handouts/ho02.tex
author cu
Wed, 18 Oct 2017 22:31:20 +0100
changeset 553 9fe160a13539
parent 541 5cd1865d45bd
permissions -rw-r--r--
updated
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
     1
\documentclass{article}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
     2
\usepackage{../style}
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
     3
\usepackage{../langs}
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
     4
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
     5
\begin{document}
541
5cd1865d45bd updated
cu
parents: 466
diff changeset
     6
\fnote{\copyright{} Christian Urban, 2014, 2015, 2016, 2017}
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
     7
415
56bc53ba7c5b updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 404
diff changeset
     8
456
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
     9
%% second angle of the problem
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    10
%Jonathan Zittrain is interested in algorithmic accountability,
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    11
%from Facebook’s ability to tell that two people are in a
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    12
%relationship before they announce it, to their ability to
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    13
%engineer an election by prompting one side’s supporters.
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    14
%They’d be in the soup if they were caught, but they have been
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    15
%near the soup a number of times. One internal meeting had the
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    16
%question “What responsibility does FB have to prevent
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    17
%President Trump?” That has repudiated once leaked, but the age
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    18
%of innocence is behind us. Back in 2005 Google apologised when
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    19
%the hate site “jew watch news” appeared in search results for
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    20
%“jew”; but the site has morphed from tool to friend.
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    21
%Facebook’s M and Apple’s Siri are the same. This leads
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    22
%Jonathan to the idea of “information fiduciaries” whereby the
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    23
%big firms would have to put user welfare first like doctors or
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    24
%lawyers. Should Google tell you to vaccinate your child?
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    25
%Already in Europe they suppress hate speech and promote
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    26
%counter-narratives. To whom does Uber owe a fiduciary duty –
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    27
%the driver or the passenger? And should data scientists join
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    28
%divines, medics, lawyers and surveyors as a learned
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    29
%profession?
f65e4fa6e902 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 447
diff changeset
    30
461
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 456
diff changeset
    31
% recent
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 456
diff changeset
    32
%http://www.secretballotatrisk.org
462
33dcbafb27ce updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 461
diff changeset
    33
%
33dcbafb27ce updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 461
diff changeset
    34
%Andrew Appel has a good two-part essay on securing elections.
33dcbafb27ce updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 461
diff changeset
    35
%https://freedom-to-tinker.com/blog/appel/security-against-election-hacking-part-1-software-independence/
33dcbafb27ce updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 461
diff changeset
    36
%https://freedom-to-tinker.com/blog/appel/security-against-election-hacking-part-2-cyberoffense-is-not-the-best-cyberdefense/
415
56bc53ba7c5b updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 404
diff changeset
    37
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    38
\section*{Handout 2 (E-Voting)}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    39
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    40
In security engineering, there are many counter-intuitive
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    41
phenomena: for example I am happy (more or less) to use online
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    42
banking every day, where if something goes wrong, I can
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    43
potentially lose a lot of money, but I am staunchly against
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
    44
using electronic voting (let's call it e-voting for short).
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    45
E-voting is an idea that is nowadays often promoted in order
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    46
to counter low turnouts in elections\footnote{In my last local
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    47
election where I was eligible to vote only 48\% of the
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    48
population have cast their ballot. I was, I shamefully admit,
541
5cd1865d45bd updated
cu
parents: 466
diff changeset
    49
one of the non-voters. (Update) I finally bothered to vote by
5cd1865d45bd updated
cu
parents: 466
diff changeset
    50
mail in the 2017 election.} and generally sounds like a good idea.
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    51
Right? Voting from the comfort of your own home, or on your
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    52
mobile on the go, what could possibly go wrong? Even the UK's
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    53
head of the Electoral Commission, Jenny Watson, argued in 2014
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    54
in a Guardian article that the UK should have e-voting. Her
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    55
plausible argument is that 76\% of pensioners in the UK vote
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    56
(in a general election?), but only 44\% of the under-25s. For
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    57
which constituency politicians might therefore make more
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    58
favourable (short-term) decisions is clear. So being not yet
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    59
pensioner, I should be in favour of e-voting, no?
