Internet Voting Technology and policy issues

Selective History of Voting (US) early 1800’s: public oral voting at County Hall 1800’s: free-form, non-secret paper ballots 1884: widespread vote fraud 1888: adoption of Australian secret ballot 1930’s: lever machines widely adopted 1960’s: punchcard voting developed 2000: hanging chads: Florida voting snafu 2002: Help America Vote Act

Attacks on the Secret Ballot Registration fraud: Register in multiple jurisdictions Graveyard voting Voter fraud: Vote multiple times (ballot box stuffing) Impersonation Insider fraud: Throw ballot boxes into the bay Stuff ballot box after polls close Sleight of hand Voter intimidation “Run out of ballots” Tallying attacks: Malicious talliers might calculate wrong results Give talliers bogus tools Registration fraud: Register in multiple jurisdictions Graveyard voting Voter fraud: Vote multiple times (ballot box stuffing) Impersonation Insider fraud: Throw ballot boxes into the bay Stuff ballot box after polls close Sleight of hand Voter intimidation “Run out of ballots” Tallying attacks: Malicious talliers might calculate wrong results Give talliers bogus tools

How Secure is the Secret Ballot? It’s easy to forge a few fraudulent votes But: It’s very hard to forge a lot of fraudulent votes… Summary: Australian secret ballot is quite robust; a well-designed security system.

History of Internet Voting 2000: 36,000 Arizona citizens vote in Democratic primary over the Internet; 85 military personnel vote in November elections over the Internet 2000: California studies Internet voting; task force recommends against it 2000: NSF panel warns of security risks in Internet voting 2004: SERVE will accept votes over the Internet

The SERVE Project A DoD project for overseas voters Register & vote from abroad Vote over the Internet, using your computer

Who is eligible for SERVE? Overseas & military voters from participating jurisdictions (7 states, 51 counties)

The SERVE Architecture Internet Citizen HTTPS UVS Control Data Ballot Definitions Voted Ballots (Encrypted) LEO Processes Voter Registration Ballot Definition Ballot Decryption Ballot Tabulation Voter History Web Server HTTPS, SFTP SERVEUSA.gov * * * Firewall ** Identification & Authentication Process SERVE server infrastructure Election officials UVS Laptop Ballot Definition Voting Engine Ballot Reconciliation Voter Registration I & A Process ** Voter Status Check Overseas voters Encrypted Voted Ballots Ballot Def. Data UVS Control Data

Security Risks in SERVE (1) Software flaws: Unintentional bugs might enable remote attacks Malicious code might contain a backdoor COTS software might be insecure or backdoored Insider attacks: Votes cast could be modified or deleted Election officials could learn how you voted, or count your votes incorrectly Sys-admins, developers could bypass security

Security Risks in SERVE (2) Attacks on the client: Worms, viruses Remote attacks Malicious websites, ActiveX Denial of service attacks: DDoS might render servers unreachable Targeted disenfranchisement Website spoofing: Voters might be re- directed to the wrong site (DNS hijacking, ) Spoofed site might observe or change votes Automated vote swapping and vote buying

Summary How do you know that your vote was counted? How much security is enough? How much security is too much ? You won the election, but I won the count. -- Somoza

Arguments Internet voting is a danger to democracy No voting system will ever be perfectly secure; why worry? Absentee vote-by-mail is already insecure; why should Internet voting be held to a higher standard? 30% of our military today can’t vote; a little insecurity is worth it if it fixes the problem The threat of extraterritorial election fraud is new, and requires new laws

Sources