Voting over the Internet in 2014? Union of British Columbia Municipalities 2012 Annual Convention UBCM 2012 Annual Convention In Conversation

Transcription

1 Stephen M.A. Huycke, Acting Deputy City Clerk Teodor L. Tecsa, Manager Applications & GIS September 28, 2012 Voting over the Internet in 2014? Union of British Columbia Municipalities 2012 Annual Convention 1. Background 2. Markham s 2010 Election Model 3. Markham Online Voting Statistics 4. Online Voting Experience 5. Security Considerations 6. Project Management 7. Community Engagement 8. Lessons Learned 1

2 Current population 309,000 (185,470 eligible voters 2010) 16 th largest municipality in Canada Diverse population: - 42% English - 58% Non-English (29% Chinese, 12% South Asian) - Largest age cohorts: & years 56% have University degree, college diploma or trade More than 80% of residents have access to at least 1 personal computer at home & 80% of residents have highspeed internet access Markham introduced online voting in 2003 out of a desire to leverage technology to increase voter engagement Online voting offered flexibility & convenience for commuters, business travelers & snowbirds Online voting held promise in terms of engaging youth Online voting would allow persons with disabilities to vote independently 2

3 Ontario municipal elections are governed by the Municipal Elections Act, 1996 ( MEA ) Eligible Voters in Ontario municipal elections are Canadian Citizens, 18 years of age or older that are: Land owners, tenants, or the spouse of owners and tenants of property in the municipality (includes commercial property) The MEA permits municipalities to use alternative voting methods (e.g. vote tabulators, vote by mail, and internet voting) MEA sec. 42(1)(b) The council of a local municipality may pass by-laws, authorizing electors to use an alternative voting method, such as voting by mail or by telephone, that does not require electors to attend at a voting place in order to vote. UBCM 2012 Annual Convention In Conversation Markham is not the only municipality in Ontario using internet voting. In 2010 internet voting was used in Ontario municipalities with very different populations Markham Perth Peterborough Population 310,000 6,360 74,898 Electors (2010) 185,470 4,590 54,795 3

4 Rationale for Model Established model (used in 2003, 2006) Cost efficient Green Program reducing the number of people driving to voting places Supports accessibility & diversity considerations Multi-channel model engages broad spectrum of voters Online voting platforms continue to improve in terms of security 2010 Model Online voting offered during Early Voting Period only In-person voting offered during Early Voting Period & on Voting Day Use of optical scan vote tabulators & complimentary (e.g., accessible) technology for in-line voting No other voting modes proposed for 2010 (e.g., vote by mail, telephone voting) Markham will be considering telephone voting in 2014 to further enhance voting channels UBCM 2012 Annual Convention In Conversation 4

5 Election Model Supported By Literature review undertaken by Dr. Henry Kim, York University. Examined academic & professional literature s assessment of online voting relative to security & accessibility Dr. Kim previously undertook a Risk Assessment of various voting channels Independent security assessment of the chosen platform Markham s participation in Carleton University Symposium on online voting UBCM 2012 Annual Convention In Conversation Risk Management Important to emphasize that any election model has inherent risks Key is to identify, understand & manage risks Risk tolerance may be different for each election event or electoral jurisdiction Generally, greater public awareness of internet security & privacy requires more rigour around risk management 5

6 Risks of In-Person Voting Personation Quality of the Voters List (multiple entries of same name, ineligible voters, etc.) Coercion (i.e. pressure to vote for a specific candidate at the voting place particularly where a translator is involved) Proxy voting Incorrect ballot issued by staff Forms not properly completed by staff Finding Common Ground AMCTO s 74 th Annual Conference Risks of Vote by Mail Mail-in ballot mailed at right time but arrives too late Notification card stolen No Voting Day voting place to serve as means of recovery Level of control assumed by Canada Post to deliver ballots on time UBCM 2012 Annual Convention In Conversation 6

