156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
1 |
\documentclass{article}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
2 |
\usepackage{../style}
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
3 |
\usepackage{../langs}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
4 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
5 |
\begin{document}
|
466
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
6 |
\fnote{\copyright{} Christian Urban, 2014, 2015, 2016}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
7 |
|
415
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
8 |
|
456
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
9 |
%% second angle of the problem
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
10 |
%Jonathan Zittrain is interested in algorithmic accountability,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
11 |
%from Facebook’s ability to tell that two people are in a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
12 |
%relationship before they announce it, to their ability to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
13 |
%engineer an election by prompting one side’s supporters.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
14 |
%They’d be in the soup if they were caught, but they have been
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
15 |
%near the soup a number of times. One internal meeting had the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
16 |
%question “What responsibility does FB have to prevent
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
17 |
%President Trump?†That has repudiated once leaked, but the age
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
18 |
%of innocence is behind us. Back in 2005 Google apologised when
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
19 |
%the hate site “jew watch news†appeared in search results for
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
20 |
%“jewâ€; but the site has morphed from tool to friend.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
21 |
%Facebook’s M and Apple’s Siri are the same. This leads
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
22 |
%Jonathan to the idea of “information fiduciaries†whereby the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
23 |
%big firms would have to put user welfare first like doctors or
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
24 |
%lawyers. Should Google tell you to vaccinate your child?
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
25 |
%Already in Europe they suppress hate speech and promote
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
26 |
%counter-narratives. To whom does Uber owe a fiduciary duty –
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
27 |
%the driver or the passenger? And should data scientists join
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
28 |
%divines, medics, lawyers and surveyors as a learned
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
29 |
%profession?
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
30 |
|
461
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
31 |
% recent
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
32 |
%http://www.secretballotatrisk.org
|
462
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
33 |
%
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
34 |
%Andrew Appel has a good two-part essay on securing elections.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
35 |
%https://freedom-to-tinker.com/blog/appel/security-against-election-hacking-part-1-software-independence/
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
36 |
%https://freedom-to-tinker.com/blog/appel/security-against-election-hacking-part-2-cyberoffense-is-not-the-best-cyberdefense/
|
415
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
37 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
38 |
\section*{Handout 2 (E-Voting)}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
39 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
40 |
In security engineering, there are many counter-intuitive
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
41 |
phenomena: for example I am happy (more or less) to use online
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
42 |
banking every day, where if something goes wrong, I can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
43 |
potentially lose a lot of money, but I am staunchly against
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
44 |
using electronic voting (let's call it e-voting for short).
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
45 |
E-voting is an idea that is nowadays often promoted in order
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
46 |
to counter low turnouts in elections\footnote{In my last local
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
47 |
election where I was eligible to vote only 48\% of the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
48 |
population have cast their ballot. I was, I shamefully admit,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
49 |
one of the non-voters.} and generally sounds like a good idea.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
50 |
Right? Voting from the comfort of your own home, or on your
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
51 |
mobile on the go, what could possibly go wrong? Even the UK's
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
52 |
head of the Electoral Commission, Jenny Watson, argued in 2014
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
53 |
in a Guardian article that the UK should have e-voting. Her
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
54 |
plausible argument is that 76\% of pensioners in the UK vote
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
55 |
(in a general election?), but only 44\% of the under-25s. For
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
56 |
which constituency politicians might therefore make more
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
57 |
favourable (short-term) decisions is clear. So being not yet
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
58 |
pensioner, I should be in favour of e-voting, no?
