**Preliminary Analysis of Threats to Voting Systems**

**Draft Version March 2, 2005**

**13 November 2023**

**National Institute of Standards and Technology (NIST)**

Provided for consideration by the Technical Guidelines Development
Committee (TGDC) and the Election Assistance Commission under the
requirements of the Help America Vote Act (HAVA) of 2002.

Authority This document has been provided for consideration by the
Technical Guidelines Development Committee (TGDC) and the Election
Assistance Commission under the requirements of the Help America Vote
Act (HAVA) of 2002.

Disclaimer This document is a work in progress, provided solely as draft
input to the TGDC. Portions of this document may change substantially.

**1 Introduction**

This note analyzes the threats to voting systems, as specified in the
VSS, with a primary focus is on electronic voting systems. While all
voting systems face the same opponents and classes of attackers,
different voting system architectures tend to lead to different patterns
of potential attack, and to different ways to mitigate the resulting
risks. A separate document will address both general attack patterns for
voting systems and specific attacks on some architectures. This document
focuses on the goals an attacker might wish to accomplish, the resources
and difficulties involved in various kinds of attack, and the set of
potential attackers and their likely budgets and risk tolerance.

The natural thing to worry about in any voting system is some kind of
fraud that changes the outcome of the election\--John Smith gets 55% of
the votes, but Mary Jones is named the winner. However, the real range
of possible attacker goals is much larger: Even if an attacker can\'t
change the outcome of an election, he may be content to discredit it
with false but convincing evidence of fraud, or to change the reported
numbers enough to turn a very close election into an apparent landslide,
or to disrupt the election for thousands of voters, or to discover how
some people voted. While election fraud is the most obvious attack, and
the one likely to be best funded, it is not the only one. (Some other
attack goals, such as disrupting voting selectively at some polling
places or violating voter privacy, can be stepping stones in a larger
attempt to change the outcome of the election.)

The natural attacker to consider against a voting system is some
outsider with a few technical skills and relatively little money. It is
not difficult to design a voting system that defends very effectively
against such an attacker. However, both the history of election fraud
and available information about the amount currently spent influencing
elections and government policies demonstrate that the real set of
potential attackers includes more skilled people, with insider access
and large budgets.

Any real-world attack requires some technical skills, some kind of
access to the system, some money, and some willingness to risk being
caught. Attacks against well-designed systems also typically require
multiple parties with some insider access to be involved. The difficulty
of the attack is in some sense related to both the size of the
conspiracy necessary to carry it out, and to the diversity of that
conspiracy\--if two programmers working for the same vendor must
conspire to defeat the security of a voting system, this makes the
attack less difficult than if a programmer and an election official must
conspire, or programmers at two entirely separate companies must
conspire.

**1.1 Voting Systems**

In this document, we are concerned with voting systems as defined in the
VSS. That is, a voting system includes the mechanisms that:

a\. define ballots, b. present them to the voter, c. capture the clearly
indicated choices of the voters d. verify and record those choices e.
count and audit those choices according to the rules of the election, f.
report the results, and g. recount the results upon demand, either
partially or wholly

Attacks on the election as a whole can involve the voting system, but
they may also occur entirely outside of the voting system. For example,
voting systems as defined here do not include registration databases or
procedures by election officials to ensure that nobody gets to vote more
than once, yet one form of election fraud most people have heard of
involves casting votes on behalf of the dead. As another example, a riot
at a polling place certainly disrupts the voting process, but this has
nothing at all to do with the voting system.

**1.2 Special Concerns for Electronic Voting Systems**

Electronic voting systems are (for the purposes of this document, at
least) voting systems in which some part of the process depends on
computer software and hardware.

For electronic voting systems, there are some additional concerns, which
don\'t appear with simple paper systems. Paper ballots are pretty
well-understood by election officials, judges, and the public; the kinds
of fraud possible are also well-understood. Electronic systems tend to
have important things (like the capture and counting of votes) done in a
way that is impossible to meaningfully observe. (Doug Jones points this
out.) It is theoretically impossible (and practice definitely bears this
out) to find all bugs and security holes in a complicated program. Even
finding all accidental bugs is impossible. Yet in order to trust that
voting software is doing what it claims, we may need to find even
intentionally placed bugs, inserted by someone who knows the system very
well and knows the nature of the review to which it will be subjected.
Good coding standards and version control inside the voting system
vendor, and strong external code review and testing are all of value in
finding intentional and unintentional security problems. However, doing
them well is expensive, and even having done them well, it is plausible
for a determined and skilled insider to get a security bug past the
reviewers. (Note that despite good controls, testing, and code reviews,
unintentional software bugs still slip past in other contexts;
intentionally placed bugs are much more likely to evade detection.)