7 Total budget $1.2 million Category Budget Election Day Staffing $180,000 Internet $123,100 Lease of Vote Tabulators $90,200 Risk Analysis $3,555 Security Audit $18,000 Communications $216,600 Language Translations $45,485 Cost per elector $0.81 for internet, $5.63 for in-person Online Voting Registrants: : 11,708 (7.5% of eligible voters) : 16,251 (9.7% of eligible voters) : 17,231 (9.3 % of eligible voters) Online Voters: : 7,210 (61.6% of registrants) : 10,639 (65% of registrants) : 10,597 (61.5% of registrants) UBCM 2012 Annual Convention In Conversation 7

8 Absentee Voting: 2010 Number Number of voters that voted from another province 495 Number of voters that voted from the U.S.A. 233 Number of voters that voted from outside North America 84 UBCM 2012 Annual Convention In Conversation Online Voters by Age Paper Web s 30s 40s 50s 60s 70s 80s 90s UK* 8

9 Year Online Advanced (incl. Online) Total % (7,210) % (10,639) % (10,597) 6.5% (10,543) 9.3% (15,152) 8.9% (16,511) 28.0% (42,198) 37.9% (61,948) 35.5% (65,927) UBCM 2012 Annual Convention In Conversation Delvinia User Experience Survey (2010) 99% were satisfied with online voting 99% very likely to vote online in provincial/federal elections if option provided 91% voted from home 78% of candidates indicated the option of internet voting had a significant impact on the campaign 92% of candidates indicated they were in favour of Internet voting in the 2010 Markham Municipal Election UBCM 2012 Annual Convention In Conversation 9

10 Markham uses a 2 step registration and voting process To vote online, voter must first register their intent to vote online Credentials required for both registration & participation Model has been used since 2003 Registration Persons on Voters List were sent their Voter Information Package (VIP) by first class mail by September 24, 2010 & included instruction on how to register to vote online Registration was available from September 24, 2010 October 15, 2010 (midnight) Registration required voter to: - Provide full birth date (year, month, day). If full birth date was missing from Voters List, these voters were instructed to contact municipality to verify - Provide unique PIN from VIP - Create Personal Passcode UBCM 2012 Annual Convention In Conversation 10

11 VIP Online Voting Access Following registration, online voting letter was sent with URL & online voting PIN by first class mail URL for voting website not released prior to registration & not published online or elsewhere (i.e. not indexed by Google) Online voting procedures posted June 1, 2010 & broadly communicated to voters & candidates Voting opened 10 a.m. October 16, 2010 & closed October 21, 2010 (8 PM) - 24 hour access during this period 11

12 Online Voting Letter 12

13 Multiple Aspects of Security Server related security Unauthorized physical access ; Network infrastructure ; Environmental hazards ; Distributed Denial of Service Attacks Client related security Malicious software - malware Connection related security man in the middle attacks ; denial of service" attacks; "spoofing (phishing) attacks Voting application security Web application security vulnerabilities Voting process security Votes to reflect eligible voter choices Server (Hosting Environment) Related Security Unauthorized physical or logical access Environmental hazards - power & cooling; smoke/fire detection & suppression; special building construction features Network infrastructure - Manage network devices, monitoring Distributed Denial of Service Attacks (DDOS) - DOS, DDOS 13

14 Server Related Security - Risk Mitigation Unauthorized physical access - Security personnel; monitoring; video surveillance; role based access cards; criminal background checks; sensitive operations should be tracked; no one single person should be able to perform significant operations Environmental hazards - Redundant power & cooling; smoke/fire detection & suppression; special building construction features - Datacenter designed & maintained to be a Tier III facility Server Related Security Risk Mitigation Network infrastructure Manage network devices; perform monitoring Update gateway servers, switches, and firewalls to their most recent patches Implement all industry best and current practices for networks infrastructure, critical supporting services, including DNS Perform penetration testing of the network infrastructure Distributed Denial of Service Attacks (DDOS) Ensure plenty of bandwidth for Web servers Use distributed load-sharing technology for web servers to provide failover server protection Use Leading Edge Technologies 14

