Forgot your password?
typodupeerror
Crime Privacy The Internet United States Politics Your Rights Online

In Theory And Practice, Why Internet-Based Voting Is a Bad Idea 218

Posted by timothy
from the but-what-do-these-guys-know? dept.
A few countries, like Estonia, have gone for internet-based voting in national elections in a big way, and many others (like Ireland and Canada) have experimented with it. For Americans, with a presidential election approaching later this year, it's a timely issue: already, some states have come to allow at least certain forms of voting by internet. Proponents say online elections have compelling upsides, chief among them ease of participation. People who might not otherwise vote — in particular military personnel stationed abroad, but many others besides — are more and more reached by internet access. Online voting offers a way to keep the electoral process open to them. With online voting, too, there's no worry about conventional absentee ballots being lost or delayed in the postal system, either before reaching the voter or on the way back to be counted. The downsides, though, are daunting. According to RSA panelists David Jefferson and J. Alex Halderman, in fact, they're overwhelming. Speaking Thursday afternoon, the two laid out their case against e-voting.

(Read more for more, and look for a video interview with Halderman soon).


Jefferson and Halderman have impressive credentials as analysts and critics of internet voting. Jefferson, a computer scientist at Lawrence Livermore National Laboratory, is chairman of the board of the Verified Voting Foundation, an NGO focused on promoting election integrity, and coauthor of a report that spurred the Department of Defense to withdraw for further consideration its then-plan for online voting, called SERVE, in 2004. Halderman takes a different, hands-on approach, demonstrating (along with his grad students at the University of Michigan) just how polling-station election machines and online voting system can be compromised. "I've probably hacked into and otherwise found vulnerabilities in more polling places than anyone else," he says.

Jefferson and Halderman are careful to define the key element of elections they're trying to expose as unfixably broken: namely, the delivery of completed ballots over the internet, whether that means a web app, email or some other conduit, without a voter-verified paper audit trail. Some kinds of election technology can move from the voting booth to the online world with less risk to the integrity of the election itself — for instance, distribution of blank ballots, or even online voter registration. "This isn't about keeping score of primaries, or gathering information about candidates, but actually voting," said Jefferson. The risk of hacked elections isn't just the possibility of political rivals trying to out-do each other, he said; ultimately, vulnerable election systems compromise national security and ballot secrecy. Even a few hundred votes may suffice to swing a House or Senate race, and that can have cascading consequences for control of elected bodies themselves. "Wherever there's a concentration of votes sufficient to swing a major election, there's a national security concern."

Why assume that election systems can be manipulated? And since paper ballots are not immune to questionable or downright fraudulent counts, why call out the electronic version in particular? In part, he says, because the structure of an electronic voting system is inherently complex, and because it's difficult if not impossible to roll back results if a compromise is suspected. Unlike paper ballots (and in the absence of a paper audit trail backing an electronic voting system), online vote gathering offers no good way to re-count. Jefferson laid out four major and overlapping areas of likely attacks on internet voting systems, any one of which could taint the results of an election.

First, individual voting jurisdictions are vulnerable to attack. (In the U.S., for federal elections, that essentially means counties, totaling more than 7000.) Even in local races, there can be billions of dollars at stake in high-population counties like Cook County or L.A. County. Vendors, both their networks and their source code, are also at risk. Assuming that even best efforts can keep the source code behind the handful of election-system vendors safe is a sucker's bet, Jefferson says. Even large companies with enormous security resources have been hacked, with source code a prime target, as happened to Google and 25 other firms in 2010 in a breach attributed to Chinese operatives. "Who knows if those [online voting software] vendors have already been penetrated? You wouldn't have any idea," said Jefferson.

Even if both local voting authorities and e-voting software vendors were themselves able to deflect all attacks, voters using an online voting system on their home or office PCs would still be at the mercy of the weakest link of the chain — the security of the machines available to them. Targeted malware could be used to present a different set of on-screen options to a voter than it actually sends back to the election counters. Because one of the protections of a secret ballot is to make available to voters proof that they voted but not how they voted, individuals who intended to selected candidate A would have no reason to know their vote was cast for candidate B instead. Malware could also simply vote without user interaction. It may not be election related, but a large fraction of PCs are already infected with some kind of malware, showing how big a problem this could be.

Finally, pure network attacks (or even errors) could disrupt the integrity of an election; exactly that kind of attack brought much of Estonia's online traffic to a halt in May 2007; lucky for Estonians that was not during an election, because Estonia is one of the few countries that has fully adopted online voting. Perhaps more chilling is the brief re-routing in April 2010 of 15 percent of the world's internet traffic through China.

