Your SlideShare is downloading. ×
0
(Electronic)
Voting Security
           Ben Adida
       Harvard University

  Workshop on Electronic Voting
         IDC ...
The Point of An Election
The Point of An Election

 “The People have spoken....
       the bastards!”
                            Dick Tuck
       ...
The Point of An Election

 “The People have spoken....
       the bastards!”
                                Dick Tuck
   ...
quot;That's for me and a
 button to know.quot;
     Joe, the plumber.
5
5
5
5
5
5
5
6
6
Fashionable Voting




              http://www.cs.uiowa.edu/~jones/voting/pictures/7
Fashionable Voting




              http://www.cs.uiowa.edu/~jones/voting/pictures/7
Fashionable Voting




              http://www.cs.uiowa.edu/~jones/voting/pictures/7
Fashionable Voting




              http://www.cs.uiowa.edu/~jones/voting/pictures/7
Fashionable Voting




              http://www.cs.uiowa.edu/~jones/voting/pictures/7
Fashionable Voting




              http://www.cs.uiowa.edu/~jones/voting/pictures/7
Fashionable Voting




              http://www.cs.uiowa.edu/~jones/voting/pictures/7
Fashionable Voting




                     8
Fashionable Voting




                     8
Voting is a
fundamentally
difficult problem.


                    9
Wooten got the news from his wife, Roxanne,
  who went to City Hall on Wednesday
        to see the election results.

  q...
14

12
14

                   12




1 person, 1 vote
Enforced Privacy
to ensure each voter
   votes in his/her
  own interest

                       12
http://www.cs.uiowa.edu/~jones/voting/pictures/   13
1892 - Australian Ballot




     http://www.cs.uiowa.edu/~jones/voting/pictures/   14
The Ballot Handoff

  McCain




Alice the Voter
                                17
The Ballot Handoff

  McCain




Alice the Voter
                                17
The Ballot Handoff

  McCain




Alice the Voter
                                17
The Ballot Handoff

  McCain




Alice the Voter
                                17
The Ballot Handoff

  McCain                        Obama
                                Obama
                          ...
The Ballot Handoff

  McCain                           Obama
                                   Obama
                    ...
Chain of Custody




                   18
Chain of Custody
            /*          1
             * source
             * code
             */

            if (...
...
Chain of Custody
                    /*          1
                     * source
                     * code
       Voting...
Chain of Custody
                             /*          1
                              * source
                       ...
Chain of Custody
                                 /*          1
                                  * source
               ...
Chain of Custody
                                 /*          1
                                  * source
               ...
Chain of Custody
                                                   /*          1
                                        ...
Chain of Custody
                                                   /*          1
                                        ...
Chain of Custody
                                                   /*          1
                                        ...
The Cost of Secrecy
The Cost of Secrecy
The Cost of Secrecy
The Cost of Secrecy
The Cost of Secrecy
But Secrecy is Important.

   Secret Ballot implemented in Chile in 1958.

       “the secrecy of the ballot [...] has
   ...
Because we care about
a meaningful result,
 we’ve made auditing
    very difficult.

                        21
We are left chasing
evidence of correctness.

Meanwhile we destroy
evidence on purpose.
                           22
Obtaining Evidence
                                                   /*          1
                                      ...
Obtaining Evidence
                                 /*          1
                                  * source
             ...
Obtaining Evidence
     Polling
    Location
               3   - Multiple poll watchers
                     competing af...
Obtaining Evidence
- redundant counts
- ballot box seals
- statistical auditing by partial recounts

                     ...
Fragmented, Adversarial
     and Indirect
- each piece of evidence covers
  a small segment of the chain.
- attacker knows...
The Effect of DREs

- More to audit
- Errors can have disproportionate effects
- Software is not just for speed/efficiency,...
Software
  Independence

an undetected mistake in the
  system does not cause an
undetectable error in the tally.
Can we get
 more direct,
more end-to-end
   evidence?
Secret Ballot vs.
           Verifiability

Voting System
                convince
                           Alice

      ...
Secret Ballot vs.
               Verifiability

Voting System
                        convince
                            ...
Public Ballots
   Bulletin Board


               Bob:
              McCain

         Carol:
         Obama




          ...
Public Ballots
           Bulletin Board


                       Bob:
                      McCain

                 Caro...
Public Ballots
            Bulletin Board

         Alice:         Bob:
         Obama         McCain

                  C...
Public Ballots
            Bulletin Board

         Alice:         Bob:
         Obama         McCain

                  C...
Encrypted Public Ballots
            Bulletin Board

        Alice:          Bob:
         Rice          Clinton

        ...
Encrypted Public Ballots
                         Bulletin Board

                    Alice:           Bob:
              ...
Encrypted Public Ballots
                         Bulletin Board