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
59 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
60 |
Well, it turns out there are many things that can go wrong
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
61 |
with e-voting, as I like to argue in this handout. E-voting in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
62 |
a ``secure way'' seems to be one of the things in computer
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
63 |
science that are still very much unsolved. It is not on the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
64 |
scale of Turing's halting problem, which is proved that it can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
65 |
never be solved in general, but more in the category of being
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
66 |
unsolvable with current technology. This is not just my
|
195
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
67 |
opinion, but also shared by many security researchers amongst
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
68 |
them Alex Halderman, who is the world-expert on this subject
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
69 |
and from whose Coursera course on Securing Digital Democracy I
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
70 |
have most of my information and inspiration on this topic. It
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
71 |
is also a controversial topic in many countries:
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
72 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
73 |
\begin{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
74 |
\item The Netherlands between 1997--2006 had electronic voting
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
75 |
machines, but ``hacktivists'' had found they can be
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
76 |
hacked to change votes and also emitted radio signals
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
77 |
revealing how you voted. Now e-voting has been abandoned
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
78 |
in the Netherlands.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
79 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
80 |
\item Germany conducted pilot studies with e-voting, but in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
81 |
2007 a law suit has reached the highest court and it
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
82 |
rejected e-voting on the grounds of the mechanisms
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
83 |
behind it not being understandable to the general
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
84 |
public.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
85 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
86 |
\item UK used optical scan voting systems in a few trail
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
87 |
polls, but to my knowledge does not use any e-voting in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
88 |
elections.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
89 |
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
90 |
\item The US used mechanical machines since the 1930s, later
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
91 |
punch cards, now DREs and optical scan voting machines.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
92 |
But there is a lot of evidence that DREs and optical
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
93 |
scan voting machines are not as secure as they should
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
94 |
be. Some states experimented with Internet voting, but
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
95 |
all experiments have been security failures. One
|
466
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
96 |
exceptional election happened just after hurricane Sandy
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
97 |
in 2012 when some states allowed emergency electronic
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
98 |
voting. Voters downloaded paper ballots and emailed them
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
99 |
back to election officials.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
100 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
101 |
\item Estonia used since 2007 the Internet for national
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
102 |
elections. There were earlier pilot studies for voting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
103 |
via Internet in other countries.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
104 |
|
328
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
105 |
\item The Australian parliament ruled in 2014 that e-voting is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
106 |
highly vulnerable to hacking and will not use it any time
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
107 |
soon. That is because it is still not as secret and
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
108 |
secure as paper ballots, the parliamentary committee
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
109 |
in charge concluded.
|
445
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
110 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
111 |
\item Norway experimented with Internet voting, but their
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
112 |
interest fizzled away after some tries. Their idea was
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
113 |
to get Internet voting ``right'' --- it is a small,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
114 |
prosperous and stable country, which can afford with
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
115 |
playing with new ways of exercising their democratic
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
116 |
voting rights. Well, e-voting is an incredibly difficult
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
117 |
problem, even in such favourable circumstances, as
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
118 |
explained in this video from the Chaos Computer Club
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
119 |
conference in 2014:
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
120 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
121 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
122 |
\url{https://www.youtube.com/watch?v=KawZ3m_EeSU}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
123 |
\end{center}
|
328
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
124 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
125 |
\item India uses e-voting devices since at least 2003. They
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
126 |
use ``keep-it-simple'' machines produced by a
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
127 |
government owned company. There was some trouble for
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
128 |
an Indian researcher after he and an international
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
129 |
team of hackers showed that the devices are not
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
130 |
as secure as the government claimed.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
131 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
132 |
\item South Africa used software for its tallying in the 1993
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
133 |
elections (when Nelson Mandela was elected) and found
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
134 |
that the tallying software was rigged, but they were
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
135 |
able to tally manually.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
136 |
\end{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
137 |
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
138 |
\noindent If you are interested in the recent state of affairs
|
447
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
139 |
of e-voting machinery, I recommend a talk by Jeremy Epstein
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
140 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
141 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
142 |
\url{https://www.usenix.org/sites/default/files/conference/protected-files/jets15_slides_epstein.pdf}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
143 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
144 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
145 |
\noindent The abstract says:
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
146 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
147 |
\begin{quote}\it
|
466
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
148 |
``In April 2015, the US Commonwealth of Virginia decertified the
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
149 |
Advanced Voting Solutions (AVS) WinVote voting machine, after
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
150 |
concluding that it was insecure. This talk presents the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
151 |
results of Virginia's analysis of the WinVote, and explores
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
152 |
how we got to the point where a voting machine using an
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
153 |
unpatched version of Windows XP from 2004, using hardwired WEP
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
154 |
keys and administrator passwords, could be used for over a
|
466
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
155 |
decade in most of Virginia.''
