seems robust. [9:15] Voters can ID via their government-provided smart card, [9:18] or the SIM card in their phone. [9:20] But there are problems. [9:21] An independent report found gaps in the procedural and operational security. [9:25] The architecture of the system is a decade old and it’s now dangerously out-of-date, [9:29] and it's open to cyberattacks by foreign powers [9:33] either by exploiting individual phones [9:35] or by breaking the trust in the server that counts the votes. [9:39] The other common objection is: what about new technologies? [9:43] What about blockchain? [9:46] Look, leaving aside trying to explain blockchain to people [9:49] and asking them to trust this weird technology is worth using, [9:54] it’s basically just a write-only database. [9:56] It doesn’t solve the problem of trusting the software or hardware: [9:58] it doesn’t change how the voting machine works, [10:00] the interface between the voter’s intention [10:02] and what’s actually written to the database still has to work. [10:05] If it prints a receipt of the vote you can check later, it breaks anonymity. [10:09] If it prints a receipt of seemingly-random numbers you can check later, it breaks trust, [10:14] because hardly anyone will understand what’s actually going on there. [10:17] I’m not saying there aren’t advantages to electronic voting. Yeah, there are. [10:21] Accessibility is the main one, and that’s really important. [10:24] In low-stakes elections, for small groups, for the little things, sure, go for it. [10:29] But when the future of nations rests on the result: [10:32] electronic voting is still a bad idea, [10:36] and you should still vote against it. [10:38] While you can. [10:40] I’m endorsing Dashlane for two reasons: one, they’ve given me money. [10:44] Obviously. [10:45] But two, because I genuinely believe that if you’re techie enough to watch to the [10:49] end of this video, [10:50] you should absolutely be using a password manager. [10:53] If you go to dashlane.com/tomscott, you can get a free 30-day trial of Dashlane Premium. [10:58] Password storage, generation and autofill that works [11:00] across devices, browsers, operating systems, everything, [11:03] it syncs all your data in the cloud without sending any of those actual passwords to Dashlane themselves. [11:09] If you want to know how that works, see previous sponsored sections. [11:13] Using long, complicated, symbol-filled passwords [11:15] that are completely different for every web site and every app [11:18] is ideal for security: [11:20] but remembering them is nigh-on impossible and typing them in is a pain. [11:24] Being able to use a single master password, [11:25] or the biometrics on your phone, is great: [11:28] you’ve got one thing to remember. [11:30] Dashlane will also store and autofill credit card information, [11:32] so you don’t have to retype it every time you buy something online. [11:35] You also get a VPN and a gigabyte of secure storage. [11:39] So: dashlane.com/tomscott for a 30-day free trial of Dashlane Premium, [11:44] which includes unlimited password storage and sync. [11:46] And if you like it, you can use the code “tomscott” for 10% off.