Even Simpler Solution

Jason,

What you're missing is that a person who does not understand computers -- and that means the majority of the population -- has no hope of being able to check out fully the system you propose.

Laurent is correct; universal comprehensibility is vitally important. What you can't understand, you can't trust.

Even if the full schematic diagrams, firmware listings and mechanical blueprints for the voting machines are published -- and democracy demands no less -- most of the population will still be unable to understand them, let alone trust them.

For the sake of saving a few hours every few years (as Regadpellagru points out), it's just not worth it.

Simple solution? Non

The PC sounds ideal, cheap, commoditised hardware and OS. The problem is that despite the rather dubious reputation of a certain manufacturer of these dodgy pieces of bespoke hardware in a certain rather large 'democracy' the systems are at least 'certified' to a standard. Most of the cost isn't the hardware, after all it isn't exactly a VLSI 200m transistor processor at the centre - the security OS 'should' be sitting on a relatively simple, relatively cheap to fab chip.

The cost is in the certification of the hardware and software, and with the best will in the world none of the major OSes qualify, let alone the buffer overflow ridden hardware of cheap PCs, and removing the connectivity doesn't work - you still need to certify the USB drives, and then ensure no tampering with something specifically designed to be slipped into a pocket easily and conveniently. Not to mention the potential leaks or corruption from em radiation - deliberate or otherwise.

You might be able to make a case for something like qnx, or possibly secure BSD, but something mainstream - no hope. Can you really imagine security auditing windows source code, or even linux, with it's open source advantage. Let's face it even MS don't deliberately make their OS uselessly open to hackers, and they have the best view and huge resources to ensure it doesn't happen. But it does. Often for no good reason than 'because it's there'

I guess someone could build a truly secure linux by taking out huge gobs of unnecessary functionality - the open source nature would make the bug hunting fun. But it would take a while, and the closed source additions would still require auditing. All possible, BUT what do you reckon the end price would be. I'm guessing around 6k Euro.

Simple solution?

How about using standalone (with the ethernet port ripped off) windows/linux/unix machine, locked in a safe, and a simple HTML form linked to a database taking the votes? Multiple choice, you can only choose option, so no one can mess it up. Then when the votes are in, you get a brand new formatted pen drive, take the database to another standalone windows/linux/unix machine, merge the databases, and voila!

Or am I really missing something here?