# Security Testing of Voting Systems (DRAFT)

### Peter M. Ketcham

### 02 Mar 2005

## 1. Introduction

The approach to security testing of voting systems is based on two
orthogonal concepts: the system vista (i.e. viewpoint) and the testing
strategy. It is often difficult or time-prohibitive to test all possible
combinations of inputs and vulnerabilities of a system. Therefore, it is
advantageous to select test cases derived from coordinates along
orthogonal axes. As an abstract example, one might provide coverage for
the functionality testing of a voting system by choosing particularly
vulnerable or interesting coordinates along the system vista axis. As a
concrete example, one might test that a voting system correctly records
a voter\'s intention under the condition that all unnecessary physical
interfaces are blocked, the operating system and network system are
heavily loaded, and the voter-interface application software presents
the maximum allowable number of candidates and ballot choices.

## 2. System Vistas

The security testing of a voting system, electronic or otherwise, may be
analyzed from several different vistas, or viewpoints. These vistas are
overlapping and interdependent. We consider four vistas: the physical
system, the operating system, the network system, and the application
system. Although considered primarily with electronic voting systems in
mind, in some cases these four vistas have analogues to paper and
mechanical voting systems as well.

### 2.1. Physical System

The material, tangible components and interfaces constitute the physical
system. The physical system may be mechanically, electrically, or
manually manipulated. In the electronic realm, the physical system might
consist of items such as displays, mass storage devices, cables, and
electrical buses. We further divide the physical system into two
categories: components and interfaces.

#### 2.1.1. Components

For a mechanical voting system, physical components may include items
such as pull-levers, gear-driven counters, paper-punching styli, and
ballot alignment guides. For an electronic voting system, physical
components may include items such as:

1.  display devices (e.g. cathode-ray tubes, liquid crystal displays),

2.  mass storage devices (hard disk drives, tape drives, nonvolatile
    flash memory devices),

3.  memory devices (e.g. read-only memory, random-access memory),

4.  communication devices (e.g. modems, network interface cards), and

5.  processing devices (e.g. central processing units).

#### 2.1.2. Interfaces

For an electronic voting system, physical interfaces may include items
such as:

1.  internal electrical buses (e.g. advanced technology attachment,
    peripheral component interconnect),

2.  external electrical buses (e.g. universal serial bus), and

3.  internal-external electrical buses (e.g. small computer system
    interface).

### 2.2. Operating System

The operating system acts as a resource manager for the voting system.

### 2.3. Network System

The network system constitutes the voting system in the context of its
connections to other voting systems and support systems.

### 2.4. Application System

The application system comprises the software that presents ballots to a
voter, accepts the voter\'s choices, and tabulates the aggregate
results.

## 3. Testing Strategies

The strategy for testing a voting system may be subdivided into three
areas that are roughly chronological with respect to the design,
manufacture, installation, and usage of a voting system. These three
areas are intended to address the following three questions:

1.  Does the voting system function properly within its entire range of
    design parameters?

2.  Can the voting system be compromised by a malicious party?

3.  Is the voting system, as delivered and installed at the polling
    place, in a state consistent with its expected design and operation?

### 3.1. Functionality Testing

Functionality testing addresses the operation of a voting system with
respect to its design and implementation. Questions to consider during
functionality testing include:

1.  Does a review of the operating system and application system source
    code reveal unacceptable deficiencies, vulnerabilities, design
    flaws, or lack of robustness?

2.  If the operating system and application system source code cannot be
    reviewed, are there alternative methods to verify the proper
    operation of the software?

### 3.2. Penetration Testing

Penetration testing addresses the robustness of a voting system when
subject to attack or compromise by a malicious party. Questions to
consider during penetration testing include:

1.  Can the interfaces of the voting system be connected to an auxiliary
    device in such a way as to alter the outcome of an election?

2.  Can physical components be added or deleted from the voting system
    in order to prevent or alter its proper operation?

### 3.3. Assurance Testing

Assurance testing addresses the integrity of a voting system upon
installation at the polling place. Questions to consider during
assurance testing include:

1.  Do the operating system and application system executable codes
    match their expected profiles?

2.  Are interfaces to the voting system in their proper state and
    configuration?