Electronic Voting: Danger and Opportunity

1. Electronic Voting:Danger and Opportunity J. Alex Halderman Department of Computer Science Center for Information Technology Policy Princeton University

3. Joint work with … Joe Calandrino Ari Feldman Ed Felten

5. 2000 Recount Debacle Legislative response: Help America Vote Act Provided $3.9 billion to statesto upgrade voting machines by November 2006

6. DREs to the Rescue? Direct Recording Electronic – Store votes in internal memory

7. DREs are Computers Rootkits Viruses Bugs Attacks =

10. Diebold’s History of Secrecy • Prevented states from allowing independent security audits – hid behind NDAs, trade secret law • Source code leaked in 2003, researchers at Johns Hopkins found major flaws Diebold responded with vague legal threats,personal attacks, disinformation campaign • Internal emails leaked in 2003 reveal poor security practices by developers Diebold tried to suppress sites with legal threats

11. Obtained legally from an anonymous private party Software is 2002 version, but certified and used in actual elections First complete, public, independent security audit of a DRE We Get a Machine(2006)

12. Research Goals • Conduct independent security audit • Confirm findings of previous researchers(Hursti, Kohno et al.) • Verify threats by building demonstration attacks • Figure out how to do better Who wants to know? Voters, candidates, election officials, policy makers, researchers

13. SH3CPU 32 MBRAM 128 KB EPROM 16 MB Flash Boot Jumper Table 2 PCMCIA Slots

15. Software Problems One Example: DES-CBCK(BallotID:VoteBitmap), CRC-16(…)

16. Our Findings • Malicious software running on the machine can steal votes undetectably, altering all backups and logs [Feldman, Halderman & Felten 2007]

17. Correct result: George 5, Benedict 0

20. Our Findings • Malicious software running on the machine can steal votes undetectably, altering all backups and logs • Anyone with physical access to the machine or memory card can install malicious code in as little as one minute [Feldman, Halderman & Felten 2007]

22. The Key

24. Our Findings • Malicious software running on the machine can steal votes undetectably, altering all backups and logs • Anyone with physical access to the machine or memory card can install malicious code in as little as one minute • Malicious code can spread automatically and silently from machine to machine in the form of a voting machine virus [Feldman, Halderman & Felten 2007]

25. Voting Machine Virus

26. Viral Spread

28. California “Top-to-Bottom” Study Bill Zeller Alex Halderman Harlan Yu Joe Calandrino Debra Bowen Ari Feldman

29. California “Top-to-Bottom” Results Hart Sequoia Diebold

31. WHAT TO DO?

32. E-Voting Advantages • Voters prefer it • Faster reporting • Fewer undervotes • Improved accessibility • Potentially increased security*

33. WE CAN DO BETTER!

34. Electronic + Paper Records Touch-screen (DRE) machine,plus voter-verifiable paper trail Hand-marked paper ballot,machine-scanned immediately

35. Paper Ballots Physical tampering “Retail” fraud After the election Failure Modes Electronic Records Cyber-tampering “Wholesale” fraud Before the election Redundancy + Different failure modes = Greater security But…Redundancy only helps if we use both records!

36. How to Use Paper Records? Use a machine to count the paper records Too risky Count all the paper records by hand Too expensive Check a random subset of paper records by hand …but which subset?

37. Standard Approach Pick some precincts randomly. Hand-count paper records. Should match electronic records.

38. Statistical Auditing’s Goal Establish, with high statistical confidence, that hand-counting all of the paper records would yield the same winner as the electronic tally.

39. Audit Example Goal: Reject hypothesis that ≥ 5% of ballots differ between electronic and paper Alice: 55% Bob: 45% For 95% confidence, hand-audit 60 precincts Cost: about $100,000

40. An Alternative Approach Precinct-based auditing Ballot-based auditing

41. 100 marbles, 10% blue 6300 beads, 10% blue How large a sample do we need?

42. Audit Example Goal: Reject hypothesis that ≥ 5% of ballots differ between electronic and paper ballots Alice: 55% Bob: 45% For 95% confidence, hand-audit 60 precincts Cost: about $100,000 $1,000

43. Why Not Ballot-based? ● Alice ○ Bob Voting Machine ○ Alice ● Bob Need to match up electronic with paper ballots. Alice Bob Alice ● Alice ○ Bob Compromises the secret ballot!

44. Secret Ballot Prevents coercion and vote-buying Requirements: Nobody can tell how you voted. You can’t prove to anyone how you voted. You can be confident in these properties.

45. Serial Numbers 1 ●Alice ○Bob Voting Machine 2 ○ Alice ● Bob 1 Alice 2 Bob 3 Alice 3 ●Alice ○Bob

46. “Random” Identifiers 325631 ●Alice ○Bob Voting Machine 218594 ○ Alice ● Bob 325631 Alice 218594 Bob 810581 Alice 810581 ●Alice ○Bob

47. ○ Alice ● Bob ○ Alice ● Bob 1 Machine-Assisted Auditing 1 Bob 2 Alice ... 929 Bob Alice: 510 Bob: 419 Step 1. Check electronic records against paper recordsusing a recount machine. = [Calandrino, Halderman & Felten 2007]

48. ○ Alice ● Bob ○ Alice ● Bob 1 Machine-Assisted Auditing 1 Bob Alice ... 929 Bob Alice: 510 Bob: 419 = [Calandrino, Halderman & Felten 2007]

49. ○ Alice ● Bob 1 ○ Alice ● Bob 1 Machine-Assisted Auditing ○ Alice ● Bob 321 ● Alice ○ Bob 716 = 1 Bob Alice ... 929 Bob 321 Bob 716 Alice Step 2. Audit the recount machine by selecting random ballots for human inspection. = [Calandrino, Halderman & Felten 2007]

50. Machine-Assisted Auditing As efficient as ballot-based auditing,while protecting the secret ballot. Machine Recount Manual Audit We can use a machinewithout having to trust it!