Internet Voting | CTVotersCount.org

Testimony on two more election bills: RLAs and Internet Voting

H.B.6325 was a second bill similar to an earlier on that proposed a task force for Risk limiting Audits (RLAs). My detailed testimony only changed a little bit. For the previous bill, I only testified on paper. For this bill I spoke, especially giving my answer to a legislators question of another on another bill. I’m glad I had a few days contemplate an answer: “How would you explain RLAs to forth graders?”

That is a good question: Risk Limiting Audits are intended to confirm that elections are correctly counted and totaled or to correct incorrect results…

That is a good question: Risk Limiting Audits are intended to confirm that elections are correctly counted and totaled or to correct incorrect results. Over a 10-year period, Connecticut has about 20,000 election contests. For instance, if 20 of those contests were incorrectly decided due to error or fraud, rigorous Risk Limiting Audits which examine all 20,000 contests would correct at least 19 of the 20.

After several hiatus an Internet voting bill is being proposed, one of 28 sections. It also included a flawed proposal for curing absentee ballots rejected for signature issues etc. S.B.5 was patterned after systems that have failed independent security studies, spectacularly.

New Paper: Evidence Based Elections

A new paper by Andrew Appel and Philip Stark: EVIDENCE-BASED ELECTIONS:CREATE A MEANINGFUL PAPER TRAIL,THEN AUDIT Provides a thorough description of how the public can be assured of election outcomes, in spite of hack-able voting equipment.

The bottom line: The only reliable method available is Voter-Marked Paper Ballots, with strong security for the ballots, followed by sufficient post-election audits. Other technologies, including Ballot Marking Devices and Internet voting are insufficient.

Anyone interested in trustworthy elections should read this paper – especially those who think that expensive Ballot Marking Devices should be trusted. And those who think it is impossible to use technology to count votes accurately.

A new paper by Andrew Appel and Philip Stark: EVIDENCE-BASED ELECTIONS:CREATE A MEANINGFUL PAPER TRAIL,THEN AUDIT <read> Provides a thorough description of how the public can be assured of election outcomes, in spite of hack-able voting equipment.

Anyone interested in trustworthy elections should read this paper – especially those who think that expensive Ballot Marking Devices should be trusted.

The vulnerability of computers to hacking is well understood. Modern computer systems, including voting machines, have many layers of software, comprising millions of lines of computer code; there are thousands of bugs in that code. Some of those bugs are security vulnerabilities that permit attackers to modify or replace the software in the upper layers,so we can never be sure that the legitimate vote-counting software or the vote-marking user interface is actually the software running on election day. One might think, “our voting machines are never connected to the Internet, so hackers cannot get to them.” But all voting machines need to be programmed for each new election: They need a “ballot-definition file” with the contests and candidate names for each election, and lists of the contests different voters are eligible to vote in. This programming is typically done via removable media such as a USB thumb drive or a memory card. Vote-stealing malware can piggyback on removable media and infect voting machines—even machines with no network connection. There is a way to count votes by computer and still achieve trustworthy election outcomes. A trustworthy paper trail of voter selections can be used to check, or correct, the electoral outcomes of the contest in an election…

If a BMD is hacked and systematically steals 5% of the votes in one contest and only 7% of voters inspect their ballots carefully enough to notice, then the effective rate of vote-theft is5% ?93% ,or 4.65%;this is enough to change the outcome of a moderately close election. The same analysis applies to a DRE+VVPATsystem.One might think:“not everyone needs to carefully verify their ballots;” if only 7% of voters carefully inspect their ballots, they can serve as a kind of “random audit” of the BMDs. But this sentiment fails to hold up under careful analysis…

in our hypothetical scenario in which a hacked BMD steals 5% of the votes, and 7% of voters carefully inspect their ballots (and know what to do when they see a mistake), then7% ?5% ofvoters will alert a pollworker; that is, 1 in every 285 voters will claim their paper ballot was mismarked—if the voters do not assume it was their own error. The BMD would successfully steal “only” 4.65% of the votes.One might think:“but some voters caught the BMD cheating, red-handed.” But nothing can be done. It is a rare election official who would invalidate an entire election because 1 out of 285 voters complained.

