Internet Voting | CTVotersCount.org

NonScience Nonsense, another claim of electronic voting security

In late June a respected source published a non-peer-reviewed article: The case for election technology Which despite its title is actually a marketing piece disguised as science, not for election technology but for electronic voting, including Internet voting. The case actually made is for skepticism and peer-review.

That skepticism is well addressed in posts by Jeremy Epstein and E. John Sebes: How not to measure security and A Hacked Case For Election Technology

In late June a respected source published a non-peer-reviewed article: The case for election technology <read>. Which despite its title is actually a marketing piece disguised as science, not for election technology but for electronic voting, including Internet voting. The case actually made is for skepticism and peer-review.

That skepticism is well addressed in posts by Jeremy Epstein and E. John Sebes: How not to measure security <read> and A Hacked Case For Election Technology <read>

From Epstein:

But the most outrageous statement in the article is this:

The important thing is that, when all of these methods [for providing voting system security] are combined, it becomes possible to calculate with mathematical precision the probability of the system being hacked in the available time, because an election usually happens in a few hours or at the most over a few days. (For example, for one of our average customers, the probability was 1×10-19. That is a point followed by 19 [sic] zeros and then 1). The probability is lower than that of a meteor hitting the earth and wiping us all out in the next few years—approximately 1×10-7 (Chemical Industry Education Centre, Risk-Ed n.d.)—hence it seems reasonable to use the term ‘unhackable’, to the chagrin of the purists and to my pleasure.

As noted previously, we don’t know how to measure much of anything in security, and we’re even less capable of measuring the results of combining technologies together (which sometimes makes things more secure, and other times less secure). The claim that putting multiple security measures together gives risk probabilities with “mathematical precision” is ludicrous. And calling any system “unhackable” is just ridiculous, as Oracle discovered some years ago when the marketing department claimed their products were “unhackable”. (For the record, my colleagues in engineering at Oracle said they were aghast at the slogan.)

As Ron Rivest said at a CITP symposium, if voting vendors have “solved the Internet security and cybersecurity problem, what are they doing implementing voting systems? They should be working with the Department of Defense or financial industry. These are not solved problems there.” If Smartmatic has a method for obtaining and measuring security with “mathematical precision” at the level of 1019, they should be selling trillions of dollars in technology or expertise to every company on the planet, and putting everyone else out of business.

We would add that just because an election happens over a short period is not a reason to claim any increased level of security or reduced vulnerability:

Programming election systems occurs months and weeks ahead of the election. Systems are vulnerable for their whole life up to and including each election. Its like saying air traffic control systems are not vulnerable to errors because directing each airplane occurs over a very short period of time in each control center. Of course that never happens.
And the rush to provide results quickly, all including the work of tired, lightly trained, technically challenged, and often partisan officials increases the vulnerability.
And the very suggestion of less vulnerability actually can have the effect of reducing vigilance, and increasing risk.

From Sebes:

I also disagree with most of Mugica’s comparisons between eVoting and paper voting because from a U.S. perspective (and I admit this review is all from a U.S.-centric viewpoint) it’s comparing the wrong two things: paperless eVoting verses hand-marked hand-counted paper ballots. It ignores the actual systems that are the most widely used for election integrity in the U.S.

Now, perhaps Mugica’s argument is for eVoting more broadly, without insisting on the paperless part. But in that case, most of America already has some form of eVoting, using voting machines and paper ballots or records, coupled with some form of paper ballot audit to detect malfunctioning machines. In that case, you don’t need to claim mythical security properties along with implied mythical perfect performance. If some equipment doesn’t work right – whether from hacks or good old fashioned software bugs – the audit can detect and correct the results.

1. The Article Misses the Point

This paper completely misses the point that it is not paper-voting vs. electronic-voting, but rather that each is insufficient. In reality, transparent (in technology and process), accurate, secure, and verifiable elections require a combination of people + paper + process + computers, each cross-checking the other. The majority of U.S. election officials now commonly understand this as the norm. Either that, or the author assumes that eVoting includes support for ballot audit (more below), and is arguing against paper-only hand-count elections—a practice that is no longer relevant in the U.S.

