sen-material: comparison handouts/ho02.tex

equal deleted inserted replaced

-:cceb3d2dcba0
+:67d7d239c617
 never be solved in general, but more in the category of being
 unsolvable with current technology. This is not just my
 opinion, but also shared by many security researchers amongst
 them Alex Halderman, who is the world-expert on this subject
 and from whose Coursera course on Securing Digital Democracy I
-have most of my information and inspiration. It is also a
+have most of my information and inspiration on this topic. It
-controversial topic in many countries:
+is also a controversial topic in many countries:
 \begin{itemize}
 \item The Netherlands between 1997--2006 had electronic voting
 machines, but ``hacktivists'' had found they can be
 hacked to change votes and also emitted radio signals
 revealing how you voted. Now e-voting has been abandoned
 in the Netherlands.
 \item Germany conducted pilot studies with e-voting, but in
 2007 a law suit has reached the highest court and it
-rejected e-voting on the grounds of not being
+rejected e-voting on the grounds of the mechanisms
-understandable by the general public.
+behind it not being understandable to the general
+public.
 \item UK used optical scan voting systems in a few trail
 polls, but to my knowledge does not use any e-voting in
 elections.
-\item The US used mechanical machines since the 1930s, later punch
+\item The US used mechanical machines since the 1930s, later
-cards, now DREs and optical scan voting machines.  But there is a
+punch cards, now DREs and optical scan voting machines.
-lot of evidence that DREs and optical scan voting machines are not
+But there is a lot of evidence that DREs and optical
-as secure as they should be. Some states experimented with Internet
+scan voting machines are not as secure as they should
-voting, but all experiments have been security failures. One
+be. Some states experimented with Internet voting, but
-exceptional election happened just after hurrican Sandy in 2012 when
+all experiments have been security failures. One
-some states allowed emergency electronic voting. Voters downloaded
+exceptional election happened just after hurrican Sandy
-paper ballots and emailed them back to election officials.
+in 2012 when some states allowed emergency electronic
+voting. Voters downloaded paper ballots and emailed them
+back to election officials.
 \item Estonia used since 2007 the Internet for national
 elections. There were earlier pilot studies for voting
 via Internet in other countries.
 elections (when Nelson Mandela was elected) and found
 that the tallying software was rigged, but they were
 able to tally manually.
 \end{itemize}
+\noindent If you are interested in the recent state of affairs
+of e-voting machinery, I recommend the talk Jeremy Epstein
+\begin{center}
+\url{https://www.usenix.org/sites/default/files/conference/protected-files/jets15_slides_epstein.pdf}
+\end{center}
+\noindent The abstract says:
+\begin{quote}\it
+In April 2015, the US Commonwealth of Virginia decertified the
+Advanced Voting Solutions (AVS) WinVote voting machine, after
+concluding that it was insecure. This talk presents the
+results of Virginia's analysis of the WinVote, and explores
+how we got to the point where a voting machine using an
+unpatched version of Windows XP from 2004, using hardwired WEP
+keys and administrator passwords, could be used for over a
+decade in most of Virginia.
+\end{quote}
 The reason that e-voting is such a hard problem is that we
 have requirements about the voting process that conflict with
 each other. The five main requirements for voting in general
 are:
 also independent observers.
 One interesting attack against completely anonymous paper
 ballots is called \emph{chain vote attack}. It works if the
 paper ballots are given out to each voter at the polling
-station. Then an attacker can give the prefilled ballot to a
+station. Then an attacker can give a prefilled ballot to a
 voter. The voter uses this prefilled ballot to cast the vote,
 and then returns the empty ballot paper back to the attacker who now
 compensates the voter. The blank ballot can be reused for the
 next voter. I let you ponder why it is important for this
 attack that the voter returns the empty ballot to the
 attacker.
 To sum up, the point is that paper ballots have evolved over some time
 and no single best method has emerged for preventing fraud.
 But the involved technology is well understood in order to
-provide good enough security with paper ballots.
+provide good enough security with paper ballots\ldots{}unless
+you lived in Florida at around 2000.
 \subsection*{E-Voting}
 If one is to replace paper ballots by some electronic
 mechanism, one should always start from simple premise taken
-from an Australian white paper about e-voting:
+from an Australian government white paper about e-voting:
 \begin{quote} \it ``Any electronic voting system should
 provide at least the same security, privacy and transparency
 as the system it replaces.''
 \end{quote}
-\noindent Whenever people argue in favour of e-voting they
+\noindent Whenever people argue in favour of e-voting, they
 seem to be ignoring this basic premise.\bigskip
 \noindent After the debacle of the Florida presidential
 election in 2000, many voting pre\-cincts in the US used
 Direct-Recording Electronic voting machines (DREs) or optical
 What made matters worse was that Diebold tried to hide their
