Internet Voting David Jefferson Compaq Systems Research Center 130 Lytton Ave. Palo Alto, CA

Classification of Internet Voting Systems Poll-site Internet voting –Election officials secure the client configuration –Voters identify themselves to officials Kiosk voting –Election officials secure the client configuration –Voters authenticate themselves to voting machine Remote voting –Voters or 3 rd parties control client configuration

Recommendations of CA and NSF panels Poll-site systems: Experimentation leading to certification can proceed cautiously Kiosk systems: Find consensus on best way to authenticate voters; then proceed as with poll-site systems. Remote voting systems: –Profound security problems with voting from unsecured platforms (i.e. conventional hardware + OS + browser): Trojan horse attacks (pre-existing or delivered by virus, etc.) Remote management software attacks Spoofing attacks Denial of service attacks Automated vote selling schemes –Large numbers of votes could be changed, discarded, spied upon, or bought/sold—undetectably—by anyone in the world. No fixes in sight. –Vast combinatorial space of platforms to support –Digital divide problem –Recommend indefinite delay in considering such systems.

Electronic systems will change rapidly Hardware Software  Changes to certification process recertification of systems put to other use continuous certification and decertification  Changes to “business model” capital purchase gives way to leasing, rental, financing, dual use, and other options  Changes to training and management

Ideas whose time has come Open specifications of interfaces and protocols –Allows interchangeable software parts Public source for election software –There should be no proprietary or secret code in the vote data path (but IP rights still protected) Universally verifiable cryptographic election protocols –Anyone can verify that the entire process, from just after the casting of votes, all the way to the output of the canvass, is conducted correctly, while still preserving privacy

Disadvantages of paper vs. electronic ballots Low reliability –Many more ways for voters to make errors –Paper ballots constitute a single point of failure if lost or damaged; cannot be “copied” without loss of fidelity –Just as much software required as in electronic voting (in scanners and printers) –Require human judgment to ascertain “voter intent” –Paper is essentially an analog medium Poor security –No checksums or encryption possible—data is non-redundant and in cleartext –Paper ballots can be manipulated by hand—no tools or skill required –Trojan horse argument not avoided--possible in printers, scanners, etc. Excessive costs –Printing –Mechanical paper-handling equipment (scanners, printers) required –Storage, transport, and storage again –Waste