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
156 |
\end{quote}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
157 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
158 |
The reason that e-voting is such a hard problem is that we
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
159 |
have requirements about the voting process that conflict with
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
160 |
each other. The five main requirements for voting in general
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
161 |
are:
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
162 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
163 |
\begin{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
164 |
\item {\bf Integrity}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
165 |
\begin{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
166 |
\item By this we mean that the outcome of the vote matches
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
167 |
with the voters' intend. Note that it does not say
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
168 |
that every vote should be counted as cast. This might
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
169 |
be surprising, but even counting paper ballots will
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
170 |
always have an error rate: people after several hours
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
171 |
looking at ballots will inevitably miscount votes. But
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
172 |
what should be ensured is that the error rate does not
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
173 |
change the outcome of the election. Of course if
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
174 |
elections continue to be on knives edges we need to
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
175 |
strive for rather small error rates.
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
176 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
177 |
\item There might be gigantic sums at stake and need to be
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
178 |
defended against. The problem with this is that if
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
179 |
the incentives are great and enough resources are
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
180 |
available, then maybe it is feasible to mount a DoS
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
181 |
attack against the voting server and by bringing the
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
182 |
system to its knees, change the outcome of an
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
183 |
election. Not to mention to hack the complete
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
184 |
system with malware and change votes undetectably.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
185 |
\end{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
186 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
187 |
\item {\bf Ballot Secrecy}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
188 |
\begin{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
189 |
\item Nobody can find out how you voted. This is to avoid
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
190 |
that voters can be coerced to vote in a certain way
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
191 |
(for example by relatives, employers etc).
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
192 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
193 |
\item (Stronger) Even if you try, you cannot prove how
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
194 |
you voted. The reason for this is that you want to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
195 |
avoid vote coercion, but also vote selling. That
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
196 |
this can be a problem is proved by the fact that
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
197 |
some jokers in the recent Scottish referendum tried
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
198 |
to make money out of their vote. \end{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
199 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
200 |
\item {\bf Voter Authentication}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
201 |
\begin{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
202 |
\item Only authorised voters can vote up to the permitted
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
203 |
number of votes (in order to avoid the ``vote early,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
204 |
vote often'').
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
205 |
\end{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
206 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
207 |
\item {\bf Enfranchisement}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
208 |
\begin{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
209 |
\item Authorised voters should have the opportunity to vote.
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
210 |
This can, for example, be a problem if you make the
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
211 |
authorisation dependent on an ID card, say a driving
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
212 |
license. Then everybody who does not have a license
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
213 |
cannot vote. While this sounds an innocent
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
214 |
requirement, in fact some parts of the population for
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
215 |
one reason or another just do not have driving
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
216 |
licenses. They are now excluded. Also if you insist on
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
217 |
paper ballots you have to have special provisions for
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
218 |
blind people. Otherwise they too cannot vote.
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
219 |
\end{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
220 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
221 |
\item {\bf Availability}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
222 |
\begin{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
223 |
\item The voting system should accept all authorised votes
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
224 |
and produce results in a timely manner. If you move
|
195
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
225 |
an election online, you have to guard against DoS
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
226 |
attacks for example.
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
227 |
\end{itemize}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
228 |
\end{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
229 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
230 |
\noindent While these requirements seem natural, the problem
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
231 |
is that they often clash with each other. For example
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
232 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
233 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
234 |
integrity vs.~ballot secrecy\\
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
235 |
authentication vs.~enfranchisement
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
236 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
237 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
238 |
\noindent If we had ballots with complete voter
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
239 |
identification, then we can improve integrity because we can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
240 |
trace back the votes to the voters. This would be good when
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
241 |
verifying the results or when recounting. But such an
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
242 |
identification would violate ballot secrecy (you can prove to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
243 |
somebody else how you voted). In contrast, if we remove all
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
244 |
identification for ensuring ballot secrecy, then we have to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
245 |
ensure that no ``vote-stuffing'' occurs. Similarly, if we
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
246 |
improve authentication by requiring to be present at the
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
247 |
polling station with an ID card, then we exclude absentee
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
248 |
voting.
