Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is that the people should be able to vote for elections using the internet.

One concern for me is that on the web site of the promoters, there are no details about how this system shall be managed, hosted and secured. I stumbled upon some documents in the internet, that show that such prototype systems have been successfully hacked so far and that this is a very insecure mechanism for elections. However the people insist that there is a way, that the system can be made secure enough, and that there are no problems.

Do you think that the implementation of such system is possible TODAY with the current technologies that we have - like modern Cryptographic algorithms, Digital Signatures, SSL or some proprietary protocols? Or in the future?

Isn't it possible for a government with high enough budget for super-computers to break, manipulate and compromise the system according to their wishes?

share|improve this question
1  
It is worth noting that in the USA, even widely used offline vote counters have security vulnerabilities. In the documentary Hacking Democracy, it was demonstrated that an executable could be added to the storage device which would change the results from the scanner, before they were written to the storage. This leaves the necessary (and I hope practiced) step of testing and/or ensuring the hardware is not tampered with. Don't know about Bulgaria's current system. I would advocate ensuring more fool-proof security before advocating online voting. Might be worth checking on. –  George Bailey May 28 '12 at 18:13
4  
@GeorgeBailey IMO those hacks aren't even the main issue. The core problem is that no outsider can verify if machines that nobody tampered with are even secure, or if the manufacturer added in some kind of backdoor. –  CodesInChaos May 28 '12 at 19:24
1  
The Dutch have an Open-Source "Rijnland Internet Election System". This allows professionals the ability to verify the authenticity of voting systems. The need for professionals isn't new; detecting voting fraud has always required expertise. –  MSalters May 28 '12 at 20:54
1  
@MSalters What kind of expertise does the detection of ballots in sockets require? –  curiousguy May 29 '12 at 3:18
1  
You mention "technologies" (cryptography), but you have to realise that an election process is just that: a process. Given the existing "technology" of small papers, opaque envelopes, and a transparent box, what matters is the process. No amount of cryptography can solve a real world problem unless secure procedures are followed (f.ex. SSL does not protect you if you accept any unverifiable site SSL certificate). For any electronic voting proposal, you have to evaluate not only its safety, but also the ability of voters, election official and watchers to control procedures. –  curiousguy May 29 '12 at 3:41
add comment

7 Answers

up vote 13 down vote accepted

It is not known how to build an Internet voting system that will be verifiably secure and auditable. Ron Rivest, Turing award winner and the R in RSA, has famously compared Internet voting to drunk driving: something you just can't do safely.

(By Internet voting, I mean voting over the Internet from client computers not controlled by election authorities, including return of voted ballots electronically over the Internet.)

The argument against Internet voting is a bit elaborate, but you can find details in the following articles:

Don't miss the last paper. It is a totally epic hack of an Internet voting system.

share|improve this answer
add comment

The biggest unsolvable issue, in my mind, with Internet-based voting, is that voters are not protected from social pressure. The voting booth is there to allow each voter to make his/her own choice: nobody sees what is inserted in the envelope, and the voter cannot bring back any proof that he/she voted for a specific candidate.

In a system where people vote from home, no booth. Voters can "sell" their vote by voting before the eyes of whoever is bribing them to vote in a specific way. Also, voters can no longer vote freely with regards to the wishes of their inquisitive wife/husband.

So, voting (the anonymous vote for political election) needs a booth, and cannot be done safely from home. And if you have a booth, then all the talk about voting protocols is just a way to optimize the counting process, which can be done efficiently with papers and people.

(Of course, Internet-based voting is great for some specialized elections; in particular the elections for some associations -- e.g. the IACR -- where vote-selling seems a preposterous idea, and there are really rarely two voters in the same house; and also non-anonymous elections in stock holder assemblies. But, for government elections, never.)

share|improve this answer
add comment

tl;dr: Internet voting is certainly a bad idea now for important elections.

Many of us consider secure Internet voting one of the great unsolved problems in IT Security. That's because of the very challenging requirement for both anonymity and transparency. It also combines the enormous challenges of securing both clients and servers, and requires dealing with denial-of-service. It was nominated as worthy of an X-PRIZE at DESSEC: DEsigning a Secure Systems Engineering Competition.