Early Returns from Iowa: Losers and Potential Winners

We may not know who won Iowa, yet we know the losers: Internet Voting, Caucusing, and Immediate Gratification.

NYTimes article: 2020 Iowa Caucus Updates: Delayed Results Lead to Confusion

““This is an embarrassment but it shouldn’t shake people’s confidence in the results,” Mr. Halderman said. “If this had been an election conducted by phone, or online, that would have been a major disaster. We might never know the results and would have had to re-run the entire contest.”

“This is an urgent reminder,” Mr. Halderman said, “of why online voting is not ready for prime time.”

Editorial: Potential Winners…

We may not know who won Iowa, yet we know the losers: Internet Voting, Caucusing, and Immediate Gratification.

NYTimes article: 2020 Iowa Caucus Updates: Delayed Results Lead to Confusion <read>

“This app has never been used in any real election or tested at a statewide scale and it’s only been contemplated for use for two months now,” said Mr. Jefferson, who also serves on the board of Verified Voting, a nonpartisan election integrity organization.

“This is an embarrassment but it shouldn’t shake people’s confidence in the results,” Mr. Halderman said. “If this had been an election conducted by phone, or online, that would have been a major disaster. We might never know the results and would have had to re-run the entire contest.”

“This is an urgent reminder,” Mr. Halderman said, “of why online voting is not ready for prime time.”

A detail that emphasizes how ridiculous caucuses can be: Count Bernie 101, Mayor Pete: 66. Result after a coin-toss: 2 delegates each. That is actually mathematically defensible, yet unsettling. The whole process from beginning to end seems like that.

Editorial: Potential Winners…

Picking up where Dr. Halderman left off: Perhaps tomorrow, we will be able to declare two winners: Paper Records and Publicly Verifiable Elections

Too early to tell. If there are good paper records and they were displayed and photographed or otherwise verified by candidate supporters, both of those ideas will prove their value. On the other hand, even so, will those lessons actually be learned?

Beware: The Gospel of Internet Voting

LA Times article features the entrepreneur behind Internet voting pilots vs. Science: The vote-by-phone tech trend is scaring the life out of security experts <read>

With their playbook for pushing government boundaries as a guide, some Silicon Valley investors are nudging election officials toward an innovation that prominent coders and cryptographers warn is downright dangerous for democracy…
As seasoned disruptors of the status quo, tech pioneers have proven persuasive in selling the idea, even as the National Academies of Science, Engineering and Medicine specifically warn against any such experiment…

Tusk is certain participation in elections would surge if the technology were widely permitted, even though studies in some of the few places around the world that have tried the method revealed no big turnout boost

Crusade, Gospel, Genie seem appropriate to describe entrepreneur Tusk. Its a blind disregard for evidence, science, and the scientists, including yours truly, warning of the risks of Internet voting

LA Times article features the entrepreneur behind Internet voting pilots vs. Science: The vote-by-phone tech trend is scaring the life out of security experts <read>

With their playbook for pushing government boundaries as a guide, some Silicon Valley investors are nudging election officials toward an innovation that prominent coders and cryptographers warn is downright dangerous for democracy…
As seasoned disruptors of the status quo, tech pioneers have proven persuasive in selling the idea, even as the National Academies of Science, Engineering and Medicine specifically warn against any such experiment.
The fight over mobile voting pits technologists who warn about the risks of entrusting voting to apps and cellphones against others who see internet voting as the only hope for getting most Americans to consistently participate on election day…
Bradley Tusk is using the same tactics in this personal crusade that he used to advance tech startups. He has bet a significant share of the fortune he built off his equity stake in Uber that the gospel of mobile voting will spread so fast that most Americans will have the option of casting their ballots for president by phone as soon as 2028.
He has already persuaded the state of West Virginia and the City of Denver to start tinkering with voting by phone, and hopes to move quickly from there.
“What we learned at Uber is once the genie is out of the bottle, it can’t be put it back in,”…
Tusk is certain participation in elections would surge if the technology were widely permitted, even though studies in some of the few places around the world that have tried the method revealed no big turnout boost