Election fraud with paper systems, lever machines, and the like is
usually a retail business\--a fairly large number of local officials
need to be involved in the fraud to make it work. This makes keeping the
fraud a secret much harder, and limits the scope of the obvious and
well-known weaknesses inherent in simple paper ballot systems. The
attacks aren\'t all that difficult, but they\'re pretty labor intensive.
On the other hand, the fact that they\'re labor intensive hasn\'t kept
them from happening before, so they\'re still relevant to the security
of a voting system.

Election fraud with electronic systems can be a wholesale business\--the
conspiracy involved may be no more than one or two programmers of the
voting system, or a few people who have some knowledge of a weakness in
the voting system\'s security and have worked out a way to exploit it on
election day. The potential problem is one of \"monoculture\"\--it\'s
possible to have thousands of identical voting machines being used on
election day. This provides some nice economies of scale for running the
election, and even for securing the machines. (Georgia can afford to do
an extensive security review of their voting system because they only
use one for the whole state, for example.) But it also means that if
there is a vulnerability that allows some attack, that vulnerability is
all over the place, and can lead to a huge attack impact\--perhaps
silently and undetectably changing the outcome of a major election. A
constraint on this is the diversity of ballots and election procedures,
but it is difficult to determine how effective this is at preventing the
attacks, rather than simply making them more difficult.

This ultimately resolves into three issues:

a\. Corrupt machines\--if the machines start out corrupt (perhaps the
programming team which designed the machines included an activist
willing to risk jail to have a chance at changing an election result),
then the machines\' reported results aren\'t trustworthy.

b\. Compromiseable machines\--if the machines start out honest, but they
have some unknown weakness, they may be compromised very quickly. (This
is known as a \"class break\"\--the attacker works out the attack once,
and has it applied everywhere.) Technologies such as wireless networking
magnify this threat, as an attacker need not have phyisical access to
the voting machine.

c\. Corruptable communications\--if the machines in the field and those
used to combine the counts are all honest, but the mechanism for
transmitting results from local machines and polling places is weak, an
attacker may be able to substitute or alter those results in some broad
way which changes many different results. Procedural defenses against
any tampering with the transmitted results can prevent this from being a
problem in practice.

In all cases, we not only want to prevent an attack, we want some strong
evidence at the end of an election that no successful attack took place.
Because so much of an election using electronic systems takes place in a
way that\'s not really observable, this is very important. This drives
us toward a general requirement that everything in a voting system be
auditable.

This is the context in which a consideration of threats on electronic
voting systems, whether state-of-the-art DRE machines or simple
optical-scan paper ballots that are filled in by hand, must proceed.

**1.3 Scope of Elections**

It is important to recall the enormous range of elections for which the
same voting system may be used. In large-scale elections, such as those
for president, congress, or governor of a state, the value of an attack
that changes the outcome is very high (based on what people spend to try
to change that outcome in open ways). On the other hand, these elections
take place under considerable media scrutiny, usually with good polling
data available to compare against reported totals, and with well-funded
contestants who may challenge suspicious results in court. These
elections are also highly distributed, with different ballot designs,
different election officials, different election procedures, and (in
national elections) different election laws sometimes applying to
different the voting system in different places. All of these enormously
complicate an attack in practice.

Smaller scale elections are likely to be worth less money to fix, based
on the amount of money spent openly to try to win them. On the other
hand, election procedures, ballot designs, etc., are much more likely to
be the same or very similar, and there is likely to be less polling
data. Contestants have smaller budgets, which means less money for an
attacker, but also less money for court challenges if there is a
surprising result, and less hard evidence that a result is indeed
surprising.

**2 Goals of the Attackers**

A successful attack on a voting system accomplishes one of a fairly
small set of goals. Each kind of goal an attacker may reach has some
constraints on how it may be reached, many outside the scope of the
voting system itself, and each goal has a different likely impact.