Insecurity on the internet is itself a long-standing problem, so why the fuss? Unlike financial crime, such as credit card fraud, election fraud is hard to detect, and even harder to correct for, in large part because ballot secrecy is key to fair elections.

Voting is different. "Superficially, you'd think the transactions are very similar [to financial transactions], but underneath, all the issues are completely different. The privacy requirements are completely different, for example," says Jefferson. To prevent coerced voting, or simple vote selling, "You're allowed to tell anyone how you voted all you want, but you're not allowed to have proof of how you voted." Rolling back results to investigate suspected breaches is impossible, Jefferson says, without exposing the actual votes of individuals, at the very least to election officials.

Investigating financial crime online is the opposite; there, figuring out exactly who did what and when is the whole point, and the evidence is easy to find: if banking credentials are stolen, he said, "some account will go to zero." But in the case of elections, it's more likely that "the wrong people take office, and life goes on, and it's just never discovered."

And while no election fraud has yet been attributed to it, the trend is growing to institute the version of online voting that Jefferson calls "the worst idea ever" — voting by email. 33 states have modded their voting systems to accept in some cases PDFs of scanned ballots through ordinary e-mail to be entered by election workers. The numbers may be small (typically, this form of voting is limited to overseas voters, and in some cases voters are asked to acknowledge that their vote cannot be kept secret), but this allowance means that "e-mail voting is very widespread in the United States."

While Jefferson works through Verified Voting to influence policy makers to lay out the case against online voting, J. Alex Halderman, in his role as an assistant professor at the University of Michigan, turns theory into reality: he and his students break election systems (devices as well as software) in the U.S. and abroad to show just how easily a malicious attacker could do the same. He offered as an example of several of the ways electronic voting can fail his successful attack on an internet voting plan (see this earlier Slashdot story) that was to have been implemented in 2010 in the District of Columbia. The District had, with Federal grant money, designed an online voting system and already put it nearly into production, and had mailed PINs and voter ID numbers to voters in anticipation.

To D.C.'s credit, Halderman says, the election officials at least asked first for advice from security experts around the country, and invited them to test it in advance of using the system in an actual election, though mere days before the system was to have gone live. "It's not every day you're invited to hack into government computers without the threat of jail hanging over your head," says Halderman, who was attracted to the challenge of investigating the system itself, as well as curiosity about how the D.C. officials would respond to a system compromise.

Though Halderman says the Ruby on Rails-based system was written in "generally clean code," his team discovered a shell injection vulnerability which gave them access to the D.C. system (see his full paper as a PDF for the details), and immediately set about playing.

Web apps tend to be brittle, says Halderman, and D.C.'s was no exception. "App frameworks are written in ways that allow small mistakes to have big consequences," especially when vulnerabilities are often widely disseminated soon after discovery, and not always by white hat hackers like him.

"The first thing we did was steal all the important stuff," he says — credentials, keys, and more. Simply snooping on the data wasn't enough to fully demonstrate the problems in the system, though; the team replaced the information on all of the ballots as well, replacing the actual candidates with ones of their choice, offering up options like Hall 9000, and Bender for school board, and forced client machines to play the University of Michigan's fight song, before erasing the logs that would have allowed their intrusion to be properly analyzed by the system's administrators.

Their attack also led them to gain full access to a terminal server on the same network, and after they'd hacked into this ("using the default password from the owner's manual," Halderman notes) they noticed there was evidence in the logs of other attacks. In particular, some of the attacks appearing to originate in Iran and in China. While Halderman doubts these represent an attack specifically on the DC system voting system, the evidence of such attacks is "an illustration of how vulnerable things are."

Halderman acknowledges that voting in person, especially by electronic means, is far from foolproof, but he joins Jefferson in saying that online voting is categorically worse, and suggests that everyone who takes an interest in security or the mechanics of democratic elections raise the issues of privacy and security. His conclusion and advice for election officials in the U.S.: Voting online is a bad idea, and it simply can't be fixed in the foreseeable future. All the security problems of e-voting machines at polling stations apply directly to internet voting, too, which means that anyone on Earth can attack an online election.

"If my vote is insecure, everyone else who lives under that same government is harmed by that."
This discussion has been archived. No new comments can be posted.