Crusade, Gospel, Genie seem appropriate to describe Tusk. It is a blind disregard for evidence, science, and the scientists, including yours truly, warning of Internet voting:

The entrepreneur frames the fight as one pitting reformers against special interests invested in a low turnout that makes lawmakers unaccountable and easy to corrupt. He talks of the security concerns as if they are a sideshow. Sure, the scholars raising them are earnest, he said, but their approach to the challenge bewilders him. He likens them to people whose only solution to making a swimming pool safer is to fill it with concrete.That prospect alarms some of the nation’s most prominent election-security thinkers, who see in Tusk a formidable adversary with an intimidating public relations tool kit. They say he and other promoters for the projects are misleading election officials about how secure the systems are.
“There is wide agreement among computer security experts that this is problematic,” said David Dill, a professor emeritus in computer science at Stanford. “It disturbs me that officials are getting enthusiastic about this voting technology without talking to the people who have the expertise to evaluate its security.”
The National Academies report warns that the risks of this and other forms of internet voting are “more significant than the benefits.”

Read the full article for more details behind Tusk’s quest and the warnings from scientists.

Email and Internet Voting: The Overlooked Threat to Election Security

New report Email and Internet Voting: The Overlooked Threat to Election Security

This report reviews the research that has been conducted by the federal government concluding that secure online voting is not yet feasible…

States that permit online return of voted ballots should suspend the practice.

New report Email and Internet Voting: The Overlooked Threat to Election Security <read>

This report reviews the research that has been conducted by the federal government concluding that secure online voting is not yet feasible…

Until there is a major technological breakthrough in or fundamental change to the nature of the internet, the best method for securing elections is a tried-and-true one: mailed paper ballots. Paper ballots are not tamper-proof, but they are not vulnerable to the same wholesale fraud or manipulation associated with internet voting. Tampering with mailed paper ballots is a one-at-a-time attack. Infecting voters’ computers with malware or infecting the computers in the elections office that handle and count ballots are both effective methods for large-scale corruption.

Military voters undoubtedly face greater obstacles in casting their ballots. They deserve any help the government can give them to participate in democracy equally with all other citizens. However, in this threat-filled environment, online voting endangers the very democracy the U.S. military is charged with protecting.

Considering current technology and current threats, postal return of a voted ballot is the most responsible option. States that permit online return of voted ballots should suspend the practice.

the Myth of “Secure” Blockchain Voting

From David Jefferson at Verified Voting: Verified Voting Blog: The Myth of “Secure” Blockchain Voting <read>

Internet voting has been studied by computer security researchers for over twenty years. Cyber security experts universally agree that no technology, including blockchains, can adequately secure an online public election. Elections have unique security and privacy requirements fundamentally different from and much more stringent than those in other applications, such as e-commerce. They are uniquely vulnerable because anyone on Earth can attack them, and a successful cyberattack might go completely undetected, resulting in the wrong people elected with no evidence that anything was amiss….

Election security is a matter of national security. Blockchains, despite all the hype surrounding them, offer no defense against any of these well-known threats to which all online elections are vulnerable.

From David Jefferson at Verified Voting: Verified Voting Blog: The Myth of “Secure” Blockchain Voting <read>

Several startup companies have recently begun to promote Internet voting systems, but with a new twist – using a blockchain as the container for voted ballots transmitted over the Internet from the voter’s private device. Blockchains are a relatively new system category a little akin to a distributed database. Proponents of blockchain voting promote it as a revolutionary innovation providing strong security guarantees that enable truly secure online elections. Unfortunately, these claims are false. Blockchains do not offer any real election security at all.

Internet voting has been studied by computer security researchers for over twenty years. Cyber security experts universally agree that no technology, including blockchains, can adequately secure an online public election. Elections have unique security and privacy requirements fundamentally different from and much more stringent than those in other applications, such as e-commerce. They are uniquely vulnerable because anyone on Earth can attack them, and a successful cyberattack might go completely undetected, resulting in the wrong people elected with no evidence that anything was amiss.

There are many foundational computer security problems that must be solved before we can safely conduct elections online, and we are not close to solving any of them. The use of blockchains does not even address these problems. Here are just a few:

No reliable voter identification: There is no foolproof way of determining exactly who is trying to vote remotely through the Internet. All known and proposed methods have grave weaknesses, and blockchains do not address the issue at all.