Broadly, the attack goals are:

a\. Election fraud\--change the outcome of the election, either by
changing who won, or by substantially changing the reported totals.

b\. Disruption\--cause the election to be so disrupted that the results
are not credible or reasonable to accept, e.g., by preventing some large
fraction of voters from voting or having their votes counted.

c\. Discrediting\--convincingly call the results of the election into
question.

d\. Involuntary Privacy Violation\--reveal the votes of a large number
of voters without their cooperation.

e\. Voluntary Privacy Violation\--provide strong evidence how some
voters voted, with the cooperation of the voters themselves.

It is important to remember that many of these goals can be accomplished
in ways that have nothing to do with the voting system itself; these are
worth noticing, but they are outside the scope of our analysis except
where they point out fundamental limits in what a voting system can do
to secure things.

**2.1 Election Fraud**

Election fraud means that the attacker gets to change the reported
totals. Although any change to the reported totals from the correct
values violates the security goals of the voting system, election fraud
becomes more serious as the scale increases. The normal situation to
imagine for election fraud is someone changing the outcome of some
election\--this could be a major office like the president or governor,
but it could also be some local office. It\'s important to keep the
different levels of elections in mind, because some of the natural
constraints on national-scale attacks (like good polling data) may not
be available at a local level.

**2.1.1 Impact and Value**

The impact of successful election fraud is potentially choosing the
winner of the election. For a national scale election, this could
involve choosing the President, changing the balance in Congress,
choosing the Governor of various states, etc. The impact goes down when
the election is for lower offices. Election fraud can also involve
changing totals without changing the winner. The impact of this attack
is enormously smaller in every case, and the value is similarly
diminished.

The value to some attacker of determining the winner of political
offices is potentially huge, though it\'s not clear how to put a precise
number on it. One reasonable estimate of the value of changing the
outcome of the election can be drawn from the amount of money spent on
political campaigns, and this information is publically available.

These numbers will not give us an attacker\'s budget (it\'s not
plausible that a 527 group would, say, publically raise 20 million
dollars and then spend it subverting a voting system), but it will give
us a notion of the kind of money that may be available to an attacker.
The main benefit of this source of information for analysis is that the
law requires that all kinds of financial information about political
campaigns, 527 groups, and lobbying efforts be publically reported. We
thus try to use the amounts openly reported to estimate what kind of
money would be available for secret, criminal attempts accomplish the
same goals.

According to opensecrets.org, the Bush campaign in 2004 spend about 367
million dollars, while the Kerry campaign spent about 326 million.
According to publicintegrity.org, 527 committees raised about another
246 million total which was focused on the presidential election. The
527 group which spent the most on the presidential race was America
Coming Together, which spent about 78 million dollars, and there were
nineteen 527 groups which raised more than a million dollars toward
influencing the presidential race. Both presidential campaigns and the
biggest 527 groups have millions of dollars to spend on improving their
chances of victory, though the openness with which they must legally
conduct their finances and the media scrutiny under which they often
find themselves presumably makes it difficult for them to spend a lot of
money on doing something illegal.

The largest private donors to 527 organizations gave enormous sums;
George Soros headed the list, with donations of \$23 million. The
largest 20 corporate/non-union interest group donors to 527s were also
listed (I don\'t know why they exclude unions); the biggest (chamber of
commerce) gave about \$4 million, while smaller donations ran down to
about \$690,000. Again, this doesn\'t precisely tell us an attacker\'s
budget, but it points out that there is a lot of money being spent on
presidential races, from a great many sources. The implication is that
an attempt to change the outcome of a presidential election, the balance
of congress, etc., may draw on substantial financial resources, perhaps
totaling in the millions of dollars.

Another source of information about the value of influencing elections
is the amount spent by various companies and industry groups to lobby
congress and the president for various changes to the law. For example,
lobbying by the broadcast industry between 1998 and 2004 was reported
(on www.publicintegrity.org) at about \$222 million. The largest
lobbying effort in that industry came from GE, which reported spending
over \$100 million on lobbying in that period. Broadly, many companies
spent more than \$1 million on lobbying in that period, and a few spent
in the tens or even hundreds of millions of dollars. Again, it\'s not
easy to take a precise dollar amount from this that might be spent on
illegal activities (lobbying is legal, and all these numbers come from
openly reported activities), but it gives us some sense of the amount of
money interested parties, whether private companies, industry consortia,
or issue interest groups, are currently spending to try to influence
laws.