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
249 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
250 |
To tackle the problem of e-voting, we should first have a look
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
251 |
into the history of voting and how paper-based ballots
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
252 |
evolved. Because also good-old-fashioned paper ballot voting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
253 |
is not entirely trivial and immune from being hacked. We know
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
254 |
for sure that elections were held in Athens as early as 600
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
255 |
BC, but might even date to the time of Mesopotamia and also in
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
256 |
India some kind of republics might have existed before the
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
257 |
Alexander the Great invaded them. Have a look at Wikipedia about
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
258 |
the history of democracy for more information. These elections
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
259 |
were mainly based on voting by show of hands. While this
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
260 |
method of voting satisfies many of the requirements stipulated
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
261 |
above, the main problem with hand voting is that it does not
|
195
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
262 |
guaranty ballot secrecy. As far as I know the old Greeks and
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
263 |
Romans did not perceive this as a problem, but the result was
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
264 |
that their elections favoured rich, famous people who had
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
265 |
enough resources to swing votes. Even using small coloured
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
266 |
stones, which were also used at that time, did not really
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
267 |
mitigate the problem with ballot secrecy. The problem of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
268 |
authorisation was solved by friends or neighbours vouching for
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
269 |
you to prove you are eligible to vote (there were no ID cards
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
270 |
in ancient Greece and Rome).
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
271 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
272 |
Starting with the French Revolution and the US constitution,
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
273 |
people began to value a more egalitarian approach to voting
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
274 |
and electing officials. This was also the time where paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
275 |
ballots started to become the prevailing form of casting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
276 |
votes. While more resistant against voter intimidation, paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
277 |
ballots need a number of security mechanisms to avoid fraud.
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
278 |
For example you need voting booths for being able to fill out
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
279 |
the ballot in secret. Also transparent ballot boxes are often
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
280 |
used in order to easily detect and prevent vote stuffing
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
281 |
(prefilling the ballot box with false votes).
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
282 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
283 |
\begin{center}
|
199
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
284 |
\includegraphics[scale=2.5]{../pics/ballotbox.jpg}
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
285 |
\end{center}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
286 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
287 |
\noindent Another security mechanism is to guard the ballot
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
288 |
box against any tampering during the election until counting.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
289 |
The counting needs to be done by a team potentially involving
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
290 |
also independent observers.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
291 |
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
292 |
One interesting attack against completely anonymous paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
293 |
ballots is called \emph{chain vote attack}. It works if the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
294 |
paper ballots are given out to each voter at the polling
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
295 |
station. Then an attacker can give a prefilled ballot to a
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
296 |
voter. The voter uses this prefilled ballot to cast the vote,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
297 |
and then returns the empty ballot paper back to the attacker who now
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
298 |
compensates the voter. The blank ballot can be reused for the
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
299 |
next voter. I let you ponder why it is important for this
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
300 |
attack that the voter returns the empty ballot to the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
301 |
attacker.
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
302 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
303 |
To sum up, the point is that paper ballots have evolved over some time
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
304 |
and no single best method has emerged for preventing fraud.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
305 |
But the involved technology is well understood in order to
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
306 |
provide good enough security with paper ballots\ldots{}unless
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
307 |
you lived in Florida at around 2000.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
308 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
309 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
310 |
\subsection*{E-Voting}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
311 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
312 |
If one is to replace paper ballots by some electronic
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
313 |
mechanism, one should always start from simple premise taken
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
314 |
from an Australian government white paper about e-voting:
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
315 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
316 |
\begin{quote} \it ``Any electronic voting system should
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
317 |
provide at least the same security, privacy and transparency
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
318 |
as the system it replaces.''