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    60
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    61
Well, it turns out there are many things that can go wrong
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    62
with e-voting, as I like to argue in this handout. E-voting in
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    63
a ``secure way'' seems to be one of the things in computer
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    64
science that are still very much unsolved. It is not on the
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    65
scale of Turing's halting problem, which is proved that it can
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    66
never be solved in general, but more in the category of being
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    67
unsolvable with current technology. This is not just my
195
78309f29a58f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 194
diff changeset
    68
opinion, but also shared by many security researchers amongst
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    69
them Alex Halderman, who is the world-expert on this subject
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
    70
and from whose Coursera course on Securing Digital Democracy I
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    71
have most of my information and inspiration on this topic. It
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    72
is also a controversial topic in many countries:
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    73
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    74
\begin{itemize}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    75
\item The Netherlands between 1997--2006 had electronic voting
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    76
      machines, but ``hacktivists'' had found they can be
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    77
      hacked to change votes and also emitted radio signals
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
    78
      revealing how you voted. Now e-voting has been abandoned
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
    79
      in the Netherlands.
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    80
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    81
\item Germany conducted pilot studies with e-voting, but in
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    82
      2007 a law suit has reached the highest court and it
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    83
      rejected e-voting on the grounds of the mechanisms
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    84
      behind it not being understandable to the general
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    85
      public.
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    86
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    87
\item UK used optical scan voting systems in a few trail
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    88
      polls, but to my knowledge does not use any e-voting in
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
    89
      elections.
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
    90
      
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    91
\item The US used mechanical machines since the 1930s, later
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    92
      punch cards, now DREs and optical scan voting machines.
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    93
      But there is a lot of evidence that DREs and optical
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    94
      scan voting machines are not as secure as they should
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    95
      be. Some states experimented with Internet voting, but
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    96
      all experiments have been security failures. One
466
ddf7315450c9 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 462
diff changeset
    97
      exceptional election happened just after hurricane Sandy
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    98
      in 2012 when some states allowed emergency electronic
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
    99
      voting. Voters downloaded paper ballots and emailed them
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   100
      back to election officials.
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   101
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   102
\item Estonia used since 2007 the Internet for national
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   103
      elections. There were earlier pilot studies for voting
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   104
      via Internet in other countries.
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   105
328
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   106
\item The Australian parliament ruled in 2014 that e-voting is
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   107
      highly vulnerable to hacking and will not use it any time
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   108
      soon. That is because it is still not as secret and 
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   109
      secure as paper ballots, the parliamentary committee 
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   110
      in charge concluded.
445
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   111
      
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   112
\item Norway experimented with Internet voting, but their
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   113
      interest fizzled away after some tries. Their idea was
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   114
      to get Internet voting ``right'' --- it is a small,
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   115
      prosperous and stable country, which can afford with
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   116
      playing with new ways of exercising their democratic
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   117
      voting rights. Well, e-voting is an incredibly difficult
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   118
      problem, even in such favourable circumstances, as
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   119
      explained in this video from the Chaos Computer Club
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   120
      conference in 2014:
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   121
      
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   122
      \begin{center}
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   123
      \url{https://www.youtube.com/watch?v=KawZ3m_EeSU}   
9ad6445a0354 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 443
diff changeset
   124
      \end{center}   
328
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   125
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   126
\item India uses e-voting devices since at least 2003. They
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   127
      use ``keep-it-simple'' machines produced by a
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   128
      government owned company. There was some trouble for
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   129
      an Indian researcher after he and an international 
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   130
      team of hackers showed that the devices are not 
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   131
      as secure as the government claimed.
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   132
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   133
\item South Africa used software for its tallying in the 1993
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   134
      elections (when Nelson Mandela was elected) and found
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   135
      that the tallying software was rigged, but they were
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   136
      able to tally manually. 