15 Client Related Security The weakest link in an internet voting system. Around 90% of home computers use a version of the Microsoft Windows operating system. The problematic security of the windows platform along with the widespread deployment of "macro languages" in applications like Word or Outlook, has provided a fertile breeding ground for many different forms of malicious payloads - computer viruses, "worms", "spyware", or "trojan horse" applications. Despite the widespread use of firewalls and anti-virus software, it has been estimated that 20% of all personal computers are infected with some type of malicious code - "malware. Malware could potentially alter the original vote by having the voters actually signing other data than they intended to sign. While their computer s display makes them believe they sign a vote for one candidate the malicious code existing on their system changes their vote in favour another candidate. Client Related Security - Risk Mitigation Providing special electronic receipts or adding a human interpretation element Use special end to end cryptographic protocols provide an electronic receipt back to the voter that allows the voter to confirm that the vote was received as intended while preserving anonymity on server side Use captcha images to make selections during voting Using digital authentication based on smart cards Instructing and/or providing end users with the option to update their antivirus software and have their systems scanned 15

16 Connection Related Security Securing the connection between the voter's home computer and the central server could be also problematic, but in this area the correct use of public-key cryptography allows for a good degree of confidence in the integrity of this communication channel. The SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols used by web browsers and servers to create secure channels were designed to prevent the so-called "man in the middle" attack whereby a network transmission is hijacked. Unfortunately, even if this technology is used correctly, it is still possibly vulnerable to attacks including "denial of service" attacks or "spoofing" attacks. A spoofing attack is said to occur when one of the communicating parties is tricked into opening a secure connection to a site controlled by an attacker. A variety of spoofing attack, popularly known as "phishing", has become extremely widespread in recent years, typically involving an containing a link to a site which has been created to perfectly mimic a particular target website along with an urgent request to "re-enter" sensitive personal information (passwords, etc.) Connection Related Security Risk Mitigation Update gateway servers, switches, and firewalls to their most recent operating systems upgrades Instructing and/or providing end users with the option to update their operating system software with latest security patches Implementing all possible industry best and current practices for networks infrastructure, as well as applications, critical supporting services, including DNS Ensure plenty of bandwidth for Web servers Use distributed load-sharing technology for web servers to provide failover server protection Educate voters about spoofing, phishing attacks 16

17 Web Application Security A recent study published by 7Safe, UK Security Breach Investigations Report, analyzed 62 cybercrime breach investigation & states that in 86% of all attacks, a weakness in a web interface was exploited versus 14% infrastructure weaknesses - & the attackers were predominately external (80%). These results are largely consistent with the US-based Verizon Data Breach Incident Report (2008) which tracks over 500 cases. Combine this knowledge with the targeted Web-related attacks against Google, Adobe, Yahoo, the US House of Representatives, TechCrunch, Twitter, Heartland Payment Systems, bank after bank, university after university, country after country -- the story is the same. It s a Web security world. Engaged a vendor to perform a web application security assessment of the online voting application Web Application Security Assessment Scope To perform a vulnerability assessment on the external IP address of the web server hosting the online voting application To perform a web application security audit of the electronic voting online application To perform a penetration testing to exploit select vulnerabilities discovered 17

18 Web Application Security Assessment Deliverables Test plan with detailed test cases & execution results Methodology & tools used Summary of identified vulnerabilities for the IP address examined during the scans Summary of open ports Summary of identified vulnerabilities for the user roles examined during the scans Web Application Security Assessment Deliverables, cont d Recommendations regarding web application & system configuration changes necessary Recommendations regarding OS & applications patches & updates necessary Recommendations on how to address the gaps identified Other recommendations (e.g. process, technology improvements) which could provide benefits without compromising the current functionality and/or provide more secure & better user experience 18

