156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
1 |
\documentclass{article}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
2 |
\usepackage{../style}
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
3 |
\usepackage{../langs}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
4 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
5 |
\begin{document}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
6 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
7 |
\section*{Handout 2 (E-Voting)}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
8 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
9 |
In security engineering, there are many counter-intuitive
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
10 |
phenomena: for example I am happy (more or less) to use online
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
11 |
banking every day, where if something goes wrong, I can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
12 |
potentially lose a lot of money, but I am staunchly against
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
13 |
using electronic voting (let's call it e-voting for short).
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
14 |
E-voting is an idea that is nowadays often promoted in order
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
15 |
to counter low turnouts in elections\footnote{In my last local
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
16 |
election where I was eligible to vote only 48\% of the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
17 |
population have cast their ballot. I was, I shamefully admit,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
18 |
one of the non-voters.} and generally sounds like a good idea.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
19 |
Right? Voting from the comfort of your own home, or on your
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
20 |
mobile on the go, what could possibly go wrong? Even the UK's
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
21 |
head of the Electoral Commission, Jenny Watson, argued in 2014
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
22 |
in a Guardian article that the UK should have e-voting. Her
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
23 |
plausible argument is that 76\% of pensioners in the UK vote
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
24 |
(in a general election?), but only 44\% of the under-25s. For
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
25 |
which constituency politicians might therefore make more
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
26 |
favourable (short-term) decisions is clear. So being not yet
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
27 |
pensioner, I should be in favour of e-voting, no?
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
28 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
29 |
Well, it turns out there are many things that can go wrong
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
30 |
with e-voting, as I like to argue in this handout. E-voting in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
31 |
a ``secure way'' seems to be one of the things in computer
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
32 |
science that are still very much unsolved. It is not on the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
33 |
scale of Turing's halting problem, which is proved that it can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
34 |
never be solved in general, but more in the category of being
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
35 |
unsolvable with current technology. This is not just my
|
195
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
36 |
opinion, but also shared by many security researchers amongst
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
37 |
them Alex Halderman, who is the world-expert on this subject
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
38 |
and from whose Coursera course on Securing Digital Democracy I
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
39 |
have most of my information and inspiration. It is also a
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
40 |
controversial topic in many countries:
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
41 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
42 |
\begin{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
43 |
\item The Netherlands between 1997--2006 had electronic voting
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
44 |
machines, but ``hacktivists'' had found they can be
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
45 |
hacked to change votes and also emitted radio signals
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
46 |
revealing how you voted.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
47 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
48 |
\item Germany conducted pilot studies with e-voting, but in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
49 |
2007 a law suit has reached the highest court and it
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
50 |
rejected e-voting on the grounds of not being
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
51 |
understandable by the general public.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
52 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
53 |
\item UK used optical scan voting systems in a few trail
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
54 |
polls, but to my knowledge does not use any e-voting in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
55 |
elections.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
56 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
57 |
\item The US used mechanical machines since the 1930s, later
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
58 |
punch cards, now DREs and optical scan voting machines.
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
59 |
But there is a lot of evidence that DREs and optical
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
60 |
scan voting machines are not as secure as they should
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
61 |
be.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
62 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
63 |
\item Estonia used since 2007 the Internet for national
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
64 |
elections. There were earlier pilot studies for voting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
65 |
via Internet in other countries.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
66 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
67 |
\item India uses e-voting devices since at least 2003. They
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
68 |
use ``keep-it-simple'' machines produced by a
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
69 |
government owned company.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
70 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
71 |
\item South Africa used software for its tallying in the 1993
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
72 |
elections (when Nelson Mandela was elected) and found
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
73 |
that the tallying software was rigged, but they were
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
74 |
able to tally manually.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
75 |
\end{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
76 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
77 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
78 |
The reason that e-voting is such a hard problem is that we
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
79 |
have requirements about the voting process that conflict with
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
80 |
each other. The five main requirements for voting in general
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
81 |
are:
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
82 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
83 |
\begin{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
84 |
\item {\bf Integrity}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
85 |
\begin{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
86 |
\item By this we mean that the outcome of the vote matches
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
87 |
with the voters' intend. Note that it does not say
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
88 |
that every vote should be counted as cast. This might
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
89 |
be surprising, but even counting paper ballots will
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
90 |
always have an error rate: people after several hours
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
91 |
looking at ballots will inevitably miscount votes. But
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
92 |
what should be ensured is that the error rate does not
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
93 |
change the outcome of the election. Of course if
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
94 |
elections continue to be on knives edges we need to
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
95 |
strive for rather small error rates.
