L9. Electronic Voting

Transcription

1 L9. Electronic Voting Alice E. Fischer October 2, 2018 Voting... 1/27

2 Public Policy Voting Basics On-Site vs. Off-site Voting Voting... 2/27

3 Voting is a Public Policy Concern Voting... 3/27

4 Public elections attract money and power The results of an election can be far-reaching. Large amounts of money and power are used to influence the results of state and national elections. Parties involved include: The people who vote (part of the public) The press Politicians Lobbyists (big business) Foreign leaders and their henchmen How many of these care about honesty and fairness? Which ones care more about winning or self-interest? Which ones are motivated to try to influence an election? Voting... 4/27

5 What is the worst thing that can happen? We want to make it very difficult to buy elections. A foreign power could try to sway the vote. A well-endowed organization could buy employees of a voting-machine company. Back doors could be installed into the software that could falsify vote totals. False initial values could be installed in the ballot cards to falsify totals. Instead of buying one precinct, a well-organized and well-funded effort could pervert a national election. We could end up with a government that supports one-party rule. Did you vote in the last election? Are you registered now? Voting... 5/27

6 Voting is... Our best defense against tyranny. Maybe our only defense against tyranny. Voting... 6/27

7 Elections are Required by the Laws of our Land Voting machines and methods are only a part of a complex, larger process. The process starts with registering eligible voters. It continues with the casting of ballots, which must be anonymous. Then we count the ballots and publish the outcome. Finally, we turn power over to the winners. Utter chaos would result if the people did not trust the outcome. Voting... 7/27

8 Fraud is Possible at Every Step Voter registration databases can be (and have been) hacked. Voters can be (and have been) disenfranchised by having long lines at too few polling places. Ineligible voters (people who are dead or registered twice) have voted. Election officials can lose ballot boxes. Truly, many ways to steal an election have been devised. And used. In the old days, the effects were localized to one district. Voting... 8/27

9 What are the issues with on-site electronic voting? Ability to do a meaningful recount. Anonymity of the ballot + ability to verify honest vote counting. (Ameliorated by a paper trail) How can we trust the software? (Trade secrecy vs. public power) How can we trust the hardware? (There are known exploits.) Voting... 9/27

10 Voting Voting procedures and rules are part of the laws of every state. Each voter has a reasonable need to be confident that his votes are recorded honestly and accurately. However, the voter and the vote must not be associated anywhere in storage. The vote must be anonymous. We have a reasonable need to be able to audit an election and do a recount, while retaining anonymity The real challenge is getting everyone who is eligible to vote! Voting... 10/27

11 Society Must Trust the Process Trust and transparency are the most important elements for minimizing fraud. Trust comes from having many eyes (from both parties) watching the polls at, and after, an election. Transparency allows those eyes to see misbehavior. Computerized systems lack transparency. Even if the voting officials are honest and have the best of intentions, they can t see what s going on inside a computer, and it s very hard to know whether a computer is doing what it is supposed to do. Voting... 11/27

12 Casting and Counting Ballots In Connecticut, poll watchers from both parties cooperate to make sure that only registered voters receive ballots, and no voter can get another ballot without turning in a spoiled one. The voter marks the ballot-card in an area shielded from other eyes. The ballot is inserted into a scanner that senses the marks and counts them. The ballot is dropped, face down, into a box, which is stored for a possible recount. It is not possible to deduce who cast a particular ballot. Voting... 12/27

13 What is our Situation Nationally? Very few balloting systems have been approved. Some were certified, installed, and later decertified. They are still in use. Some systems have been hacked. This is the cheapest way to let the voter verify his vote and to produce a recountable paper trail. The scanning software used is not open for public scrutiny. We hope it is fair and honest. Online voting is not yet a secure reality. [HailToTheVictors.pdf] Voting... 13/27

14 2016 News about Voting A judge in Florida ordered the Governor to keep voter registration open an extra week to compensate for the disruptions caused by the Hurricane on the last normal week. A judge in North Carolina ordered the state to restore the names it purged from the voting lists. An Ohio judge warned Trump against allowing people to intimidate voters at the polls. The judge created the possibility of fines or jail time for Trump allies who harass voters. Trump had been encouraging his supporters to serve as poll-watchers on Election Day. Russia hacked U.S. sites related to politics and spread disinformation to disrupt the process. Voting... 14/27