19 Web Application Security - Risk Mitigation Voting software and systems to be audited, tested and certified Perform penetration testing for voting application Perform web application security audit Perform voting testing during elections Use security related best practices in the development of voting applications Voting Process Security From a security perspective, the voting process must ensure that the votes casted could not be modified by a third party and that the election results are an accurate reflection of the votes that were casted by voters Attesting the correct assignment of the vote to the proper candidate Attesting the fact that the vote was counted Attesting the fact that voter can vote only once Attesting the fact that the vote can not be tracked to the voter 19

20 Voting Process Security - Risk Mitigation Use 2-step voting process & 2-factor authentication How client, connection, server side and web application security risks are mitigated Ensure voting data is not stored on client/voting computer Provide vote audit trail Online voting system must ensure that votes are verifiable Online voting system must ensure that the vote was actually counted Online voting system must ensure that a voter can only vote once Online voting system must ensure that a vote is secure from tampering Online voting system must protect the privacy, anonymity, & integrity of each elector's ballot 20

21 Online voting system must include intrusion detection systems Online voting system must have passed all relevant penetration tests Online voting system must provide real time updates to Voters List Online voting system must not allow for modification of the cast vote (after a voter has dispatched his/her vote) Online voting system must ensure none of the actors involved in the voting process (organizers, election officials, trusted third parties, voters etc) are able to link a vote to an identifiable voter The actual content of the elector s votes on the client computer should be kept only in volatile memory, if possible, so that it will be automatically erased in the event of a power failure or rebooting. Votes should not be written to long-term storage on the client machine or for any reason, even in encrypted form The ballot, along with any other appropriate information, must be transmitted to the vote server in encrypted form to protect the privacy & integrity of the information 21

22 Must describe the authorization process to control access, detailing how role-based access control (RBAC) is utilized to ensure least privilege access to functions &/or data sets Online voting system must record the IP address of the workstation that was used to record the vote so that Town of Markham can inspect patterns that could imply voting irregularities Hosting related security The proponent must outline a system recovery & disaster plan The proponent must commit to 99.99% uptime during advance & Voting Day voting The proponent must provide a proper data centre environment, including AC, UPS & fire solution. A detailed outline is required The proponent will be responsible for data protection, data backup & data security. A detailed outline is required 22

23 Electronic voting is different from electronic commerce in several important ways: In electronic commerce there is always time to dispute a transaction if something hasn't worked correctly. With voting, there is a deadline that must be met. In an electronic commerce transaction, the buyer typically gets a receipt that can be used later to resolve disputes. Voters do not get receipts showing how they voted In electronic commerce, transaction records identify the parties involved. In electronic voting, the ballots cast should not identify the voters who cast them, as this might violate the voter's privacy Rivest, R. L.: Electronic Voting Auditing The voting session creates a record, that is the bases of an audit trail, that records: - Identity of the voter - When they first accessed the system - What voting channel is used - A remote identifier (if available) - Language preference for the session - The type of browser being used 23

24 Auditing When a voter makes selections and hits the confirmation button, the system records the voter s participation in a contest. From an audit perspective, this part of the transaction identifies: - The voter - The time the vote was cast - The channel used for voting Recounting Recount to determine voter intention Cannot accidently spoil an evote, voter intention of a spoiled evote is clear (i.e. they deliberately spoiled their ballot) Recount conducted in same manner as original count Run the same report & the system would function the same & the numbers would be the same including a count of those voters who opted to spoil their ballot Timing of a recount The ballots & voting information are held securely in the system until their destruction is ordered by the Returning Officer 24

25 Auditor Role Markham implemented an Audit Role in 2010 Municipal Election to: Provide Chief Electoral Officer with an informed review of the processes followed in the election Express an informed opinion with regard to the accuracy & integrity of the online election results Monitor the online election at the ballot level through the use of audit PINs Print results of the online voting & insert them into a sealed envelope & deliver to Returning Officer Considering the benefits of online voting and the following security related aspects: The Hosting environment was designed & maintained to be a Tier III facility and successful SAS70 audit had been performed on the entire Managed Hosted Services area How the platform requirements were satisfied by the vendor The voting process security measures in place The results of the Web application security audit The results of our own extensive testing of the product That we could test the application during election period using audit pins and thus ensuring that the application functions as expected Online voting offered during Advanced Voting Period only in parallel with Inperson voting The geo-political context and the likelihood of a major security incident happening for a Markham election We concluded that the security related risks were mitigated to our satisfaction 25

