A handwritten tally is suddenly looking rather sophisticated.
Daniel voted today and came back thinking about what he could not see. The body cameras and the restrictions around the polling station were obvious. The machinery that keeps one dishonest person from changing the result was not. He wants the surprising safeguards democracies build, especially the ones with an attempted cheat somewhere in their ancestry.
The really satisfying detail is two people counting the same slips separately. Not taking turns. Not having one person count while another nods. Separate records, kept by people whose parties would very much like different results.
A useful application of people not getting along.
Potentially the most productive relationship in the room. I'm Herman Poppleberry, and the little committee behind that table is doing considerably more than checking identification.
The camera can record something going wrong. I am more interested in the arrangements that make going wrong require cooperation from your opponent.
That distinction matters all the way from the voter register to the final published result. The person handling a ballot, the person recording a total, and the person checking the paperwork do not simply become the same trusted individual wearing progressively more important badges.
Promotion by lanyard. A dangerous constitutional model.
Israel has twelve thousand and eighteen polling stations for this operation. At that scale, honest administration cannot mean knowing everybody personally. It has to mean making each person's work checkable by somebody else.
Although we should narrow that slightly. “Nobody can change anything alone” sounds stronger than reality. Somebody can make a false entry alone. Somebody can hide a slip. The protection is that their action leaves a disagreement somewhere else.
Yes... detection and correction, as well as prevention. A separate tally, a signed protocol, an envelope total that fails to match the register. You want several independent opportunities for a small dishonest act to become conspicuous.
The apparent inconvenience is doing a job.
Often. Not every inconvenience earns that defence. Israel's restrictions on overseas voting, for instance, also impose a substantial access cost. Roughly eight hundred and ten thousand eligible Israelis live abroad, and ordinary citizens abroad generally have to travel back. There are limited arrangements for diplomats and other eligible state representatives, among other exceptions.
A plane ticket is a fairly aggressive authentication factor.
It reduces some remote-voting problems, but exclusion and integrity are separate considerations. You can acknowledge that without pretending an internet ballot would be an easy substitute.
Likewise the campaigning boundary. Five to ten metres, depending on the premises, is about what happens around the voter. It cannot establish that the total written down that night is correct.
Nor can a body camera alone. A recording needs somebody to preserve it, review it, and relate what it shows to a disputed action. Otherwise you have a very well-documented mystery.
You're about to defend a committee, Herman. I can hear the bureaucratic Hebrew assembling.
I am defending a particular committee. You defend any object that can be repaired with string.
String has never asked me to trust its firmware.
Fair distinction. Would you accept the count if the committee were entirely professional civil servants, with no party representatives?
I would accept their competence more readily than their exclusivity. Professionals should administer it. Opponents should be able to watch. I don't want to replace expertise with rivalry, but I would rather not have to choose.
That is the arrangement worth examining. A secretary appointed by the Central Elections Committee sits alongside members drawn from different parties. Rival lists can have observers. The official procedure supplies the common rules; political competition supplies people motivated to notice departures from them.
There is a trap there, though. If everybody shares one sheet, everybody can watch the same mistake happen.
Separate tallies address that. Once voting finishes, the ballots are counted manually at the polling station. Each slip is shown to those present and read aloud. At least two committee members from different parties maintain independent counts.
Those counts have to be independent. “I've got the same as him” is not another measurement.
Correct. Independence means each person produces a record that can disagree. Then they reconcile. The number marked as having voted is checked against the number of envelopes, and the account distinguishes valid votes, invalid votes, and discrepancies.
Imagine a hundred people marked off, but a hundred and one envelopes. The extra envelope doesn't come with a label saying which candidate benefited. You need a procedure that preserves the problem rather than somebody quietly making the arithmetic nice.
Every anomaly goes into the protocol. That written record gives later reviewers something more useful than recollections from tired people. It also prevents an awkward incident from vanishing into an informal agreement at the table.
“We sorted it out” is a terrible audit trail.