15 On-Site vs. Off-site Voting Voting... 15/27

16 Vote independently once and only once. Can a similarly accurate system be implemented remotely? Using bio-data for ID? How can we assure one man one vote? If a person does not need to be at the polling place, he could log in to multiple sites and vote as often as he liked. Remote = beyond protection. How can we prevent large-scale coercion and vote-buying? Maybe we could provide secure remote polling places for large groups of voters (soldiers, hospitals). Voting... 16/27

17 Issues with voting by internet. What kind of databases would be required to authenticate voters. Using bio-data for ID? Is it wise for us to warehouse that kind of data? Authentication of the server and voting app. (Man in the middle?) Providing a virus-free server. (Think about Stuxnet.) Denial of service attacks on voting day. Malfunctioning equipment in the field. Voting... 17/27

18 Electronic Voting We vote on-line all the time. It is cheap, easy, and convenient. Organizations elect directors We referee papers for professional conferences Public opinion polls are run online. Reality shows rely on online voting. Voting... 18/27

19 Pros and Cons The benefits of online voting: Absent or ill voters could vote from anywhere. Servicemen could vote from the battlefield. Counting the votes would be quick and cheap. The problems with online elections: Voter authentication would be much more difficult. There is no way to prevent coercion or buying votes. There is no way to guarantee that the software and hardware are bug-free. No way to prevent or detect internet attacks, no way to know who receives your vote. Voting... 19/27

20 Voting is not Like Banking. We use and trust secure online transactions all the time: Banks offer you secure online access to your accounts. The internet supports encrypted transactions (https) We routinely use encryption to safeguard information. So... why the fuss about using voting via internet? Voting must happen during a specified time slot. There must be no way to associate the voter with his vote. With banking, an accounting mistake can be identified from the monthly statement. Voting... 20/27

21 Paper ballots aren t perfect either Nothing is perfect. We do the best we can. Political bosses have been stuffing ballot boxes for as long as anyone can remember. Hand-counting ballots is very expensive. Absentee ballots are a nuisance and make it hard for many people to vote. They may not even be counted if they cannot change the results. Voting... 21/27

22 Use Cryptography to Fix the Problems. Not possible. Crypto can conceal a vote during transit but: It cannot help with coercion or buying votes at the voter end. It cannot ensure the vote goes to the correct destination. It cannot solve DDOS attacks. It cannot compensate for hacked tallying software. An election system needs to be secure from beginning to end. Voting... 22/27

23 DRE machines. Direct Recording Electronic machines increment a counter to record a vote. They make no record of an individual s vote, so there is no way for a person to verify that the machine recorded the vote the way the human intended. There is no meaningful way to do a recount. The software that runs the machines is secret. DRE voting machines were not designed for security and are easily hacked. We can t trust computers, even those we own and use daily. Voting... 23/27

24 In Connecticut, we use scanners. If the scanner counts the ballots locally, as is done in Connecticut, one must trust the scanner. The totals on the machine must be read, checked by all parties, and recorded. Poll workers send this number to the town officials and telephone it to their party headquarters. The precinct totals are added together at a central location. All info is displayed on a website to allow people at party headquarters to verify that the precinct counts and the total are correct. The paper ballots are boxed, sealed, and stored in a secure place pending certification of the election. The chain of custody is carefully controlled. Voting... 24/27

25 Paper Ballots Support Vote Verification Using paper ballots solves the biggest problem: they make it possible to do a recount. However, they are not enough to prevent fraud and other kinds of trouble. CT is using scanners to read paper ballots. Too few paper ballots equals trouble (Bridgeport, 2010) A scanner can still break down, delaying everything. In some states, the vote-counting chip on the scanner is relayed to a central location by internet. There are known problems with concurrency. The scanners still run on proprietary software that the public cannot see and verify, although there is, currently, an open-code project to produce scanning software. Voting... 25/27

26 Summary To be trust worthy, a system must allow for a voter-verifiable paper trail and a recount of the votes. Electronic voting systems are inherently insecure. But we still have states using electronic machines. People can still walk into a polling place just before an election, claim that the voting machine company sent them, and insert a different memory card into the voting machines after the machines have been certified for use. Voting... 26/27

27 Verified Voting VerifiedVoting.org is a non-partisan non-profit organization that advocates for legislation and regulation that promotes accuracy, transparency and verifiability of elections. Their web site has a wealth of information on elections. I strongly recommend it to those of you who are concerned about preserving the integrity of our elections. Note: My husband serves on their Board of Advisors. Voting... 27/27