1. Internet Voting a menace to society? Jan Meijer

3. POWER

4. You exercise your right to vote... If you are elligable Anonymous In private, it’s YOUR vote, leave your consultant at home to elect well defined subject(s) According to a well defined process

5. Water boards & RIES 2003, Water board Rijnland, Rijnland Internet Election System 1.2 million voters 300k for Internet voting Postal + Internet

6. RIES: The ”Robers” protocol Herman Robers. Electronic elections employing DES smartcards. Master's thesis, Delft University of Technology, December 1998. http://www.iscit.surfnet.nl/team/Herman/election. ps. http://www.iscit.surfnet.nl/team/Herman/election. ps http://www.cs.ru.nl/W.Pieters/compsac2005.pdf Virtual ballot using DES

7. 3 phase system Phase 1: Prepare. –Distribute pseudo Id and voter secret to each voter Phase 2: Voting window Phase 3: Tally

8. Network paradigm client (voter) server (polling station)network (internet)process stage vote process processingverification vote contact vote materials vote result vote confirmation unsecured secured

9. Security is a mindset

10. Know your goal: won the battle..

11. Know your risks

12. shit will happen

13. Know when it’s good enough...

14. System characteristics Peak performance 2004: 23 voters/s over SSL Holistic approach Compartimentalized security Layered security Sustain multiple component failure BCP, common sense ”Lazy running” Dirt cheap

15. Not in outer space You scavenge... A network Existing services (DNS, RPS, NTP,...) SURFnet-CERT...

16. Architecture overview

17. Our dashboard

18. It worked… Resource usage Rijnland elections

19. No peak? vote server 1, 2006vote server 2, 2006 vote server 1, Dommelvote server 1, Rijnland

20. So, a menace to society? ONLY IF DONE BADLY

21. Easiest to monitor 10.000 polling stations (Nigeria, UK, NL?) or 1 station

22. /me? Voting by the people, for the people: it’s democracy stupid! Internet age opportunity Publicly owned system, open source End commercial incompetence Power to the people! State of our eVoting systems is a professional disgrace!

23. Still not convinced? http://www.theregister.co.uk/2007/05/17/sarasota_county_n etwork_breached/ “Slammer turns Florida election result into worm food” …The county server was breached on the first day of early voting in the 2006 election, which included a now-disputed race for a seat in the US House of Representatives. The attack code was a variant of the infamous Slammer worm that penetrated the county's server, which unbelievably, was missing five years worth of security patches…