The Devolution of Voting Technology: Recent Developments Joseph Lorenzo Hall UC Berkeley, School of Information NSF ACCURATE Center This material is based upon work supported by the National Science Foundation under A Center for Correct, Usable, Reliable, Auditable and Transparent Elections (ACCURATE), Grant Number CNS-0524745. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author and do not necessarily reflect the views of the National Science Foundation.

A Brief History of Voting Tech. Early Voting by voice Then by ballot (1629) Then by secret ballot (1888-1909, …) Lever machines (1892; Lockport, NY) Punchcard (1960’s) Optical scanners (1970’s) Direct Recording Electronic (1980’s) 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Early Voting by voice

Then by ballot (1629)

Then by secret ballot (1888-1909, …)

Lever machines (1892; Lockport, NY)

Punchcard (1960’s)

Optical scanners (1970’s)

Direct Recording Electronic (1980’s)

Punchcard Systems Two styles: Votomatic and DataVote 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Two styles: Votomatic and DataVote

Lever Systems 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Optical Scan 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information Precinct-based (PCOS) Centrally Counted (CCOS)

InkaVote Plus Used in Los Angeles for most precinct voting Uses an inked stylus Can be precint or central 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Used in Los Angeles for most precinct voting

Uses an inked stylus

Can be precint or central

DRE Voting Systems “ full-face” vs “scrolling” machines 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information ES&S Unilect Sequoia 1242 Diebold Sequoia Hart MicroVote

“ full-face” vs “scrolling” machines

Ballot Marking Devices 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information AutoMARK Populex

Others 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information Vote-PAD: essentially a laminated template Has “nubs” next to holes Large page turning assists Can be used with existing optical scan IVS Inpsire: Can be used on phone In precinct audio Verification of paper via bar code scanner

Vote-PAD: essentially a laminated template

Has “nubs” next to holes

Large page turning assists

Can be used with existing optical scan

IVS Inpsire:

Can be used on phone

In precinct audio

Verification of paper

via bar code scanner

Registration/Activation Systems DESI’s e-pollbook Card Activators ES&S PEB 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

DESI’s e-pollbook

Card Activators

ES&S PEB

Recent History 2000 Presidential Election HAVA passed in 2002 ($3.86B) Required accessibility in each polling place Encouraged ditching lever, punchcards Established the US EAC Computerized Tech. widely deployed $1 Billion /yr ($200M in tech.) [2001] 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

2000 Presidential Election

HAVA passed in 2002 ($3.86B)

Required accessibility in each polling place

Encouraged ditching lever, punchcards

Established the US EAC

Computerized Tech. widely deployed

$1 Billion /yr ($200M in tech.) [2001]

Current State Complicated and expensive federal qualification/certification process Most States have their own cert. Some States have gone even further: CA Top-To-Bottom Review (TTBR) OH EVEREST Review 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Complicated and expensive federal qualification/certification process

Most States have their own cert.

Some States have gone even further:

CA Top-To-Bottom Review (TTBR)

OH EVEREST Review

CA Top-To-Bottom Review http://sos.ca.gov/elections/elections_vsr .htm CA SoS’ review of 3 voting systems 4 types of review exercises: source code review red team review accessibility review document review 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

http://sos.ca.gov/elections/elections_vsr .htm

CA SoS’ review of 3 voting systems

4 types of review exercises:

source code review

red team review

accessibility review

document review

CA TTBR Results Cryptography was flawed or missing Sequoia: “secret” -> “secretXYZ” Sequoia team: “We could not find a single instance of of correctly used cryptography that successfully accomplished the security purposes for which it was intended.” Diebold: default password = “diebold” Hart had systemic lack of authentication 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Cryptography was flawed or missing

Sequoia: “secret” -> “secretXYZ”

Sequoia team: “We could not find a single instance of of correctly used cryptography that successfully accomplished the security purposes for which it was intended.”

Diebold: default password = “diebold”

Hart had systemic lack of authentication

CA TTBR Results Ballot secrecy remains a challenge Diebold: stores votes in order cast Hart: stores votes in a predictable order Systems failed basic eng. principles All three systems open to viruses Red team results so bad, results private Accessibility: none HAVA compliant 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Ballot secrecy remains a challenge

Diebold: stores votes in order cast

Hart: stores votes in a predictable order

Systems failed basic eng. principles

All three systems open to viruses

Red team results so bad, results private

Accessibility: none HAVA compliant

CA TTBR Results Document review: previous qualification regime inadequate could not determine what tests performed difficult to run elections independently evidence delivered to states was not adequate to substantiate certification some systems far from usable by typical jurisdictions 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Document review:

previous qualification regime inadequate

could not determine what tests performed

difficult to run elections independently

evidence delivered to states was not adequate to substantiate certification

some systems far from usable by typical jurisdictions

OH EVEREST Review http://www.sos.state.oh.us/SOS/elections/voterInformation/equipment/VotingSystemReviewFindings.aspx OH SoS’ review of 3 voting systems Including ES&S’ systems Types of review: Academic vulnerability testing Industry vulnerability testing Industry reliability testing Industry configuration management testing 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

http://www.sos.state.oh.us/SOS/elections/voterInformation/equipment/VotingSystemReviewFindings.aspx

OH SoS’ review of 3 voting systems

Including ES&S’ systems

Types of review:

Academic vulnerability testing

Industry vulnerability testing

Industry reliability testing

Industry configuration management testing

Results Academic testing expanded CA results Confirmed and extended many vulns. Insufficient security Virus susceptibility Voter-side tampering No trustworthy auditing capability Flaws place incredible pressure on physical security and human procedures 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Academic testing expanded CA results

Confirmed and extended many vulns.

Insufficient security

Virus susceptibility

Voter-side tampering

No trustworthy auditing capability

Flaws place incredible pressure on physical security and human procedures

8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Effects on 2008 Elections Increased procedural security measures Increased physical security measures Increased post-election audits Litigation in CA (SD Co. v. Bowen) Some jurisdictions (OH, CO) completely scrapping certain systems Litigation in OH (ACLU v. Brunner) 8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information

Increased procedural security measures

Increased physical security measures

Increased post-election audits

Litigation in CA (SD Co. v. Bowen)

Some jurisdictions (OH, CO) completely scrapping certain systems

Litigation in OH (ACLU v. Brunner)

8 Aug 2008 (cc) 2008, Joseph Lorenzo Hall; UC Berkeley, School of Information