**2.1.2 Constraints on Election Fraud**

Election fraud is ultimately about changing the reported totals of the
election. The two major constraints on election fraud are plausibility
and the formal procedures for challenging the election results. A
completely implausible result (e.g., Mickey Mouse winning the election)
is a disruption attack, not really election fraud, since there is no
chance of the result being taken seriously. Results that wildly
contradict exit polls or previous polling data may or may not be
possible to challenge in court. It is important to remember that not all
elections have the same coverage of polling data; even if good polling
data exists for national or statewide elections, it may not exist for
local elections.

Election fraud doesn\'t have to change the outcome of an election\--it
can simply alter the totals. For example, it may be worthwhile for some
attacker to alter the totals of an election so that a 52/48 victory
shows up as a 65/35 victory. It would certainly be worthwhile for a
third party candidate in a national election to increase his share from
1% to 6%, and thus to win matching funds in the next election. This is a
nice example of the way that election fraud interacts with election
law\--there may not be an easy way to challenge such a result, if
there\'s really no question about the outcome of the election. (Note
that some places only count the provisional and absentee ballots if
they\'re needed to decide the real election outcome; this is kind-of
related to that.)

It\'s worth noting that preventing or recovering securely from election
fraud is much better than merely detecting it (it then becomes a
disruption attack), and that routinely detecting it in auditing is much
better than being able to detect it in a recount or other kind of
election challenge. Among other things, some kinds of widespread
election fraud can be very hard to detect without a careful
hand-recount.

**2.1.3 Constraints on Resisting Election Fraud**

In any secure system, it\'s useful to determine what the limits are on
resisting various attacks.

A voting system is typically limited to capturing, recording, and
counting the votes it is given. The integrity of the reported results
can be no better than the processes that prevent multiple voting and
voting by unregistered voters. A voting system can (and must) support
the procedures that prevent these things from happening, by allowing the
election officials to control access to the process of casting votes.
However, most of the job of preventing multiple and unauthorized voting
falls to local election officials and their procedures and polling place
layout.

Similarly, the final reported totals from the voting system are directly
provided to a small number of election officials and observers. If the
totals are not reported to the public correctly by these people, no
amount of security on the part of the voting system will make the public
totals reliable.

The error rate of the whole process of voting and counting votes
determines the range of tampering with the results which is impossible
to detect. For example, if 1% of all ballots are read incorrectly, then
fraud within the system can typically change up to about 1% of the votes
without being detectable.

**2.2 Disruption**

The result of a successful disruption attack is that the election
doesn\'t proceed normally. At the end of the election, some people will
have had their ability to vote impeded in a major way, and the election
may have to be rerun.

One impact of a disruption attack is that it delays the normal processes
of choosing a leader or deciding a question, and may force the outcome
to be decided in some different way. An attacker who can carry out a
disruption attack may do so as a form of protest, to change the timing
of an election in some way intended to influence the results, or to
cause confusion or delay in the actions of some elected office. For
example, a foreign government contemplating some invasion that might
draw a US response might attempt to disrupt the presidential election in
November and carry out the invasion in December, while the incumbent is
getting ready to leave and the next president is not yet sure he has won
the election. (\[The 9/11 commission report discusses the confusion of
the transition between administrations as a possible factor in the
attacks\' success.)

A more likely impact of the disruption attack is to influence the
outcome of the election, by disrupting voting selectively.

**2.2.1 Constraints on Disruption Attacks**

Election law provides a certain kind of constraint on disruption
attacks, because it determines forms of disruption that will get an
election successfully challenged, and what may be done as a result of a
successful challenge.

Similarly, the general flexibility of the election system as a whole may
have an impact on the effectiveness of a disruption attack. For example,
if voters are permitted to cast provisional ballots in polling places
other than the ones they\'re normally directed to, an attack that shuts
down several heavily used polling places may not have as much of an
impact.

**2.2.2 Impact and Value**

It\'s hard to know what value to put on a disruption attack. It is a
rather blunt instrument for affecting an election\'s outcome. Outside
changing the outcome of the election, there are no clear financial
benefits to disrupting an election. At most, disrupting an election
might delay or lengthen the transition time for a new administration or
officeholder. The most likely long-term goals of an attacker who
disrupts the election are either to seek publicity for some cause, or
simple vandalism.

**2.2.3 Constraints on Resisting Disruption Attacks**

Attackers can disrupt an election by physical means without ever
affecting the voting system, and this is outside our scope. Protests,
riots, bomb threats, bombs, and backhoes cutting into buried power lines
are all effective ways to shut down polling places that don\'t touch on
voting system security.