26 California Institute of Technology (CALTECH) and Massachusetts Institute of Technology (MIT): Voting Technology Project, Jefferson, D.; Rubin, A.D.; Simons, B.; Wagner, D.: A Security Analysis of the Secure Electronic Registration and Voting Experiment (SERVE), REQUEST FOR PROPOSAL 339-R General Election Tabulation and Online Voting Support & Services Markham Internet voting online article ( Schryen, G. : How Security Problems Can Compromise Remote Internet Voting Systems Wolchok,S.; Wustrow, E.; Isabel, D.; Halderman, J.A. :Attacking the Washington, D.C. Internet Voting System Rivest, R. L.: Electronic Voting ( 10 Strategies To Fight Anonymous DDoS Attacks - InformationWeek, February 08, 2012 Used solid PM principles for the overall Markham Elections for both channels: online & in-person channels Excellent internal collaboration between Clerks, ITS, Corporate Communications, Contact Centre Departments as well as between Markham & external vendors & media Performed extensive end user testing 26

27 Tester Pin Ward Electorate Race Candidate(s) to be selected ,2, ,3, ,3, ,4, Coverage: Cover each ward, electorate, race, candidates; under-vote, over-vote; interrupt voting and restart; cast no vote in some races, etc; use all major browser types (IE7&8, Firefox, Chrome, Safari); 8 testers, 200 voting pins, 8 wards, 5 electorates, 4 races Electorate: English Public, English Separate, French Public, French Separate, No School Support Race: Mayor, Regional Councillor, Ward Councillor, School Board Councillor 27

28 Online Voter Support Key to the success of any internet voting is a Communication and Community Engagement strategy Markham s Contact Centre trained throughout process to provide support to online voting Weekend & evening hour availability critical Clear understanding of expectations/scope of services to be provided by Clerk s & Contact Centre critical Ongoing quality assurance: address issues quickly & consistently; communicate often Easy to remember , ext. VOTE or info@markham.ca Typical Online Voter Issues As expected wide range of issues relating to web browsing experience & comfort level (many tried to use search engines to direct them to the secure site) Issues associated with inaccuracies in Voters List used to generate VIP (deaths, name misspelled, moved voters, etc.) Human error issues: - Misplaced VIP, misplaced online voting letter - Misplaced PIN, Personal Passcode - Misunderstand instructions 28

29 Typical Online Voter Issues (Cont d) Scenarios where spouse, family member or friend is calling on behalf of voter Voters realizing their Ward or School Board Support information is incorrect after having already voted Voters exiting the platform prior to completing their ballot Security concerns Understand & plan for new &/or emerging online voting risks & build options early (well in advance of Council decision points) Ensure internal online voting resources are clearly defined & supported Engage Council, candidates & public early & encourage online voting questions & educate Use candidates as means of communication & feedback from voters regarding online voting Establish & communicate protocol for common human error issues relative to online voting process 29

30 Ensure clear understanding of vendor s platform & never rely on vendor to make policy decisions Fully understand limitations & functionality of online voting it is NOT a cure all for declining voter turnout! Understand integration of online voting platform, in-person & other voting channels Recognize & communicate the changing nature of candidate & scrutineer function in an online voting environment & communicate this early Contingency & emergency planning Conduct user experience surveys it is worth the time and effort! Audit function is essential Proper testing should be performed for the system (functional, system, end user, coverage, performance) Proper project management is essential for success of the process Preference should be given to wired connectivity as opposed to wireless connectivity for the admin modules used by election staff Ensure proper processes are in place for sharing election results with the media & that the process is fully understood by all parties 30