2. The Article Ignores Common U.S. Election Practices

“The security of a paper-based, manual vote with a manual count is extremely low. Single copies of each vote make them easy to tamper with or destroy.”

True, but only for the most procedurally simple methods of conducting hand counts or hand audits. Just last week, the state of Wisconsin conducted a public manual ballot audit that was a model of transparency and integrity.

Security is not the main issue for either hand count or machine count. Accuracy is.

We have long held that optical scan, including strong ballot security, sufficient audits and recounts is the best available system today.

Consensus Reached on Recommendations Toward the Future of Internet Voting

The U.S. Vote Foundation has released a report on the feasibility and requirements for Internet voting. This is the result of about eighteen months of work by computer scientists, security experts, and election officials. The goal was to answer definitively once and for all if Internet voting was feasible today or in the future.

The short version is the Internet voting is not ready for prime time, not ready for democracy. Yet, it is possible in the future that a system may be developed which could provide safe Internet voting. The paper lays out the requirements and testing criteria for such a system.

(Internet voting includes online voting, email voting, and fax voting).

The U.S. Vote Foundation has released a report on the feasibility and requirements for Internet voting: <press release> <report summary> <full report> This is the result of about eighteen months of work by computer scientists, security experts, and election officials. The goal was to answer definitively once and for all if Internet voting was feasible today or in the future.

(Internet voting includes online voting, email voting, and fax voting).

From the press release:

Developed by a team of the nation’s leading experts in election integrity, election administration, high-assurance systems engineering, and cryptography, the report starts from the premise that public elections in the U.S. are a matter of national security. The authors assert that Internet voting systems must be transparent and designed to run in a manner that embraces the constructs of end-to-end verifiability – a property missing from existing Internet voting systems…

As election technology evolves and more states evaluate Internet voting, caution on compromises to integrity and security is warranted, and according to the report, should be particularly avoided by the premature deployment of Internet voting. The report aims to list the security challenges that exist with Internet voting and emphasizes that research should continue as the threat landscape continues to shift. Existing proprietary systems that meet only a subset of the requirements cannot be considered secure enough for use in the U.S.

Key recommendations in the report to make Internet voting more secure and transparent include:

Any public elections conducted over the Internet must be end-to-end verifiable
End-to-End Verifiable systems must be in-person and supervised first
End-to-End Verifiable Internet Voting systems must be high assurance
End-to-End Verifiable Internet Voting systems must be usable and accessible to all voters
Maintain aggressive election R&D efforts

I would recommend that anyone supporting Internet voting read the Press Release, Summary, and Full Report and then recruit experts of equal credibility to do the work and make an equally compelling case refuting this report

“Security online today, is not up to the task of online voting today.”

My friend, Duncan Buell, sent along a .pdf with a blog post of his, Computer Security and the Risks of Online Voting, along with another blog post about drones Meet A.I. Joe

My friend, Duncan Buell, sent along a .pdf with a blog post of his, Computer Security and the Risks of Online Voting, along with another blog post about drones Meet A.I. Joe <read>

They are both worth reading and contemplating. Duncan’s focus is on the unique responsibility of computer scientists to warn the World of the dangers of Internet/Online voting. It is also a quick, high-level introduction to the relevant history and arguments:

many election officials around the country and around the world seem enchanted with the marketing hype of Internet voting software vendors and are buying in to the notion that we could—and should—vote online now and in the very near future.
Never mind the almost-daily reports of data breaches of financial organizations with deep pockets to spend on securing their computers. Never mind that governments, with shallower pockets, are routinely hacked…Election officials seem in awe of ill-defined vendor terms like “military-grade encryption.”…
Many U.S. states are toying with the notion of online voting, contracting their elections to private companies whose code has never been given a public vetting. As scientists, we would all probably rather be doing science than trying to find ways to convince the public and election officials that security online today is not up to the task of voting online today.

The second article highlights a risk similar to one that I have been contemplating myself, the take over of drones by opposing forces. In short we could fund and provide an enemy, including terrorists the power to defeat, kill, and terrorize us:

Even worse, can robots be hacked? The Iranians claim to have hacked an American drone and brought it down safely on their territory back in 2011.However it happened, they have it, and refused to return it when President Obama somewhat cheekily asked for it back. This incident should prompt us to consider the question: What if robots could be taken over and turned on their masters?