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
319 |
\end{quote}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
320 |
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
321 |
\noindent Whenever people argue in favour of e-voting, they
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
322 |
seem to be ignoring this basic premise.\bigskip
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
323 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
324 |
\noindent After the debacle of the Florida presidential
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
325 |
election in 2000, many voting pre\-cincts in the US used
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
326 |
Direct-Recording Electronic voting machines (DREs) or optical
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
327 |
scan machines. One popular model of DREs was sold by a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
328 |
company called Diebold. In hindsight they were a complete
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
329 |
disaster: the products were inadequate and the company
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
330 |
incompetent. Direct recording meant that there was no paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
331 |
trail, the votes were directly recorded on memory cards. Thus
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
332 |
the voters had no visible assurance whether the votes were
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
333 |
correctly cast. Even if there is a printout provided;
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
334 |
it does not give any guaranty about what is recorded on
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
335 |
the memory card.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
336 |
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
337 |
The machines behind these DREs were ``normal'' Windows
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
338 |
computers, which could be used for anything, for example for
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
339 |
changing votes. Why did nobody at Diebold think of that? I
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
340 |
have no idea. But that this was eventually done undetectably
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
341 |
is the result of the determination of ethical hackers like
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
342 |
Alex Halderman. His group thoroughly hacked Diebold's DREs
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
343 |
showing that election fraud with them is easily possible. They
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
344 |
even managed to write a virus that infected the whole system
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
345 |
by having only access to a single machine.
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
346 |
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
347 |
\begin{figure}[t]
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
348 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
349 |
\begin{tabular}{c}
|
199
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
350 |
\includegraphics[scale=0.45]{../pics/dre1.jpg}\;
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
351 |
\includegraphics[scale=0.40]{../pics/dre2.jpg}\smallskip\\
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
352 |
\includegraphics[scale=0.5]{../pics/opticalscan.jpg}
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
353 |
\end{tabular}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
354 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
355 |
\caption{Direct-Recording Electronic voting machines above;
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
356 |
an optical scan machine below.\label{machines}}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
357 |
\end{figure}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
358 |
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
359 |
What made matters worse was that Diebold tried to hide their
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
360 |
incompetence and the inferiority of their products by
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
361 |
requiring that election counties must not give the machines up
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
362 |
for independent review. They also kept their source code
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
363 |
secret. This meant Halderman and his group could not obtain a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
364 |
machine through the official channels, but whoever could hope
|
466
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
365 |
that prevented them from obtaining a machine? Ok, they got one.
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
366 |
They then had to reverse engineer the source code in order to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
367 |
design an attack. What all this showed is that a shady
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
368 |
security design is no match for a determined hacker.