**2.3 Discrediting**

The result of a successful discrediting attack is an election in which
there is substantial doubt about the correctness of its result. This is
distinct from a disruption attack in that the election runs normally,
and gives a plausible result, but then manufactured evidence of fraud
surfaces.

The impact of a discrediting attack in the short run seems rather
modest\--perhaps the winner of the election has a harder time governing,
or is less popular, as a result. In the long run, discrediting attacks
can call the legitimacy of an election or even a whole country\'s
government into question. It can also affect voting patterns in a broad
way, if some voters are convinced that their votes will never really be
counted even if they bother showing up at the polls.

The core idea behind discrediting attacks is that the voting system
gives evidence of correct operation by two kinds of evidence:

a\. Evidence of correctness of results

b\. Evidence of attacks or problems with results

If an attacker can cause some evidence or attacks to be produced
incorrectly, or can cause some evidence of correctness to fail to be
produced, he may be able to carry out a discrediting attack.

**2.3.1 Constraints on Discrediting Attacks**

Discrediting attacks interact with election law, technology, and
election administration in complicated ways.

A voting system which can be caused to falsely produce evidence of fraud
is highly vulnerable to discrediting attacks\--this corresponds to
\"framing\" attacks in many cryptographic protocols. A voting system
which provides very little evidence of correct operations may also be
vulnerable to discrediting attacks, as there is no evidence to use to
respond to a claim of fraud. (For example, if a fired programmer from a
DRE vendor claimed to have been ordered to fix an election, it\'s not
clear what evidence would be sufficient to convince anyone that
elections hadn\'t been fixed by that vendor. At the very least, this
would require a major, expensive investigation, and might never entirely
convince the loser of the election that he had lost fairly.)

Details of how elections may be challenged in court, how recounts are
done, and how elections are administered all can make discrediting
attacks either easier or harder.

**2.3.2 Impact and Value**

The impact of a successful discrediting attack is potentially quite
large, in the sense that it could change the nature of the victory won
by the legitimate victor. The problems with butterfly ballots, hanging
chads, and finally court decisions determining the outcome of the 2000
election provide an example of this, though the discrediting was clearly
unintentional. It is hard to put a dollar value on the damage this does,
though the experience of the years since the election have not
demonstrated any obvious loss of power or authority to the presidency.

**2.3.3 Constraints on Resisting Discrediting Attacks**

Once again, we care only about discrediting attacks on voting systems
themselves. Effective public relations or disinformation campaigns that
call the legitimacy of the election into question are outside the scope
of the voting system. The interesting question for a given voting system
is how hard it is to make a discrediting argument, whether some aspect
of the voting system can make this easier for an attacker, and
especially whether it\'s possible for an attacker to undermine the
apparent legitimacy of the election using some components of the voting
system.

**2.4 Involuntary Privacy Violations**

Involuntary privacy violations happen when an attacker learns how some
voters voted, without the voters\' cooperation.

**2.4.1 Constraints on Involuntary Privacy Violation Attacks**

Privacy violation attacks only work when the attacker can get access to
all the information he needs to get at least reasonable confidence that
he\'s learned some voters\' votes. Most practical attack scenarios
involve knowing the order of voting at a given machine, and then also
getting information from the recorded votes that lets the attacker map
the votes to the order of voting. With paper voting technology, disabled
and alternative-language voters may have to use entirely different
ballots or technology to vote; this imposes fundamental limits on the
amount of privacy a disabled voter can expect, at least when there are
only a small number of disabled voters appearing at a polling place.

So long as the paper ballots or ballot records exist, an attacker who
has observed the voting order and knows how to map ballots to voting
order can violate voter privacy. Once the ballot records are destroyed,
if they ever are, then the information is lost. Similarly, even if such
information exists, unless the attacker has observed the order of voting
or can reconstruct it from other available information, he typically
cannot learn how different people voted.

If an attacker has tampered with an electronic voting machine, then
carrying out an involuntary voter privacy violation is usually very
easy. This amounts to keeping track of the sequence of voters in some
way, and leaking this somehow to one of the election observers. The
specific details of the attack depend on the technology involved.

The voter is the enemy of the attacker in an involuntary privacy
violation attack, and cannot generally be induced to do anything to make
the attacker\'s job easier.