Especially when everyone remembers a different sorting. The protocol records the official account, signatures attach responsibility, and the physical ballots remain available. Think how differently those pieces behave. A mistaken total can be checked against ballots. A disputed procedure can be checked against the record and other evidence. No single artefact answers every question.
My instinct is to preserve everything and publish everything. Then I remember a ballot has to be private. You cannot make a beautiful forensic record of how each named person voted.
The double-envelope process is precisely that tension. Soldiers, hospital patients, prisoners, diplomats, and other eligible voters outside the ordinary arrangement use an identifying outer envelope and a secret inner envelope.
Before the ballot envelopes are opened for counting... let me put that more carefully. Before the anonymous vote is admitted into the count, officials check the identifying material for eligibility and whether that person also voted at their regular station or through another outer envelope.
Identity gets checked before identity gets detached.
Then the inner envelopes are separated from the personal details and shuffled to preserve secrecy. Suspicious cases are examined individually. The whole double-envelope operation runs inside the Knesset building.
That is the surprising safeguard for me. You delay the anonymous count because you first need a named check. Do it in the wrong order and you either lose the ability to detect duplicate participation or retain a connection you ought to destroy.
Would you rather count those ballots locally and send the eligibility information afterwards?
No. If a duplicate is discovered after the ballot has joined the pile, you cannot identify which vote to remove without breaking secrecy. You have created a problem that counting more carefully cannot solve.
Precisely the ordering constraint. Eligibility first, separation second, counting afterwards. This is why a slower category of ballots need not mean somebody is improvising. The extra administrative work happens before counting can safely begin.
Television would prefer the order reversed.
Television would prefer a certified government before the polling stations close. Meanwhile the ordinary station's result is written in its protocol, signed, documented on video, and physically taken to a regional committee. A regional judge checks the reconciliation of voters and votes.
The result has to survive a journey as well as a count.
Ballot materials are sealed, transported by two officials, and handed over against a signed receipt. The retained physical material allows subsequent examination.
And the seal on that ballot box is checked by two officials from different parties, because in this system the box is treated like an air conditioner.
Gloria: Clarification, fourth today. When a host said the ballot box was quote treated like an air conditioner quote, a viewer in Haifa filed complaint four four seven one, citing appliance defamation policy nine two. Please say the seal was checked, not that the box was serviced.
My apologies to the appliances of Haifa.
A signed receipt establishes who handed what to whom. The two-person transport rule reduces the opportunity for an unobserved intervention. The seal gives the receiving officials something physical to inspect. None of those substitutes for the others.
A seal by itself can tell you the package appears unchanged since sealing. It cannot tell you the original contents were honest. People give tamper evidence an enormous amount of unpaid work.
You need the observed count before it and the documented receipt after it. The result does not travel from the station over the internet. After regional checks, data enters central systems that are air-gapped, separate from the public results feed.
An important distinction. The website being online does not mean the counting system is online. Equally, “air-gapped” does not mean there are no humans typing numbers into computers.
Humans still enter data. Humans can mistype it. Which is why the Central Elections Committee publishes images of the handwritten protocols alongside the electronic results. A member of the public can compare the source record with the displayed number.
The handwriting has a higher security clearance than the dashboard.
It provides an external check on the transcription. A compromised public website could display nonsense without changing the retained paper, and a transcription error could be found without accusing the whole station of fraud.
This is where I think transparency can be oversold. Publishing a scan makes verification possible. It doesn't mean anybody has actually compared it. Nor does it tell a confused reader whether an apparent discrepancy already has a documented explanation.
That is a communication problem as well as an audit problem. A good publication system needs the original, the correction if there is one, and an intelligible account of what changed. Silently replacing a number invites precisely the suspicion you are trying to dispel.
You would put an explanatory leaflet on a correction to an explanatory leaflet.
If the correction affected a seat, Corn, you would read both.
I would annotate them.
I know. After election day, teams including hundreds of legal professionals review protocols and complaints before certification. Material can be re-examined and counts repeated where needed. Suspected offences go to the authorities.