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   137
\end{itemize}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   138
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   139
\noindent If you are interested in the recent state of affairs
447
b1c2f5b85880 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 445
diff changeset
   140
of e-voting machinery, I recommend a talk by Jeremy Epstein
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   141
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   142
\begin{center}
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   143
\url{https://www.usenix.org/sites/default/files/conference/protected-files/jets15_slides_epstein.pdf}
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   144
\end{center}
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   145
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   146
\noindent The abstract says:
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   147
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   148
\begin{quote}\it 
466
ddf7315450c9 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 462
diff changeset
   149
``In April 2015, the US Commonwealth of Virginia decertified the
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   150
Advanced Voting Solutions (AVS) WinVote voting machine, after
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   151
concluding that it was insecure. This talk presents the
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   152
results of Virginia's analysis of the WinVote, and explores
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   153
how we got to the point where a voting machine using an
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   154
unpatched version of Windows XP from 2004, using hardwired WEP
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   155
keys and administrator passwords, could be used for over a
466
ddf7315450c9 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 462
diff changeset
   156
decade in most of Virginia.''
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   157
\end{quote}
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   158
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   159
The reason that e-voting is such a hard problem is that we
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   160
have requirements about the voting process that conflict with
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   161
each other. The five main requirements for voting in general
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   162
are:
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   163
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   164
\begin{itemize}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   165
\item {\bf Integrity} 
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   166
  \begin{itemize}
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   167
  \item By this we mean that the outcome of the vote matches
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   168
        with the voters' intend. Note that it does not say
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   169
        that every vote should be counted as cast. This might
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   170
        be surprising, but even counting paper ballots will
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   171
        always have an error rate: people after several hours
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   172
        looking at ballots will inevitably miscount votes. But
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   173
        what should be ensured is that the error rate does not
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   174
        change the outcome of the election. Of course if
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   175
        elections continue to be on knives edges we need to
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   176
        strive for rather small error rates. 
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   177
          
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   178
  \item There might be gigantic sums at stake and need to be
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   179
        defended against. The problem with this is that if
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   180
        the incentives are great and enough resources are
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   181
        available, then maybe it is feasible to mount a DoS
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   182
        attack against the voting server and by bringing the
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   183
        system to its knees, change the outcome of an
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   184
        election. Not to mention to hack the complete
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   185
        system with malware and change votes undetectably.                
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   186
  \end{itemize}
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   187
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   188
\item {\bf Ballot Secrecy}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   189
  \begin{itemize}
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   190
  \item Nobody can find out how you voted. This is to avoid
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   191
        that voters can be coerced to vote in a certain way
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   192
        (for example by relatives, employers etc).
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   193
         
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   194
     \item (Stronger) Even if you try, you cannot prove how
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   195
           you voted. The reason for this is that you want to
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   196
           avoid vote coercion, but also vote selling. That
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   197
           this can be a problem is proved by the fact that
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   198
           some jokers in the recent Scottish referendum tried
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   199
           to make money out of their vote. \end{itemize}
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   200
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   201
\item {\bf Voter Authentication}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   202
  \begin{itemize}
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   203
  \item Only authorised voters can vote up to the permitted
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   204
        number of votes (in order to avoid the ``vote early,
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   205
        vote often'').
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   206
  \end{itemize}
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   207
  
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   208
\item {\bf Enfranchisement}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   209
  \begin{itemize}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   210
  \item Authorised voters should have the opportunity to vote.
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   211
        This can, for example, be a problem if you make the
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   212
        authorisation dependent on an ID card, say a driving
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   213
        license. Then everybody who does not have a license
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   214
        cannot vote. While this sounds an innocent
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   215
        requirement, in fact some parts of the population for
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   216
        one reason or another just do not have driving
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   217
        licenses. They are now excluded. Also if you insist on
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   218
        paper ballots you have to have special provisions for
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   219
        blind people. Otherwise they too cannot vote.
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   220
 \end{itemize}
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   221
  
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   222
\item {\bf Availability}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   223
  \begin{itemize}
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   224
  \item The voting system should accept all authorised votes
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   225
        and produce results in a timely manner. If you move
195
78309f29a58f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 194
diff changeset
   226
        an election online, you have to guard against DoS 
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   227
        attacks for example.