                    Alice:              Bob:
           ...
End-to-End Verification
End-to-End Verification
                       /*
                        * source
                        * code
         ...
End-to-End Verification
                                  /*
                                   * source
                  ...
End-to-End Verification
                                  /*
                                   * source
                  ...
End-to-End Verification
                                      /*
                                       * source
          ...
End-to-End Verification
                                      /*
                                       * source
          ...
Open-Audit
 Elections
Evidence-Based
   Elections
Questions?
ben_adida@harvard.edu
Voting Security Overview
Voting Security Overview
Voting Security Overview
Voting Security Overview
Upcoming SlideShare
Loading in...5
×

Voting Security Overview

1,782

Published on

A general talk on voting security, presented at IDC Herzliya, Israel, May 2009.

Published in: Technology, News & Politics
0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
1,782
On Slideshare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
75
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Transcript of "Voting Security Overview"

  1. 1. (Electronic) Voting Security Ben Adida Harvard University Workshop on Electronic Voting IDC Herzliya 17 May 2009
  2. 2. The Point of An Election
  3. 3. The Point of An Election “The People have spoken.... the bastards!” Dick Tuck 1966 Concession Speech
  4. 4. The Point of An Election “The People have spoken.... the bastards!” Dick Tuck 1966 Concession Speech Provide enough evidence to convince the loser.
  5. 5. quot;That's for me and a button to know.quot; Joe, the plumber.
  6. 6. 5
  7. 7. 5
  8. 8. 5
  9. 9. 5
  10. 10. 5
  11. 11. 5
  12. 12. 5
  13. 13. 6
  14. 14. 6
  15. 15. Fashionable Voting http://www.cs.uiowa.edu/~jones/voting/pictures/7
  16. 16. Fashionable Voting http://www.cs.uiowa.edu/~jones/voting/pictures/7
  17. 17. Fashionable Voting http://www.cs.uiowa.edu/~jones/voting/pictures/7
  18. 18. Fashionable Voting http://www.cs.uiowa.edu/~jones/voting/pictures/7
  19. 19. Fashionable Voting http://www.cs.uiowa.edu/~jones/voting/pictures/7
  20. 20. Fashionable Voting http://www.cs.uiowa.edu/~jones/voting/pictures/7
  21. 21. Fashionable Voting http://www.cs.uiowa.edu/~jones/voting/pictures/7
  22. 22. Fashionable Voting 8
  23. 23. Fashionable Voting 8
  24. 24. Voting is a fundamentally difficult problem. 9
  25. 25. Wooten got the news from his wife, Roxanne, who went to City Hall on Wednesday to see the election results. quot;She saw my name with zero votes by it. She came home and asked me if I had voted for myself or not.quot; 10
  26. 26. 14 12
  27. 27. 14 12 1 person, 1 vote
  28. 28. Enforced Privacy to ensure each voter votes in his/her own interest 12
  29. 29. http://www.cs.uiowa.edu/~jones/voting/pictures/ 13
  30. 30. 1892 - Australian Ballot http://www.cs.uiowa.edu/~jones/voting/pictures/ 14
  31. 31. The Ballot Handoff McCain Alice the Voter 17
  32. 32. The Ballot Handoff McCain Alice the Voter 17
  33. 33. The Ballot Handoff McCain Alice the Voter 17
  34. 34. The Ballot Handoff McCain Alice the Voter 17
  35. 35. The Ballot Handoff McCain Obama Obama Obama McCain McCain McCain Alice the Voter 17
  36. 36. The Ballot Handoff McCain Obama Obama Obama McCain McCain McCain Alice the Voter Black Box 17
  37. 37. Chain of Custody 18
  38. 38. Chain of Custody /* 1 * source * code */ if (... Vendor 18
  39. 39. Chain of Custody /* 1 * source * code Voting 2 */ Machine if (... Vendor 18
  40. 40. Chain of Custody /* 1 * source * code Polling Voting */ 3 2 Location Machine if (... Vendor 18
  41. 41. Chain of Custody /* 1 * source * code Polling Voting */ 3 2 Location Machine if (... Vendor 4 Alice 18
  42. 42. Chain of Custody /* 1 * source * code Polling Voting */ 3 2 Location Machine if (... Vendor 4 Alice 18
  43. 43. Chain of Custody /* 1 * source * code Polling Voting */ 3 2 Location Machine if (... Vendor 4 Alice 5 Ballot Box Collection 18
