Download as PDF, PPTX
Uploaded byPatricia Aas
Elections, Trust and Critical Infrastructure (NDC TechTown)
The document discusses recent advancements in election security in Norway, including the implementation of mandatory manual ballot counting and a new national security act aimed at protecting the democratic process. It emphasizes the complexities of election security threats, the importance of manual elections, and the risks associated with digital voting systems. The author advocates for an auditable electoral process that combines manual counting with statistical auditing to ensure election integrity.
More Related Content
Similar to Elections, Trust and Critical Infrastructure (NDC TechTown)
Elections, Trust and Critical Infrastructure (NDC TechTown)
- 1.
- 2. TurtleSec @pati_gallardo 2 In 2017I made a bit of fuss about election security Ok, fine, I made a lot of fuss And, ok, yes, I didn’t stop
- 3. TurtleSec @pati_gallardo 3 This yearNorway finally made it mandatory that one of the ballot counts has to be manual On Monday we will have our first election with this in place
- 4. TurtleSec @pati_gallardo 4 January 1stNorway's new National Security Act went into effect It makes protecting the democratic process a matter of national security
- 5. TurtleSec @pati_gallardo 5 Both ofthese events will have profound effects on election security in Norway. But nothing new happened to make elections less secure in 2017.
- 6. TurtleSec @pati_gallardo 6 Except suddenlyit seemed much more likely.
- 7. TurtleSec @pati_gallardo 7The Turtlevs The Hare
- 8.
- 9. TurtleSec @pati_gallardo@pati_gallardo Who can youtrust? Who feeds you the data?
- 10. TurtleSec @pati_gallardo Elections Trust and CriticalInfrastructure NDC TechTown 2019 Patricia Aas Turtle Sec
- 11. TurtleSec @pati_gallardo Patricia Aas - Trainer& Consultant C++ Programmer, Application Security Currently : TurtleSec Previously : Vivaldi, Cisco Systems, Knowit, Opera Software Master in Computer Science Pronouns: she/her @pati_gallardo Turtle Sec
- 12.
- 13.
- 14. TurtleSec @pati_gallardo@pati_gallardo Is the Norwegian ElectionSystem complex? 14@pati_gallardo
- 15.
- 16. TurtleSec @pati_gallardo “The testing isperformed using a prototype implementation in Java. Though the implementation does not take into consideration security and anonymity concerns, it is a full implementation of the Electoral System.” Evaluating the suitability of EML 4.0 for the Norwegian Electoral System : A prototype approach Patricia Aas, Masters Thesis UiO, 2005 https://www.duo.uio.no/handle/10852/9298 16
- 17. TurtleSec @pati_gallardo What are these“security and anonymity concerns”? 17
- 18.
- 19. TurtleSec @pati_gallardo 19@pati_gallardo What arewe protecting?
- 20. TurtleSec @pati_gallardo Worst Case Scenario Anaccepted, but manipulated Election Result 20
- 21. TurtleSec @pati_gallardo@pati_gallardo What is the ElectionResult? 21@pati_gallardo
- 22. TurtleSec @pati_gallardo The Election Result isthe distribution of the mandates 22
- 23. TurtleSec @pati_gallardo An Election doesn’thave to be flawless as long as The Election Result is correct 23
- 24.
- 25. TurtleSec @pati_gallardo 25@pati_gallardo What isthe Threat Model?
- 26. TurtleSec @pati_gallardo@pati_gallardo What are you afraidof? 26@pati_gallardo
- 27. TurtleSec @pati_gallardo Adding ballots Removing ballots Changingballots Reporting wrong counts 27
- 28. TurtleSec @pati_gallardo At its mostextreme: Preventing a coup Keeping a democracy 28
- 29. TurtleSec @pati_gallardo Who are theThreat Actors in Elections? 29
- 30. TurtleSec @pati_gallardo The most likelyThreat Actor Historically Internationally Is the sitting (local) government 30
- 31. TurtleSec @pati_gallardo Others include: Foreign governments, privatecompanies, terrorists, activists, lone wolfs 31
- 32. TurtleSec @pati_gallardo The most likelyThreat Actor in an election is the sitting government 32
- 33. TurtleSec @pati_gallardo The same government runningthe election 33
- 34. TurtleSec @pati_gallardo Two “acceptable” outcomes 1.A correct election 2. Prevented a rigged election (hopefully correctable)¹ 34¹ How feasible is a new election?