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   228
   \end{itemize}
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   229
\end{itemize}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   230
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   231
\noindent While these requirements seem natural, the problem 
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   232
is that they often clash with each other. For example
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   233
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   234
\begin{center}
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   235
integrity vs.~ballot secrecy\\
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   236
authentication vs.~enfranchisement
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   237
\end{center}
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   238
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   239
\noindent If we had ballots with complete voter
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   240
identification, then we can improve integrity because we can
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   241
trace back the votes to the voters. This would be good when
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   242
verifying the results or when recounting. But such an
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   243
identification would violate ballot secrecy (you can prove to
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   244
somebody else how you voted). In contrast, if we remove all
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   245
identification for ensuring ballot secrecy, then we have to
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   246
ensure that no ``vote-stuffing'' occurs. Similarly, if we
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   247
improve authentication by requiring to be present at the
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   248
polling station with an ID card, then we exclude absentee
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   249
voting.
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   250
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   251
To tackle the problem of e-voting, we should first have a look
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   252
into the history of voting and how paper-based ballots
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   253
evolved. Because also good-old-fashioned paper ballot voting
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   254
is not entirely trivial and immune from being hacked. We know
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   255
for sure that elections were held in Athens as early as 600
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   256
BC, but might even date to the time of Mesopotamia and also in
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   257
India some kind of republics might have existed before the
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   258
Alexander the Great invaded them. Have a look at Wikipedia about
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   259
the history of democracy for more information. These elections
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   260
were mainly based on voting by show of hands. While this
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   261
method of voting satisfies many of the requirements stipulated
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   262
above, the main problem with hand voting is that it does not
195
78309f29a58f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 194
diff changeset
   263
guaranty ballot secrecy. As far as I know the old Greeks and
78309f29a58f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 194
diff changeset
   264
Romans did not perceive this as a problem, but the result was
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   265
that their elections favoured rich, famous people who had
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   266
enough resources to swing votes. Even using small coloured
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   267
stones, which were also used at that time, did not really
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   268
mitigate the problem with ballot secrecy. The problem of
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   269
authorisation was solved by friends or neighbours vouching for
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   270
you to prove you are eligible to vote (there were no ID cards
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   271
in ancient Greece and Rome).
190
4ee6812ab436 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 188
diff changeset
   272
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   273
Starting with the French Revolution and the US constitution,
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   274
people began to value a more egalitarian approach to voting
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   275
and electing officials. This was also the time where paper
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   276
ballots started to become the prevailing form of casting
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   277
votes. While more resistant against voter intimidation, paper
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   278
ballots need a number of security mechanisms to avoid fraud.
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   279
For example you need voting booths for being able to fill out
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   280
the ballot in secret. Also transparent ballot boxes are often
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   281
used in order to easily detect and prevent vote stuffing
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   282
(prefilling the ballot box with false votes). 
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   283
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   284
\begin{center}
199
20af800ce736 updated pics
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 195
diff changeset
   285
\includegraphics[scale=2.5]{../pics/ballotbox.jpg}
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   286
\end{center}
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   287
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   288
\noindent Another security mechanism is to guard the ballot
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   289
box against any tampering during the election until counting.
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   290
The counting needs to be done by a team potentially involving
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   291
also independent observers. 
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   292
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   293
One interesting attack against completely anonymous paper
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   294
ballots is called \emph{chain vote attack}. It works if the
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   295
paper ballots are given out to each voter at the polling
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   296
station. Then an attacker can give a prefilled ballot to a
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   297
voter. The voter uses this prefilled ballot to cast the vote,
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   298
and then returns the empty ballot paper back to the attacker who now
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   299
compensates the voter. The blank ballot can be reused for the
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   300
next voter. I let you ponder why it is important for this
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   301
attack that the voter returns the empty ballot to the 
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   302
attacker.
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   303
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   304
To sum up, the point is that paper ballots have evolved over some time 
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   305
and no single best method has emerged for preventing fraud.
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   306
But the involved technology is well understood in order to
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   307
provide good enough security with paper ballots\ldots{}unless
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   308
you lived in Florida at around 2000. 
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   309
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   310
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   311
\subsection*{E-Voting}
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   312
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   313
If one is to replace paper ballots by some electronic
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   314
mechanism, one should always start from simple premise taken
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   315
from an Australian government white paper about e-voting:
191
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   316
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   317
\begin{quote} \it ``Any electronic voting system should
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   318
provide at least the same security, privacy and transparency
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   319
as the system it replaces.''
