Why can t I vote online? ONLINE SECURITY AND THE FUTURE OF INTERNET VOTING
Verified Voting Founded in 2004 by computer scientists Non-partisan, not for profit. Focus on elections technology security, auditability, and accessibility. Board of directors and advisors include renowned computer security experts and election officials Organization provides analysis, expertise and advice, including to California Internet Voting Task Force, California Top to Bottom Review, and Department of Defense on the SERVE Internet voting project, among others. Produce research reports, Verifier, The Voting News.
Verifier
Internet Voting: Let s start with a definition Internet voting systems NOT online voter registration Email return of voted ballots NOT online delivery of blank ballots Fax return of voted ballots NOT online sample ballots Online ballot marking* (transmits vote choices over the Internet, introduces voter privacy issues) NOT online polling place lookup, etc.
Security of online elections online banking Secret ballot > unauditable Online banking is not secure No way determine acceptable level of loss. Can t buy insurance. Margin of error in voting is much smaller than for online commerce
Consensus that online voting can t be done securely yet because of unsolved security issues. Department of Defense (Federal Voting Assistance Program) National Institute of Standards and Technology (NIST) US Vote Foundation Future of Voting Utah Lt. Governor ivote Advisory Committee Computer technologists statement on Internet voting
Department of Defense [The Department of Defense] does not advocate for the electronic transmission of any voted ballot, whether it be by fax, email or via the Internet. - Pentagon spokesman Lt. Commander Nathan Christensen April 16, 2015 Gordon, Greg, As states warm to online voting, experts warn of trouble ahead, The Olympian, April 16, 2015 http://www.theolympian.com/news/nationworld/article26122669.html#storylink=cpy
Federal Voting Assistance Program (FVAP) Electronic delivery of a blank ballot, when combined with the postal return of the voted ballot, remains the most responsible method for moving forward until such time applicable Federal security guidelines are adopted by the EAC. - May 2013 Federal Voting Assistance Program s 2010 Electronic Voting Support Wizard (EVSW) Technology Pilot Program Report to Congress - http://www.fvap.gov/uploads/fvap/reports/evsw_report.pdf
Internet voting project repealed Because of unresolved security issues, Congress repeals direction to the DoD/FVAP to develop an Internet voting demonstration project in the 2015 National Defense Authorization Act (NDAA).
National Institute of Standards and Technology (NIST) Has studied Internet voting for many years for the Department of Defense Publishes reports on the security and risks of online voting procedures See http://www.nist.gov/itl/vote/uocava.cfm
NIST summary statement concluded that Internet voting systems cannot currently be audited with a comparable level of confidence in the audit results as those for polling place systems. Malware on voters' personal computers poses a serious threat that could compromise the secrecy or integrity of voters' ballots. And, the United States currently lacks a public infrastructure for secure electronic voter authentication. Therefore, NIST's research results indicate that additional research and development is needed to overcome these challenges before secure Internet voting will be feasible.
So why does NIST claim online voting can t yet be done securely? Security tools and features currently available encryption, firewalls, credential authentication, etc. can mitigate some classes of attacks but not all. Unsolved problems regarding voter authentication, privacy and system security Some types of online attacks cannot be mitigated.
Computer Technologist Statement on Internet Voting The internet has the potential to transform democracy in many ways, but permitting it to be used for public elections without assurance that the results are verifiably accurate is an extraordinary and unnecessary risk to democracy.
So.? No system is totally secure.
Risk factors of online voting 1. Vulnerability of the system/votes 2. Likelihood of an attack (value of the target) 3. Scale of potential damage 4. Recovery/ resilience of the election system
1. Vulnerability example Malware on voters computers 30-40% of computers infected. Via Dark Web attackers rent access to already infected computers; update remotely Cost: ~ $2500 Impact: Potentially large scale Vulnerability: Intercept, modify ballots marked online, sent by email and/or via web portal Prevention/mitigation: none. Detection: probably not.
Email return of ballots Ballots sent by email as attachments can be manipulated or corrupted in transit. least secure method significantly easier to modify Easiest attack is to strip the attached ballot, replace it.
A different intriguing example New South Wales
Computer scientists run an off-the-shelf security test on the system
Analysis of the ivote server showed a 3 rd party script running in the voter s browser Security of the 3 rd party script got an F from the Qualys test The system was vulnerable to multiple man in the middle attacks that could allow an attacker to manipulate vote choices undetected.
