Openness & Secu

Prof. David L. Dill

Department of Computer Sc

Stanford University

http://www.verifiedvoting
My Background

•

Professor of Computer Science 

Stanford University

•

Founder of verifiedvoting.org

•

Researcher in “formal verificati

years.

• V

o

tin

g

–

California Ad Hoc Task Force on T

Voting Feb -

May 2003

–

Citizens DRE Oversight Board, San

County

–

IEEE P1583 Voting Standards Com
Outline

• Principles• Trust and DREs• Voter verifiable audit trail• Conclusion
Role of Elections

Democracy depends on everyone, e

the losers, accepting the results elections.

“The people have spoken . . . the 

-

Dick Tuck concessi
Burden of Proof

We should be able to prove that e

are accurate.

– Procedures and equipment must be 

secure.

–

Election results are routinely and m

audited.

Audit: independently reconstruct 

results from the original record

With conventional paper-based sy

manual recounts.
Integrity With Paper B

Integrity measures (with good pro

–

Voter makes a permanent record o

–

Locked ballot box is in public view.

–

Transportation and counting of ba

observed by political parties and eofficials.

Everyone understands physical sec

paper ballots.

Any new system should be 

this trustworthy.
Trust

“You have to trust somebo

We only need to trust groups of p

diverse interests (e.g., observerdifferent political parties).
Outline

• Principles• DREs• Voter verifiable audit trail• Conclusion
Clarification: DRE

For this talk, 

“DRE” does not include mac

with 

voter verifiable paper reco
The Man Behind the Cu

Suppose voting booth has a man be

curtain

–

Voter is anonymous

–

Voter dictates votes to scribe.

–

Voter never sees ballot. 

There is no accountability 

system!

(analogy due to Dan Wallach and Drew D
The DRE Auditing G

Screen 

touches

DRE System

?

President

Joe Blow

Any accidental or deliberate flaw in re

mechanism can compromise the electio

. . . Undetectably!
Integrity of DRE Impleme

?

?

Paperless electronic voting require

software and hardware to be pe

It must never lose or change vote

Current computer technology 

the task.
Program bugs

We don’t know how to eliminate pr

bugs.

•

Inspection and testing catch the 

problems.

•

Only the really nasty ones rema

– o

b

s

c

u

r

e

–

happen unpredictably.
Security Risk

•

What assets are being protecte

–

At the national level, trillions of do

•

Who are potential attackers?

–

Hackers, Candidates, Zealots, 

–

Foreign governments, Criminal orga

Attackers may be very sophisticat

well-financed.
A Generic Attack

•

Programmer, system administrat

janitor adds hidden vote-changi

•

Code can be concealed from insp

hundreds of ways.

•

Code can be triggered only durin

election

–

Using “cues” -

date, voter behavior

–

Explicitly by voter, poll worker, or 

network.

•

Change small % of votes in plaus
Generic attack

DREs are creating new kinds of risNationwide fraud becomes easier 

fraud.

Local election officials can’t stop 
Threats From Inside

•

FBI: “The disgruntled insider is 

source of computer crimes.”

–

The 1999 Computer Security Inst

report notes that 55% of respondemalicious activity by insiders.

•

Crimes are easier for insiders (e

embezzling).
Voting is Especially H

Unlike almost every other secure 

voting must discard vital inform

the connection between the the vote.
Comparison with bank

Electronic audit records have nam

everyone involved in every trans

Banks usually have paper backup!. . . And computer crime still occur

especially by insiders.

but•

Fraud can be quantified (we can 

happens).

•

Customers are protected.
What software are we r

We cannot verify that desired sof

running on a computer.

•

Stringent software design/revie

formal verification) doesn’t solvproblem.

•

Open source does not solve the 

–

“Disclosed” source is, however, hig

desireable!
Technical Barriers

It is currently impossible to creat

trustworthy DREs because:

•

We cannot eliminate program bu

•

We cannot guarantee program s

•

We cannot verify that the desir

software is running on the comp
Outline

• Principles• Trust and DREs• Voter verifiable audit trail• Conclusion
The Man Behind the Cu

Now, suppose the man who filled o

ballot

–

Shows you the ballot so you can ma

correct.

–

Lets you put it in the ballot box (o

watch him do it).

There is accountability

–

You can make him redo the ballot i

–

He can be fired or arrested if he d
Voter Verifiable Audit 

•

Voter must be able to verify the 

permanent record of his or her ballot).

•

Ballot is deposited in a secure b

–

Voter can’t keep it because of 

vote selling.

•

Voter verified records must be 

and must take precedence over counts.

This closes the auditing 
VVAT is not enoug

Closing the audit gap is necessary 

sufficient.

Additional conditions:

–

Physical security of ballots throug

must be maintained.

– Process must be transparent (obse

diverse interests must be permittepoints).

There are many other requiremen

accessibility.
Manual Recounts

Computer counts cannot be trusteLike other audits, independent rec

should be performed at least

–

When there are doubts about the 

–

When candidates challenge

–

On a random basis

Computer-generated ballots can h

additional security features.

–

Digital signatures/time stamps

–

Matching identifiers for reconcilin

ballots.
Options for Voter Verifiab

Trails

•

Manual ballots with manual coun

•

Optically scanned paper ballots.

– Precinct-based optical scan ballots 

voter error rates.

•

Touch screen machines with vot

verifiable printers.

•

Other possibilities (unproven! ).

–

Other media than paper?

–

Cryptographic schemes?

For now, paper is the only 
Outline

• Principles• Trust and DREs• Voter verifiable audit trail• Conclusion
Key points

• Election equipment should be pr

reliable and secure before it is 

• There is little evidence that DR

safe, and a lot of evidence to th

• The problems cannot be fixed w

voter verifiable audit trail of so

• With a voter verifiable audit tra

attention to election practices, problem can be solved.
The Big Risk

All elections conduct

DREs are open to que
www.verifiedvoting.o

More information is available at ou