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
96 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
97 |
\item There might be gigantic sums at stake and need to be
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
98 |
defended against. The problem with this is that if
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
99 |
the incentives are great and enough resources are
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
100 |
available, then maybe it is feasible to mount a DoS
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
101 |
attack against the voting server and by bringing the
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
102 |
system to its knees, change the outcome of an
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
103 |
election. Not to mention to hack the complete
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
104 |
system with malware and change votes undetectably.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
105 |
\end{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
106 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
107 |
\item {\bf Ballot Secrecy}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
108 |
\begin{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
109 |
\item Nobody can find out how you voted. This is to avoid
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
110 |
that voters can be coerced to vote in a certain way
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
111 |
(for example by relatives, employers etc).
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
112 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
113 |
\item (Stronger) Even if you try, you cannot prove how
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
114 |
you voted. The reason for this is that you want to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
115 |
avoid vote coercion, but also vote selling. That
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
116 |
this can be a problem is proved by the fact that
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
117 |
some jokers in the recent Scottish referendum tried
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
118 |
to make money out of their vote. \end{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
119 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
120 |
\item {\bf Voter Authentication}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
121 |
\begin{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
122 |
\item Only authorised voters can vote up to the permitted
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
123 |
number of votes (in order to avoid the ``vote early,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
124 |
vote often'').
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
125 |
\end{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
126 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
127 |
\item {\bf Enfranchisement}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
128 |
\begin{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
129 |
\item Authorised voters should have the opportunity to vote.
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
130 |
This can, for example, be a problem if you make the
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
131 |
authorisation dependent on an ID card, say a driving
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
132 |
license. Then everybody who does not have a license
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
133 |
cannot vote. While this sounds an innocent
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
134 |
requirement, in fact some parts of the population for
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
135 |
one reason or another just do not have driving
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
136 |
licenses. They are now excluded. Also if you insist on
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
137 |
paper ballots you have to have special provisions for
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
138 |
blind people. Otherwise they too cannot vote.
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
139 |
\end{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
140 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
141 |
\item {\bf Availability}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
142 |
\begin{itemize}
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
143 |
\item The voting system should accept all authorised votes
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
144 |
and produce results in a timely manner. If you move
|
195
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
145 |
an election online, you have to guard against DoS
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
146 |
attacks for example.
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
147 |
\end{itemize}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
148 |
\end{itemize}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
149 |
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
150 |
\noindent While these requirements seem natural, the problem
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
151 |
is that they often clash with each other. For example
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
152 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
153 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
154 |
integrity vs.~ballot secrecy\\
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
155 |
authentication vs.~enfranchisement
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
156 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
157 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
158 |
\noindent If we had ballots with complete voter
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
159 |
identification, then we can improve integrity because we can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
160 |
trace back the votes to the voters. This would be good when
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
161 |
verifying the results or when recounting. But such an
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
162 |
identification would violate ballot secrecy (you can prove to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
163 |
somebody else how you voted). In contrast, if we remove all
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
164 |
identification for ensuring ballot secrecy, then we have to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
165 |
ensure that no ``vote-stuffing'' occurs. Similarly, if we
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
166 |
improve authentication by requiring to be present at the
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
167 |
polling station with an ID card, then we exclude absentee
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
168 |
voting.
