Section 10: Seven Ways to Break an Election - Interviewer Deep-Dive Challenges

Executive Summary: With the tally and the bulletin board in place, the interviewer stops asking how the design works and starts trying to break it. Seven challenges: a watching roommate, a curious admin, a flood at 08:55, a ballot at 08:59:59.8, a race with 4 voters, live turnout and accessibility. Most are answered by a decision already on the board. Two can't be fully closed in software, and saying so plainly is the strongest answer in the room.

The map first, so every answer has a place to land:

Challenge 1: "Their Roommate Watches Them Vote"

"Alex's roommate stands behind them while they vote. Or someone pays students for screenshots."

What they're really asking: Do you know which threats remote voting cannot stop, and will you say so?

The model answer: The server can't see the room Alex is in. What the design does is refuse to help the buyer: tracking code K7Q-2MF-9XD proves a ballot was recorded, never what it says (Section 9 owns the receipt argument). A buyer who watches in person, though, needs no proof at all.

The standard mitigation is revoting: count only Alex's last ballot, so a coerced one can be quietly replaced. We rejected it because replacing Alex's earlier ballot needs a link from Alex to it, and the split stores exist so that nothing holds one. Keeping that link hidden needs a cryptographic scheme, and a coercer can still sit with Alex at the deadline.

Interviewer: "So you just accept it?"

You: "For a student council, yes, with two policies: the rules forbid selling votes, and the committee runs an in-person station for anyone who wants privacy. If coercion of remote voters becomes a real concern, revoting is the flip, and the crypto comes with it."

The senior line: "Remote voting can make a bought vote unprovable. It cannot make a watched vote secret, and that belongs in the design review, not a footnote."