1. CSC 382/582: Computer SecuritySlide #1 CSC 382/582: Computer Security Voting Security

2. CSC 382/582: Computer SecuritySlide #2 Topics 1.Why do we vote? 2.Do we have a right to vote? 3.How do we vote? 4.Electronic voting

3. CSC 382/582: Computer SecuritySlide #3 Why do we vote? 1.What’s the purpose of democracy? 2.Does democracy require voting? 3.Does voting mean you live in a democracy?

4. CSC 382/582: Computer SecuritySlide #4 Voting Rights Do we have a right to vote?

5. CSC 382/582: Computer SecuritySlide #5 Voting Rights Non-discrimination is protected –15 th (race) –19 th (sex) –26 th (age) But the SCOTUS majority concluded: "the individual citizen has no federal constitutional right to vote for electors for the President of the United States." (Bush v. Gore, 531 U.S. 98, 104 (2000))

6. CSC 382/582: Computer SecuritySlide #6 Voting Methods Binary Ranked Condorcet Rated Proportional

7. CSC 382/582: Computer SecuritySlide #7 Binary Methods Plurality –First-past-the-post, largest number wins. Approval –Vote for multiple candidates; largest number wins. Runoff –Multiple rounds of plurality until majority winner. –Typical: select top 2, then hold election with just those 2. Random –People vote for their candidate. –Randomly selected ballot determines winner.

8. CSC 382/582: Computer SecuritySlide #8 Voting Criteria Majority criterionMajority criterion — If there exists a majority preferring a single candidate, does he always win if that majority votes sincerely? Monotonicity criterionMonotonicity criterion — Is it impossible to cause a winning candidate to lose by ranking him higher, or to cause a losing candidate to win by ranking him lower? Consistency criterionConsistency criterion — If the electorate is divided in two and a choice wins in both parts, does it always win overall? Participation criterionParticipation criterion — Is it always better to vote honestly than to not vote? Condorcet criterionCondorcet criterion — If a candidate beats every other candidate in pairwise comparison, does that candidate always win? Arrow’s Impossibility Theorem

9. CSC 382/582: Computer SecuritySlide #9 Indirect Elections Plurality in state select electors Winner takes all in most states Majority of electoral vote wins Congress selects if no majority 2004 Population cartogram 286 (Bush)-251 (Kerry) 2004 Electoral College Map Bush (red), Kerry (blue)

10. CSC 382/582: Computer SecuritySlide #10 Voting Details

11. CSC 382/582: Computer SecuritySlide #11 History of Voting Voice Voting Ballots: black pebble, white pebble Paper Ballots Australian Paper Ballot Lever Voting Machines Punched Card Optical Scanner DRE Machines

12. CSC 382/582: Computer SecuritySlide #12 Types of Electronic Voting Paper-based voting –Computer marks paper ballots, which are counted. Direct-recording electronic (DRE) –Records vote count electronically. Networked DRE –Uploads vote count electronically. –Includes Internet voting.

13. CSC 382/582: Computer SecuritySlide #13 Advantages of e-voting Accessibility Cheaper per election costs due to no paper –Multi-lingual ballots Speed of tabulation Remote voting

14. CSC 382/582: Computer SecuritySlide #14 Disadvantages of e-voting Voters could be tracked Lack of reliability Lack of verification Lack of transparency Undetectable fraud (Rice’s theorem) Wholesale fraud

15. CSC 382/582: Computer SecuritySlide #15 Are Voting Machines Reliable? Columbus, OH – An error while a Danaher / Guardian ELECTronic 1242 was plugged into a laptop to download results gave President Bush 3,893 extra votes.: http://www.usatoday.com/tech/news/techpolicy/evoting/2004-11-06- ohio-evote-trouble_x.htmhttp://www.usatoday.com/tech/news/techpolicy/evoting/2004-11-06- ohio-evote-trouble_x.htm Carteret Co., NC – More early voters voted on Unilect Inc.’s Patriot voting system than the system could handle resulting in the loss of more than 4,500 votes.: http://www.usatoday.com/news/politicselections/vote2004/2004-11-04-votes- lost_x.htm http://www.usatoday.com/news/politicselections/vote2004/2004-11-04-votes- lost_x.htm Broward Co., FL – ES&S software on their machines only reads 32,000 votes at a precinct then it starts counting backwards (see this update): http://www.news4jax.com/politics/3890292/detail.htmlthis update http://www.news4jax.com/politics/3890292/detail.html Mecklenburg Co., NC – More votes registered than voters: http://www.charlotte.com/mld/charlotte/news/politics/10094165.htm http://www.charlotte.com/mld/charlotte/news/politics/10094165.htm LaPorte County, IN - A bug in ES&S’ software causes each precinct to be reported as only having (exactly) 300 voters each; all reports add up to 22,000 voters in a county that has more than 79,000 registered voters.: http://www.heraldargus.com/content/story.php?storyid=5304 http://www.heraldargus.com/content/story.php?storyid=5304 Utah County, UT - 33,000 straight-party ballots are not counted due to a programming error in punchcard counting equipment.: http://deseretnews.com/dn/view/0,1249,595105309,00.html http://deseretnews.com/dn/view/0,1249,595105309,00.html