  44. 44. Chain of Custody /* 1 * source * code Polling Voting */ 3 2 Location Machine if (... Vendor 4 Alice Results 5 6 ..... Ballot Box Collection 18
  45. 45. Chain of Custody /* 1 * source * code Polling Voting */ 3 2 Location Machine if (... Vendor 4 Alice Results 5 6 ..... Ballot Box Collection Black Box 18
  46. 46. The Cost of Secrecy
  47. 47. The Cost of Secrecy
  48. 48. The Cost of Secrecy
  49. 49. The Cost of Secrecy
  50. 50. The Cost of Secrecy
  51. 51. But Secrecy is Important. Secret Ballot implemented in Chile in 1958. “the secrecy of the ballot [...] has first-order implications for resource allocation, political outcomes, and social efficiency.” [BalandRobinson 2004]
  52. 52. Because we care about a meaningful result, we’ve made auditing very difficult. 21
  53. 53. We are left chasing evidence of correctness. Meanwhile we destroy evidence on purpose. 22
  54. 54. Obtaining Evidence /* 1 * source * code Polling Voting */ 3 2 Location Machine if (... Vendor 4 Alice Results 5 6 ..... Ballot Box Collection 23
  55. 55. Obtaining Evidence /* 1 * source * code Polling Voting */ 3 2 Location Machine if (... Vendor - source code audit - Logic & Accuracy - Parallel Testing - Voter-Verified Paper Audit Trail
  56. 56. Obtaining Evidence Polling Location 3 - Multiple poll watchers competing affiliations - No personal 4 Alice electronic devices at the polling station - Logging all events
  57. 57. Obtaining Evidence - redundant counts - ballot box seals - statistical auditing by partial recounts Results 5 6 ..... Ballot Box Collection
  58. 58. Fragmented, Adversarial and Indirect - each piece of evidence covers a small segment of the chain. - attacker knows the checks, and can try to sneak in where the chain is not covered. - to maintain security and for practical purposes, the evidence is very indirect.
  59. 59. The Effect of DREs - More to audit - Errors can have disproportionate effects - Software is not just for speed/efficiency, it becomes central for integrity.
  60. 60. Software Independence an undetected mistake in the system does not cause an undetectable error in the tally.
  61. 61. Can we get more direct, more end-to-end evidence?
  62. 62. Secret Ballot vs. Verifiability Voting System convince Alice Carl the Coercer 31
  63. 63. Secret Ballot vs. Verifiability Voting System convince Alice Carl the Coercer [Chaum81], [Benaloh85], [PIK93], [BenalohTuinstra92], [SK94], [Neff2001], [FS2001], [Chaum2004], [Neff2004], [Ryan2004], [Chaum2005] Punchscan, Scantegrity I & II, Civitas, ThreeBallot, Prêt-à-Voter, Scratch & Vote, ... 31
  64. 64. Public Ballots Bulletin Board Bob: McCain Carol: Obama 32
  65. 65. Public Ballots Bulletin Board Bob: McCain Carol: Obama Alice 32
  66. 66. Public Ballots Bulletin Board Alice: Bob: Obama McCain Carol: Obama Alice 32
  67. 67. Public Ballots Bulletin Board Alice: Bob: Obama McCain Carol: Obama Tally Obama....2 McCain....1 Alice 32
  68. 68. Encrypted Public Ballots Bulletin Board Alice: Bob: Rice Clinton Carol: Rice Tally Obama....2 McCain....1 Alice 33
  69. 69. Encrypted Public Ballots Bulletin Board Alice: Bob: Rice Clinton Carol: Ali Rice ce ver Tally ifies he rv Obama....2 ote McCain....1 Alice 33
  70. 70. Encrypted Public Ballots Bulletin Board Alice: Bob: Rice Clinton Carol: Ali ce Rice ta lly ver e thTally ifies rifies ve he rv eryone ote E v Obama....2 McCain....1 Alice 33
  71. 71. End-to-End Verification
  72. 72. End-to-End Verification /* * source * code Voting */ Machine if (... Vendor Polling Location
  73. 73. End-to-End Verification /* * source * code Voting */ Machine if (... Vendor Ballot Box / Polling Bulletin Board Location Alice
  74. 74. End-to-End Verification /* * source * code Voting */ Machine if (... Vendor Ballot Box / Results Polling Bulletin Board Location ..... Alice
  75. 75. End-to-End Verification /* * source * code Voting */ Machine if (... Vendor Ballot Box / Results Polling Bulletin Board Location ..... 1 Alice Receipt
  76. 76. End-to-End Verification /* * source * code Voting */ Machine if (... Vendor Ballot Box / Results Polling Bulletin Board Location ..... 1 2 Alice Receipt
  77. 77. Open-Audit Elections
  78. 78. Evidence-Based Elections
  79. 79. Questions? ben_adida@harvard.edu
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×