People are voting these days. In Moldova, a small country of about 3 million between Romania and Ukraine, the next election is unusually important—both for domestic politics and for its tug-of-war between Russia and the European Union. Closer to home (for me), Switzerland is also voting. That happens a lot here: nationwide and cantonal ballots come several times a year: it’s “direct democracy”, an important aspect of Swiss identity. We have executive cabinets, we have parliaments but it’s relatively easy to put issues to a popular vote.

So Swiss citizens often go to say "yes" or "no" to many proposals, but this time the popular vote is particularly relevant: the results will have important economic implications—for public finances and for household budgets. Voters are weighing changes to how homes are taxed and, at local (cantonal) level, how the mandatory health-insurance system is financed. Of course the impact of a law is not limited to its economic effect, but the results of the Sunday ballots will shift real money around.

But it's not really Sunday. That's because many people vote early from home using postal ballots that arrive weeks in advance. On Sunday all the closed and anonymous envelopes will be opened and the ballot papers will be counted, with those from the minority that still prefer to cast their vote in person.

So Sunday is officially voting day, but everything actually happens earlier: you can read the official booklet at your kitchen table, mark your yes/no, and drop it in the mail. Quite convenient. And lately there’s been talk of making it even more convenient by letting people vote from their phones.

The temptation of e-voting

From a certain point of view the idea is not absurd: if we already bank, manage health data and sensitive information from a smartphone, why not cast a ballot too? The promise of secure, simple, cost-effective e-voting systems doesn't sound like wishful thinking, if we trust our smartphone for our checking account.

We must consider that security is where the trade-offs bite. My online banking doesn't need to be perfect, but robust enough to resist hackers motivated by my economic resources. I resist the temptation to joke that a ‘12345’ password would be sufficient for my bank account (the kind of thing an idiot would have on his luggage, according to Space Balls), but the main point remains: Influencing the outcome of a vote can be far more profitable than just logging into an online bank account. More importantly, user’s carelessness—which is the weakest point of all security measures—compromises only the money of the careless users but for voting procedures it can have an impact on collective decisions.

That’s why it’s considered acceptable to digitalize some processes (registration, delivery of blank ballots, counting of paper ballots) but not the returning of marked ballots: a U.S. National Academies’ report says that no current tech can guarantee secrecy, security and verifiability for Internet ballot return—the report is from 2018, but I don’t think the situation has significantly changed.

But let’s assume the best case: suppose we had solved all the technical difficulties, we had unbreakable cryptography and had made the servers airtight. Would that end our worries? Not entirely. Complex systems create perceived opacity that disinformation can exploit. A paper ballot has an “epistemic advantage,” as Casati and Tonello put it: anyone can grasp how a paper ballot preserves universality (any eligible person can vote), secrecy (no one knows how you voted) and integrity (each ballot really counts). It’s so clear and plain that I feel stupid to try to describe the process—explaining how an e-voting system functions, on the contrary, requires some time and requires some expertise.