Malware: The voter’s device may be infected by a virus or counterfeit app that could change votes even before they are even transmitted, or it may silently discard the ballot, or send the voter’s name and vote choices to a third party, thereby enabling coercion, retaliation, vote buying and selling, or pre-counting of votes, all undetectably. Blockchains cannot address malware.

Denial of service attacks: A server can be overwhelmed with fake traffic from a botnet so that real ballots cannot get through. Blockchains as proposed for elections use multiple redundant servers, but they offer no additional protection against denial of service attacks beyond what is achievable with a conventional system having the same aggregate communication capacity.

Penetration attacks: No servers, including blockchain servers, are immune to remote penetration and surreptitious takeover by determined sophisticated attackers. Even though blockchains use multiple servers, if attackers can disable or gain control of more than 1/3 of them they can totally disrupt or control the outcome of the election.

Nonauditability: Online voting systems, including blockchain systems, do not allow for the kind of true, voter-verified paper ballot backup that is necessary for a meaningful recount, audit, or statistical spot check. Thus, the most powerful and common-sense tools we have for protection against cyberattack are unavailable.

Election security is a matter of national security. Blockchains, despite all the hype surrounding them, offer no defense against any of these well-known threats to which all online elections are vulnerable. National rivals like Russia have demonstrated a capacity and willingness to interfere with our electoral processes and would have no difficulty disrupting or undermining a blockchain election. In this era of ubiquitous cyber threats, it is reckless and irresponsible to introduce any kind of online voting in the U.S.

We emphasize that these are just a few of the problems. We especially note that any online voting system must be subject to a comprehensive, truly independent security review followed by sufficient open public testing. The current proposed system in West Virginia is touted publicly, yet its details and alleged security review are secret. Unlike Bitcoin that itself has proven vulnerable, the West Virginia system is apparently not open to the public to participate in holding the blockchain.

Israeli Firm Proves Our Point: Fax is as risky as Online Voting

As we have been saying for years, Online/Internet voting risks include email and fax voting.
<Since 2008>

Story today in the Washington Post:
Report: Hackers Target Fax Machines
Phone Line Connected To Computer Network Can Offer Access

As we have been saying for years, Online/Internet voting risks include email and fax voting.
<Since 2008>

Story today in the Washington Post:

Report: Hackers Target Fax Machines

Phone Line Connected To Computer Network Can Offer Access
By MIRANDA MOORE Washington Post

The fax machine is widely considered to be a dinosaur of inter-office communications, but it may also present a vulnerable point where hackers can infiltrate an organization’s network, according to a new report from Israel-based software company Check Point. The company said that the vulnerability was identified as a result of research intended to discover potential security risks, and not as the result of any attack.

Hackers can gain access to a network using the phone line connected to a fax machine, which is often connected to the rest of an organization’s network. By sending an image file that contains malicious software over the phone line, hackers are able to take control of the device and access the rest of the network. The researchers were able to do this using only a fax number, which is often widely distributed by organizations on business cards and websites.
The report estimates that there are more that 17 million fax machines in use in the United States alone. The legal and medical fields both continue to rely heavily on fax machines to conduct business, since they are widely considered to be a more secure form of transmitting sensitive information and signatures compared to email. Banking and real estate also frequently transfer documents containing signatures via fax.

With the advent of all-in-one products that include fax functions as well as printing and scanning, fax machines may be more prevalent in homes and office than people realize. This particular vulnerability only applies if such a machine is connected to a telephone line, however.

The only machines tested were from HP’s line of all-in-one printers, but according to the report, these vulnerabilities are likely to be found in machines from any manufacturer that use similar technology. HP issued a patch for its products before the report was published, which is available for download from its support website.

The report advises that if a fax machine is too old to support a software update, or if the manufacturer has yet to issue a patch to fix the vulnerability, fax capabilities should be used only on a segmented part of the network without access to critical data. The report also advises that the phone line connected to an all-in-one type machine should be disconnected if a user or organization does not use the fax functions.