A big advance in solving the server problem comes with recent advances in homomorphic encryption which achieve a near-miracle: you can publicly store encrypted voted ballots in the cloud, and also allow the public to both add them up to confirm the vote counts for each candidate, and to check that their own vote was indeed included in the total, without having a receipt that could prove how they voted to a third party. See the Helios Voting system for a great implementation and explanation. It is suitable for low-risk elections. But even the author, Ben Adida, saysA government election is something that you don’t want to do over the Internet,” citing both the potential for computer viruses to corrupt the voting and the possibility of voter intimidation.

The client problem is much harder to deal with, but indeed a worthy goal that many people are working on. The denial-of-service problem is very intractable given the current architecture of the Internet.

A great overview of the subject is Internet Voting in the U.S. in CACM, October 2012.

A worthy 2012 video on the topic, by Ben Adida, is Where's my vote?.

So Internet voting is certainly a bad idea now for important elections. The experience of the Netherlands with online voting serves as a lesson in that, and how voters can be educated about the facts. Their Rijnland Internet Election System (RIES) had big security flaws, and was abandoned in 2008 after just a few years of use. See Electronic Voting in the Netherlands: From Early Adoption to Early Abolishment.

See also a previous question on this: Secure Internet Polling - IT Security

share|improve this answer
add comment

I think the German high court nailed down the problem very well:

Verifiability

The German constitutional court ruled about any kind of voting devices:

The usage of voting devices [...], is in compliance with the constitutional requirements only, if the essential steps of the voting and counting can be verified reliably and without expert knowledge.

The verdict was motivated by a case on traditional voting computers, but the ruling is more general: Those voting computers consist of a keyboard and a display. The voter presses the key for the party of his or her choice. The vote will be displayed and the voter has to confirm it.

But there is no way a voter can verify that the party he selected and saw on the screen, is the party his vote is counted for. The government tried to argue that the voting computers had been verified by an official institution and sealed to prevent manipulations.

But the court made it very clear, that "verified by experts" is not good enough, to fulfill the requirements of democratic elections.

Note: It makes no difference whether the voting is done using a foreign voting computer or a computer owned by the voter: People are not able to verify that their own computer is working correctly either. This already starts at understanding an open source voting software, but of course this goes down all the way to the microcode within the hardware.

Anonymity and non-provability

The ruling was about verifiability by non-experts only. Of course any solution to this issue, must not violate the other requirements of democratic elections.

For example verifying votes could be done by publishing a complete list of all voters with addresses and votes. But democratic elections requires anonymity to protect the voters and non-provability to prevent selling of votes.

There are some smart concepts of not publish the information for everyone to see, but still allowing the voter to verify his vote. But those concept are not easily understood by average people because of the complex math behind it. So we are back at square one.

Furthermore they cannot satisfy non-provability and provability at the same time. But if they don't allow someone to prove, that his vote was not counted the way it was supposed to be, it is quite likely that a number of people will call fraud after every election.

share|improve this answer
    
Those aren't really online voting systems, those are just classical offline voting computers. Adding paper verification to them is pretty easy. –  CodesInChaos May 28 '12 at 17:42
    
The biggest problem with non paper verified voting computers is that it's impossible even for experts to verify that they're working correctly. –  CodesInChaos May 28 '12 at 17:43
    
@CodeInChaos, Yes, as I said, the case was about classical voting computers. But the constitutional court did a much more general ruling. So in Germany, an online voting system has to comply with the same requirements. I don't think it is possible with the current technology and math. –  Hendrik Brummermann May 28 '12 at 17:52
    
There was the idea of having both paper and computers: The paper vote is the official one. The computer vote (e. g. recorded by a electronic pen) can be used for a predictions immediately after closure. To emphasize: The act of voting is not computer based. –  Hendrik Brummermann May 28 '12 at 17:54
    
I think the problems with offline voting computers and online voting are pretty different. With offline voting computers the issue is that you must vote on untrusted hardware whose correct functioning is unverifiable. With online voting we need complex protocols that are hard to implement in practise, and probably can't offer all desired properties. –  CodesInChaos May 28 '12 at 19:28
show 8 more comments

I'm sure one could create such a secure system. Security isn't the main issue.