- 35.
- 36. TurtleSec @pati_gallardo@pati_gallardo How does a secretballot play into elections? 36@pati_gallardo
- 37. TurtleSec @pati_gallardo True democracy requires thefreedom to Vote your conscience 37
- 38. TurtleSec @pati_gallardo Prevent coercion Prevent voteselling Prevent persecution now or in the future 38 #goals
- 39. TurtleSec @pati_gallardo No. The answer isnot blockchain 39
- 40.
- 41. TurtleSec @pati_gallardo To prevent persecution Youdon’t want to connect a vote to a person 41
- 42. TurtleSec @pati_gallardo To prevent coercionand vote selling You don’t want a person to be able to prove what they voted 42
- 43. TurtleSec @pati_gallardo And what putthat vote on the blockchain? Who’s in charge of that? How about chain of custody? 43
- 44.
- 45.
- 46. TurtleSec @pati_gallardo Nah. I lovecomputers. But manual elections are hard to beat. They’re just that good. 46
- 47.
- 48. TurtleSec @pati_gallardo Surprisingly, no. It’s massivelydistributed. 48
- 49. TurtleSec @pati_gallardo Isn’t manual countingerror prone? 49
- 50.
- 51. TurtleSec @pati_gallardo Norwegian risk modelfor ballot counting errors Manual vs Machine 51
- 52. TurtleSec @pati_gallardo 52 1. Canit affect the Election Result? 2. Can it go undetected? 3. Can it discredit the Election Result? 4. Can it create more work? Evaluating severity
- 53. TurtleSec @pati_gallardo 53 1. Historicallyhow common is it? 2. Is there a known threat? Evaluating likelihood
- 54. TurtleSec @pati_gallardo 54 Likelihood Severity Innocent manual Innocent machine Premeditated manual Premeditated machine Likelihood Innocent Premeditated ManualHigh Low Machine Low-Medium¹ Low Severity Innocent Premeditated Manual Low² Medium³ Machine Medium-High High Risk diagram: Counting Errors (no Machine Count Audit) ¹ Bugs: Has happened many times irl ² Distributed proportionally on parties ³ Will almost certainly be detected, but cast doubt and ballots are compromised
- 55. TurtleSec @pati_gallardo 55@pati_gallardo What isthe alternative?
- 56.
- 57. TurtleSec @pati_gallardo Software independence¹ 57¹ RonRivest (The R in RSA) and John P. Wack (NIST)
- 58. TurtleSec @pati_gallardo 58 “A votingsystem is software-independent if an undetected change or error in its software cannot cause an undetectable change or error in an election outcome” On the notion of “software-independence” in voting systems http://people.csail.mit.edu/rivest/RivestWack-OnTheNotionOfSoftwareIndependenceInVotingSystems.pdf
- 59.
- 60. TurtleSec @pati_gallardo “Verify the electionresults, not the voting system” 60 Rivest & Wack, On the notion of “software-independence” in voting systems
- 61. TurtleSec @pati_gallardo What is a“manual” election? Paper ballots Manual count¹ 61¹ Keep computers for all parts that are auditable
- 62.
- 63. TurtleSec @pati_gallardo 63 Likelihood Severity Innocent manual Innocent machine Premeditated manual Premeditated machine Premeditated machine Innocent machine Risk diagram:Counting Errors (with Machine Count Audit) An Audit will reveal - Bugs - Manipulations
- 64. TurtleSec @pati_gallardo What is anauditable election? 64
- 65.