 incompetence and the inferiority of their products by
 requiring that election counties must not give the machines up
 for independent review. They also kept their source code
-secret. This meant Halderman and his group had to obtain a
+secret. This meant Halderman and his group could not obtain a
-machine not through the official channels. They then had to
+machine through the official channels, but whoever could hope
-reverse engineer the source code in order to design their
+that revented them from obtaining a machine? Ok, they got one.
-attack. What all this showed is that a shady security design
+They then had to reverse engineer the source code in order to
-is no match for a determined hacker.
+design an attack. What all this showed is that a shady
+security design is no match for a determined hacker.
 Apart from the obvious failings (for example no paper trail),
 this story also told another side. While a paper ballot box
 need to be kept secure from the beginning of the election
 (when it needs to be ensured it is empty) until the end of the
 putting seals on computers did not work: in the process of
 getting these DREs discredited (involving court cases) it was
 shown that seals can easily be circumvented. The moral of this
 story is that election officials were incentivised with money
 by the central government to obtain new voting equipment and
-in the process fell prey to pariahs which sold them a
+in the process fell prey to pariahs which sold them
-substandard product. Diebold was not the only pariah in this
+substandard products. Diebold was not the only pariah in this
 area, but one of the more notorious ones.\footnote{An e-voting
 researcher recently made a connection between the VW-exhaust
 scandal and e-voting: His argument is that it is very hard
 to test whether a program works correctly in a hostile
 environment. The program can often recognise when it is
 that even if very good security design decisions are taken,
 e-voting is very hard to get right.\bigskip
 \noindent This brings us to the case of Estonia, which held in
-2007 the worlds first general election that used the Internet.
+2007 the World's first general election that used the
-Again their solution made some good choices: for example voter
+Internet. Their solution made some good choices: for example
-authentication is done via the Estonian ID card, which
+voter authentication is done via the Estonian ID card, which
 contains a chip like on credit cards. They also made most of
-their source code public for independent scrutiny. Of course
+their source code public for independent scrutiny---unlike
-this openness means that people (hackers) will look at your
+pariah companies like Diebold. Of course this openness means
-fingers and find code such as this snippet.
+that people (hackers) will look at your fingers and find code
+such as this snippet:
 {\footnotesize\lstinputlisting[language=Python,numbers=none]
 {../progs/estonia.py}}
-\noindent If you want to have a look at their code it can be
+\noindent If you want to have a look at their code, it can be
 downloaded from their github
 repository.\footnote{\url{https://github.com/vvk-ehk/evalimine/}}
 Also their system is designed such that Internet voting is
 used before the election: votes can be changed an unlimited
 amount of times; always the last vote is tabulated. You can
 ``magic'', like the Hellman-Diffie protocol which can be used
 to establish a secret even if you can only exchange postcards
 with your communication partner. We will look at
 zero-knowledge-proofs in a later lecture in more detail.
-The point of these theoretical/hot-air musings is to show that
+The point of these theoretical/hot-air musings like above is
-such an e-voting procedure is far from convenient: it takes
+to show that such an e-voting procedure is far from
-much more time to allow, for example, scrutinising whether the
+convenient: it takes much more time to allow, for example,
-votes were cast correctly. Very likely it will also not pass
+scrutinising whether the votes were cast correctly. Very
-the benchmark of being understandable to Joe Average. This was
+likely it will also not pass the benchmark of being
-a standard, a high court ruled, that needs to be passed in the
+understandable to Joe Average. This was a standard, a high
-German election process.
+court ruled, that needs to be passed in the German election
+process, for example.
 The overall conclusion is that an e-voting process involving
 the Internet cannot be made secure with current technology.
 Voting has just too high demands on integrity and ballot
 secrecy. This is different from online banking where the whole
 somewhere the money went). Even if there might be more
 gigantic sums at stake in online banking than with voting, it
 can be made reasonably secure and fraud-safe. That does not
 mean there are no problems with online banking. But with
 enough thought, they can usually be overcome with technology
-we have currently. This is different with e-voting: even the
+we have currently avialable. This is different with e-voting:
-best have not come up with something workable yet.
+even the best have not come up with something workable yet.
 This conclusion does not imply that some special cases of
 Internet voting cannot be made to work securely. Just in a
 general election where stakes are very high, it does not work.

changeset 443	67d7d239c617
parent 415	56bc53ba7c5b
child 445	9ad6445a0354