The main issue is: without the privacy of the voting booth, you can't be sure voters aren't choosing under pressure. This is a big concern for democracy.

share|improve this answer
1  
"I'm sure one could create such a secure system." Please define "secure". –  curiousguy May 29 '12 at 4:15
add comment

What properties should an online voting system ideally have?

  1. Secure

    • Each voter can vote only once
    • The voting authority can't add or remove votes without getting caught
  2. Privacy/Anonymity

    Other people(including the state) can't find out what you voted for.

  3. You should not be able to prove to somebody else how you voted, to prevent bought votes, or votes under duress

  4. Trojans should not be able to alter votes

  5. The process should be understandable/verifiable by non experts

What can we achieve?

5) non expert verification
that's pretty hopeless for an online system. The required crypto is simply too complicated. But I don't consider this an essential property.

4) Trojans
I can't think of a way to keep the system secure in the presence of trojans. One can simply try not to have them. For example by using a live-cd. Can't think of a way to keep the system secure in the presence of trojans.

In an ideal world we can at least achieve a system that offers 1) security and 2) anonymity, not sure about 3). But implementing a system that achieves 1) and 2) is already quite annoying in practice.

Sketch of how to build such a system

You need to be able to communicate anonymously with the voting servers using TOR or something similar.

Then you need to separate the right to vote once from the actual vote. Blind signatures allow that in principle. But they require two steps:

  1. Turning your non-anonymous vote authorization into a vote
  2. Sending the vote to the vote collection server.

You need to be careful to avoid a side-channel attack that allows correlation of these two steps, for example by timing or IP.

In the end a list of all received votes gets published, allowing every voter to verify that his vote was counted, and a list of the names of all voters gets published, so non voters can verify that nobody voted in their name, and that there aren't more votes than voters. A significant amount of voters and non voters needs to verify this for the system to be secure.

This scheme does not offer 3), and I'm not sure if it's possible to add this property.

Even building this system in practice seems quite challenging if you want to avoid all side-channel attacks on anonymity. For example one needs to put a sufficient delay between steps 1 and 2, and you probably need a slow forwarding anonymizer to avoid traffic analysis.

Conclusion

It looks to me like implementing an online voting system that comes even close to what a conventional paper based system offers is not practically possible. So I recommend staying with good old paper for important elections, but it might be possible to use online voting less important votes.

share|improve this answer
    
Hm, your fist sentence does not seem to fit the rest of the posting. –  Hendrik Brummermann May 28 '12 at 17:55
1  
@HendrikBrummermann What I meant is that you can in theory build a system that's secure and anonymous, but even such a limit system is pretty hard to build in practice. And once one adds additional requirements it becomes even harder, perhaps even impossible. –  CodesInChaos May 28 '12 at 19:22
    
I think you should edit "What properties should an online voting system ideally have?" to "What properties should a voting system ideally have?" Then you can add a section below it "What additional properties should an online voting system have?" and you can list be cheaper, more convenient than an off-line system. –  emory May 29 '12 at 0:17
1  
"allowing every voter to verify that his vote was counted" How do voters prove that it isn't the case? Each voter would need to keep a proof of his vote! –  curiousguy May 29 '12 at 3:53
1  
"The discovery of a backdoor in a military grade chip raises some serious questions about hardware assurance in the semiconductor industry. When you use and buy an embedded system or computer it is assumed, wrongly in our opinion, that the hardware is completely devoid of any vulnerabilities. We [...] found that this particular backdoor is not a result of any mistake or an innocent bug, but is instead a deliberately inserted and well thought-through backdoor that is crafted into, and part of, the PA3 security system." Paper –  Hendrik Brummermann May 30 '12 at 11:16
show 3 more comments

Actually they already did it in Estonia for some years now. For the first time in the world, they successfully carried out an electronic voting session in 2007. Since then, they are still doing it. They call it a success, even though I'm quite sceptical about it. You can read more about it on their official website and of course on Wikipedia. Note that they are using ID cards to identify individuals.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.