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
169 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
170 |
To tackle the problem of e-voting, we should first have a look
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
171 |
into the history of voting and how paper-based ballots
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
172 |
evolved. Because also good-old-fashioned paper ballot voting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
173 |
is not entirely trivial and immune from being hacked. We know
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
174 |
for sure that elections were held in Athens as early as 600
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
175 |
BC, but might even date to the time of Mesopotamia and also in
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
176 |
India some kind of republics might have existed before the
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
177 |
Alexander the Great invaded it. Have a look at Wikipedia about
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
178 |
the history of democracy for more information. These elections
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
179 |
were mainly based on voting by show of hands. While this
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
180 |
method of voting satisfies many of the requirements stipulated
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
181 |
above, the main problem with hand voting is that it does not
|
195
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
182 |
guaranty ballot secrecy. As far as I know the old Greeks and
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
183 |
Romans did not perceive this as a problem, but the result was
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
184 |
that their elections favoured rich, famous people who had
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
185 |
enough resources to swing votes. Even using small coloured
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
186 |
stones, which were also used at that time, did not really
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
187 |
mitigate the problem with ballot secrecy. The problem of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
188 |
authorisation was solved by friends or neighbours vouching for
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
189 |
you to prove you are eligible to vote (there were no ID cards
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
190 |
in ancient Greece and Rome).
|
190
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
191 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
192 |
Starting with the French Revolution and the US constitution,
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
193 |
people began to value a more egalitarian approach to voting
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
194 |
and electing officials. This was also the time where paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
195 |
ballots started to become the prevailing form of casting
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
196 |
votes. While more resistant against voter intimidation, paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
197 |
ballots need a number of security mechanisms to avoid fraud.
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
198 |
For example you need voting booths for being able to fill out
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
199 |
the ballot in secret. Also transparent ballot boxes are often
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
200 |
used in order to easily detect and prevent vote stuffing
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
201 |
(prefilling the ballot box with false votes).
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
202 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
203 |
\begin{center}
|
199
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
204 |
\includegraphics[scale=2.5]{../pics/ballotbox.jpg}
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
205 |
\end{center}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
206 |
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
207 |
\noindent Another security mechanism is to guard the ballot
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
208 |
box against any tampering during the election until counting.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
209 |
The counting needs to be done by a team potentially involving
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
210 |
also independent observers.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
211 |
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
212 |
One interesting attack against completely anonymous paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
213 |
ballots is called \emph{chain vote attack}. It works if the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
214 |
paper ballots are given out to each voter at the polling
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
215 |
station. Then an attacker can give the prefilled ballot to a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
216 |
voter. The voter uses this prefilled ballot to cast the vote,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
217 |
and then returns the empty ballot paper back to the attacker who now
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
218 |
compensates the voter. The blank ballot can be reused for the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
219 |
next voter.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
220 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
221 |
To sum up, the point is that paper ballots have evolved over some time
|
191
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
222 |
and no single best method has emerged for preventing fraud.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
223 |
But the involved technology is well understood in order to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
224 |
provide good enough security with paper ballots.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
225 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
226 |
\subsection*{E-Voting}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
227 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
228 |
If one is to replace paper ballots by some electronic
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
229 |
mechanism, one should always start from simple premise taken
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
230 |
from an Australian white paper about e-voting:
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
231 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
232 |
\begin{quote} \it ``Any electronic voting system should
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
233 |
provide at least the same security, privacy and transparency
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
234 |
as the system it replaces.''