NSW ivote system vulnerable to multiple attacks
Attacks possible despite secure SSL protocol
So.. Ok, so there are vulnerabilities, what is the real likelihood of an attack?
2. Value? Elections are high value targets Not just for individual candidates and parties but from a national security stand point.
Today s cyber security threat environment No longer just this guy in a basement
Today s cyber security threat environment State sponsored cyber attacks Terrorist groups Cyber crime syndicates for hire (many in eastern Europe, former Soviet Union) Hacktivists (Anonymous, LulzSec)
Today s cyber security threat environment Advanced Persistent Threat (APT)
APT Cyber Attacks SONY stole and released data Sands Casino wiped servers, destroyed data, froze company OPM stole federal employee data ARAMCO
Aramco Hack Malware attack Erased data on ¾ of the computers, documents, spreadsheets, emails and projected on all monitors an image of a burning U.S. flag.
Terrorist examining voting security
Cyber security environment today There are those who've been hacked by the Chinese and those who don't know they've been hacked by the Chinese. -FBI director James Comey "There is no data center or network in the world that hasn't been hacked. If you watched the number of attacks, they're going up exponentially this year, this year's going to be much worse than last year. - CISCO CEO John Chambers Attacks against us are increasing in frequency, scale, sophistication and severity of impact. - director of National Intelligence James Clapper
3. Scale of potential damage Attacks can be automated creating wholesale election fraud or corruption, rather than retail
4. Recovery/resilience of the system Resilience is a common factor when considering security of any online system How well can the system recover from an attack? --one that corrupts ballots digitally without the voter s or election official s awareness? --one that interrupts service at a crucial time of the election? Elections and voting especially UNRESILIENT in that it is unlikely one could detect a online voting attack and even if it could be detected, it would be uncorrectable.
So what about Estonia?
Estonia Public key infrastructure Not actually secure the system has been shown to be vulnerable to attacks Technologists acknowledged the system s insecurities Public distrust of the Internet voting system
So how do we go forward? Computer scientists are looking at ways to resolve the unresolved security issues presented with online voting. U.S. Vote Foundation Future of Voting Report Utah Lt. Governor s ivote Advisory Committee Report
U.S. Vote Foundation Explores using end-to-end verifiable voting systems Concludes nothing currently on the market secure enough for public, binding government elections But provides an outline for systems Recommends widespread polling place deployment first
Utah ivote Advisory Committee Concludes sufficiently secure internet voting systems do not currently exist. Offers two options online ballot build and build a voting system Recommends any system must undergo rigorous public testing.
We re not there yet. But election officials can use the Internet to improve voting in many other ways that don t endanger the legitimacy of the ballot and the election results.
Internet-assisted elections Online voter registration Online absentee ballot requests Online blank ballot delivery Online ballot tracking software for vote-by-mail and absentee voting Accessible remote ballot marking systems for disabled voters (offline) Smartphone apps for polling place lookup, voter registration info, etc. Online sample ballots
Thank you!!! www.verifiedvoting.org Susan@verifiedvoting.org
References NIST statement and reports - http://www.nist.gov/itl/vote/uocava.cfm Computer technologist statement on Internet voting - https://www.verifiedvoting.org/projects/internet-voting-statement/ NIST on malware NIST IR 7700 Security Considerations for Remote Electronic UOCAVA Voting http://www.nist.gov/itl/vote/upload/nistir-7700-feb2011.pdf NIST on Email ballots NIST IR 7551 A Threat Analysis of UOCAVA Voting Systems http://www.nist.gov/itl/vote/upload/uocava-threatanalysis-final.pdf The Canvass - Internet voting, not ready for prime-time? Feb 2013 http://www.ncsl.org/portals/1/documents/legismgt/elect/canvass_feb_2013_no_37.pdf New South Wales http://arxiv.org/pdf/1504.05646v2.pdf Sands Casino hack - http://www.bloomberg.com/bw/articles/2014-12-11/iranian-hackers-hitsheldon-adelsons-sands-casino-in-las-vegas ARAMCO hack -http://www.nytimes.com/2012/10/24/business/global/cyberattack-on-saudi-oil-firmdisquiets-us.html?_r=0
References continued U.S.Vote Foundation Future of Voting https://www.usvotefoundation.org/e2e-viv/summary Utah ivote Advisory Committee Report http://elections.utah.gov/media/default/documents/report/ivote%20report %20Final.pdf