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   320
\end{quote}
f675aa15b6d0 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 190
diff changeset
   321
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   322
\noindent Whenever people argue in favour of e-voting, they
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   323
seem to be ignoring this basic premise.\bigskip
192
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   324
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   325
\noindent After the debacle of the Florida presidential
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   326
election in 2000, many voting pre\-cincts in the US used
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   327
Direct-Recording Electronic voting machines (DREs) or optical
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   328
scan machines. One popular model of DREs was sold by a
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   329
company called Diebold. In hindsight they were a complete
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   330
disaster: the products were inadequate and the company
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   331
incompetent. Direct recording meant that there was no paper
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   332
trail, the votes were directly recorded on memory cards. Thus
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   333
the voters had no visible assurance whether the votes were
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   334
correctly cast. Even if there is a printout provided;
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   335
it does not give any guaranty about what is recorded on
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   336
the memory card.
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   337
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   338
The machines behind these DREs were ``normal'' Windows
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   339
computers, which could be used for anything, for example for
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   340
changing votes. Why did nobody at Diebold think of that? I
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   341
have no idea. But that this was eventually done undetectably
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   342
is the result of the determination of ethical hackers like
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   343
Alex Halderman. His group thoroughly hacked Diebold's DREs
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   344
showing that election fraud with them is easily possible. They
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   345
even managed to write a virus that infected the whole system
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   346
by having only access to a single machine.
192
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   347
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   348
\begin{figure}[t]
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   349
\begin{center}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   350
\begin{tabular}{c}
199
20af800ce736 updated pics
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 195
diff changeset
   351
\includegraphics[scale=0.45]{../pics/dre1.jpg}\; 
20af800ce736 updated pics
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 195
diff changeset
   352
\includegraphics[scale=0.40]{../pics/dre2.jpg}\smallskip\\
20af800ce736 updated pics
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 195
diff changeset
   353
\includegraphics[scale=0.5]{../pics/opticalscan.jpg} 
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   354
\end{tabular}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   355
\end{center}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   356
\caption{Direct-Recording Electronic voting machines above;
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   357
an optical scan machine below.\label{machines}}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   358
\end{figure}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   359
192
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   360
What made matters worse was that Diebold tried to hide their
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   361
incompetence and the inferiority of their products by
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   362
requiring that election counties must not give the machines up
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   363
for independent review. They also kept their source code
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   364
secret. This meant Halderman and his group could not obtain a
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   365
machine through the official channels, but whoever could hope
466
ddf7315450c9 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 462
diff changeset
   366
that prevented them from obtaining a machine? Ok, they got one.
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   367
They then had to reverse engineer the source code in order to
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   368
design an attack. What all this showed is that a shady
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   369
security design is no match for a determined hacker. 
192
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   370
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   371
Apart from the obvious failings (for example no paper trail),
192
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   372
this story also told another side. While a paper ballot box
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   373
need to be kept secure from the beginning of the election
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   374
(when it needs to be ensured it is empty) until the end of the
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   375
day, electronic voting machines need to be kept secure the
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   376
whole year. The reason is of course that one cannot see
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   377
whether somebody has tampered with the program a computer is
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   378
running. Such a 24/7 security is costly and often even
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   379
impossible, because voting machines need to be
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   380
distributed---usually the day before the election---to the
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   381
polling stations. These are often schools where the voting
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   382
machines are kept unsecured overnight. The obvious solution of
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   383
putting seals on computers did not work: in the process of
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   384
getting these DREs discredited (involving court cases) it was
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   385
shown that seals can easily be circumvented. The moral of this
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   386
story is that election officials were incentivised with money
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   387
by the central government to obtain new voting equipment and
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   388
in the process fell prey to pariahs which sold them 
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   389
substandard products. Diebold was not the only pariah in this
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   390
area, but one of the more notorious ones.\footnote{An e-voting 
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   391
researcher recently made a connection between the VW-exhaust
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   392
scandal and e-voting: His argument is that it is very hard
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   393
to test whether a program works correctly in a hostile
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   394
environment. The program can often recognise when it is
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   395
tested and behave correctly, but in the ``real test'' can 
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   396
behave maliciously, just like the VW diesel engines.}
192
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   397
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   398
Optical scan machines are slightly better from a security