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
235 |
\end{quote}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
236 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
237 |
\noindent Whenever people argue in favour of e-voting they
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
238 |
seem to be ignoring this basic premise.\bigskip
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
239 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
240 |
\noindent After the debacle of the Florida presidential
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
241 |
election in 2000, many voting precincts in the US used
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
242 |
Direct-Recording Electronic voting machines (DREs) or optical
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
243 |
scan machines. One popular model of DREs was sold by a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
244 |
company called Diebold. In hindsight they were a complete
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
245 |
disaster: the products were inadequate and the company
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
246 |
incompetent. Direct recording meant that there was no paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
247 |
trail, the votes were directly recorded on memory cards. Thus
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
248 |
the voters had no visible assurance whether the votes were
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
249 |
correctly cast. Even if there is a printout provided;
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
250 |
it does not give any guaranty about what is recorded on
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
251 |
the memory card.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
252 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
253 |
The machines behind these DREs were ``normal'' windows
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
254 |
computers, which could be used for anything, for example for
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
255 |
changing votes. Why did nobody at Diebold think of that? I
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
256 |
have no idea. But that this was eventually done undetectably
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
257 |
is the result of the determination of ethical hackers like
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
258 |
Alex Halderman. His group thoroughly hacked Diebold's DREs
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
259 |
showing that election fraud with them is easily possible. They
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
260 |
even managed to write a virus that infected the whole system
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
261 |
by having only access to a single machine.
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
262 |
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
263 |
\begin{figure}[t]
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
264 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
265 |
\begin{tabular}{c}
|
199
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
266 |
\includegraphics[scale=0.45]{../pics/dre1.jpg}\;
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
267 |
\includegraphics[scale=0.40]{../pics/dre2.jpg}\smallskip\\
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
268 |
\includegraphics[scale=0.5]{../pics/opticalscan.jpg}
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
269 |
\end{tabular}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
270 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
271 |
\caption{Direct-Recording Electronic voting machines above;
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
272 |
an optical scan machine below.\label{machines}}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
273 |
\end{figure}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
274 |
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
275 |
What made matters worse was that Diebold tried to hide their
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
276 |
incompetency and the inferiority of their products, by
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
277 |
requiring that election counties must not give the machines up
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
278 |
for independent review. They also kept their source secret.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
279 |
This meant Halderman and his group had to obtain a machine not
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
280 |
through the official channels. They then had to reverse
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
281 |
engineer the source code in order to design their attack. What
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
282 |
this all showed is that a shady security design is no match to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
283 |
a determined hacker.
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
284 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
285 |
Apart from the obvious failings (for example no papertrail),
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
286 |
this story also told another side. While a paper ballot box
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
287 |
need to be kept secure from the beginning of the election
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
288 |
(when it needs to be ensured it is empty) until the end of the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
289 |
day, electronic voting machines need to be kept secure the
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
290 |
whole year. The reason is of course that one cannot see
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
291 |
whether somebody has tampered with the program a computer is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
292 |
running. Such a 24/7 security is costly and often even
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
293 |
impossible, because voting machines need to be distributed
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
294 |
usually the day before the election to the polling stations.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
295 |
These are often schools where the voting machines are kept
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
296 |
unsecured overnight. The obvious solution of putting seals on
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
297 |
computers did not work: in the process of getting these DREs
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
298 |
discredited (involving court cases) it was shown that seals
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
299 |
can easily be circumvented. The moral of this story is that
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
300 |
election officials were incentivised with money by the central
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
301 |
government to obtain new voting equipment and in the process
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
302 |
fell prey to pariahs which sold them a substandard product.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
303 |
Diebold was not the only pariah in this area, but one of the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
304 |
more notorious ones.