In Theory And Practice, Why Internet-Based Voting Is a Bad Idea

Comments Filter:
  • by Sir_Sri (199544) on Friday March 02, 2012 @05:35PM (#39225495)

    For the military in overseas operations in something like guam or airbases it's probably the most easy. Their deployments are scheduled by the government in advance, and they are there by orders of the government who will generally need to be able to speak with them before their deployment and generally during. You may need to make allowances that they need to vote either in advance (potentially days) or you need to accept a delay in the return of their results or a bit of both. Guam is also US territory, meaning there are official US government officials running the show who should be able to organize things. The same could be said of any area with an Embassy, since the election should be handled through the Embassy and consular offices. A flight from Guam to Hawaii is 7 hours. Vote on the island, load plane with ballots, fly to hawaii, or 5 more hours and Los Angles. This doesn't need to be hard.

    The guy who's screwed is an aid worker trying to get red cross supplies into Syria, aid into Somalia, that sort of thing. There's no official government presence where you can show up and connect to them, the deployments are arranged as needed, on short notice in many cases, and they may not have any sort of diplomatic baggage transfer system that you can access, especially without an embassy (think Iran, where even though US operations are going to be run out of someone elses embassy you don't necessarily want to hand the Iranians a list of all Americans in the country by virtue of asking them to vote).

    Now that doesn't mean the US government doesn't make life unnecessarily difficult for voting from Guam or Afghanistan or whatever, but there's no reason it needs to be. If you can get someone ammunition you can get them a ballot. And if you can't get them food or ammunition you generally know well enough in advance that they're being sent out.

    Submarines operating on long deployments submerged are basically screwed. But not Guam. Yes, you have to have some tolerance for early voting, that a person who's going to be deployed to a fire base for the next 2 months might not have a ballot on election day sort of thing. But if the military is running it, it really isn't that hard to handle an election, they may make it seem hard by choosing to be incompetent, which makes a lot of sense on the specific example of Guam of course.

  • by NicBenjamin (2124018) on Friday March 02, 2012 @06:27PM (#39226147)

    In Michigan the way the handicapped vote is simple: they bring a friend they trust who verifies their ballot is right. It's technically not a secret ballot, but so far it's worked fine.

    As for multiple languages, I think you don't understand the law very well. Russians, Poles, Germans, and French people do not have any legal right to demand ballots in their native tongues. Only Native Americans, Asian Americans, Hispanics, and Alaskan Natives do; and they only get them in jurisdictions where they make up a large portion of the population (10,000 people or 5% of the population, whichever is lower). New York State, for example, has Counties that print ballots in Spanish, Korean and Chinese. I wouldn't be surprised if there're more languages in Arizona, for the simple reason that AZ has a lot of Indian reservations which have populations speaking a Native American language.

  • by tlhIngan (30335) <slashdot@worfMOSCOW.net minus city> on Friday March 02, 2012 @06:53PM (#39226475)

    The only way to enforce such an act would be to require that voters present ID -- something to which I'm sure you'd be opposed.

    Here in Canada they do that.

    Here's how the elections are done. You arrive at the location, and present your voter card (fi registered) or ID (if not). The greeter will direct you to one of several tables set up for registering your vote. They will ask for government photo ID, and find you on the voter's list, to which you must then place your signature beside your name on the list.

    Then the volunteer tears a ballot off the the booklet, and records the serial number of the ballot beside your name. They hand you the ballot, and you got make your choices. When you return, you hand the ballot back, they tear off the serial number foil and deposit it in a bag. The now anonymized (there's no serial number anymore) ballot goes into the box.

    So now there's several safeguards.

    One - voter is assigned a ballot box. Thus the names and signatures on the registration sheet must correspond to a ballot, so there should be no extra nor short any ballots.

    Second, the serial number stubs are kept, and verified to ensure that the voter got the right ballot, and there too has to be the same number of stubs as voters. The unused books are returned and serial numbers verified to ensure proper count of unused ballots.

    If someone wanted to stuff the ballot box, they could, but they'd have to know exactly how many ballots there are, and do reprints of the ballots (since they're all numbered, the number of ballots left over plus the number of ballots cast or spoiled must equal the number printed).

    And the serial number is unique to the ballot - a different voting region will not have ballots with the same serial number - they are all unique.

    Still can't avoid fraud or voter intimidation, but there are plenty of checks available.

  • by AF_Cheddar_Head (1186601) on Friday March 02, 2012 @07:05PM (#39226601)

    Actually many jurisdictions make it extremely difficult for overseas military to vote with unrealistic deadlines for applying for the absentee ballot then mailing them out 10 days before the election and expecting to get them back by election day. 25 yrs in the service and I've seen many of the hassles that different jurisdictions use.

    Your idea about flying the ballot to LA is a non-starter as the ballots need to get back to my home jurisdiction to be counted. They already fly the mail. The real difficulty is complying with all the deadlines that are different for each state.

Truly simple systems... require infinite testing. -- Norman Augustine

Working...