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   399
point of view but by no means good enough. Their main idea
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   400
is that the voter fills out a paper ballot, which is then 
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   401
scanned by a machine. At the very least the paper ballot can 
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   402
serve as a paper trail in cases an election result needs to
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   403
be recounted. But if one takes the paper ballots as the 
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   404
version that counts in the end, thereby using the optical 
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   405
scan machine only as a device to obtain quickly preliminary
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   406
results, then why not sticking with paper ballots in the 
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   407
first place?\bigskip 
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   408
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   409
\noindent An interesting solution for e-voting was designed in
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   410
India. Essentially they designed a bespoke voting device,
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   411
which could not be used for anything else. Having a bespoke
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   412
device is a good security engineering decision because it
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   413
makes the attack surface much smaller. If you have a
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   414
full-fledged computer behind your voting system, then you can
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   415
do everything a computer can do\ldots{}and that is a lot,
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   416
including a lot of abuse. What was bad about the devices in
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   417
India was that these machines did not have the important paper
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   418
trail: that means if an election was tampered with, nobody
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   419
would find out. Even if they had by their bespoke design a
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   420
very small attack surface, ethical hackers were still able to
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   421
tamper with them. The moral with Indian's voting machines is
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   422
that even if very good security design decisions are taken,
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   423
e-voting is very hard to get right.\bigskip 
192
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   424
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   425
2cb42412f3fd updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 191
diff changeset
   426
\noindent This brings us to the case of Estonia, which held in
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   427
2007 the World's first general election that used the
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   428
Internet. Their solution made some good choices: for example
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   429
voter authentication is done via the Estonian ID card, which
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   430
contains a chip like on credit cards. They also made most of
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   431
their source code public for independent scrutiny---unlike
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   432
pariah companies like Diebold. Of course this openness means
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   433
that people (hackers) will look at your fingers and find code
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   434
such as this snippet:
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   435
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   436
{\footnotesize\lstinputlisting[language=Python,numbers=none]
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   437
{../progs/estonia.py}}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   438
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   439
\noindent If you want to have a look at their code, it can be
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   440
downloaded from their github
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   441
repository.\footnote{\url{https://github.com/vvk-ehk/evalimine/}}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   442
Also their system is designed such that Internet voting is
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   443
used before the election: votes can be changed an unlimited
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   444
amount of times; always the last vote is tabulated. You can
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   445
even change your vote on the polling day in person. This is an
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   446
important security mechanism guarding against vote coercion,
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   447
which of course is an important problem if you are allowed to
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   448
vote via Internet.
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   449
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   450
However, the weak spots in any Internet voting system are the
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   451
voters' computers and the central server. Unfortunately, their
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   452
system is designed such that they need to trust the integrity
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   453
of voters’ computers, central server components and also the
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   454
election staff. In 2014, a group of independent observers around
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   455
Alex Halderman were able to scrutinise the election process in
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   456
Estonia. They found many weaknesses, for example careless
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   457
handling of software updates on the servers. They also
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   458
simulated an election with the available software and were
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   459
able to covertly manipulate results by inserting malware on
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   460
the voters' computers. Overall, their recommendation is 
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   461
to abandon Internet voting and to go back to an entirely
195
78309f29a58f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 194
diff changeset
   462
paper-based voting process. In face of state-sponsored
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   463
cyber-crime (for example NSA), Internet voting cannot be made
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   464
secure with current technology. They have a small video
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   465
clip with their findings at
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   466
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   467
\begin{center}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   468
\url{https://estoniaevoting.org}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   469
\end{center}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   470
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   471
\noindent This brings us to the question, what could be a
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   472
viable electronic voting process in
365
942205605c30 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 357
diff changeset
   473
\underline{\smash{\textbf{\emph{theory}}}} with current technology?
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   474
In the literature one can find proposals such as this one:
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   475
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   476
\begin{enumerate}
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   477
\item Alice prepares and audits some ballots, then casts an
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   478
      encrypted ballot, which requires her to authenticate to
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   479
      a server.
