1. Internet Voting Technology and policy issues David Wagner UC Berkeley

2. Introductions I’m a computer security researcher We study attacks and countermeasures –Before one can design a system that will resist attack, one must anticipate how it might be attacked

3. No Secrets Proactive study of attacks is generally a good thing Mounting such attacks is not, of course –Don’t use your super powers for evil

4. Selective History of Voting (US) early 1800’s: public oral voting at County Hall 1800’s: free-form, non-secret paper ballots popular 1884: widespread vote fraud 1888: adoption of Australian secret ballot 1930’s: lever machines widely adopted 1960’s: punchcard voting developed 2000: butterfly ballots, chad, Florida, gack! 2002: HAVA

5. Attacks on the Secret Ballot Registration fraud: Register in multiple jurisdictions Graveyard voting “Cleanse” the voter list Districting & re-districting Voter fraud: Vote multiple times (ballot box stuffing) Multiple voting Impersonation Insider fraud: Throw ballot boxes into the bay Stuff ballot box after polls close Sleight of hand Voter intimidation “Run out of ballots” Tallying attacks: Malicious talliers might calculate wrong results Give talliers bogus tools

6. Attacks on the Secret Ballot Registration fraud: Identity fraud Voter fraud: Impersonation Vote multiple times Vote buying, chain voting Insider fraud: Ballot box stuffing Ballot marking Tallying attacks: Inaccurate counts Ballot marking Manipulation of challenge procedure

7. How Secure is the Secret Ballot? It’s easy to forge a few fraudulent votes But: It’s very hard to forge a lot of fraudulent votes… Summary: Australian secret ballot is quite robust; a well-designed security system.

8. History of Internet Voting 2000: 36,000 Arizona citizens vote in Democratic primary over the Internet; 85 military personnel vote in November elections over the Internet 2000: California studies Internet voting; task force recommends against it 2000: NSF panel warns of security risks in Internet voting 2004: SERVE will accept votes over the Internet

9. The SERVE Project A DoD project for overseas voters Register & vote from abroad Vote over the Internet, using your Windows computer

10. Who is eligible for SERVE? Overseas & military voters from participating jurisdictions (7 states, 51 counties)

11. The SERVE Architecture (1) Internet Citizen HTTPS UVS Control Data Ballot Definitions Voted Ballots (Encrypted) LEO Processes Voter Registration Ballot Definition Ballot Decryption Ballot Tabulation Voter History Web Server HTTPS, SFTP SERVEUSA.gov * * * Firewall ** Identification & Authentication Process SERVE server infrastructure Election officials UVS Laptop Ballot Definition Voting Engine Ballot Reconciliation Voter Registration I & A Process ** Voter Status Check Overseas voters Encrypted Voted Ballots Ballot Def. Data UVS Control Data

12. The SERVE Architecture (2) LEO Infrastructure UOCAVA Voting System (UVS) Citizen HTTPS Encrypted Voted Ballots Manual Ballot Def. Data UVS Control Data Central Server Voter History

13. Security Risks in SERVE (1) Software flaws: Unintentional bugs might enable remote attacks Malicious code might contain a backdoor COTS software might be insecure or backdoored Insider attacks: Votes cast could be modified or deleted Election officials could learn how you voted, or count your votes incorrectly Sysadmins, developers could bypass security

14. Security Risks in SERVE (2) Attacks on the client: Worms, viruses Remote attacks Malicious websites, ActiveX Denial of service attacks: DDoS might render servers unreachable Targeted disenfranchisement Website spoofing: Voters might be re- directed to the wrong site (DNS hijacking, email) Spoofed site might observe or change votes Automated vote swapping and vote buying

15. Summary How do you know that your vote was counted? How much security is enough? How much security is too much? You won the election, but I won the count. -- Somoza

16. Discussion?

17. Fighting Words Internet voting is a danger to democracy No voting system will ever be perfectly secure; why worry? Absentee vote-by-mail is already insecure; why should Internet voting be held to a higher standard? 30% of our military today can’t vote; a little insecurity is worth it if it fixes the problem The threat of extraterritorial election fraud is new, and requires new laws