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
369 |
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
370 |
Apart from the obvious failings (for example no paper trail),
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
371 |
this story also told another side. While a paper ballot box
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
372 |
need to be kept secure from the beginning of the election
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
373 |
(when it needs to be ensured it is empty) until the end of the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
374 |
day, electronic voting machines need to be kept secure the
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
375 |
whole year. The reason is of course that one cannot see
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
376 |
whether somebody has tampered with the program a computer is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
377 |
running. Such a 24/7 security is costly and often even
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
378 |
impossible, because voting machines need to be
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
379 |
distributed---usually the day before the election---to the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
380 |
polling stations. These are often schools where the voting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
381 |
machines are kept unsecured overnight. The obvious solution of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
382 |
putting seals on computers did not work: in the process of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
383 |
getting these DREs discredited (involving court cases) it was
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
384 |
shown that seals can easily be circumvented. The moral of this
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
385 |
story is that election officials were incentivised with money
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
386 |
by the central government to obtain new voting equipment and
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
387 |
in the process fell prey to pariahs which sold them
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
388 |
substandard products. Diebold was not the only pariah in this
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
389 |
area, but one of the more notorious ones.\footnote{An e-voting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
390 |
researcher recently made a connection between the VW-exhaust
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
391 |
scandal and e-voting: His argument is that it is very hard
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
392 |
to test whether a program works correctly in a hostile
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
393 |
environment. The program can often recognise when it is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
394 |
tested and behave correctly, but in the ``real test'' can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
395 |
behave maliciously, just like the VW diesel engines.}
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
396 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
397 |
Optical scan machines are slightly better from a security
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
398 |
point of view but by no means good enough. Their main idea
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
399 |
is that the voter fills out a paper ballot, which is then
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
400 |
scanned by a machine. At the very least the paper ballot can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
401 |
serve as a paper trail in cases an election result needs to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
402 |
be recounted. But if one takes the paper ballots as the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
403 |
version that counts in the end, thereby using the optical
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
404 |
scan machine only as a device to obtain quickly preliminary
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
405 |
results, then why not sticking with paper ballots in the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
406 |
first place?\bigskip
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
407 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
408 |
\noindent An interesting solution for e-voting was designed in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
409 |
India. Essentially they designed a bespoke voting device,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
410 |
which could not be used for anything else. Having a bespoke
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
411 |
device is a good security engineering decision because it
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
412 |
makes the attack surface much smaller. If you have a
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
413 |
full-fledged computer behind your voting system, then you can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
414 |
do everything a computer can do\ldots{}and that is a lot,
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
415 |
including a lot of abuse. What was bad about the devices in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
416 |
India was that these machines did not have the important paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
417 |
trail: that means if an election was tampered with, nobody
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
418 |
would find out. Even if they had by their bespoke design a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
419 |
very small attack surface, ethical hackers were still able to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
420 |
tamper with them. The moral with Indian's voting machines is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
421 |
that even if very good security design decisions are taken,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
422 |
e-voting is very hard to get right.\bigskip
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
423 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
424 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
425 |
\noindent This brings us to the case of Estonia, which held in
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
426 |
2007 the World's first general election that used the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
427 |
Internet. Their solution made some good choices: for example
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
428 |
voter authentication is done via the Estonian ID card, which
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
429 |
contains a chip like on credit cards. They also made most of
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
430 |
their source code public for independent scrutiny---unlike
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
431 |
pariah companies like Diebold. Of course this openness means
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
432 |
that people (hackers) will look at your fingers and find code
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
433 |
such as this snippet:
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
434 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
435 |
{\footnotesize\lstinputlisting[language=Python,numbers=none]
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
436 |
{../progs/estonia.py}}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
437 |
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
438 |
\noindent If you want to have a look at their code, it can be
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
439 |
downloaded from their github
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
440 |
repository.\footnote{\url{https://github.com/vvk-ehk/evalimine/}}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
441 |
Also their system is designed such that Internet voting is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
442 |
used before the election: votes can be changed an unlimited
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
443 |
amount of times; always the last vote is tabulated. You can
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
444 |
even change your vote on the polling day in person. This is an
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
445 |
important security mechanism guarding against vote coercion,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
446 |
which of course is an important problem if you are allowed to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
447 |
vote via Internet.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
448 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
449 |
However, the weak spots in any Internet voting system are the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
450 |
voters' computers and the central server. Unfortunately, their
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
451 |
system is designed such that they need to trust the integrity
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
452 |
of voters’ computers, central server components and also the
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
453 |
election staff. In 2014, a group of independent observers around
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
454 |
Alex Halderman were able to scrutinise the election process in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
455 |
Estonia. They found many weaknesses, for example careless
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
456 |
handling of software updates on the servers. They also
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
457 |
simulated an election with the available software and were
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
458 |
able to covertly manipulate results by inserting malware on
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
459 |
the voters' computers. Overall, their recommendation is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
460 |
to abandon Internet voting and to go back to an entirely
|
195
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
461 |
paper-based voting process. In face of state-sponsored
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
462 |
cyber-crime (for example NSA), Internet voting cannot be made
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
463 |
secure with current technology. They have a small video
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
464 |
clip with their findings at
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
465 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
466 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
467 |
\url{https://estoniaevoting.org}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
468 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
469 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
470 |
\noindent This brings us to the question, what could be a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
471 |
viable electronic voting process in
|
365
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
472 |
\underline{\smash{\textbf{\emph{theory}}}} with current technology?