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   480
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   481
\item A bulletin board posts Alice's name and encrypted
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   482
      ballot. Anyone, including Alice, can check the bulletin
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   483
      board and find her encrypted vote posted. This is to
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   484
       make sure the vote was received by the server.
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   485
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   486
\item When the election closes, all votes are shuffled and the
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   487
      system produces a non-interactive proof of a correct
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   488
      shuffling---correct in the sense that one cannot determine
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   489
       anymore who has voted for what. This will require a 
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   490
       shuffling procedure based on zero-knowledge-proofs.
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   491
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   492
\item After a reasonable complaint period, let auditors
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   493
      check the shuffling, all shuffled ballots are decrypted,
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   494
      and the system provides a decryption proof for each
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   495
      decrypted ballot. Again this will need a 
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   496
      zero-knowledge-proof-type of method.
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   497
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   498
\item Perform a tally of the decrypted votes.
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   499
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   500
\item An auditor can download the entire (shuffled) election
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   501
      data and verify the shuffle, decryptions and tally.
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   502
\end{enumerate}
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   503
325
48c6751f2173 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 287
diff changeset
   504
\noindent As you can see, the whole process is not trivial at
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   505
all and leaves out a number of crucial details (such as how to
227
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   506
best distribute public keys for encryption). It even depends
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   507
on a highly sophisticated process called
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   508
\emph{zero-knowledge-proofs}. They essentially allow one to
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   509
convince somebody else to know a secret without actually
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   510
revealing what the secret is. This is a kind of cryptographic
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   511
``magic'', like the Hellman-Diffie protocol which can be used
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   512
to establish a secret even if you can only exchange postcards
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   513
with your communication partner. We will look at
7807863c4196 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 199
diff changeset
   514
zero-knowledge-proofs in a later lecture in more detail. 
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   515
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   516
The point of these theoretical/hot-air musings like above is
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   517
to show that such an e-voting procedure is far from
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   518
convenient: it takes much more time to allow, for example,
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   519
scrutinising whether the votes were cast correctly. Very
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   520
likely it will also not pass the benchmark of being
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   521
understandable to Joe Average. This was a standard, a high
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   522
court ruled, that needs to be passed in the German election
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   523
process, for example. 
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   524
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   525
The overall conclusion is that an e-voting process involving
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   526
the Internet cannot be made secure with current technology.
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   527
Voting has just too high demands on integrity and ballot
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   528
secrecy. This is different from online banking where the whole
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   529
process is designed around authentication. If fraud occurs,
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   530
you try to identify who did what (somebody’s account got zero;
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   531
somewhere the money went). Even if there might be more
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   532
gigantic sums at stake in online banking than with voting, it
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   533
can be made reasonably secure and fraud-safe. That does not
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   534
mean there are no problems with online banking. But with
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   535
enough thought, they can usually be overcome with technology
466
ddf7315450c9 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 462
diff changeset
   536
we have currently available. This is different with e-voting:
443
67d7d239c617 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 415
diff changeset
   537
even the best have not come up with something workable yet.
193
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   538
a97b828bf87f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 192
diff changeset
   539
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   540
This conclusion does not imply that some special cases of
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   541
Internet voting cannot be made to work securely. Just in a
194
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   542
general election where stakes are very high, it does not work.
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   543
For example a good-enough and workable in-lecture online
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   544
voting system where students' votes are anonymous and students
386
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   545
cannot tamper with the outcome, I am sure, can be implemented
3c69029f4a1c updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 369
diff changeset
   546
(see some of my MSc projects). 
287
0b9a16ddd625 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 276
diff changeset
   547
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   548
287
0b9a16ddd625 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 276
diff changeset
   549
\subsubsection*{Further Reading}
0b9a16ddd625 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 276
diff changeset
   550
0b9a16ddd625 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 276
diff changeset
   551
If you want to know more about e-voting, I recommend
194
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   552
the highly entertaining online course by Alex Halderman at
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   553
Coursera.
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   554
194
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   555
\begin{center}
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   556
\url{https://www.coursera.org/course/digitaldemocracy}
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   557
\end{center}
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   558
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   559
\noindent There is also an entertaining TEDtalk by Barbara
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   560
Simons called ``Why can I bank online but not vote online?''
