electronic voting down for the count?

Electronic VotingDown for the Count?

Charles P RiedeselUniversity of Nebraska, Lincoln

Computer Science & Engineering

Where I am coming from

• Mathematician – “fair” elections are impossible

• Computer scientist/engineer – designing errorless/unhackable computer hardware and software is impossible

• Politition – fooling the people all the time is impossible

Where am I coming from?• I teach computer organization – By the end of

freshman year my students can design the circuitry of a functional computer. I know how to hide an “Easter Egg” in hardware that is virtually impossible to find.– Counterfeit chips are already a problem– An Easter Egg is a surprise that can be uncovered by

very particular actions, a “Cryptic Knock”– Example: MicroSoft Excel 97 had a hidden flight

simulator, activated by keying at special cell– Cryptic knocks can be used to wake up trojan horses!

Where am I coming from?

• I have taught operating systems and compiler construction at the jr/sr/grad level. With this knowledge we can replace and/or modify COTS (Commercial Off The Shelf) software to do things totally unexpected by unknowing programmers.

Where am I coming from?

• I have gone through a lot of the technical reports about voting systems hardware and software, and can make sense and comment of most of it. My colleagues who are more expert at communication networks and software engineering aspects can absorb it all.

Today’s Agenda

• The role of elections in our democracy• Makings of an election• Rise and fall of the DRE• Other players, organizations, documents• Recommendations

The Role of Elections in Our Democracy

• Inherent mathematical flaws of elections• An election is only a snapshot of those

voting• Weighted voting• One person, one vote?• Legitimacy based on trust• Principles for a good election

Inherent Mathematical Flaws of Elections

• Winning is not transitive– Three-way race with Alice, Bob and Calvin based on

three equally important issues of abortion, taxes, and war.

– Voters prefer Alice, then Bob, then Calvin on abortion.– Voters prefer Bob, then Calvin, then Alice on taxes.– Voters prefer Calvin, then Alice, then Bob on war– In two way races Alice beats Bob, Bob beats Calvin,

and Calvin beats Alice!

An Election is only a Snapshot

• Elections are held on one day (usually)• Polls demonstrate dynamics of a race• Sensitive to late-breaking news, charges• New information after the election• Election really valid for 2, 4, or 6 years?

Weighted Voting

• What if Alice beats Bob, but it is only because 51% mildly prefer Alice, but 49% detest Alice and adore Bob? Overall, Bob is better liked!

• What if Calvin beats Don 55% to 45%. Instead of winner takes all, put both in office and weigh their single vote 55-45 on all issues!

One Person, One Vote?

• You are smart, well versed on issues.• The idiot with an IQ of 40 on your right

really has no idea what is going on.• The blow-hard on your left is caught up in

some single-issue thing.• Should your vote really count the same as

either of theirs?

Legitimacy Based on Trust

• Numerous flaws in elections• Possibility of mathematically invalid results• Can anyone find a better way?• What level of imperfection can we

tolerate?• Essential that winners and losers alike buy

in to the system and accept results

Principles for a Good Election

• Vote storage mechanisms should be– Simple– Reliable– Durable (for the votes)– Tamper-evident– History-independent– Subliminal-free– Cost effective

Principles for a Good Election

• Voters need to know their vote is– Accurately recorded– Counted in the total– Anonymous – no way to track back who voted

how– Private – no possible evidence to show

anyone how he/she voted

Makings of an Election• Voting system machinery

– GEMS– Electronic Voting Machines

• DRE, DRE with VVPT, PCOS• Process of an election• Regulatory actors

– HAVA– NIST, TGDC, EAC, STS– ITA’s – ciber, Wyle Labs, SysTest Labs– NASED– FEC

Voting System Machinery• GEMS: General Election Management System –

the computer and software that takes in and processes the results from all the voting machines

• DRE: Direct Recording Electronic voting machine – votes recorded in software

• DRE with VVPT: Voter Verifiable Paper Trail – votes also recorded on paper

• PCOS: Precinct Center Optical Scan – scans and records vote upon being cast

Process of an Election• Election Definition – define races, candidates,

districts, precincts• Configure Voting Equipment, Print Ballots –

geography makes each precinct different• Pre-Election Test – Verify that everything is

ready• Election Day – Open polls, vote, close polls• Canvassing – Compute and publish totals,

archive results– (Copied from a slide by Douglas Jones)

Regulatory Actors

• HAVA: Help America Vote Act, 2002, – Get rid of hanging chad, – Eliminate mechanical voting machines,– Central count for absentee ballots only,– Promote accessibility for disabled voters,– Fund new machines, – Set up new agencies

