The traditional hand-based process isn't much cheaper, which is one of the reasons they're
changing. It's basically not auditable; any sort of recount is very expensive. And do you have
any idea what type of insane, biased software is running on some of the vote counters in the
traditional hand-based process?

Standard off-the-shelf processors and compilers are generally trustworthy. If they give you
the code, you can compile it yourself. Alternately, high-reliability software, like for
airplanes and military applications, will compile without complex optimizations just so they
can audit the assembly and the source code simultaneously. 

I just wanted to post similar comment.

But I don't think it's impossible. You 'simply' need to audit machine code of one version of
gcc (statically linked) and one version of kernel.

Then you publish this gcc and kernel along with source and then anyone can verify object code
by recompiling it with published certified gcc launched on certified kernel.

Via source code review and usage of certified tools you can then certify other versions of gcc
and kernel more easily.

Something like this should work I think.

The main need for a machine is to have a way that spoiled ballots (i.e., ballots that cannot
be unambiguously read) can be rejected (and recast) without any human other than the voter
seeing them (or the result on them) before they can no longer be connected to a particular
voter. The second need for a machine is to allow people with disabilities to vote, again
without revealing the vote to another human.

There's plenty of history of votes which have been miscast or discarded on account of voters
accidentally submitting ballots which the election officials could not interpret successfully.

Of course, the right device is a machine which optically scans hand-marked ballots and
collects them (if they're unambiguous) in a box for later recount (if necessary). This could
be coupled with a device that uses an audio interface and a button to decide what to print on
a ballot for blind people as well as the ability to read the ballot through the headphones
(optically scanning it) so the voter can confirm their vote independently of what they did
with the interface, before casting it. Of course, this needs very little source, open or
otherwise, and it can all be verified experimentally to behave correctly.

The only election issue that I can see machinery helping with is the cost of the election. But
it seems very surprising then that richer countries rather than poorer ones are obsessed with
using machinery for this purpose. In the UK we have not yet (in my view fortunately) succumbed
to the temptation to use machinery to count votes. As a software engineer and frequent
participant (candidate and agent) in my local elections there is no way I could trust anything
as complex as a computer to do this job. My city may have plenty of software engineers capable
of verifying the machinery as well as is possible, but why should everyone else trust a small
group of specialists to do this job, when we can and do use a much simpler system that
everyone can see work in front of them ? 

Spoiled paper ballots really are not an issue. We might get one or 2 votes in several thousand
that are genuinely ambiguous - where the common sense of the returning officer takes on the
slightest possibility of being in any way arbitrary. I have seen several hundred deliberately
and some marginally spoiled ballots, without once seeing a case where I have felt the
returning officer made the wrong call. In the very rare occasions where the majority is less
than 2 or 3 (in local elections majorities of hundreds or thousands are more common and in
parliamentary elections majorities are usually 10,000 or more) the recount would subject
spoiled ballots to much closer scrutiny.

The only way I can see computers assisting with the process would be for the computer to print
a paper ballot which is checked by the voter (and which has a "none of these" deliberate spoil
option) and put into an ordinary ballot box, which can be sampled in the event of a large
machine counted majority to verify it, and with all the paper ballots counted manually and
treated as canonical in the event of a very small majority or statistically large enough
sampling discrepancies.

If our American friends can't afford to have a few hundred people in a city of a million stay
up for a few hours once a year to count a few thousand paper ballots each, this doesn't speak
as highly of your commitment to a democratic process as many of your other actions do.

And here I was thinking, "finally, a good use for platform lock-down!"

Technological protection measures should only be used where something legitimately needs to be
protected, and then they should work.  The security of a voting system in operation is
certainly a legitimate example of a place where hard verification and few keys should be used.