**2.4.2 Impact and Value**

There are two impacts to this kind of attack. First, violating voter
privacy may make some voters reluctant to vote, or reluctant to vote in
the way they want. This is especially true when the vote involves some
deeply controversial issue, or something which is overwhelmingly popular
or unpopular in the area. Second, if records are kept for a long time,
the privacy violation may be done years after the election, in a very
different legal, political and social environment. If the information
necessary to violate voter privacy is held by a set of trustees (some
cryptographic voting schemes appear to have this property), then a court
order may force the trustees to reveal how each person voted. (Whether
any court would issue that order is a different question.)

The value of violating a lot of voters\' privacy may be pretty high in
some cases, because it can set up future election fraud attacks by
allowing rewarding of desired votes and punishment of undesired votes.
It may also be valuable to discredit someone publically based on
revealing some unpopular or inconsistent votes.

**2.4.3 Constraints on Resisting Involuntary Privacy Violation Attacks**

Surveilance of the voting machine or location will trivially reveal how
each voter voted. This can be through direct observation, video cameras,
or more advanced surveilance technologies, such as those using different
wavelengths of light to see through curtains, or RF emissions from the
computer or headphones observe the voting process remotely.

Some forensic methods may also be able to violate voter privacy. For
example, threads of clothing, DNA samples, and fingerprints may all be
left on paper ballots; an extensive enough investigation might be able
to determine how someone voted. Computer forensics may be similarly
useful; even if audit log information stored on the computer doesn\'t
directly record the sequence of votes, it may be possible to partially
or fully reconstruct them given the sequence of events captured in the
logs.

**2.5 Voluntary Privacy Violations**

A voluntary privacy violation attack takes place when the voter takes
actions to make it possible for someone else to verify how he voted with
some reasonably high level of assurance. The typical scenario for this
kind of attack is that the voter is offered money to vote a certain way,
or threatened if he doesn\'t vote a certain way.

**2.5.1 Constraints on Voluntary Privacy Violations**

The voter can always just tell the attacker how he voted, but for this
attack, the attacker needs some evidence of how he voted. This typically
requires some kind of access to some of the ballot records, plus some
way to mark those ballot records (by the voter\'s choices, by physical
means for paper ballots, etc.) or to specially note them for the
attacker (by writing down or remembering a serial number or other
identifier).

**2.5.2 Impact and Value**

This attack facilitates vote-buying and coercion. It has high value and
impact. Interestingly, much of the power of the attack resides in the
belief in its effectiveness by the voter. A voter who is convinced that
his vote is being monitored, and that he will lose his job if he votes
the wrong way, is likely to be convinced to vote as he is told,
regardless of whether the attacker really can monitor his vote.

**2.5.3 Constraints on Resisting Voluntary Privacy Violations**

Any involuntary voting privacy violation attack can be used in this
attack. Also, a voter who can be induced to bring in a camera,
cameraphone, cellphone (for the audio ballots), or videocamera can
always demonstrate how he voted. (Note that the attacker presumably
supplies the camera or whatever.)

Write-in ballots and very unusual combinations of votes offer a way of
marking a ballot within the legal election system; there appears to be
nothing that can be done to stop this kind of marking in the election
system, though better voting system design and procedures can make it
more difficult for the attacker to get access to all the information he
needs in order to exploit these.

**2.6 Summary**

The attack goals specify the bad things an attacker might wish to do to
an election which is being supported by one or more voting systems. All
of these goals can be accomplished in ways that bypass the voting
system; those ways of attacking the election as a whole must be
prevented by things outside the voting system, such as procedures
followed by election officials, election law, etc.

**3 Rating the Difficulty of Attacks**

There are two broad ways to rate the difficulty of attacks on voting
systems, neither of which is entirely satisfactory:

a\. Resources used: Money, skills, risk tolerance, and insider access

b\. Conspiracy required: Size and diversity

**3.1 Money and Skills of Attackers**

Most attacks on computer systems require some kind of
resources\--specialized hardware, attack tools, and most fundamentally,
time in which to work out the details of the attack. These attacks also
require skills; if an attacker doesn\'t have the skills needed to carry
out some attack, he must either give up or hire someone with those
skills.

**3.2 Insider Access**

Computer security naturally tends toward a model of the world in which a
big wall is built around the system to be kept secure, with insiders
trusted to behave, and outsiders carefully kept from getting inside.
Unfortunately, insiders are corruptable, and sometimes corrupt. In
electronic voting systems, as with many other computer security systems,
insider access is an enormous asset in mounting an attack.