Regulatory Actors• NIST: National Institute of Standards &

Technology – technical advisor to• TGDC: Technical Guidelines Development

Committee – advisory board to– (note: Nebraska Secretary Of State John A. Gale is a

member of TGDC!)• EAC: U.S. Elections Assistance Commission –

handful of presidential appointees• STS: Security and Transparency Subcommittee

of TGDC – “Requiring Software Independence in VVSG 2007” recommendation to TGDC 11/2006

Regulatory Actors

• ITA’s: Independent Testing Authorities– Ciber: employs standard methodologies for

evaluating correctness and quality of software• Jan 2007 – in trouble for not following quality

control procedures and lack of documentation– Wyle Labs: review source code, does

hardware testing and functional testing of voting machines

– SysTest: quality assurance, software test engineering, verification & validation

Regulatory Actors

• NASED (National Organization of State Election Directors) under the

• Election Center to which the ITAs report, part of the old

• FEC (Federal Election Commission)

Rise and Fall of the DRE• The Direct Recording Electronic machine• Hopkins Report• SAIC Report• Compuware Report• Raba Report• VSTAAB Report• Hursti II Report• Princeton Report• Nedap Report

Rise and Fall of the DRE

• Major makers of DRE’s are– Sequoia– Diebold– ES&S

• Policy of “Security through Obscurity”• Fundamental Challenge – electronic votes

can evaporate with NO remaining evidence, unlike paper ballots

• Not a transparent process


• Categories of Possible Attacks– Corrupt software inserted prior to election day– Wireless or other remote control attacks– Attacks on tally servers– Miscalibration of machines– Shutting off voting machine features– Denial-of-service attacks– Corrupt poll workers actions– Attacks on ballots or VVPT

• (thanks to Brennan Center for Justice)


• Challenges for the Attacker– Overcome vendor motivation– Finding an insertion opportunity– Obtaining technical knowledge– Obtaining election knowledge– Changing votes– Eluding inspection– Eluding testing and detection– Avoiding detection after polls close

• (thanks to Brennan Center for Justice)


• Hopkins Report – Bev Harris discovered an ftp site for Diebold that contained the software for its DRE, the AccuVote-TS. She took it to Aviel Rubin of Stanford.– “Analysis of an Electronic Voting System” by

Aviel Rubin, et. al., 7/23/2003– Based just on code analysis discovered

numerous potential security problems and lax software engineering standards.


• SAIC (Science Applications International Corporation) Report for Maryland State Board of Elections– “Risk Assessment Report: Diebold AccuVote-TS

Voting System and Processes”, 9/2/2003– Only 40 page redacted version (Diebold’s agreement

let them do it) ever released until nearly 200 page full version leaked 11/2006 by whistleblower

– Risk assessment responding to Hopkins Report, resolves many problems and hides others


• Compuware (Corp.) Report– “Direct Recording Electronic (DRE) Technical Security

Assessment Report”, for the Ohio Secretary of State, 11/21/2003

– Security assessment and validation of four voting machines, including Diebold’s AccuVote-TS

– About 275 pages with test scenarios, results, and any identified risks with risk level (of which are a number)

– Limited to the voting machine, not policies and processes

Rise and Fall of the DRE• RABA (Technologies) Report for the state of

Maryland– “Trusted Agent Report: Diebold AccuVote-TS Voting

System”, January 20, 2004– Security experts review the Diebold system, the SAIC

report, and formed “Red Team” exercise to probe actual system setup

– Successfully hacked it and the GEMS server in multiple ways

– “Considerable” risks found, but with recommendations can be mitigated well enough for the primary

– More needed for general election - ultimately need paper receipts


• VSTAAB (California’s Voting System Technical Assessment and Advisory Board) Report “Security Analysis of the Diebold AccuBasic Interpreter”, 2/14/2006– 3 computer scientists from U of California

analyzed AccuBasic, a proprietary, interpreted language used in a couple machines including the AV-TSx touchscreen because no ITA testing was done

– Problems (many easily correctable) found


• Hursti II Report, a Black Box Voting Project by Harri Hursti, “Diebold TSx Evaluation – SECURITY ALERT: May 11, 2006: Critical Security Issues with Diebold TSx at invitation of a Utah county– Firmware is easy to change– PCMCIA virus threat


• Princeton Report “Security Analysis of the Diebold AccuVote-TS Voting Machine” by several authors at Princeton University, Sept 13, 2006– Obtained one of the DRE machines,

demonstrated Hursti’s proposed virus, and created a demo virus that attacks an election