31 Possible expansion of online voting up to & including Voting Day Possible addition of telephone to Markham s online & inperson channels Expanded third party assessment of online voting platform Expanded Audit function possibly by external party 31

32 Stephen Huycke, Acting Deputy City Clerk , ext Teodor Tecsa, Manager Applications & GIS Additional Background Information INTERNET VOTING PLATFORM Registration Screen Captures 32

33 1. Enter capcha 2. Enter birth date & Registration PIN 33

34 3. Voter information displayed 4. Voters enter 6 digit number to create Personal Passcode 34

35 5. Registration success message Additional Background Information INTERNET VOTING PLATFORM Voting Screen Captures 35

36 1. Enter capcha 2. Enter Personal Passcode & Internet Voting PIN 3. Welcome page shows available races. Select Continue to proceed to Mayoralty race. 4. Click on box beside candidate of one s choice, then Submit 36

37 5. Select Vote Now to cast ballot or Return to Ballot to re-examine choice. 6. Status screen follows. Select Continue to proceed to further races or questions 7. When all races or questions have been voted on, thank you screen follows. Click on Continue which links to option of completing user survey 37

38 Additional Background Information Additional Security Slides Bell Aliant Data Center Designed & maintained to be a Tier III facility (composed of multiple active power & cooling distribution paths, but only one path active, has redundant components, & is concurrently maintainable, providing % availability Aliant constantly achieves % availability) Locally controlled security, data, power & cooling solutions; Had recently a SAS70 audit performed on the entire Managed Hosted Service area HP c7000 blade system Each blade is a BL465c blade server with dual 2.6 GHZ AMD dual core Opteron processors & 4 GB RAM All blades have dual fibre channel connectivity through redundant pathways to an HP MSA1000 SAN Load balancing & SSL hardware acceleration is provided 38

39 SAS 70 is the most widely recognized professional auditing standard. Developed by AICPA (American Institute of Certified Public Accountants), SAS 70 represents the professional guidelines that CPAs (certified public accountants) must follow when conducting audits. SAS 70 Type II compliance signifies the most stringent form of professional examination. An audit based on this level of compliance certifies that a hosting provider has had its control objectives & activities examined by a qualified independent accounting & auditing firm. SAS 70 Type II adherence demonstrates that a provider maintains adequate processes & safeguards when it hosts or processes customer data. Union of British Columbia Municipalities 2012 Annual Convention An SAS 70 Type II audit is a major undertaking for any hosting provider, which has much to gain or lose depending on the audit's outcome. Key areas of analysis include: Computer and network operations Network security Business physical security Datacenter physical security Business-environment security Datacenter-environment security Logical security Business continuity and disaster-recovery planning Change management for applications and solutions Executive and senior management Decision-making processes Human resources Union of British Columbia Municipalities 2012 Annual Convention 39

40 Online Voting Used a P12 Client SSL Certificate (PKCS12 format) for admin modules Application Security Assessment Tools Fiddler2 includes the ability to decrypt, view, & modify HTTPS-secured traffic for debugging purposes. Burp Suite contains the following key components: - An intercepting proxy, which lets you inspect & modify traffic between your browser & the target application. - An application-aware spider, for crawling content and functionality. - An advanced web application scanner, for automating the detection of numerous types of vulnerability. - An intruder tool, for performing powerful customized attacks to find & exploit unusual vulnerabilities. - A repeater tool, for manipulating & resending individual requests. - A sequencer tool, for testing the randomness of session tokens. Union of British Columbia Municipalities 2012 Annual Convention Web Application Security Assessment Scope Unvalidated Parameters Broken Access Control Broken Account & Session Management Cross-Site Scripting (XSS) Flaws Buffer Overflows Command Injection Flaws Error Handling Problems Insecure Use of Cryptography Remote Administration Flaws Web & Application Server miss configuration security gaps Union of British Columbia Municipalities 2012 Annual Convention 40

41 Union of British Columbia Municipalities 2012 Annual Convention 41