My concern is that if cars can be hacked, why not police vehicles, especially, those armored military vehicles now in the hands of our local police?

9 things about voting machines

The National Council of State Legislatures has a released a report on voting machines: Elections Technology: Nine Things Legislators May Want to Know

It makes a strong case for the importance of technology in elections, planning, and understanding the details. We especially an additional borrowed list within the report: Ten Things to Know About Selecting a Voting System

The National Council of State Legislatures has a released a report on voting machines: Elections Technology: Nine Things Legislators May Want to Know <read>

It makes a strong case for the importance of technology in elections, planning, and understanding the details.

“What makes you lose sleep?” That’s what NCSL staff asked members of the National Association of State Election Directors back in September 2012. The answer wasn’t voter ID, or early voting, or turnout, as we expected. Instead, it was this: “Our equipment is aging, and we aren’t sure we’ll have workable equipment for our citizens to vote on beyond 2016.”

That was NCSL’s wake-up call to get busy and learn how elections and technology work together. We’ve spent much of the last two years focusing on that through the Elections Technology Project, funded by the MacArthur Foundation. One thing we learned is that virtually all election policy choices have a technology component. Just two examples: vote centers and all-mail elections. While both can be debated based on such values as their effect on voters, election officials and budgets, neither can be decided without considering technology. Vote centers rely on e-poll books, and all-mail elections depend on optical scan equipment to handle volumes of paper ballots.

It points to the importance of security in voting systems, the risks of Internet voting and pointing out the ‘pressure’ to do Internet voting. We especially an additional borrowed list within the report:

Ten Things to Know About Selecting a Voting System

While NCSL was finalizing its list of “things to know,” Merle King, executive director of the Center for Election Systems at Kennesaw State University in Georgia was working on another brand-new list with a similar goal. His list focuses on what to look for when choosing a voting system. Interestingly, there are no points of disagreement between our list and his and no overlap.

1. A voting system is the core technology that drives and integrates the system—and it is the part the voter touches.

2. Know who does what and why. Without clearly defined roles and responsibilities, problems will occur.

3. The true cost of ownership is the cost to purchase, operate and maintain a voting system over its life span. It is more than you think.

4. The request for proposal (RFP) is your first, last and best chance to get the system requirements right. Systems are never better than the RFPs used to define the requirements.

5. Changing a voting system is like changing tires on the bus … without stopping. A transition plan may allow the seamless migration from the old system to the new system, with minimum disruption.

6. Training and education may cost more than the purchase price of the system when you factor in voter education, poll workers, election officials, etc.

7. How long will new systems last? What shortens their lives? What needs to be done before purchase to ensure long life?

8. All modern voting systems are “multimodal,” meaning they will have to function for vote-by-mail ballots, in-person voting, online ballot return, etc. That means flexibility in the architecture is required to avoid retrofitting later.

9. Either you manage vendors or they manage you. Pick.

10. Know the “known unknowns,” such as security, accessibility, auditability, usability, voter convenience, transparency of process and testing and certification requirements.

Should we trust Internet voting? A Video

A new video from a Princeton student.

Elections and Voting Summit Joseph Kiniry: Technical Tradeoffs

Last January I attended the annual Elections and Voting Summit. I was most interested in a presentation by Joseph Kiniry on Technical Trade0ffs. It is a relatively brief presentation, with some important thoughts: Online voting convenience vs. risks, transparent systems vs. proprietary rights etc.

Last January I attended the annual Elections and Voting Summit. I was most interested in a presentation by Joseph Kiniry on Technical Trade0ffs. It is a relatively brief presentation, with some important deep ideas: Online voting convenience vs. risks, transparent systems vs. proprietary rights, etc.

Internet Voting Roundup: At the Not-OK Corral

Texas likes to do things big. But when it comes to Internet voting it is as they say “All hat and no cattle”.

We always tend to side with science and the best independent expert analysis, and tend to be skeptical of vendors seeking profit and officials looking for the easy way to look good.

