Internet Voting Technology and policy issues

1
Internet VotingTechnology and policy issues

• David WagnerUC Berkeley

2
Introductions

• Im a computer security researcher
• We study attacks and countermeasures
• Before one can design a system that will resist
  attack, one must anticipate how it might be
  attacked

3
No Secrets

• Proactive study of attacks is generally a good
  thing
• Mounting such attacks is not, of course
• Dont use your super powers for evil

4
Selective History of Voting (US)

• early 1800s public oral voting at County Hall
• 1800s free-form, non-secret paper ballots
  popular
• 1884 widespread vote fraud
• 1888 adoption of Australian secret ballot
• 1930s lever machines widely adopted
• 1960s punchcard voting developed
• 2000 butterfly ballots, chad, Florida, gack!
• 2002 HAVA

5
Attacks on the Secret Ballot

• Registration fraud
• Register in multiple jurisdictions
• Graveyard voting
• Cleanse the voter list
• Districting re-districting
• Voter fraud
• Vote multiple times (ballot box stuffing)
• Multiple voting
• Impersonation

• Insider fraud
• Throw ballot boxes into the bay
• Stuff ballot box after polls close
• Sleight of hand
• Voter intimidation
• Run out of ballots
• Tallying attacks
• Malicious talliers might calculate wrong results
• Give talliers bogus tools

6
Attacks on the Secret Ballot

• Registration fraud
• Identity fraud
• Voter fraud
• Impersonation
• Vote multiple times
• Vote buying, chain voting

• Insider fraud
• Ballot box stuffing
• Ballot marking
• Tallying attacks
• Inaccurate counts
• Ballot marking
• Manipulation of challenge procedure

7
How Secure is the Secret Ballot?

• Its easy to forge a few fraudulent votes
• But Its very hard to forge a lot of fraudulent
  votes
• Summary Australian secret ballot is quite
  robust a well-designed security system.

8
History of Internet Voting

• 2000 36,000 Arizona citizens vote in Democratic
  primary over the Internet 85 military personnel
  vote in November elections over the Internet
• 2000 California studies Internet voting task
  force recommends against it
• 2000 NSF panel warns of security risks in
  Internet voting
• 2004 SERVE will accept votes over the Internet

9
The SERVE Project

• A DoD project for overseas voters
• Register vote from abroad
• Vote over the Internet, using your Windows
  computer

10
Who is eligible for SERVE? Overseas military
voters from participating jurisdictions (7
states, 51 counties)
11
The SERVE Architecture (1)

Citizen

HTTPS
Ballot Def. Data
Web Server
Overseas voters
SERVEUSA.gov
Encrypted Voted Ballots
Internet
HTTPS, SFTP
UVS Control Data

• LEO Processes
• Voter Registration
• Ballot Definition
• Ballot Decryption
• Ballot Tabulation
• Voter History

UVS Control Data Ballot Definitions Voted
Ballots (Encrypted)
Firewall Identification Authentication
Process
UVS Laptop
Election officials
SERVE server infrastructure
12
The SERVE Architecture (2)
Ballot Def. Data
Encrypted Voted Ballots
Central Server
UVS Control Data
Voter History
Manual
13
Security Risks in SERVE (1)

• Software flaws
• Unintentional bugs might enable remote attacks
• Malicious code might contain a backdoor
• COTS software might be insecure or backdoored

• Insider attacks
• Votes cast could be modified or deleted
• Election officials could learn how you voted, or
  count your votes incorrectly
• Sysadmins, developers could bypass security

14
Security Risks in SERVE (2)

• Attacks on the client
• Worms, viruses
• Remote attacks
• Malicious websites, ActiveX
• Denial of service attacks
• DDoS might render servers unreachable
• Targeted disenfranchisement

• Website spoofing
• Voters might be re-directed to the wrong site
  (DNS hijacking, email)
• Spoofed site might observe or change votes
• Automated vote swapping and vote buying

15
Summary

• How do you know that your vote was counted?
• How much security is enough?
• How much security is too much?

You won the election, but I won the count. --
Somoza
16
Discussion?
17
Fighting Words

• Internet voting is a danger to democracy
• No voting system will ever be perfectly secure
  why worry?
• Absentee vote-by-mail is already insecure why
  should Internet voting be held to a higher
  standard?
• 30 of our military today cant vote a little
  insecurity is worth it if it fixes the problem
• The threat of extraterritorial election fraud is
  new, and requires new laws