Electronic Voting Machines

1
Electronic Voting Machines

• Colin Dougherty

2
Agenda

• History of Electronic Voting
• Problems with Electronic Voting
• Examples of Said Problems
• Solutions to Said Problems

3
The Need for E-Voting
4
Voting Requirements

• Accuracy
• Anonymity
• Scalability
• Speed

5
Agenda

• History of Electronic Voting
• Problems with Electronic Voting
• Examples of Said Problems
• Solutions to Said Problems

6
Examples of Problems

• In Fairfax County, VA, in 2003, a programming
  error in the electronic voting machines caused
  them to mysteriously subtract 100 votes from one
  particular candidates totals.
• In San Bernardino County, CA in 2001, a
  programming error caused the computer to look for
  votes in the wrong portion of the ballot in 33
  local elections, which meant that no votes
  registered on those ballots for that election. A
  recount was done by hand.
• In Volusia County, FL in 2000, an electronic
  voting machine gave Al Gore a final vote count of
  negative 16,022 votes.
• The 2003 election in Boone County, IA, had the
  electronic vote-counting equipment showing that
  more than 140,000 votes had been cast in the Nov.
  4 municipal elections. The county has only 50,000
  residents and less than half of them were
  eligible to vote in this election.

7
So what?

• Non-uniform distribution of errors
• Software errors are propagated to every voting
  machine
• Software can be hacked

8
Agenda

• History of Electronic Voting
• Problems with Electronic Voting
• Examples of Said Problems
• Solutions to Said Problems

9
Maryland E-voting Audit
http//www.thedailyshow.com/video/index.jhtml?vide
oId108199titlediebold-with-a-vengeancetaggene
ric_tag_evotingitemId108434
10
E-voting California Style

• E-voting Machine Findings
• Windows OS
• Physical security
• Overwriting firmware and boot loader
• Detecting election mode
• Default cryptographic keys used
• Undisclosed accounts discovered
• Gain access to privileged menus

11
Security
12
Agenda

• History of Electronic Voting
• Problems with Electronic Voting
• Examples of Said Problems
• Solutions to Said Problems

13
Possible Solutions

• Open Source
• Software Assurance
• Low Tech

14
Open Source

• Need for transparency
• Security by obscurity does not work!

15
Software Assurance

• NASA "planned and systematic set of activities
  that ensures that software processes and products
  conform to requirements, standards, and
  procedures. It includes the disciplines of
  Quality Assurance, Quality Engineering,
  Verification and Validation, Nonconformance
  Reporting and Corrective Action, Safety
  Assurance, and Security Assurance and their
  application during a software life cycle."
• Most painful to implement

16
Low Tech

• Improved physical security
• Paper audit trails!

17
References

• 2007 Red Team Report from California Electronic
  Election Machine Certification
  http//www.sos.ca.gov/elections/voting_systems/ttb
  r/red_overview.pdf
• NASA-STD-2201-93 "Software Assurance Standard",
  10 November 1992
• Secrets Lies, Digital Security in a Networked
  World. Bruce Schneier. John Wiley Sons, 2000
• http//www.schneier.com/blog/archives/2004/11/the_
  problem_wit.html
• http//www.wired.com/politics/security/commentary/
  securitymatters/2007/08/securitymatters_0809
• http//www.forbes.com/home/security/2006/11/10/vot
  ing-fraud-security-tech-security-cz_bs_1113securit
  y.html
• http//www.schneier.com/essay-046.html
• http//arstechnica.com/news.ars/post/20070806-cali
  fornia-to-recertify-insecure-voting-machines.html?
  rel

18
Questions

• What is one way to improve the security of
  electronic voting machines?
• Why does security through obscurity not work?

19
Electronic Voting Machines

• Colin Dougherty