16. CSC 382/582: Computer SecuritySlide #16 Are Voting Machines Secure? “As long as I count the votes, what are you going to do about it?” –William Marcy “Boss” Tweed, 1871

17. CSC 382/582: Computer SecuritySlide #17 Diebold BallotStation 1.Setup –D/L ballot setup 2.Pre-Election –L&A testing 3.Election –Voting 4.Post-Election –Print result tape –Transfer votes

18. CSC 382/582: Computer SecuritySlide #18 Attack Scenarios Transferring Votes –Transfer vote from one candidate to another. –Leaves total number of votes unchanged. Denial of Service –Target precinct that votes for opponent. –Malware shuts down or wipes machine. –Forged administrative smartcard attack.

19. CSC 382/582: Computer SecuritySlide #19 Injecting Attack Code Direct installation –Replace EPROM. –Exploit backdoor to install from smartcard. –Reboot using smartcard with botloader. –Voting machines use standard minibar keys. Virus –Infects memory cards. –Memory cards infect machines on boot. –Software upgrades delivered via memory cards.

20. CSC 382/582: Computer SecuritySlide #20 Concealing Voting Malware Timing –Software only active in Election mode. –Software only active on certain dates / times. Knock –Software actives only after secret “knock” given. Hiding processes and files –Rootkit techniques –Virtualization

21. CSC 382/582: Computer SecuritySlide #21 Mitigating Attacks Be like an XBox. Digital signatures for software updates Securing audit logs and counters –Specialized hardware –Cryptographic techniques Chain of custody for memory cards Voter verifiable paper trail

22. CSC 382/582: Computer SecuritySlide #22 References 1.Caltech/MIT Voting Project, “Residual Votes Attributable to Technology,” http://www.hss.caltech.edu/~voting/CalTech_MIT_Report_Version2.pdf#sea rch=%22mit%20caltech%20uncounted%20ballots%22, 2001. http://www.hss.caltech.edu/~voting/CalTech_MIT_Report_Version2.pdf#sea rch=%22mit%20caltech%20uncounted%20ballots%22 2.“More e-voting problems,” http://www.evoting-experts.com/, December 12, 2004.http://www.evoting-experts.com/ 3.Ariel J. Feldman, J. Alex Halderman, Edward W. Felten, “Security Analysis of the Diebold AccuVote-TS Voting Machine,” http://itpolicy.princeton.edu/voting, Sep 13, 2006. http://itpolicy.princeton.edu/voting 4.Douglas Jones, “Illustrated Voting Machine History,” http://www.cs.uiowa.edu/~jones/voting/pictures/, 2003. http://www.cs.uiowa.edu/~jones/voting/pictures/ 5.Tadayoshi Kohno, Adam Stubblefield, Aviel D. Rubin, Dan S. Wallach, “Analysis of an Electronic Voting System,” IEEE Symposium on Security and Privacy, Oakland, CA, May, 2004 6.Mark Newman, “Election Result Maps,” http://www- personal.umich.edu/~mejn/election/, 2004.http://www- personal.umich.edu/~mejn/election/ 7.Avi Rubin, Brave New Ballot, Morgan Road Books, 2006. 8.Kim Zetter, “House Dems seek Election Inquiry,” http://www.wired.com/news/evote/0,2645,65623,00.html, Nov 5, 2004. http://www.wired.com/news/evote/0,2645,65623,00.html 9.http://en.wikipedia.org/wiki/Voting_system, 2006.http://en.wikipedia.org/wiki/Voting_system