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
305 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
306 |
Optical scan machines are slightly better from a security
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
307 |
point of view but by no means good enough. Their main idea
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
308 |
is that the voter fills out a paper ballot, which is then
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
309 |
scanned by a machine. At the very least the paper ballot can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
310 |
serve as a paper trail in cases an election result needs to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
311 |
be recounted. But if one takes the paper ballots as the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
312 |
version that counts in the end, thereby using the optical
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
313 |
scan machine only as a device to obtain quickly preliminary
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
314 |
results, then why not sticking with paper ballots in the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
315 |
first place?\bigskip
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
316 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
317 |
\noindent An interesting solution for e-voting was designed in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
318 |
India. Essentially they designed a bespoke voting device,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
319 |
which could not be used for anything else. Having a bespoke
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
320 |
device is a good security engineering decision because it
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
321 |
makes the attack surface much smaller. If you have a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
322 |
full-fledged computer behind your system, then you can do
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
323 |
everything a computer can do\ldots{}and that is a lot,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
324 |
including a lot of abuse. What was bad about the devices in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
325 |
India was that these machines did not have the important paper
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
326 |
trail: that means if an election was tampered with, nobody
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
327 |
would find out. Even if they had by their bespoke design a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
328 |
very small attack surface, ethical hackers were still able to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
329 |
tamper with them. The moral with Indian's voting machines is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
330 |
that even if very good security design decisions are taken,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
331 |
e-voting is very hard to get right.\bigskip
|
192
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
332 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
333 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
334 |
\noindent This brings us to the case of Estonia, which held in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
335 |
2007 the worlds first general election that used Internet.
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
336 |
Again their solution made some good choices: for example voter
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
337 |
authentication is done via the Estonian ID card, which
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
338 |
contains a chip like on credit cards. They also made most of
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
339 |
their source code public for independent scrutiny. Of course
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
340 |
this openness means that people (hackers) will look at your
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
341 |
fingers and find code such as this snippet.
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
342 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
343 |
{\footnotesize\lstinputlisting[language=Python,numbers=none]
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
344 |
{../progs/estonia.py}}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
345 |
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
346 |
\noindent If you want to have a look their code can be
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
347 |
downloaded from their github
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
348 |
repository.\footnote{\url{https://github.com/vvk-ehk/evalimine/}}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
349 |
Also their system is designed such that Internet voting is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
350 |
used before the election: votes can be changed an unlimited
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
351 |
amount of times, always the last vote is tabulated, you can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
352 |
even change your vote on the polling day in person. This is an
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
353 |
important security mechanism guarding against vote coercion,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
354 |
which of course is an important problem if you are allowed to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
355 |
vote via Internet.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
356 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
357 |
However, the weak spots in any Internet voting system are the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
358 |
voters' computers and the central server. Unfortunately, their
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
359 |
system is designed such that they needs to trust the integrity
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
360 |
of voters’ computers, central server components and also the
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
361 |
election staff. In 2014, a group of independent observers around
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
362 |
Alex Halderman were able to scrutinise the election process in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
363 |
Estonia. They found many weaknesses, for example careless
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
364 |
handling of software updates on the servers. They also
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
365 |
simulated an election with the available software and were
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
366 |
able to covertly manipulate results by inserting malware on
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
367 |
the voters' computers. Overall, their recommendation is
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
368 |
to abandon Internet voting and to go back to an entirely
|
195
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
369 |
paper-based voting process. In face of state-sponsored
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
370 |
cyber-crime (for example NSA), Internet voting cannot be made
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
371 |
secure with current technology. They have a small video
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
372 |
clip with their findings at
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
373 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
374 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
375 |
\url{https://estoniaevoting.org}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
376 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
377 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
378 |
\noindent This brings us to the question, what could be a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
379 |
viable electronic voting process in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
380 |
\underline{\textbf{\emph{theory}}} with current technology?
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
381 |
In the literature one can find proposals such as this one:
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
382 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
383 |
\begin{enumerate}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
384 |
\item Alice prepares and audits some ballots, then casts an
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
385 |
encrypted ballot, which requires her to authenticate to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
386 |
a server.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
387 |
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
388 |
\item A bulletin board posts Alice's name and encrypted
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
389 |
ballot. Anyone, including Alice, can check the bulletin
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
390 |
board and find her encrypted vote posted. This is to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
391 |
make sure the vote was received by the server.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
392 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
393 |
\item When the election closes, all votes are shuffled and the
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
394 |
system produces a non-interactive proof of a correct
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
395 |
shuffling---correct in the sense that one cannot determine
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
396 |
anymore who has voted for what. This will require a
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
397 |
shuffling procedure based on zero-knowledge-proofs.