It’s Impossible to Know (how) Your Internet Vote Counted

As West Virginia plans, once again, to allow Internet voting for military voters, it is a good time to remind everyone that Internet voting (web page, web application, email, fax voting etc.) are all unsafe for democracy. And that block-chains cannot solve those problems.

One of those problems is that there is no guarantee that your laptop or smart phone has not been hacked in a way that alters your vote. Another challenge is the, so called, Secret Ballot.

West Virginia’s new scheme involves block-chains which entrepreneurs bent on profit claim will make Internet voting safe <read>, Several years ago Secretary of the State, Denise Merrill, held a Symposium on Internet Voting including three experts and the Secretary of State of West Virginia. The problem is that block-chains fail to solve the major unsolved problems remaining preventing trusted Internet voting.

One of those problems is that there is no guarantee that your laptop or smart phone has not been hacked in a way that alters your vote, such that what you see is not what is presented and recorded by the actual voting system. A hack could fool you, the voting system, or both.

How easy is it to hack your laptop or smart phone? Check out this recent story by a computer expert, Micah Lee: It’s Impossible to Prove Your Laptop Hasn’t Been Hacked. I Spent Two Years Finding Out. <read> Do you understand the article? Lee, an expert, could not guarantee his own laptop was not hacked. Do you check your laptop to the level that Lee did for an experiment? Block-chains do not solve this.

Another challenge is the, so called, Secret Ballot – which requires that nobody can associate your vote with you. And that you cannot prove how you voted to anyone. There are Internet voting systems that let you check that your ballot was recorded properly, yet they cannot allow you to prove that to anyone else. Block-chains do not solve this.

Block-chains do provide assurance, that without a central authority, the vote sent to the voting system is not changed after it was recorded. Yet, that is unnecessary given that there is a central voting authority.

Do you need a blockchain? (Probably not!)

Blockchains are the latest technology to enter the mainstream. A blockchain powers and makes BitCoin possible. Many are treating blockchains as the next big breakthrough in technology. There is even a Blockchain Caucus in Congress.

Do not get your hopes up or bet your retirement savings on blockchains, they are definitely not the next Internet or Hula Hoop. Most importantly they will not transform elections or solve the challenges of online voting.

From IEEE Do You Need a Blockchain?

“I find myself debunking a blockchain voting effort about every few weeks,” says Josh Benaloh, the senior cryptographer at Microsoft Research. “It feels like a very good fit for voting, until you dig a couple millimeters below the surface.”

From IEEE Do You Need a Blockchain? <read>

Blockchain technology is, in essence, a novel way to manage data. As such, it competes with the data-management systems we already have. Relational databases…suffer from one major constraint: They put the task of storing and updating entries in the hands of one or a few entities, whom you have to trust won’t mess with the data or get hacked.

Blockchains, as an alternative, improve upon this architecture in one specific way—by removing the need for a trusted authority. With public blockchains…, a group of anonymous strangers (and their computers) can work together to store, curate, and secure a perpetually growing set of data without anyone having to trust anyone else. Because blockchains are replicated across a peer-to-peer network, the information they contain is very difficult to corrupt or extinguish.

This feature alone is enough to justify using a blockchain if the intended service is the kind that attracts censors…

However, removing the need for trust comes with limitations. Public blockchains are slower and less private than traditional databases, precisely because they have to coordinate the resources of multiple unaffiliated participants. To import data onto them, users often pay transaction fees in amounts that are constantly changing and therefore difficult to predict. And the long-term status of the software is unpredictable as well. Just as no one person or company manages the data on a public blockchain, no one entity updates the software. Rather, a whole community of developers contributes to the open-source code in a process that, in Bitcoin at least, lacks formal governance…

“If you don’t mind putting someone in charge of a database…then there’s no point using a blockchain, because [the blockchain] is just a more inefficient version of what you would otherwise do,” says Gideon Greenspan, the CEO of Coin Sciences, a company that builds technologies on top of both public and permissioned blockchains.

With this one rule, you can mow down quite a few blockchain fantasies. Online voting, for example, has inspired many well-intentioned blockchain developers, but it probably does not stand to gain much from the technology.