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
473 |
In the literature one can find proposals such as this one:
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
474 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
475 |
\begin{enumerate}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
476 |
\item Alice prepares and audits some ballots, then casts an
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
477 |
encrypted ballot, which requires her to authenticate to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
478 |
a server.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
479 |
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
480 |
\item A bulletin board posts Alice's name and encrypted
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
481 |
ballot. Anyone, including Alice, can check the bulletin
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
482 |
board and find her encrypted vote posted. This is to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
483 |
make sure the vote was received by the server.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
484 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
485 |
\item When the election closes, all votes are shuffled and the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
486 |
system produces a non-interactive proof of a correct
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
487 |
shuffling---correct in the sense that one cannot determine
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
488 |
anymore who has voted for what. This will require a
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
489 |
shuffling procedure based on zero-knowledge-proofs.
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
490 |
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
491 |
\item After a reasonable complaint period, let auditors
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
492 |
check the shuffling, all shuffled ballots are decrypted,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
493 |
and the system provides a decryption proof for each
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
494 |
decrypted ballot. Again this will need a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
495 |
zero-knowledge-proof-type of method.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
496 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
497 |
\item Perform a tally of the decrypted votes.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
498 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
499 |
\item An auditor can download the entire (shuffled) election
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
500 |
data and verify the shuffle, decryptions and tally.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
501 |
\end{enumerate}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
502 |
|
325
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
503 |
\noindent As you can see, the whole process is not trivial at
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
504 |
all and leaves out a number of crucial details (such as how to
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
505 |
best distribute public keys for encryption). It even depends
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
506 |
on a highly sophisticated process called
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
507 |
\emph{zero-knowledge-proofs}. They essentially allow one to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
508 |
convince somebody else to know a secret without actually
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
509 |
revealing what the secret is. This is a kind of cryptographic
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
510 |
``magic'', like the Hellman-Diffie protocol which can be used
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
511 |
to establish a secret even if you can only exchange postcards
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
512 |
with your communication partner. We will look at
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
513 |
zero-knowledge-proofs in a later lecture in more detail.
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
514 |
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
515 |
The point of these theoretical/hot-air musings like above is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
516 |
to show that such an e-voting procedure is far from
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
517 |
convenient: it takes much more time to allow, for example,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
518 |
scrutinising whether the votes were cast correctly. Very
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
519 |
likely it will also not pass the benchmark of being
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
520 |
understandable to Joe Average. This was a standard, a high
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
521 |
court ruled, that needs to be passed in the German election
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
522 |
process, for example.
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
523 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
524 |
The overall conclusion is that an e-voting process involving
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
525 |
the Internet cannot be made secure with current technology.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
526 |
Voting has just too high demands on integrity and ballot
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
527 |
secrecy. This is different from online banking where the whole
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
528 |
process is designed around authentication. If fraud occurs,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
529 |
you try to identify who did what (somebody’s account got zero;
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
530 |
somewhere the money went). Even if there might be more
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
531 |
gigantic sums at stake in online banking than with voting, it
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
532 |
can be made reasonably secure and fraud-safe. That does not
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
533 |
mean there are no problems with online banking. But with
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
534 |
enough thought, they can usually be overcome with technology
|
466
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
535 |
we have currently available. This is different with e-voting:
|
443
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
536 |
even the best have not come up with something workable yet.