That is different from the American statistical audit approach, where you sample ballots under a formal rule that expands the examination if the evidence is insufficient. We shouldn't call every recount a risk-limiting audit just because somebody is limiting risk.
Israel's process here is protocol review and discretionary recounting. Other democracies combine hand-marked paper with optical scanners and statistical audits. The shared objective is an independently examinable record, not a universal ban on using electricity.
An encouraging development for your microphone.
The physical scale is still extraordinary. Eighteen thousand ballot boxes and roughly a hundred thousand personnel. Staffing, training, transport, and secure handling are part of the protection, not background decoration.
Cheap integrity is usually somebody else's unpaid vigilance.
The budget is about six hundred and ninety million shekels. Roughly four hundred and fifty million ballot slips were printed, consuming around two hundred and fifty tonnes of paper.
Democracy has ordered a forest with spare candidates.
Separate party slips create that stock requirement. What matters is that unused stock does not become unaccounted-for voting material. Paper's advantages depend on control over its issue, handling, counting, and retention.
You predicted I would defend the old option. I will, but only if it comes with the boring procedures. A cardboard box is not inherently virtuous.
The Netherlands reached much the same practical conclusion after electronic voting machines attracted sustained scrutiny. The campaign called We Don't Trust Voting Computers demonstrated weaknesses in Nedap machines beginning in two thousand six. The country abandoned electronic voting.
An unusually accurate campaign name. No ambiguity about the requested outcome.
Then, ahead of the two thousand seventeen election, concern about Russian hacking pushed the government back towards manual counting and away from electronic vote-counting arrangements. The important move was reducing dependence on software for establishing the result.
We should separate that from an incident where somebody demonstrably changed an election. A demonstrated weakness can justify a safeguard before an attacker wins with it.
Yes. Daniel's interest in cheating leads to several kinds of origin story. Actual misconduct, a credible demonstration, a lawsuit revealing an unacceptable design, and a threat judged serious enough to remove an exposure.
History is untidier than a list of “this scandal invented this rule.”
Israel's double envelopes are a case in point. I cannot tie their introduction to a particular fraud. We can explain the problem they address without inventing the parliamentary moment when somebody supposedly solved it.
A useful refusal. Otherwise every administrative procedure gets a villain and a birthday.
Germany supplies a clearer litigation example. Two voters challenged the use of Nedap machines in the two thousand five Bundestag election. Almost two million people had voted on machines that produced no voter-verifiable paper receipt.
The voter could operate the machine, but could not independently inspect the evidence of its arithmetic.
The Constitutional Court heard the case in two thousand eight. Constanze Kurz of the Chaos Computer Club was among the technical critics. The broader constitutional issue was public scrutiny of the essential steps without requiring specialist computer knowledge.
I like that standard more than “an expert assures us it works.” Expertise remains necessary, but citizens shouldn't need to reverse-engineer software to understand why the declared candidate won.
How far would you push it? Most citizens cannot personally inspect every ballot either.
I don't require everyone to do everything. I require a route by which competing observers can check meaningful evidence, and other people can understand what they checked. Reading a tally and matching it to a signed sheet is accessible in a way that inspecting proprietary firmware isn't.
That also explains why paper can coexist with scanners. The machine can provide speed while the paper supplies an independently inspectable basis for checking it. Remove that basis and you concentrate authority in the machine and whoever certifies it.
Your elegant mechanism has acquired a clipboard.
It was always going to.
Israel's Fureidis incident in two thousand nineteen shows a more elementary attempt to dismantle observation. A Likud representative allegedly posed as an elections committee representative and asked rival party representatives to leave for a briefing. He was then found behind the screen near the ballot box with more than a hundred stamped envelopes, some containing Likud slips.
The proposed vulnerability was a meeting.
More precisely, an apparent instruction from authority that would remove the people meant to watch. That is why knowing who is authorised to issue instructions matters as much as having observers nominally assigned.
A room full of rivals protects nothing if one impressive badge can send them all into the corridor. You need people who feel entitled to refuse a suspicious request.
