Electronic Voting Ian Brown (with some slides from Matt Bishop, UC Davis)

Overview Voting procedures Whats broke? E-voting options UK government plans Security problems US situation

Properties Voter must be able to vote Votes are secret Votes are anonymous Voter can verify votes at any point before dropping ballot into ballot box

Requirements Must be available Must provide simple to use, easy to understand, hard to misuse interface for voter Must not be able to associate votes with a particular voter

Requirements (2) Must allow voter to discard votes up to the time the voter officially casts ballot Must prevent voter from casting more than limited number of votes per race, or once per ballot Voter must be able to verify vote up to time vote is cast

Key Ideas Separation of Privilege –Observers can check everything in paper election Not with e-voting systems to the same degree Auditability –Maybe with e-voting systems …

Paper elections Go to polling place and give name, address Get ballot paper, enter booth Use pencil to mark paper to indicate vote Fold ballot paper Leave booth, drop paper into ballot box

Whats broke? Low turnout in elections – 61% in 2005 general election (compared to historical figures of 70 80%), 2030% local elections Especially prevalent among younger voters (40% of 1824 year olds voted in 2001) Voters only get their say roughly once every four years on national government

UK government plans Add options for casting vote – expand postal vote, introduce telephone, SMS, digital TV and Internet voting Trials in local elections Want to use in next-but-one general election Might eventually lead to greater use of referendums

May 2002 trials New voting methods trialled in council elections 30 local authorities tested various combinations of all-postal voting and remote electronic voting technology

Trial results Some local authorities saw a doubling of turnout in postal votes Technology methods seemed to make no significant difference to turnout Scope found that disabled voters felt accessibility was improved Use of polling station equipment not seen as a useful way forward

Potential security problems Insider attacks – hard to fully audit code, esp. if proprietary, closed source Computer compromise – how can you guarantee the machines used to vote arent infected by vote-stealing viruses Network problems – how do you make sure Denial of Service attacks dont take down network infrastructure or servers Server protection – easier as centralised and under direct govt control Public confidence – how do you convince voters that election was fair?

Local e-democracy National Project Aim is to improve democratic participation between elections Piloting projects to allow council meeting documents to be tracked online, enable micro-consultations, online petitions and citizen panels Provide evidence to councillors of effectiveness of web pages, , and other online consultation mechanisms Research tools to promote social inclusion of groups such as the disabled and less literate

US situation Each ballot paper tends to contain MANY options for voters – local officials (e.g. sherrifs), referendums – perhaps >100 Makes hand count of ballots impracticable Machines have been used for many years, but problems (e.g. hanging chads) led to Help America Vote Act HAVA funding new computerised terminals across the US

AccuVote-TS Terminals

Compromise All locks have the same key –Can duplicate it in any hardware store –Pick locks in under 1 minute (first timer), 10 seconds (with some knowledge) In bay lie PCMCIA card, PS2 port –Hook up keyboard, hit F2 or Enter and youre a Supervisor! Jam card reader Disconnect monitor

Voter Verified Audit Trail How can voter know whether her votes tallied accurately? –Some sort of paper trail –NOT just a printout from a voting machine, but a printed slip that voters can check when casting vote –Stored in machine or ballot box –May be optically scanned –Can be used as basis for recount when required (and randomly to verify machine operation) –Required by law in California for all new e-voting machines after March 2004, and cannot use e-voting machines without them after 2006

Pentagon SERVE project Secure Electronic Registration and Voting Experiment US project to allow 100,000 overseas personnel to cast votes remotely for primaries and general election using the Internet Shut down after damaging report from Security Peer Review Group: There really is no good way to build such a voting system without a radical change in overall architecture of the Internet and the PC

Conclusions Election security is hard – anonymity requirement and high stakes – and has been evolving for over a century in the UK New voting mechanisms have been suggested as way of increasing turnout, but is how or why more important? Trials in 2002 UK local elections found no significant effect on turnout of new technology UK government still pressing ahead with e-voting, but e- participation projects might have more immediate impact