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
398 |
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
399 |
\item After a reasonable complaint period, let auditors
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
400 |
check the shuffling, all shuffled ballots are decrypted,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
401 |
and the system provides a decryption proof for each
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
402 |
decrypted ballot. Again this will need a
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
403 |
zero-knowledge-proof-type of method.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
404 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
405 |
\item Perform a tally of the decrypted votes.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
406 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
407 |
\item An auditor can download the entire (shuffled) election
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
408 |
data and verify the shuffle, decryptions and tally.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
409 |
\end{enumerate}
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
410 |
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
411 |
\noindent As you can see the whole process is not trivial at
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
412 |
all and leaves out a number of crucial details (such as how to
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
413 |
best distribute public keys for encryption). It even depends
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
414 |
on a highly sophisticated process called
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
415 |
\emph{zero-knowledge-proofs}. They essentially allow one to
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
416 |
convince somebody else to know a secret without actually
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
417 |
revealing what the secret is. This is a kind of cryptographic
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
418 |
``magic'', like the Hellman-Diffie protocol which can be used
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
419 |
to establish a secret even if you can only exchange postcards
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
420 |
with your communication partner. We will look at
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
421 |
zero-knowledge-proofs in a later lecture in more detail.
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
422 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
423 |
The point of these theoretical/hot-air musings is to show that
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
424 |
such an e-voting procedure is far from convenient: it takes
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
425 |
much more time to allow, for example, for scrutinising whether
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
426 |
the votes were cast correctly. Very likely it will also not
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
427 |
pass the benchmark of being understandable to Joe Average.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
428 |
This was a standard a court rules that needs to be passed in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
429 |
the German election process.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
430 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
431 |
The overall conclusion is that an e-voting process involving
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
432 |
the Internet cannot be made secure with current technology.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
433 |
Voting has just too high demands on integrity and ballot
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
434 |
secrecy. This is different from online banking where the whole
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
435 |
process is designed around authentication. If fraud occurs,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
436 |
you try to identify who did what (somebody’s account got zero;
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
437 |
somewhere the money went). Even if there might be more
|
193
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
438 |
gigantic sums at stake in online banking than with voting,
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
439 |
it can be solved. That does not mean there are no problems
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
440 |
with online banking. But with enough thought, they can
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
441 |
usually be overcome with technology we have currently. This
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
442 |
is different with e-voting: even the best have not come
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
443 |
up with something workable yet.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
444 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
445 |
|
194
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
446 |
This conclusion does not imply that in some special cases
|
227
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
447 |
of Internet voting cannot be made to work securely. Just in a
|
194
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
448 |
general election where stakes are very high, it does not work.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
449 |
For example a good-enough and workable in-lecture online
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
450 |
voting system where students' votes are anonymous and students
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
451 |
cannot tamper with the outcome, I am sure, can be implemented.
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
452 |
\bigskip
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
453 |
|
194
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
454 |
\noindent If you want to know more about e-voting, I recommend
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
455 |
the highly entertaining online course by Alex Halderman at
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
456 |
Coursera.
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
457 |
|
194
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
458 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
459 |
\url{https://www.coursera.org/course/digitaldemocracy}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
460 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
461 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
462 |
\noindent There is also an entertaining TEDtalk by Barbara
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
463 |
Simons called ``Why can I bank online but not vote online?''
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
464 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
465 |
\begin{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
466 |
\url{https://www.youtube.com/watch?v=Wv3VuGZzdK8}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
467 |
\end{center}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
468 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
469 |
\noindent At the beginning she describes the complete break-in
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
470 |
by the group of Alex Halderman at the try-out voting at
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
471 |
Washington D.C.
|
157
Christian Urban <christian dot urban at kcl dot ac dot uk>
diff
changeset
|
472 |
|
156
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
473 |
\end{document}
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
474 |
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
475 |
%%% Local Variables:
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
476 |
%%% mode: latex
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
477 |
%%% TeX-master: t
|
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff
changeset
|
478 |
%%% End:
|