– Problems in common with desktop PCs– Diebold response is that polling place

procedures provide adequate protection


• Nedap(/Groenendaal) Report – “Nedap/Groenendall ES3B Voting Computer: a Security Analysis”, 10/6/2006– Used extensively in Netherlands and nearby– Authors show how anyone can quickly gain

complete and virtually undetectable control over election results

– Radio eminations up to several meters away can be used to tell who votes what

– Sold in US by Liberty Voting Solutions


• TGDC report by STS to NIST calls for Software Independence, basically ruling out paperless DRE’s

• By the end of November 2006, NIST concludes that paperless DRE’s are not acceptable

• At the beginning of December 2006, the EAC rejects 6-6 recommendation to only certify DRE’s that use “independent audit technology” (namely paper). Cost was a factor.

Other Players, Organizations, Documents

• Douglas Jones• Ariel Rubin• Bev Harris – Black Box Voting• Rebecca Mercuri• Eugene Spafford• William Pitt – Truthout• David Dill – Verified Voting Foundation• Linda Malone – President of NASED• Barbara Simons - USACM• The Brennan Center for Justice• IEEE, ACM

Douglas Jones

• University of Iowa at Iowa City• Department of Computer Science• Gives many talks, lay and technical• Inspiration for parts of this presentation

– See “Voting Security: A Technical Perspective”, presented at U of S. Car. Cybersecurity Symposium, 10/27/2005

Aviel Rubin

• John Hopkins University• Election Judge• Author “Brave New Ballot: The Battle to

Safeguard Democracy in the Age of Electronic Voting”

• Analyzed source code at the discovered Diebold ftp site

Bev Harris

• Seattle grandmother and writer• Stumbled on the Diebold ftp site, 2002• Founded Black Box Voting• Voracious investigator

Rebecca Mercuri

• Founder of Notable Software and Knowledge Concepts

• Promotes mechanism with printout to be voter verified which is protected behind glass before being dropped into box

Eugene Spafford

• Chair of USACM (US Public Policy Committee of the ACM)

• Endorsed Nov. 2006 STS report advocating paper trails

William Pitt

• Managing editor of Truth Out

David Dill

• Founder of Verified Voting Foundation• Stanford University• Endorses voter verifiable audit trail

Linda Malone

• President of NASED• Administrator of Maryland’s State Board of

Elections• In unaired Oct 2006 interview responds to

questions about critical Diebold report with “I think you are in fantasy land”

Barbara Simons

• Formerly at IBM• Former ACM chair• USACM member• Gives statements and testimony• Upcoming 2007 book with Doug Jones

The Brennan Center for Justice

• New York University• 2006 report on security problems of 3

most common electronic systems

IEEE and ACM

• Association for Computing Machinery• Institute of Electrical and Electronics Engineers• Professional organizations representing

computer sciences and engineering• ACM Policy Statement – all systems should

have– Careful engineering– Strong safeguards– Rigorous testing of design and operation

Recommendations

• Keep things in perspective• Restore and maintain trust• Regulate, fund, and train• Decentralize and diversify• Establish reasonable processes• Implement an assessment cycle

Recommendations

• Keep Things in Perspective – There are many factors that influence an election. Some we accept without question as legitimate, some are ignored, some are presented as terrible threats. How much do we spend to eliminate one threat, no matter how small and unlikely?

Recommendations

• Restore and Maintain Trust– Pay attention and respond respectfully– Educate yourself and others– Openly take reasonable steps– Stay calm– Act quickly and decisively when appropriate– Question authority at the same time as you

respect authority– Keep everything as transparent as possible

Recommendations

• Regulate, Fund, and Train – There is no human or technological perfect system– Regulate all aspects of the election cycle– Provide adequate funding for all aspects of

the election cycle including certification, acquisition, verification, and development of hardware and software

– Poll workers are generally low paid and unskilled, yet the system depends on them!

Recommendations

• Decentralize and Diversify – Attacks (accidental and malicious) are most effective when implemented system-wide. Think of virus threat if all computers were the same or all cattle had the same DNA – thus the same vulnerabilities!– Promote competition in the industry– One size doesn’t fit all – consider costs,

demographics, and accessibility– Don’t fund a pie-in-the-sky perfect solution– Limited use of DRE’s may be acceptable

Recommendations

• Establish Reasonable Processes – People need to know what to do in case of all kinds of events. Secure systems depend on the people implementing and using them following proper protocols. Development and certification are loaded with details that are easily overlooked.

Recommendations

• Implement an Assessment Cycle – The poll workers and others closest to an election should participate in evaluating the processes, looking for both good and bad features, and providing feedback that will be used (not sit on a shelf!!!) to improve the system. They see things the experts miss.