The allegation also exposes the need to control envelopes, not merely candidate slips. A perfectly genuine slip placed in an improperly introduced envelope is still a problem.
Authentic ingredients, fraudulent dinner.
Go further back and the record checks become revealing. For the nineteen eighty-eight election, the State Comptroller identified four hundred and thirty-five people marked as having voted among fifty-four thousand eligible voters flagged as being abroad.
That establishes a suspicious mismatch, not automatically four hundred and thirty-five proven impersonations. Border records, registers, and clerical entries can each need investigation. The achievement is making the mismatch visible.
The report described a well-founded suspicion of unlawful identity use. We cannot honestly attach a particular later safeguard to it without that historical link. It does illustrate why cross-checks across administrative records matter.
The polling station sees the person standing in front of it. A later comparison can ask whether the paperwork describes somebody who could have been there.
India's indelible ink makes the participation check visible on the voter instead. Developed by the National Physical Laboratory and first used in the nineteen sixty-two general election, it helps prevent someone presenting themselves to vote again.
An audit trail you have to take home.
It is now exported to more than thirty countries. It addresses repeat participation rather than proving which candidate received a vote. Like the double envelope, its purpose belongs to a specific stage.
That matters because people ask whether a safeguard “stops fraud” as though fraud were one action. Ink doesn't stop a dishonest total. A reconciled total doesn't stop a bribe. A secret ballot doesn't clean up campaign finance.
Israel has examples outside the box. Samuel Flatto-Sharon was convicted of election bribery in nineteen eighty-one over a campaign involving promises of low-rent housing. The fictitious-invoices affair around the nineteen eighty-eight election concerned routing campaign money outside party-financing rules.
You can count every purchased vote correctly.
Which makes a technically accurate count necessary but insufficient. Contemporary disputes over voter data expose another boundary. Party representatives receive access to administrative information because they are performing an election-day public function. Can they repurpose that access for campaigning?
I would distinguish a party activist asking supporters whether they've voted from an official copying the attendance register into the party's database. The information may look similar at headquarters. The authority that produced it is entirely different.
In September the High Court unanimously overturned permission for identified reporting from polling stations. On October twenty-second, a divided court also barred representatives and observers from digitally counting voters and transmitting totals to party headquarters in real time.
Attendance has become campaign infrastructure.
Systems such as Elector let campaigns compare participation information with their own lists and pursue supporters who have not voted. That reveals whether somebody voted, not how. Even so, official access creates a substantial advantage and a privacy issue.
Wait... aggregate turnout also sounds harmless until you ask who collected it, from which privileged position, and for whose exclusive use. The committee publishing turnout to everybody is different from a committee member feeding one campaign.
Today the chairman also temporarily barred United Torah Judaism and its representatives from reporting turnout figures, whether continuously or periodically. An order has to be enforced while the information is still useful. Resolving that dispute after polls close cannot restore the original conditions.
This is not the internet entering the ballot count. It is the internet connecting the official's chair to the campaign office. Different boundary, different safeguard.
The allegations concerning Likud's Victory twenty-six app went further, including a claimed secret monitoring capability. Those remain allegations, not an established description of what the app did. The underlying legal question about administrative access stands without assuming every accusation is proved.
I am less worried by a campaign knowing turnout is low than by a voter believing the official checking their identification is reporting them to a party. That perception could change behaviour even when the ballot itself remains secret.
The Israel Democracy Institute's warning about the policing environment belongs here. Private firearm licences rose from roughly a hundred and fifty-five thousand in two thousand twenty-two to three hundred and fifty-one thousand by March. That number alone does not establish intimidation.
The specific concern is armed presence near voters, who authorised it, and what happens when somebody decides they personally represent election integrity.
Likud and Religious Zionism announced around two thousand activists for polling stations in Arab towns. Adalah petitioned against armed polling officials. Supporters describe fraud prevention; critics warn of intimidation and potentially violent encounters. The assigned committee and police have defined legal roles. Self-appointed enforcement creates uncertainty about who is in charge.