Voting systems have a long history of attacks by insiders\--most
notably, ballot-box stuffing. In a voting system, many of the natural
defenses against attacks are not effective against insiders. For
example, the integrity of ballot boxes is ensured by having trusted
insiders keep custody of them; if those trusted insiders are corrupt,
then the ballot boxes can (and probably will) arrive at the counting
facility with some extra ballots. Observers from opposing parties can
make this sort of thing much more difficult.

In an electronic system, many of the insiders are not visible on
election day. The programmers who worked on the voting system, the
technicians who have maintained it, the system administrators who
maintain the general-purpose systems on which ballot design and central
counting are done, all are effective insiders in the system. Much of the
work done by these insiders is very hard to observe, though standards
for code review and version control of software are attempts to do so.

**3.3 Risk Tolerance**

Any attack, no matter how clever, has some chance of being detected.
Depending on the details of the attack, this may lead to a high risk of
some of the attackers going to prison. Insider attacks tend to involve
some substantial risk, since if the attack is discovered, there are
often only a small number of possible suspects. Different attacks have
different risks of being caught. For example, one pattern for attacking
a voting system involves changing the records that are initially
counted, but not the records used for recounts. In this case, the risk
of having the attack detected depends on the likelihood of a full or
partial recount. Many state standards for voter-verified paper audit
trail systems include an auditing requirement, in which 1% of DREs are
checked by recounting their paper audit trails\--an attacker who tampers
with ten out of a thousand DREs\' electronic results in one of these
states faces about a 5% risk of detection even without a recount.

**3.4 Conspiracies**

Any attack on an election is certain to be a serious crime, and to be
taken very seriously by the authorities. Many attacks, if leaked before
they occur, can be prevented. Others can be recovered from if they are
leaked. A major goal for any attacker is thus to minimize the chances
that the attack will be leaked.

Most attacks aren\'t practical for a single person to carry out. As more
people are involved in a conspiracy to fix an election, or disrupt it,
or massively violate voter privacy, it becomes more and more likely that
the attack will be discovered. The attacker must build a conspiracy to
effectively carry out the attack. A huge number of practical security
mechanisms rely on this, by mandating split control\--a common example
is not letting a cashier count down his own cash drawer.

The larger the conspiracy, the harder it is to form and keep secret. An
attack that requires hundreds of people to be involved is probably not
much of a secret. Note that many of the commonly-known kinds of election
fraud in the past have involved very widespread corruption that wasn\'t
really kept secret. (Large scale buying or coercion of votes is a good
example of an attack which is simply not possible to keep secret.)
However, we expect that modern versions of election fraud probably
cannot be all that open.

The more diverse the conspiracy, the harder it is to form and keep
secret. A conspiracy that has to cross many organizational lines is
harder to construct and keep secret than one that does not have to cross
organizational lines. For example, a conspiracy between two or three
programmers working for the same voting system vendor can occur among
friends and colleagues, with some trust between them at the beginning of
the conspiracy and probably with some bad consequences for any of them
that go to the authorities. This is the logic behind requirements for
external auditors, and external reviews by testing labs.

**4 Attackers, Resources, and Motivation**

There are a large number of potential kinds of attacker, each with
different resources, risk tolerance, etc. The main additional
qualification for being an attacker is the willingness of an
organization\'s leadership, or possibly some rogue members, to get
involved in a serious felony. In this section, we consider a few
categories of attacker in enough detail to get a broad view of what
resources might be brought to bear during an attack.

The critical question for an attacker is what resources and motivation
he has. Resources include money, expertise, insider access, and risk
tolerance. For example, a well-known private company might have a great
deal of money to spend on influencing an election, and some experts in
computer or physical security who could carry out an attack, but lack
the willingness to risk being caught trying to fix an election. On the
other hand, a dedicated activist might have insider access and the
willingness to go to jail for his beliefs, but not have much money or
any special expertise available.

**4.1 Political activists and extremists as insiders**

Activists are basically strong believers in some cause. Many activists
commit minor crimes in the course of demonstrations (e.g., not getting a
permit, throwing rocks, trespassing), but this doesn\'t seem to track
with willingness to tamper with an election. A very small number commit
serious crimes. Examples include serious vandalism by environmental
groups, bombings and assassinations by pro-life groups, destruction of
labs and theft of lab animals by animal rights groups, and on the
extreme end, bombings by other terrorists such as the Unabomber and
Timothy McVeigh.

As a rule, extremist activists will not be especially well-funded, but
may be willing to accept very large personal risks. An extremist
programmer working on a voting system, or in a position of authority
over some aspect of an election, would be in an excellent position to
carry out some low-cost, high-risk attacks.

