internet voting technology and policy issues david wagner uc berkeley
Post on 20-Dec-2015
216 views
TRANSCRIPT
Internet VotingTechnology and policy issues
David WagnerUC Berkeley
Introductions
• I’m a computer security researcher
• We study attacks and countermeasures– Before one can design a system that will resist attack,
one must anticipate how it might be attacked
No Secrets
• Proactive study of attacks is generally a good thing• Mounting such attacks is not, of course
– Don’t use your super powers for evil
Selective History of Voting (US)
• early 1800’s: public oral voting at County Hall• 1800’s: free-form, non-secret paper ballots popular• 1884: widespread vote fraud• 1888: adoption of Australian secret ballot• 1930’s: lever machines widely adopted• 1960’s: punchcard voting developed• 2000: butterfly ballots, chad, Florida, gack!• 2002: HAVA
Attacks on the Secret Ballot
Registration fraud:• Register in multiple
jurisdictions• Graveyard voting• “Cleanse” the voter list• Districting & re-districting
Voter fraud:• Vote multiple times
(ballot box stuffing)• Multiple voting• Impersonation
Insider fraud:• Throw ballot boxes into the
bay• Stuff ballot box after polls
close• Sleight of hand• Voter intimidation• “Run out of ballots”
Tallying attacks:• Malicious talliers might
calculate wrong results• Give talliers bogus tools
Attacks on the Secret Ballot
Registration fraud:• Identity fraud
Voter fraud:• Impersonation• Vote multiple times• Vote buying, chain
voting
Insider fraud:• Ballot box stuffing• Ballot marking
Tallying attacks:• Inaccurate counts• Ballot marking• Manipulation of
challenge procedure
How Secure is the Secret Ballot?
• It’s easy to forge a few fraudulent votes
• But: It’s very hard to forge a lot of fraudulent votes…
• Summary: Australian secret ballot is quite robust; a well-designed security system.
History of Internet Voting
• 2000: 36,000 Arizona citizens vote in Democratic primary over the Internet; 85 military personnel vote in November elections over the Internet
• 2000: California studies Internet voting; task force recommends against it
• 2000: NSF panel warns of security risks in Internet voting
• 2004: SERVE will accept votes over the Internet
The SERVE Project
• A DoD project for overseas voters
• Register & vote from abroad
• Vote over the Internet, using your Windows computer
Arkansas
Utah
Washington
Minnesota
Ohio
Pennsylvania
South Carolina
Florida
Hawaii
North Carolina
Key
State-wide Participation
Select county Participation
Legislation in Place
Who is eligible for SERVE? Overseas & military voters from participating jurisdictions (7 states, 51 counties)
The SERVE Architecture (1)
Internet
CitizenHTTPS
UVS Control Data Ballot Definitions
Voted Ballots(Encrypted)
LEO Processes•Voter Registration
•Ballot Definition
•Ballot Decryption
•Ballot Tabulation
•Voter History
WebServer
HTTPS, SFTP
SE
RV
EU
SA
.go
v
*
*
* Firewall** Identification & Authentication Process
SERVE server infrastructureElection officials
UVS Laptop
Ballot Definition
Voting Engine
Ballot Reconciliation
Voter Registration
I &
A P
roc
ess
**
Voter Status CheckOverseas voters
EncryptedVoted Ballots
Ballot Def. Data
UVS Control Data
The SERVE Architecture (2)
LEO Infrastructure
UOCAVA Voting System (UVS)
Citizen
HTTPS
HTTPS
EncryptedVoted Ballots
Manual
Ballot Def. Data
UVS Control Data
Central Server
Voter History
LEO Local Workstations
LEO Local Workstations
Security Risks in SERVE (1)
Software flaws:• Unintentional bugs might
enable remote attacks• Malicious code might
contain a backdoor• COTS software might be
insecure or backdoored
Insider attacks:• Votes cast could be
modified or deleted• Election officials could
learn how you voted, or count your votes incorrectly
• Sysadmins, developers could bypass security
Security Risks in SERVE (2)
Attacks on the client:• Worms, viruses• Remote attacks• Malicious websites,
ActiveX
Denial of service attacks:• DDoS might render
servers unreachable• Targeted
disenfranchisement
Website spoofing:• Voters might be re-
directed to the wrong site (DNS hijacking, email)
• Spoofed site might observe or change votes
• Automated vote swapping and vote buying
Summary
• How do you know that your vote was counted?• How much security is enough?• How much security is too much?
You won the election, but I won the count.-- Somoza
Discussion?
Fighting Words
• Internet voting is a danger to democracy• No voting system will ever be perfectly secure;
why worry?• Absentee vote-by-mail is already insecure; why
should Internet voting be held to a higher standard?• 30% of our military today can’t vote; a little
insecurity is worth it if it fixes the problem• The threat of extraterritorial election fraud is new,
and requires new laws