Texas likes to do things big. But when it comes to Internet voting it is as they say “All hat and no cattle”. As reported in Election Line Bexar County successfully tests email ballots for military members<read>

Under a bill approved by the Texas Legislature, in 2014 Callanen was allowed to not only email ballots to service members, but she was also able to accept voted ballots via email from military members serving in hostile fire zones.

According to a report from the secretary of state’s office, the pilot program in Bexar was a success even if the numbers were small. In the May 2014 primary the county received three ballots via email and in the November 2014 general election eight ballots were returned via email.

Service members must first sign an affidavit confirming that they are indeed in a hostile fire zone. Then they are assigned a one-time use secure email address, are sent their ballot, allowed to vote it and return it to the county.

Three ballots, eight ballots pretty slim test an not much success to fill much of a hat. We point out that there is not much to a “secure email address” unless those service members use some very very strong and difficult encryption methods along with the county. Others wonder how that email address was sent to those service members – Was it through some secure email address developed by the service member? Perhaps they could help out Sony, whose email was allegedly hacked by North Korea, and with those same emails provided for all to see at Wikileaks. We wonder how much did such security such cost to develop our purchase? – we will learn this a bit later.

“It took a lot of push and shove,” Callanen said “[Because] the presumption was that it was so close to Internet voting. We had to make sure it was absolutely secure.”

That seems to be a pretty common error – that emails are somehow sent without the Internet or somehow do not constitute Internet voting. Emails use the Internet and if anything are less secure that online voting. Perhaps because, in addition to compromise in transit, they are easily and often, must be, seen by people – local election officials:

The county has a dedicated computer set up in the tabulation room to receive the ballots. Only three people in the office, all who have also signed sworn affidavits, including Callanen, have access to the computer. Once received, the ballot is remade onto an optical scan ballot, put in a secrecy envelope and treated like any other ballot.

And apparently that “secure email” came at very little cost and effort:

“We did this on a thin dime,” Callanen said. “Sure it takes some time to have the computer people set up the emails, but we’ve gone from mailing thousands of ballots to emailing them.”

We can be sure it works because they did an apparently confidential (secure?) survey that proved how wonderful it was. They actually claim about 1400% a response rate from the small base of users, supposedly in combat zones:

Following the elections, Callanen surveyed the service members using Survey Monkey to find out how they felt about the process and got back more responses to the survey — 117 — than they did ballots.

“The general response was that it’s wonderful,” Callanen said. “I wish you could see the raw, unedited comments we got.”

Obviously they did not use a secure email to send the survey to the actual users.

Meanwhile, just how secure is Internet/Email voting? Some good and not so good news from McClachyDC: As states warm to online voting, experts warn of trouble ahead <read>

The not so good news and some good news:

A Pentagon official sat before a committee of the Washington State Legislature in January and declared that the U.S. military supported a bill that would allow voters in the state to cast election ballots via email or fax without having to certify their identities.

Military liaison Mark San Souci’s brief testimony was stunning because it directly contradicted the Pentagon’s previously stated position on online voting:

It’s against it.

Along with Congress, the Defense Department has heeded warnings over the past decade from cybersecurity experts that no Internet voting system can effectively block hackers from tampering with election results.

And email and fax transmissions are the most vulnerable of all, according to experts, including officials at the National Institute of Standards and Technology, which is part of the Commerce Department.

San Souci declined to comment. A Pentagon spokesman, Lt. Cmdr. Nathan Christensen, said the Defense Department “does not advocate for the electronic transmission of any voted ballot, whether it be by fax, email or via the Internet.”

The Washington state legislation is dead for this year. But the episode provides a window into how the voting industry, with an occasional boost from the Pentagon, is succeeding in selling state and local officials on the new technology, despite predictions of likely security breaches.

It’s also put state lawmakers and election officials at odds with their counterparts in the other Washington: the nation’s capital…

Susannah Goodman, director of a voting integrity project for the citizens’ lobby Common Cause, worries that many state officials lack the technical expertise to avoid being manipulated by the vendors.