Being pro-Likud would not make an unauthorised instruction valid. Being anti-Likud would not make a documented discrepancy disappear. The procedure has to survive the political identity of the person invoking it.
Deepfakes put pressure on another outer boundary. A fabricated announcement about a station closing can interfere with participation without getting anywhere near an envelope. Paper protects the count against some digital attacks. It cannot personally escort a voter past a convincing lie.
Nor does a viral video carry its own chain of custody. A clip can show a genuine event with the wrong location, the wrong time, or the explanation cut off. A specific complaint is something officials can examine. A mood is much harder to audit.
Dean Livne, the acting elections director-general, used a remarkably sweeping line: “Anyone who believes these elections can be rigged can also believe in flat Earth and that birds are CIA drones.”
The birds have declined to publish their protocols.
I would make the reassurance narrower. The system has strong protections against covertly changing totals at scale. Individual offences and mistakes remain possible. The post-election review exists because “impossible” would be the wrong operating assumption.
A correction should be visible without turning every correction into evidence that nothing can be trusted.
“Anomaly” is too grand a word, Corn. I use a protocol for my household votes every Thursday. Herman gave the separate tallies their full explanation earlier, so I am keeping mine separate now. I have twelve entries. Eleven. Abstentions written in pencil do not count as entries. The vote is on whether the hallway light stays on overnight. It always passes. I live alone, but I allow the upstairs landing a postal ballot.
The landing has a direct interest.
It does. I will not let it observe the count. My cousin works in election supplies and says the record needs ordinary details as well as disputes. Time sealed. Names of carriers. He says a blank line is an invitation to an argument. He is not to be trusted. He signs birthday cards on behalf of people who have not approved the wording. I write everything down anyway. The exact entry this week is, light switched on, nine seventeen, no objection received from landing. Your point about separating identity from the vote has changed my view of its envelope.
You can preserve the envelope as correspondence without treating its return address as part of the vote.
I do. A man I met travelling through Brno had the same surname as the landing's previous tenant. I keep thinking of him because his signature would solve the carrier problem. He had exceptionally clear handwriting. The little ballot box is gone. I returned it because the slot admitted toast. The record stays in the locked cabinet. My cousin calls at three in the morning about a broken seal, then admits he means the emergency biscuits. Half the packet is already gone when he tells me.
Your cousin has mistaken access to supplies for permission to consume them. Put the biscuits on the inventory, not the ballot.
Only the unopened packet. Crumbs are not stock.
Access to the register is a similarly specific permission. People need it to carry out one assigned function. The technology makes using it for another purpose effortless, which is precisely why the boundary needs to be explicit.
I would also distinguish the official record from whatever story travels fastest. The handwritten protocol is not automatically the easiest thing to find when a rumour breaks. Somebody has to connect the complaint to the relevant station and document.
A convincing public explanation can be very small. Here is the claimed discrepancy. Here is the original sheet. Here is the recount or corrected transcription. Here is what changed. That offers more than a general assurance from an important person.
The idea that stays with me is the separate tally. A system can make disagreement useful before it becomes an accusation. The rival party member is allowed to produce a conflicting number, and the procedure tells the room what to do next.
Paper, signatures, and custody records preserve the evidence needed to settle that disagreement. Their value is in how they work together, not in looking old-fashioned.
The open question is whether those slow, specific records can reach citizens before a fast allegation hardens into certainty. A time written beside an ordinary action may end up doing more public work than the dramatic footage.
Thanks to Hilbert Flumingtop for producing the show.
For more along these lines, there's episode twenty-six thirteen, What Makes an Election Actually Free and Fair; episode twenty-six fourteen, Who Gets to Vote from Abroad; and episode sixteen, On Deepfakes, SynthID, And AI Watermarking. This has been My Weird Prompts, the human-AI collaboration podcast.
If you enjoy these deep dives, leave us a review wherever you listen. It helps other people find the show.
See you tomorrow.