- 66. TurtleSec @pati_gallardo Norway 2019 Manual preliminarycount¹ 66¹ Ask me about this process sometime ;)
- 67. TurtleSec @pati_gallardo Norway has twocounts: Preliminary and Final Results can be compared 67
- 68. TurtleSec @pati_gallardo Goal for manyUS researchers Risk-Limiting Audits 68
- 69. TurtleSec @pati_gallardo What’s a RiskLimiting Audit? A statistical model for manual ballot sampling 69
- 70. TurtleSec @pati_gallardo “The Norwegian electoralsystem: a study of EVA Skanning, implemented error detection mechanisms, and applicability of risk-limiting audits” Vilde Elise Samnøy Amundsen, Masters Thesis NTNU, 2019 Thesis Advisor: Patricia Aas http://www.valgforum.no/wp-content/uploads/2019/02/Masteroppgave-Vilde-Amundsen.pdf 70
- 71. TurtleSec @pati_gallardo What was theproblem in Norway? 71
- 72.
- 73. TurtleSec @pati_gallardo Paper ballots arenot enough There has to be an audit Performed by regular folks 73
- 74. TurtleSec @pati_gallardo Manually counted elections havea built-in audit People. 74
- 75. TurtleSec @pati_gallardo Manually counted electionscan also be rigged But everyone knows they are 75
- 76. TurtleSec @pati_gallardo If an electionis rigged and nobody knows, do you have a democracy? 76
- 77. TurtleSec @pati_gallardo No. You’ve had acoup. And you don’t even know it. 77
- 78. TurtleSec @pati_gallardo@pati_gallardo What could anattack on Critical Infrastructure look like?
- 79. TurtleSec @pati_gallardo 79 Countdown toZero Day: Stuxnet and the Launch of the World's First Digital Weapon, Kim Zetter Attack on Siemens PLCs in centrifuges at an Iranian uranium enrichment plant The diagnostic data was manipulated so it seemed like there was no error Probably hundreds of centrifuges were destroyed Stuxnet
- 80. TurtleSec @pati_gallardo@pati_gallardo What is modernlife if not ruled by Critical Infrastructure?
- 81. TurtleSec @pati_gallardo 81 Modern societyis a legacy system Never designed, it evolved Based on layers of dated technology Containing massive technical debt Lacks in holistic security analysis
- 82. TurtleSec @pati_gallardo@pati_gallardo Did something happen tomake us less secure?
- 83. TurtleSec @pati_gallardo@pati_gallardo Or did itjust suddenly feel more likely?
- 84. TurtleSec @pati_gallardo@pati_gallardo What lessons can welearn from the mistrust in Election Security?
- 85. TurtleSec @pati_gallardo 85 Make diagnosticsthat don’t depend on computers Be wary of single points of failure Segment your infrastructure Manual operations require physical presence, this is a feature Figure out who are your most likely Threat Actors
- 86. TurtleSec @pati_gallardo 86 On theother hand...
- 87. TurtleSec @pati_gallardo 87 July 10th2019 Ukrainian Secret Service (SBU) raided South Ukraine Nuclear Power Plant
- 88.
- 89. TurtleSec @pati_gallardo Best way torig an election? Internet voting. 89
- 90.
- 91. TurtleSec @pati_gallardo 91 Høringssvar, PatriciaAas, TurtleSec, https://elections.no/2018/12/13/hoeringssvar_turtlesec.html “Election Cybersecurity Progress Report”, Professor J. Alex Halderman (University of Michigan), https://youtu.be/U-184ssFce4 “Electronic Voting In 2018: Threat Or Menace”, Professor Matt Blaze, Joe Hall, Margaret MacAlpine, and Harri Hursti, https://youtu.be/Lo3iibtVh6M “Testimony of Prof. Matt Blaze”, Professor Matt Blaze (University of Pennsylvania), https://oversight.house.gov/wp-content/uploads/2017/11/Blaze-UPenn-Statement-Voting-Machines-11-29.pdf “Securing the Vote: Protecting American Democracy”, The National Academies of Sciences, Engineering, and Medicine, https://www.nap.edu/catalog/25120/securing-the-vote-protecting-american-democracy “DEF CON 26 Voting Village Report”, Blaze, Braun, Hursti, Jefferson, MacAlpine, Moss, https://defcon.org/images/defcon-26/DEF%20CON%2026%20voting%20village%20report.pdf Resources