**4.1.1 Resource Summary**

Money: Low Expertise: Moderate Insider Access: High Risk Tolerance: Very
High

**4.2 Corporations, Churches, and Large Political Organizations**

Large and basically respectable organizations spend millions of dollars
a year trying to influence elections and law, through lobbying,
contributions to political campaigns and 527 groups, and other means.
Most of these organizations will not make a policy of breaking the law,
though some have, and even those whose formal policy doesn\'t support
breaking the law may have rogue employees who do so using the
organization\'s resources.

As a rule, large respectable organizations will be very well funded, and
typically will have some available expertise. They may have insider
access (depending on circumstances). They are usually unwilling to take
large risks of getting caught.

**4.2.1 Resource Summary**

Money: High Expertise: High Insider Access: High Risk Tolerance: Low

**4.3 Politicians, parties, or campaign staff**

Politicians, political parties, and political campaigns make up the
group that is historically associated with most attacks on voting
systems. They have large motivations (they\'re in the business of
winning elections), substantial resources, considerable expertise in the
processes of voting, and very often have insider access as well.
Experience suggests that people within the group are sometimes willing
to take reasonable-sized risks of getting caught, and that people with
substantial political power may face fewer risks from such scandals than
others would.

**4.3.1 Resource Summary**

Money: High Expertise: High Insider Access: Very High Risk Tolerance:
Moderate

**4.4 Foreign governments**

Foreign governments are probably the most potentially worrying of
attackers, because they already have an infrastructure of intelligence
organizations that have substantial money and expertise in carrying out
attacks on real-world systems. Agents of foreign governments, and the
governments themselves, can be expected to be very reluctant to be
caught tampering with elections in the US.

There are two important points to remember about attacks by foreign
governments: First, even friendly governments spy on one another.
Second, governments routinely spend a lot of money openly to try to
influence laws and policies of other governments\--in the US, most
countries have paid lobbyists.

Resource Summary:

Money: Very High Expertise: Very High Insider Access: Low (but
professional spies may be able to get around this) Risk Tolerance: Low

**5 Summary**

Above, we have discussed the goals an attacker may have, and the
constraints on both those goals and on any attempt to defend against
achieving them. We have discussed the resources used to mount attacks,
and broadly considered a number of classes of attacker who might have
the necessary resources and motivation to attack a voting system.

The most important thing to take from this discussion is that there are
well-funded attackers with significant expertise, access, and tolerance
for the risk of getting caught. We can come to a few broad conclusions,
which set the stage for our later analysis:

a\. Changing the outcome of an election is worth a lot of money.
Political parties, wealthy individuals, political activist
organizations, and corporations spend huge amounts of money financing
political campaigns, especially presidential campaigns. Corporations,
industry consortia, and foreign governments spend hundreds of millions
of dollars every year trying to influence policy through lobbying. While
it\'s not possible to precisely determine an attacker\'s budget, an
attacker trying to fix a presidential election could plausibly have
millions of dollars to spend, and could have highly skilled
professionals on staff.

b\. Some people who would like to change election outcomes are
potentially insiders in the voting system\--employees of voting system
vendors, employees of testing laboratories, state and local election
officials. Some of these insiders may be willing to run high risks of
getting caught in order to have a chance to affect an election outcome.

c\. Violating voter privacy, especially involuntarily, is potentially
valuable for people trying to change election outcomes without directly
attacking the voting system\'s defenses against election fraud.
Violating voter privacy makes it possible to reward or punish votes, to
publicize unpopular votes, etc. These attacks almost always require some
level of insider access, and they can be quite hard to defend against.

d\. Disrupting an election can similarly be a way of accomplishing the
goal of changing the election outcome without directly attacking the
strongest part of the voting system\--for example, by requiring that an
election be rerun, or by forcing the election result to be decided in
court or by a vote of the state legislature. Localized disruptions that
don\'t call the whole election into question may function to limit the
number of votes from some polling places, and thus to change the outcome
of the election. Disruption may also be the only goal of a disruption
attack, for example to mount a political protest of some kind.

e\. Discrediting an election result cannot, by definition, change the
result. (We define a discrediting attack as one that doesn\'t change the
election outcome.) It may have a big impact on future election results
or on the way an official governs, and it may be of some value to sow
uncertainty about the reliability of election results as a way of
weakening a government or leader.