“I’ve seen the vendors characterize their products as being secure when the most prominent cybersecurity experts in the country will tell you they’re not,” she said. “The state legislators and the election officials are only hearing from one side. . . . That’s putting our democracy at risk.”

For example, election officials in Washington’s Pierce and King counties, which include the Tacoma and Seattle metro areas, offer voters the option of faxing or emailing ballots. They said the process was not online voting – even though emails travel over the Internet.

We always tend to side with science and the best independent expert analysis, and tend to be skeptical of vendors seeking profit and officials looking for the easy way to look good.

UK Considers risky online voting…Safe enough for democracy?

Guardian article, apparently titled by an editor who trusts MPs opinions more than scientists and experience: Why electronic voting isn’t secure – but may be safe enough .

Safe enough, not for democracy. The link to the article says it better “Why Electronic Voting is NOT SECURE.

Guardian article, apparently titled by an editor who trusts MPs opinions more than scientists and experience: Why electronic voting isn’t secure – but may be safe enough <read>

Safe enough, not for democracy. The link to the article says it better “Why Electronic Voting is NOT SECURE.

From the Article:

The UK has run trials for local elections before – in 2002, 2003 and 2007 – and Estonia famously became the first to offer online voting for its general election for parliament in 2007.

However, Meg Hillier, Labour MP and member of the digital commission that wrote the 2020 report, admitted that the team was “not set up to investigate in detail the issues of security and the mechanisms for delivering that,” hoping that the Electoral Commission “and others will take that on”…

The MPs debating that report all accepted that e-voting security was a concern, but believe the challenges are outweighed by the benefits.

Campaign group WebRoots Democracy laid out the argument for online votes in its own report, claiming two thirds of respondents to a survey would be more likely to vote if they could do so online, and that’s particularly true for younger voters.

Plus, the report claimed online voting would cut the cost per vote by a third to £2.59 and reduce the number of accidentally spoiled ballots.

Those same promises have been made before, each time the UK has previously trialled the idea. In 2002, five city councils let voters cast a ballot by home internet, text message and “kiosk”; in 2003, that was expanded to 14 councils.

Turnout increased by an average 4.9 points, but varied widely, with South Tyneside leaping by 20 percentage points and Vale Royal sliding by two points.

Following the 2003 elections, a report by the BBC showed e-voting “failed to make much of an impact”. Voters were given a ballot number and a PIN, but there were issues with technology – in St Albans, PCs in polling booths had connectivity issues and had to be abandoned for paper ballots…

All of the potential benefits are moot if we can’t trust the result, but so far there haven’t been any attacks against e-voting systems – or at least none we’re aware of.

As a report into e-voting in Switzerland from Harvard’s cyber law department pointed out, the digital option has remained poorly used by the electorate.

“It is reasonable to assume, however, that the systems will be exposed to higher numbers of attempted attacks and manipulation as the use of e-voting becomes more widespread,” the report noted.

If the government does press forward with e-voting trials, as it appears set to do, it needs to get some experts in, Anderson said – and there’s one Green politician who knows the issue inside and out.

UK should consider e-voting, elections watchdog urges

Despite spending years developing GNU.FREE, a free online voting system, Jason Kitcat – leader of Brighton and Hove City Council – isn’t a fan of e-voting (nor is his party).

“Through working on this I came to the conclusion, now shared by most computer scientists, that e-voting cannot be delivered securely and reliably with current technology. So I stopped developing the system but continued to campaign on and research the issues,” he said…

“When I and colleagues have monitored trials we have always observed serious flaws in the security and reliability of the systems used,” he said. “Yes, we have found problems every single time, and we have documented these at great length in peer-reviewed articles.”

Kitcat argued there are three requirements for robust political elections: security, anonymity and verifiability. “Meeting those three requirements is a very difficult problem quite unlike other transactions,” he said….

”Online banking suffers problems but refunds are possible after checking your bank statement. You can’t ‘refund’ a vote and ‘vote statements’ can’t be provided to check your vote was correctly recorded as that would enable vote selling and coercion.”
All that paper in standard ballots may seem old fashioned, but it leaves a trail that votes cast from PCs and phones don’t, agreed other experts. “There’s a fundamental conflict between verification and keeping votes anonymous,” Jim Killock, executive director of the Open Rights Group. “Paper ballots do this very neatly but computers find this hard because they leave audit trails.”