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
537 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
538 |
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
539 |
This conclusion does not imply that some special cases of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
540 |
Internet voting cannot be made to work securely. Just in a
|
194
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
541 |
general election where stakes are very high, it does not work.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
542 |
For example a good-enough and workable in-lecture online
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
543 |
voting system where students' votes are anonymous and students
|
386
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
544 |
cannot tamper with the outcome, I am sure, can be implemented
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
545 |
(see some of my MSc projects).
|
287
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
546 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
547 |
|
287
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
548 |
\subsubsection*{Further Reading}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
549 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
550 |
If you want to know more about e-voting, I recommend
|
194
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
551 |
the highly entertaining online course by Alex Halderman at
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
552 |
Coursera.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
553 |
|
194
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
554 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
555 |
\url{https://www.coursera.org/course/digitaldemocracy}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
556 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
557 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
558 |
\noindent There is also an entertaining TEDtalk by Barbara
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
559 |
Simons called ``Why can I bank online but not vote online?''
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
560 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
561 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
562 |
\url{https://www.youtube.com/watch?v=Wv3VuGZzdK8}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
563 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
564 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
565 |
\noindent At the beginning she describes the complete break-in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
566 |
by the group of Alex Halderman at the try-out voting at
|
328
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
567 |
Washington D.C. Halderman's amusing paper about this break in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
568 |
including pictures is at
|
276
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
569 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
570 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
571 |
\url{https://jhalderm.com/pub/papers/dcvoting-fc12.pdf}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
572 |
\end{center}
|
157
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
573 |
|
328
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
574 |
\noindent
|
357
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
575 |
Another passionate plea to not use electronic voting is the youtube
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
576 |
video
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
577 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
578 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
579 |
\url{https://www.youtube.com/watch?v=w3_0x6oaDmI}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
580 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
581 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
582 |
\noindent
|
328
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
583 |
Two researchers from Galois, Inc., present an interesting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
584 |
attack against home routers which silently alters pdf-based
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
585 |
voting ballots. This shows that the vote submission via
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
586 |
an unencrypted pdf-file is highly unsafe.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
587 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
588 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
589 |
\url{http://galois.com/wp-content/uploads/2014/11/technical-hack-a-pdf.pdf}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
590 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
591 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
592 |
\end{document}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
593 |
|
369
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
594 |
%unikernels for e-voting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
595 |
Trust, trustworthiness, and the TCB
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
596 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
597 |
The notion of trust is important in security. It is also a source of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
598 |
confusion, especially if people are sloppy in their terminology, and
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
599 |
do not distinguish between trust and trustworthiness.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
600 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
601 |
Depending on your point of view, trust can be something good and
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
602 |
desirable, or something bad and undesirable. Trust between parties is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
603 |
good in that it enables easy interaction and good collaboration
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
604 |
between them. However, trust is bad in that trust in another party
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
605 |
means that party can do damage to you, if it turns out not to be
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
606 |
trustworthy. For example, if you give someone your bankcard and tell
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
607 |
them your PIN code, you trust them; this can be useful, for instance
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
608 |
if you want them to do some shopping for you, but is clearly also
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
609 |
potentially dangerous.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
610 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
611 |
Note that if a party is not trustworthy, then it may be so
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
612 |
unintentionally (because it is careless or, in the case of software,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
613 |
riddled with security vulnerabilities) or intentionally (because it is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
614 |
downright malicious). When considering a system that is meant to meet
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
615 |
some security objectives, it is important to consider which parts of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
616 |
that system are trusted in order to meet that objective. This called
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
617 |
the Trusted Computing Base or TCB. Ideally, the TCB should be as
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
618 |
small as possible. The smaller the TCB, the less likely that it
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
619 |
contains security vulnerabilities. (Still, you should never under-
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
620 |
estimates people’s stupidity – or an attacker’s creativity – to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
621 |
introduce security vulnerabilities in even the smallest piece of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
622 |
software.) Also, the smaller the TCB, the less effort it takes to get
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
623 |
some confidence that it is trustworthy, for example, in the case of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
624 |
software, by doing a code review or by performing some (penetration)
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
625 |
testing.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
626 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
627 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
628 |
%%% Local Variables:
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
629 |
%%% mode: latex
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
630 |
%%% TeX-master: t
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
631 |
%%% End:
|