“I find myself debunking a blockchain voting effort about every few weeks,” says Josh Benaloh, the senior cryptographer at Microsoft Research. “It feels like a very good fit for voting, until you dig a couple millimeters below the surface.”

Benaloh points out that tallying votes on a blockchain doesn’t obviate the need for a central authority. Election officials will still take the role of creating ballots and authenticating voters. And if you trust them to do that, there’s no reason why they shouldn’t also record votes.

In my early days of advocacy, my congressman at a forum claimed that there would be no problems with electronic voting because of a magic new technology, “encryption”. It has not worked out that way. Like encryption, blockchains cannot protect against corruption of the computer itself – a laptop or smartphone used for online voting, an optical scanner or touch-screen voting machine, or the central server collecting and reporting results.

Amid Charges Russia Hacked U.S. Election, Keith Alexander Encourages eVoting for Canada

Former NSA Chief and now CEO cyber security contractor says Canada needs more cyber security, cyber weapons, and should deploy electronic voting: Don’t let cyberattack threat deter Canada from online voting, says former head of NSA

foreign interference that may have influenced the U.S. election should not deter Canada and other countries from embracing online voting, says the former head of the U.S. National Security Agency.

Retired U.S. general Keith Alexander, speaking at a defence industry trade show in Ottawa, also said it is important the Canadian military have some kind of offensive cyber capacity, even if that ability is limited.

There is no going back to a manual voting system, Alexander said in an interview with CBC News following his remarks to defence contractors, in which he warned that both government and private sector networks are vulnerable to a rising tide of “destructive” cyberattacks…

The U.S. experience is something to learn from, he said, but it should not make countries like Canada leery of e-voting.

Former National Security Agency director Keith Alexander, seen here testifying before the U.S. Senate intelligence committee in March, says Canada may need to develop an offensive cyber security posture or the ability to shut down cyberattacks. (Susan Walsh/Associated Press)

foreign interference that may have influenced the U.S. election should not deter Canada and other countries from embracing online voting, says the former head of the U.S. National Security Agency.

Retired U.S. general Keith Alexander, speaking at a defence industry trade show in Ottawa, also said it is important the Canadian military have some kind of offensive cyber capacity, even if that ability is limited.

There is no going back to a manual voting system, Alexander said in an interview with CBC News following his remarks to defence contractors, in which he warned that both government and private sector networks are vulnerable to a rising tide of “destructive” cyberattacks…

The U.S. experience is something to learn from, he said, but it should not make countries like Canada leery of e-voting.

“You can create a system where people can authenticate and vote online,” said Alexander, who in addition to running the NSA during the Edward Snowden leaks, was also head of the U.S. military’s cyber command.

We agree that everyone including all levels of the U.S. Government need to beef up cyber security. Yet, no system is yet, or ever will be completely secure. There are several reason against Internet Voting at this time:

No system has proven secure and likely cannot be made secure. Especially a system used over the Internet, presumably on consumers’ computers and smart phones.
Encryption is not sufficient and is not even safe, with holes provided by organizations within the U.S. Government.
Proposed systems for public online voting implementation do not and cannot provide voter verification and publicly verifiable auditing of results.
No commercial system has successfully passed a credible security audit or open security test. Most vendors have resisted any such testing.

Meanwhile it is pretty clear that U.S. voter registration systems were hacked before the November election. Consider the latest document leaked to the Intercept: Top-Secret NSA Report Details Russian Hacking Effort Days Before the 2016 Election <read> No evidence yet that the 2017 election was manipulated or deterred by such an attack, nor actual evidence that the Russian Government was involved. There is also little evidence to the contrary. A difficult thing to prove either way. One problem with the Internet and cybersecurity is that it is easy to make it look like someone else did it. Evidence that looks like Russian hackers could come from elsewhere, and even then its a far cry from Russian hackers to determining it was the Russian Government. From the Intercept:

The report, dated May 5, 2017, is the most detailed U.S. government account of Russian interference in the election that has yet come to light.

While the document provides a rare window into the NSA’s understanding of the mechanics of Russian hacking, it does not show the underlying “raw” intelligence on which the analysis is based. A U.S. intelligence officer who declined to be identified cautioned against drawing too big a conclusion from the document because a single analysis is not necessarily definitive.