Voting away from polls raises the spectre of vote manipulation, explained Ross Anderson, a computer security professor at the University of Cambridge.

“When you move from voting in person to voting at home (whether by post, by phone or over the internet) it vastly expands the scope for vote buying and coercion, and we’ve seen this rising steadily in the UK since the 2001 election where postal votes first became a right,” he said. “All the parties have been caught hustling up the vote in various ways.”…

“Internet voting is frankly scary,” he said. “When security experts looked at the Estonia election, they were shocked at how easy it was to defraud the system and steal votes … We shouldn’t gamble with democracy.”

Lack of transparency is another major security issue – especially if the data collection, analysis and storage happens in IT systems that aren’t fully transparent or are difficult to understand.

New South Wales wails: Researchers find flaws in Internet voting system

New South Wales, Australia is holding an election with a significant number of online votes. Researchers point out several concerns…

New South Wales, Australia is holding an election with a significant number of online votes. Researchers point out several concerns:

Votes could have been easily changed with nobody the wiser
The touted user verification has its own flaws.
The system was taken down to fix (correct) the ballot.
The source code is not disclosed, so there is no means to assess its vulnerabilities

Read the summary report and the researchers response to the response/criticisms from New South Wales officials <read>

As the summary concludes, this is not the first time flaws and risks have been exposed in Internet voting schemes:

The vulnerability to the FREAK attack [name for the particular attack mechanism demonstrated] illustrates once again why Internet Voting is hard to do securely. The system has been in development for years, but FREAK was announced only a couple of weeks before the election. Perhaps there wasn’t time to thoroughly retest the iVote system for exposure. We can bet that there are one or more major HTTPS vulnerabilities waiting to be discovered (and perhaps already known to sophisticated attackers). Verification is a vital safeguard against such unknown problems, but at best it detects problems rather than preventing them.

To election security researchers, these problems aren’t surprising. We’ve already seen dire security problems with Internet voting in Estonia and Washington, D.C. Securing Internet voting requires solving some of the hardest problems in computer security, and even the smallest mistakes can undermine the integrity of the election result. That’s why most experts agree that Internet voting cannot be adequately secured with current technology.

Digital Democracy Good – for Voting Bad Bad Bad!

Our friends across the pond are thinking of Internet Voting. Tech unsavvy elders apparently want to entice young voters. Hopefully, the young are savvy enough to understand the security risks and are too smart to trust democracy to smart phones.

Editorial in ComputerWorldUK highlighted at TheVotingNews: Digital Democracy? – Yes, Please; but Not Online Voting

Editorial in ComputerWorldUK highlighted at TheVotingNews: Digital Democracy? – Yes, Please; but Not Online Voting <read>

Enabling people to vote online would indeed draw in many young people who otherwise wouldn’t vote, and that’s hugely important. So why am I against the idea? Well, the report quotes a good encapsulation of the key issues here by the Open Rights Group:

Voting is a uniquely difficult question for computer science: the system must verify your eligibility to vote; know whether you have already voted; and allow for audits and recounts. Yet it must always preserve your anonymity and privacy. Currently, there are no practical solutions to this highly complex problem and existing systems are unacceptably flawed.

Another warning [.pdf] comes from a formidable trio of security researchers in their submission to the Digital Democracy Commission:

In our view, the adoption of online voting technology would present extremely grave challenges to the integrity of UK elections, and risk disadvantaging significant sections of the population, which would present a real danger of undermining public confidence in democracy rather than strengthening it as the Commission rightly seeks to do.

Finally, people who oppose the use of new technology for well-established activities are sometimes accused of being Luddites and of letting their ignorance stand in the way of perfectly acceptable change. In the case of e-voting, we believe that the more familiar people are with the technology, the more they understand the very substantial risks that it poses to the democratic process. It is ignorance that leads people to suppose that e-voting is risk-free and desirable; and it is technical experts such as us (and our colleagues whose carefully-argued papers we have cited) who are cautioning against embracing e-voting for the foreseeable future.