CSC 382/582: Computer Security Slide #1

CSC 382/582: Computer Security

Voting Security

CSC 382/582: Computer Security Slide #2

Topics

1. Why do we vote?

2. Do we have a right to vote?

3. How do we vote?

4. Electronic voting

CSC 382/582: Computer Security Slide #3

Why do we vote?

1. What’s the purpose of democracy?

2. Does democracy require voting?

3. Does voting mean you live in a democracy?

CSC 382/582: Computer Security Slide #4

Voting Rights

Do we have a right to vote?

CSC 382/582: Computer Security Slide #5

Voting Rights

• Non-discrimination is protected– 15th (race)– 19th (sex)– 26th (age)

• But the SCOTUS majority concluded: "the individual citizen has no federal constitutional right to vote for electors for the President of the United States." (Bush v. Gore, 531 U.S. 98, 104 (2000))

CSC 382/582: Computer Security Slide #6

Voting Methods

• Binary

• Ranked

• Condorcet

• Rated

• Proportional

CSC 382/582: Computer Security Slide #7

Binary Methods

• Plurality– First-past-the-post, largest number wins.

• Approval– Vote for multiple candidates; largest number wins.

• Runoff– Multiple rounds of plurality until majority winner.

– Typical: select top 2, then hold election with just those 2.

• Random– People vote for their candidate.

– Randomly selected ballot determines winner.

CSC 382/582: Computer Security Slide #8

Voting CriteriaMajority criterion — If there exists a majority preferring a

single candidate, does he always win if that majority votes sincerely?

Monotonicity criterion — Is it impossible to cause a winning candidate to lose by ranking him higher, or to cause a losing candidate to win by ranking him lower?

Consistency criterion — If the electorate is divided in two and a choice wins in both parts, does it always win overall?

Participation criterion — Is it always better to vote honestly than to not vote?

Condorcet criterion — If a candidate beats every other candidate in pairwise comparison, does that candidate always win?

Arrow’s Impossibility Theorem

CSC 382/582: Computer Security Slide #9

Indirect Elections

Plurality in state select electors Winner takes all in most statesMajority of electoral vote wins Congress selects if no majority

2004 Population cartogram286 (Bush)-251 (Kerry)

2004 Electoral College MapBush (red), Kerry (blue)

CSC 382/582: Computer Security Slide #10

Voting Details

CSC 382/582: Computer Security Slide #11

History of Voting

• Voice Voting

• Ballots: black pebble, white pebble

• Paper Ballots

• Australian Paper Ballot

• Lever Voting Machines

• Punched Card

• Optical Scanner

• DRE Machines

CSC 382/582: Computer Security Slide #12

Types of Electronic Voting

• Paper-based voting– Computer marks paper ballots, which are

counted.

• Direct-recording electronic (DRE)– Records vote count electronically.

• Networked DRE– Uploads vote count electronically.– Includes Internet voting.

CSC 382/582: Computer Security Slide #13

Advantages of e-voting

• Accessibility

• Cheaper per election costs due to no paper– Multi-lingual ballots

• Speed of tabulation

• Remote voting

CSC 382/582: Computer Security Slide #14

Disadvantages of e-voting

• Voters could be tracked

• Lack of reliability

• Lack of verification

• Lack of transparency

• Undetectable fraud (Rice’s theorem)

• Wholesale fraud

CSC 382/582: Computer Security Slide #15

Are Voting Machines Reliable?Columbus, OH – An error while a Danaher / Guardian ELECTronic 1242 was

plugged into a laptop to download results gave President Bush 3,893 extra votes.: http://www.usatoday.com/tech/news/techpolicy/evoting/2004-11-06-ohio-evote-trouble_x.htm

Carteret Co., NC – More early voters voted on Unilect Inc.’s Patriot voting system than the system could handle resulting in the loss of more than 4,500 votes.: http://www.usatoday.com/news/politicselections/vote2004/2004-11-04-votes-lost_x.htm

Broward Co., FL – ES&S software on their machines only reads 32,000 votes at a precinct then it starts counting backwards (see this update): http://www.news4jax.com/politics/3890292/detail.html

Mecklenburg Co., NC – More votes registered than voters: http://www.charlotte.com/mld/charlotte/news/politics/10094165.htm

LaPorte County, IN - A bug in ES&S’ software causes each precinct to be reported as only having (exactly) 300 voters each; all reports add up to 22,000 voters in a county that has more than 79,000 registered voters.: http://www.heraldargus.com/content/story.php?storyid=5304

Utah County, UT - 33,000 straight-party ballots are not counted due to a programming error in punchcard counting equipment.: http://deseretnews.com/dn/view/0,1249,595105309,00.html

CSC 382/582: Computer Security Slide #16

Are Voting Machines Secure?

“As long as I count the votes, what are you going to do about it?”– William Marcy “Boss” Tweed, 1871

CSC 382/582: Computer Security Slide #17

Diebold BallotStation

1. Setup– D/L ballot setup

2. Pre-Election– L&A testing

3. Election– Voting

4. Post-Election– Print result tape– Transfer votes

CSC 382/582: Computer Security Slide #18

Attack Scenarios

• Transferring Votes– Transfer vote from one candidate to another.– Leaves total number of votes unchanged.

• Denial of Service– Target precinct that votes for opponent.– Malware shuts down or wipes machine.– Forged administrative smartcard attack.

CSC 382/582: Computer Security Slide #19

Injecting Attack Code

• Direct installation– Replace EPROM.– Exploit backdoor to install from smartcard.– Reboot using smartcard with botloader.– Voting machines use standard minibar keys.

• Virus– Infects memory cards.– Memory cards infect machines on boot.– Software upgrades delivered via memory cards.

CSC 382/582: Computer Security Slide #20

Concealing Voting Malware

• Timing– Software only active in Election mode.– Software only active on certain dates / times.

• Knock– Software actives only after secret “knock” given.

• Hiding processes and files– Rootkit techniques– Virtualization

CSC 382/582: Computer Security Slide #21

Mitigating Attacks

• Be like an XBox.

• Digital signatures for software updates

• Securing audit logs and counters– Specialized hardware– Cryptographic techniques

• Chain of custody for memory cards

• Voter verifiable paper trail

CSC 382/582: Computer Security Slide #22

References1. Caltech/MIT Voting Project, “Residual Votes Attributable to Technology,”

http://www.hss.caltech.edu/~voting/CalTech_MIT_Report_Version2.pdf#search=%22mit%20caltech%20uncounted%20ballots%22, 2001.

2. “More e-voting problems,” http://www.evoting-experts.com/, December 12, 2004.

3. Ariel J. Feldman, J. Alex Halderman, Edward W. Felten, “Security Analysis of the Diebold AccuVote-TS Voting Machine,” http://itpolicy.princeton.edu/voting, Sep 13, 2006.

4. Douglas Jones, “Illustrated Voting Machine History,” http://www.cs.uiowa.edu/~jones/voting/pictures/, 2003.

5. Tadayoshi Kohno, Adam Stubblefield, Aviel D. Rubin, Dan S. Wallach, “Analysis of an Electronic Voting System,” IEEE Symposium on Security and Privacy, Oakland, CA, May, 2004

6. Mark Newman, “Election Result Maps,” http://www-personal.umich.edu/~mejn/election/, 2004.

7. Avi Rubin, Brave New Ballot, Morgan Road Books, 2006.8. Kim Zetter, “House Dems seek Election Inquiry,”

http://www.wired.com/news/evote/0,2645,65623,00.html, Nov 5, 2004.9. http://en.wikipedia.org/wiki/Voting_system, 2006.