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   561
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   562
\begin{center}
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   563
\url{https://www.youtube.com/watch?v=Wv3VuGZzdK8}
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   564
\end{center}
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   565
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   566
\noindent At the beginning she describes the complete break-in
5e7976fa8577 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 193
diff changeset
   567
by the group of Alex Halderman at the try-out voting at
328
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   568
Washington D.C. Halderman's amusing paper about this break in 
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   569
including pictures is at
276
d7109c6e721d updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 227
diff changeset
   570
d7109c6e721d updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 227
diff changeset
   571
\begin{center}
d7109c6e721d updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 227
diff changeset
   572
\url{https://jhalderm.com/pub/papers/dcvoting-fc12.pdf}
d7109c6e721d updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 227
diff changeset
   573
\end{center}
157
3a8fff66d62b updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 156
diff changeset
   574
328
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   575
\noindent
357
5b91f5ad2772 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 328
diff changeset
   576
Another passionate plea to not use electronic voting is the youtube
5b91f5ad2772 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 328
diff changeset
   577
video
5b91f5ad2772 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 328
diff changeset
   578
5b91f5ad2772 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 328
diff changeset
   579
\begin{center}
5b91f5ad2772 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 328
diff changeset
   580
\url{https://www.youtube.com/watch?v=w3_0x6oaDmI}
5b91f5ad2772 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 328
diff changeset
   581
\end{center}
5b91f5ad2772 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 328
diff changeset
   582
5b91f5ad2772 updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 328
diff changeset
   583
\noindent
328
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   584
Two researchers from Galois, Inc., present an interesting 
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   585
attack against home routers which silently alters pdf-based
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   586
voting ballots. This shows that the vote submission via
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   587
an unencrypted pdf-file is highly unsafe.
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   588
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   589
\begin{center}
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   590
\url{http://galois.com/wp-content/uploads/2014/11/technical-hack-a-pdf.pdf}
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   591
\end{center}
7ae9a893b76f updated
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 325
diff changeset
   592
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   593
\end{document}
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   594
369
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   595
%unikernels for e-voting
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   596
Trust, trustworthiness, and the TCB
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   597
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   598
The notion of trust is important in security. It is also a source of
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   599
confusion, especially if people are sloppy in their terminology, and
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   600
do not distinguish between trust and trustworthiness.
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   601
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   602
Depending on your point of view, trust can be something good and
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   603
desirable, or something bad and undesirable. Trust between parties is
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   604
good in that it enables easy interaction and good collaboration
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   605
between them. However, trust is bad in that trust in another party
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   606
means that party can do damage to you, if it turns out not to be
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   607
trustworthy. For example, if you give someone your bankcard and tell
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   608
them your PIN code, you trust them; this can be useful, for instance
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   609
if you want them to do some shopping for you, but is clearly also
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   610
potentially dangerous.
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   611
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   612
Note that if a party is not trustworthy, then it may be so
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   613
unintentionally (because it is careless or, in the case of software,
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   614
riddled with security vulnerabilities) or intentionally (because it is
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   615
downright malicious).  When considering a system that is meant to meet
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   616
some security objectives, it is important to consider which parts of
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   617
that system are trusted in order to meet that objective. This called
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   618
the Trusted Computing Base or TCB.  Ideally, the TCB should be as
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   619
small as possible. The smaller the TCB, the less likely that it
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   620
contains security vulnerabilities. (Still, you should never under-
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   621
estimates people’s stupidity – or an attacker’s creativity – to
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   622
introduce security vulnerabilities in even the smallest piece of
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   623
software.) Also, the smaller the TCB, the less effort it takes to get
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   624
some confidence that it is trustworthy, for example, in the case of
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   625
software, by doing a code review or by performing some (penetration)
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   626
testing.
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   627
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents: 366
diff changeset
   628
156
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   629
%%% Local Variables: 
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   630
%%% mode: latex
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   631
%%% TeX-master: t
3b831b9dc616 added some initial handouts
Christian Urban <christian dot urban at kcl dot ac dot uk>
parents:
diff changeset
   632
%%% End: