Voting Systems: From Art to Science 1RWH

Transcription

1 1 Voting Systems: From Art to Science Voting Technology Conference 2001 Pasadena, Calif., March Caltech/MIT Ed Gerck, Ph.D. safevote.com CEO & VP of Technology 1 1RWH 7KLVSUHVHQWDWLRQGHDOVZLWKDJHQHUDOPRGHOIRUYRWLQJXVLQJ 6KDQQRQ V&RPPXQLFDWLRQ7KHRU\7KH)XQGDPHQWDO3UREOHPRI 9RWLQJLVWKDWWKHYRWHUPXVWQRWEHDEOHWRVHHWKDWKHUYRWHZDV WDOOLHGWRSUHVHUYHHOHFWLRQLQWHJULW\DQG\HWWKHYRWHUPXVW EH DEOHWRKDYHFRQILGHQFHWKDWWKHYRWHZDVWDOOLHGDVFDVW 7KHGLVFXVVLRQUHPDLQVWLPHO\DQGYDOLG7KHODWHVWH[SHULPHQWVLQ HYRWLQJDQGSUREOHPVZLWK'5(VKDYHFRQILUPHGWKHSUHGLFWLRQV PDGHLQWKLVSUHVHQWDWLRQ 3OHDVHDOVRVHHWKHSUHVHQWDWLRQDW KWWSZZZYRWHFDOWHFKHGXZRWHSGIVJHUFNZLWQHVVSGI IRULPSOHPHQWDWLRQH[DPSOHVRIWKLVGLVFXVVLRQ 2

2 2 3URJUDP :HQHHGWRIRFXVRQUHTXLUHPHQWVDQGPRGHOVILUVWQRWRQWHFKQRORJ\ :HQHHGWRGHYHORSDYRWLQJPRGHOWKDWFDQ ([SODLQFXUUHQWV\VWHPVDQDO\VLVWRRO 3UHGLFWWKHEHKDYLRURIQHZV\VWHPV :LWKVXFKDPRGHOZHVKRXOGEHDEOHWR,PSURYHFXUUHQWV\VWHPV 'HYHORSEHWWHUV\VWHPV 7KHILUVWUHTXLUHPHQWLVYRWHUSULYDF\ 3 $FFXUDF\YV5HOLDELOLW\ $FFXUDF\DIIHFWVWKHVSUHDGRIRQHHYHQW 5HOLDELOLW\DIIHFWVHYHQWVRYHUWLPHDQGVSDFH YDOXH KLJKDFFXUDF\KLJKUHOLDELOLW\ WLPH ORZDFFXUDF\KLJKUHOLDELOLW\ KLJKDFFXUDF\ORZUHOLDELOLW\ ORZDFFXUDF\ORZUHOLDELOLW\ 5HOLDELOLW\PD\ EHFORVHWREXWQRWHTXDOWR $FFXUDF\FDQEHLQGLJLWDOV\VWHPV 4

3 3 7KH)XQGDPHQWDO3UREOHPRI1HWZRUN9RWLQJ YRWHU UHPRWHEDOORWER[ WDOOLHGYRWH EXJ YLUXV IUDXG EXJ YLUXV IUDXG /RZ5HOLDELOLW\ 7KHYRWHUFDQQRWVHHKHUWDOOLHGYRWH KHQFHWKHYRWHUFDQQRW NQRZZKHWKHUKHU YRWHZLOOEHFRXQWHGDVVHOHFWHG 5 7KH)XQGDPHQWDO3UREOHPRI(OHFWURQLF9RWLQJ YRWHU HOHFWURQLFEDOORWER[ WDOOLHGYRWH EXJ YLUXV IUDXG SRLQWWRSRLQWFHUWLILFDWLRQ UHGXQGDQF\ /RZ5HOLDELOLW\ [ +LJK5HOLDELOLW\ /RZ5HOLDELOLW\ 7KHYRWHUFDQQRWVHHKHUWDOOLHGYRWH KHQFHWKHYRWHUFDQQRW NQRZZKHWKHUKHU YRWHZLOOEHFRXQWHGDVVHOHFWHG 6

4 4 7KH)XQGDPHQWDO3UREOHPRI3DSHU9RWLQJ YRWHU EDOORWER[ WDOOLHGYRWH IUDXG GLUHFWSK\VLFDOREVHUYDWLRQ EXJ YLUXV +LJK5HOLDELOLW\ [ /RZ5HOLDELOLW\ /RZ5HOLDELOLW\ 7KHYRWHUFDQQRWVHHKHUWDOOLHGYRWH KHQFHWKHYRWHUFDQQRW NQRZZKHWKHUKHU YRWHZLOOEHFRXQWHGDVVHOHFWHG 7 7KH)XQGDPHQWDO3UREOHPRI9RWLQJ YRWHU EDOORWER[ WDOOLHGYRWH ³YRWHJDS /RZ5HOLDELOLW\ 7KHYRWHUFDQQRWVHHKHUWDOOLHGYRWH KHQFHWKHYRWHUFDQQRW NQRZZKHWKHUKHU YRWHZLOOEHFRXQWHGDVVHOHFWHG 9RWLQJUHVXOWVFDQQRWHYHUKDYHUHOLDELOLW\IRUPRUH WKDQRQHYRWHUHYHQLIHYHU\YRWHUSXEOLFO\GLVFORVHVZKDW KHUKLVYRWHZDVHYHQLIZHMXVWXVHSDSHUDQGSHQLQDOOSURFHVVHVDQGSHUIHFWO\NHHSDOOUHFRUGV7KHLPSRVVLELOLW\ RIREMHFWLYHO\UHDFKLQJUHOLDELOLW\LVGXHWRWKHDEVROXWHUHTXLUHPHQWWKDWQRRQHVKRXOGEHDEOHWRSURYHKRZD YRWHUYRWHGQRWHYHQWKHYRWHUKHUVHOI$QG\HWVRFLHW\PXVWEHFRQILGHQWWKDWWKHUHVXOWLVUHOLDEOH 8

5 5 7KH)XQGDPHQWDO3UREOHPRI&RPPXQLFDWLRQ VHQGHU UHFHLYHU QRLVH ³FRPPXQLFDWLRQJDS /RZ5HOLDELOLW\ 6KDQQRQ7KHIXQGDPHQWDOSUREOHPRIFRPPXQLFDWLRQLVWKDW RIUHSURGXFLQJ DWRQHSRLQWDPHVVDJHVHOHFWHGDWDQRWKHUSRLQW 7KHVLJQLILFDQWDVSHFWLVWKDWWKHDFWXDOPHVVDJHLVRQHVHOHFWHGIURPDVHWRISRVVLEOH PHVVDJHV7KHV\VWHPPXVWEHGHVLJQHGWRRSHUDWHIRUHDFKSRVVLEOHVHOHFWLRQQRWMXVWWKH RQHZKLFKZLOODFWXDOO\EHFKRVHQVLQFHWKLVLVXQNQRZQ 9 6ROXWLRQ(QRXJK5HGXQGDQF\ VHQGHU UHFHLYHU +LJK5HOLDELOLW\ 6KDQQRQ WK 7KHRUHP,QGHSHQGHQWFKDQQHOVFDQEHXVHGWRVHQGFRUUHFWLRQGDWDVR WKDWDOOEXWDQDUELWUDULO\VPDOO IUDFWLRQRIHUURUVFDQEHFRUUHFWHG5HGXQGDQF\Î KLJKUHOLDELOLW\ :HFDQRQO\DSSURDFKWKHOLPLWRIUHOLDELOLW\LQYRWLQJUHVXOWV7KHJRRGQHZVLVWKDWLWLVSRVVLEOHWRJHWDVFORVH DV ZHGHVLUHWR7KHEDGQHZVLVWKDW6KDQQRQ VWKHRU\GRHVQRWWHOOXVH[DFWO\KRZWRGRLW± ZHPXVWGLVFRYHULW 10

6 6 3UHFLQFW9RWLQJ $QDO\VLV(OHFWURQLF9RWLQJ3DSHU%DOORWV YRWHU EDOORWER[HV WDOOLHGYRWHV EDOORWLPDJH SDSHUFRS\ &KDQQHOV(OHFWURQLF3DSHU,IERWKFKDQQHOVGLVDJUHHWKHV\VWHPLVLQGHWHUPLQDWH 3RVVLEOHVROXWLRQDFFHSWDGLIIHUHQFHLILWPDNHVQRGLIIHUHQFH " 7KHVROXWLRQWKXVFRPHVE\SROLF\RXWVLGHWKHV\VWHPDQGGHILQHGDSULRUL $WWDFNHUVNQRZZKDWWRDWWDFNEHIRUHWKHHOHFWLRQ 11 3UHFLQFW9RWLQJ $QDO\VLV1HWZRUN9RWLQJ0LFURILOP%DOORWV YRWHU EDOORWER[HV WDOOLHGYRWHV EDOORWLPDJH FDQRQLFDOEDOORW PLFURILOPFRS\ &KDQQHOV(OHFWURQLF1HWZRUN0LFURILOP,IRQHFKDQQHOGLVDJUHHVWKHV\VWHPPD\ VWLOOEHGHWHUPLQDWH 7KHVROXWLRQFRPHVIURPWKHV\VWHPLWVHOI 6WLOOEDVHGRQDSULRULSROLF\EXWDWWDFNHUVQRZKDYHWRDWWDFN WZRSURFHVVHV " 12

7 7 3UHFLQFW9RWLQJ $QDO\VLV1HWZRUN9RWLQJ5HDOWLPH$XGLWLQJ YRWHU EDOORWER[HV WDOOLHGYRWHV EDOORWLPDJH FDQRQLFDOEDOORW DXGLW &KDQQHOV(OHFWURQLF1HWZRUN5HDOWLPH$XGLWLQJ,IRQHFKDQQHOGLVDJUHHVWKHV\VWHPPD\ VWLOOEHGHWHUPLQDWH 7KHVROXWLRQFRPHVIURPWKHV\VWHPLWVHOI 6WLOOEDVHGRQDSULRULSROLF\EXWDWWDFNHUVQRZKDYHWRDWWDFN WZRSURFHVVHV " 13 Voting System Components 1. Voter Registration Voter must be legally identified 2. Voter Authentication Authenticate voter, ballot style and ballot rotation 3. Voting Station Privacy and security 4. Ballot Box Ballot integrity 5. Tallying and Auditing Anonymity, Secrecy, Verification, Public proofs 14

8 8 Main Voting System Components Voter Authentication Authenticate voter, ballot style and ballot rotation Voting Station Privacy and security Ballot Box Ballot integrity Voting System Component Classification Local or Remote 15 Voting System Classification 3UHFLQFW 5HPRWH $XWKHQWLFDWLRQ 9RWLQJ %DOORW%R[ UHFLQFW2QO\ 0RUH&RPSOH[LW\ 0RUH9HULILFDWLRQ 5HGXQGDQF\ $OO5HPRWH 16

9 9 Who Let the Dogs Out? ³2QWKH,QWHUQHWQRERG\NQRZV\RX UHDGRJ ³'HQLDORI6HUYLFHKDVQRVROXWLRQ ³&RPSXWHUVDUHQHYHUVHFXUH ³:HQHHGSDSHUSURRI 17 3UHFLQFW(OHFWURQLF9RWLQJ Demonstrated at California Voting Technology Expo Challenges met (from current DRE systems): reduce cost increase number of vendors, keep uniformity increase voting reliability (the vote gap issue) reduce obsolescence, promote extensibility authenticate voter and ballot style without hardware token (uses DVCs) Solution: DELTA TM Safevote, software-only DRE Intel, motherboards & architecture Samsung, touch-screen & printers Smart, write-once memory card (local ballot box, for ballot images) Colfax International, integration (premier Intel Solution Provider) Vendors can join and assemble their own systems Reduces entry barrier for new vendors. Uses trained workforce PC-based. 18

10 10 3UHFLQFW,QWHUQHW9RWLQJ Used in November 2000, Contra Costa County, CA interim report at Challenges met (from list of impossibles ): Uses stealth, moving target technology to forestall, with reliability as close to 100% as desired, the following attacks on the precinct Internet node: Denial-of-Service Large Packet Ping Buffer Overrun TCP SYN Flood IP Spoofing TCP Sequence Number IP Fragmentation Network Penetration authenticate voters and ballot style without hardware token (uses DVCs) allow voters to verify on the Internet that their vote was received and is valid support fail-safe privacy (even if everything fails and everyone colludes) increase voting reliability (the vote gap issue) reduce obsolescence, promote extensibility voter freedom vote from any precinct in the state Solution: DELTA-NET TM DELTA, with precinct network linked to the Internet by dial-up router. 19 5HPRWH,QWHUQHW9RWLQJ Not for today in US public elections need to test, test, test To be tested April/May 2001 at Umeå University Student Union, Sweden Financed and supervised by the Swedish Ministry of Justice, Foundation for Knowledge, Umeå County, and the University. Cooperation with the Swedish Post. Challenges being met (from list of impossibles ): Forestall attacks on the remote voter s machine if the voter follows the voting instructions: Spoofing (99.7%) Man-in-the-middle (99.7%) (to be reported in The Bell, at Virus (?) Trojan-horse (?) Forestall coercion and vote selling. authenticate voters and ballot style without hardware token (uses DVCs) allow voters to verify on the Internet that their vote was received and is valid support fail-safe privacy (even if everything fails and everyone colludes) increase voting reliability (the vote gap issue) Solution: Read 59-page report at 20

11 11 (OHFWLRQ6\VWHP 3KDVHV Candidate Registration Election Results Ballot Creation Recount Paper Ballot Distribution Tally & Audit Internet Ballot Distribution DVC File Destruction Precinct Voting Internet Voting Mail Voting Voter Registration DVC Creation DVC Distribution DVC Management 21 (OHFWLRQ6\VWHP 7LPH 22

12 12 Safevote: Multi-Party TM Protocol (example) VA Voting Authority Resources Registration, Ballot, etc. Voter 23 2SHQ6WDQGDUGV,97$ 6DIHYRWHLVDFRIRXQGHURIWKH,97$± KWWSZZZLYWDRUJ 7KH,QWHUQHW9RWLQJ7HFKQRORJ\$OOLDQFHLQFOXGHV &RPSDQLHV 8QLYHUVLWLHVSULYDWHDQGSXEOLFUHVHDUFKFHQWHUV,QGLYLGXDOV *RYHUQPHQWVHFWRUV 7KH,97$LVDQ,QWHUQHWVWDQGDUGVVHWWLQJERG\VSHFLILFIRUYRWLQJ DSSOLFDWLRQVLQFOXGLQJSXEOLFHOHFWLRQVWKDW 2IIHUVRSHQSDUWLFLSDWLRQ 3URYLGHVIRUXQLILFDWLRQRIVWDQGDUGVZLWKRXWLQWHJUDWLRQ 8VHVSHHUSXEOLFUHYLHZSURFHGXUHVZLWKSXEOLF:RUNJURXSV 3URYLGHVSURWRFROFHUWLILFDWLRQDFFRUGLQJWR,97$VWDQGDUGV,VDQRQSURILWFRUSRUDWLRQLQFOXGLQJDOOSDUWLFLSDQWV 1RWDYHQGRUDVVRFLDWLRQ 24

13 13 16 Strict Voting System Requirements KWWSZZZWKHEHOOQHWSDSHUVYRWHUHTSGI 1. Fail-safe voter privacy the inability to link a voter to a vote 2. Collusion-free vote secrecy the inability to know the vote 3. Verifiable election integrity the inability to change the outcome except by properly voting 4. Fail-safe privacy in verifiability 5. Physical recounting and auditing % accuracy 7. Represent blank votes 8. Prevent overvotes 9. Provide for null ballots 10. Allow undervotes 11. Authenticated ballot styles 12. Manifold of links avoid single points of failure even if improbable 13. Off-line secure control structure 14. Technology independent 15. Authenticated user-defined presentation 16. Open review, open code 25 2SHQ'LDORJXH7+(%(// 6DIHYRWHSXEOLVKHV7+(%(//± KWWSZZZWKHEHOOQHW 7+(%(// $QRQSDUWLVDQPRQWKO\QHZVOHWWHU,QGHSHQGHQW(GLWRULDO%RDUG 3XEOLVKHGLQ3')DQGLQSULQW± VHDUFKDEOH+70/QH[W )UHHVXEVFULSWLRQIRU3') SDJHVZLWKTXDOLW\LQIRUPDWLRQ 2SHQSHHUUHYLHZHGDUWLFOHV± DQ\RQHPD\SXEOLVKRQO\UHTXLUHPHQWLV TXDOLW\ 0HGLD:DWFKVHFWLRQ± SURYLGHVDQHDV\FROOHFWLRQRIUHOHYDQWQHZV 'LVWULEXWHGZRUOGZLGH 3XEOLFDQG3ULYDWHVHFWRUVSDUWLFLSDWH +HOSVFUHDWHWKHPDUNHW +HOSVILQGSDUWQHUV +HOSVGHYHORSWUXVW 26

14 14 6DIHYRWH7HFKQRORJ\ DWHQWSHQGLQJ 6HFXUH1HWZRUN9RWLQJ6\VWHP $XWRPDWLFDOO\*HQHUDWLQJ8QLTXH2QH:D\&RPSDFWDQG0QHPRQLF9RWHU &UHGHQWLDOVWKDW6XSSRUW3ULYDF\DQG6HFXULW\6HUYLFHV $+LJK(QWURS\(QFRGLQJ6\VWHPIRU1HWZRUN9RWLQJ 6HFXUH1HWZRUN9RWLQJ6\VWHPZLWK5HPRWH9RWLQJ 6\VWHPIRU'HWHFWLRQDQG3UHYHQWLRQRI'HQLDORI6HUYLFH$WWDFNVLQ 3UHFLQFWEDVHG1HWZRUN9RWLQJ «PRUH 27 6XPPDU\RI5HIHUHQFHV 9RWLQJ6\VWHP5HTXLUHPHQWV KWWSZZZWKHEHOOQHWSDSHUVYRWHUHTSGI 6SHFLILFDWLRQVGHPRVWHVWUHVXOWV KWWSZZZVDIHYRWHFRP &RQWUD&RVWD&RXQW\6KDGRZ(OHFWLRQ KWWSZZZVDIHYRWHFRPFRQWUDFRVWD 8PHn 8QLYHUVLW\8QLRQ6ZHGHQ KWWSZZZXVXPXVHDUNLYSXEOLFSGI 3UHYHQWLQJ1HWZRUNLQFOXGLQJ'R6DQG'DWDDWWDFNV KWWSZZZVDIHYRWHFRPWHFKKWP 28

15 15 &RVW 29 &RVW 30

16 16 :KDW9RWHUV:DQW &RQWUD&RVWD&RXQW\&DOLI1RYHPEHU± YRWHUVDWWKHSUHFLQFW 7KLVSDJHLVQRWDERXWLQFUHDVLQJYRWHUSDUWLFLSDWLRQ 7KHLVVXHKHUHLVYRWHUSUHIHUHQFH :RXOG<RX8VHWKH,QWHUQHWWR9RWH ZRXOGYRWHIURPKRPH ZRXOGSUHIHUWRYRWHIURPWKHZRUNSODFH ZRXOGSUHIHUWRXVHWKH,QWHUQHWWRYRWHDWSUHFLQFWV GLGWU\WKHV\VWHPHYHQWKRXJKWKH\GHFODUHGWKH\ZHUHFRPSOHWHO\ RSSRVHGWRWKHLGHDRI,QWHUQHWYRWLQJ 9RWHUVZDQWVRPXFKWRYRWHDWKRPHRURIILFHWKDWVHYHUDO,QWHUQHWDQGVHFXULW\ H[SHUWVKDYHWRFRQWLQXRXVO\WU\WREORFNWKHLUHQWKXVLDVP 7KHDGYDQFHRI,QWHUQHWYRWLQJLQWKHSULYDWHVHFWRUOHJDOLQVWDWHVFDQQRWEH XVHGDVDMXVWLILFDWLRQIRUXVLQJLWWKHSXEOLFVHFWRU 31 Voting Systems: From Art to Science Voting Technology Conference 2001 Pasadena, Calif., March Caltech/MIT Ed Gerck, Ph.D. safevote.com CEO & VP of Technology 32