They think they are above the law: the firms who own America's voting system

It's possible to talk about the politics of this on HN, but if we apply one level of generalization ("people in power for whom free and fair elections do not serve their interest"), we can have a less inflamed discussion.

My rejoinder to the grandparent is, "some states are better than others". This is well known, and the correlation with party is well known as well.

This key can be used with a personal computer, or public voting computer, each using the same open-source, audited software, to produce a printed ballot with a 2D barcode on it, and a printed voting token with a 2D barcode on it.

The ballot printout can be scanned and verified independently, before casting it, that all the choices are correct. Again, all using the same open-source, audited software as the public vote-recording computers. This printout contains a hash of the voting token. This is so a party can't just print out a bunch of pre-filled ballots, and then hand them out for voters to cast, and also useful for recounts and audits.

A separate printout encodes the voting token. It cryptographically verifies that a registered voter is voting now. The voter registration system associates a different hash of the voting token, a voter hash, with the voter. The voting system can associate the ballot hash of the voting token with the voting choices. If you have a voting token, you can compute the voter hash, look up the registered voter on the voter site, compute the ballot hash, and look up what their votes were on the vote-counting site. You can't tell whether that particular ballot is the one that counts for that voter.

Because up until the end of the election, the voter can also request a new token, which invalidates their previous ballot, and cast a new one. That token will also be associated with their votes and their name, but the official election system knows to count that one, and not another one. Or they can request a "provisional", "test", or "decoy" token, which can be used to cast a ballot that will never be counted.

Anyone that attempts to coerce a voter into voting a particular way, or who tries to pay for votes, can be given a genuine token that is later cancelled, or a dummy token that was never valid to begin with. They have no means of validating if the token represents a vote that counts until after the election is over. At that time, an audit or recount might show that it was a decoy vote. You can't work backwards from a ballot to see who cast it. You can't work backwards from a public voter registration to see how they voted in any election. You can only start from the set of tokens, verify that one belongs to a registered voter, verify that it was used to cast a ballot, and if you also have privileged access to the voter registration system, determine whether or not that token is the single authoritative voting token for that voter in the current election.

In a recount or audit, the voter registration authority consults its database, finds all the tokens valid for a given election, computes the ballot hashes for each, and prints out all the ballot hashes, including machine-readable barcodes. A sorting machine could be loaded with the list, and automatically spit out a pile of ballots to be counted, and a pile of ballots that don't count. Or a human could sort them by hand, by consulting the list of valid ballot hashes, and crossing out the one printed on the ballot they are looking at. Any ballot not on the list, or already crossed off of it, goes in the "don't count" pile. Then, once again, by machine or by human, the ballots in the "valid" pile can be independently counted for the office or issue in question, and compared against the original automated count.

The secret part of this voting system is the secret kept between the voter and the government with respect to "does this specific ballot count or not?".

1) Coercion is literally the biggest concern within elections. You put a big guy with a pair of brass knuckles outside of the polling location and he beats up everyone who comes out without a picture of his ballot with the right vote in place.

Theoretical? Lol. This WAS and IS common. This is why we have international election observers.

2) There's no integrity loss with paper if things are done right. Every ballot given out at a voting booth is recorded - you can't stuff the box as a voter. The only way you can do so is if election officials from all parties collude to fudge the books together, which they would need to do in view of the public as they man the voting desks, or under the supervision of the locale manager during the end-of-night count.

Our system here in Oregon works pretty well: you vote by mail with paper ballots and there's automatic voter registration.