<$BlogRSDURL$>

Thursday, September 15, 2016

Analysis of City of Hamilton 2016 Internet Voting report

The City of Hamilton has posted a report about "alternative voting" for the General Issues Committee on September 21, 2016, 9:30 AM.

(Many cities in Ontario will be producing such reports in advance of the 2018 elections.)

You can see the agenda, and the report is discussion item 8.4 Alternative Voting Options (CL16010) (City Wide).  To get a permanent download link you have to get the link from the file icon on the right, after clicking on item 8.4.

Here's the link to the report itself: http://hamilton.siretechnologies.com/sirepub/view.aspx?cabinet=published_meetings&fileid=157256 (PDF)

(You have to know how to navigate the SIRE public documents system, for which I must say Hamilton has a particularly poor implementation.)

The report is fairly typical for a city staff report, which is to say a lot of assertions without any citations.  Let's have a look starting on page 5, Internet Voting
Experts are divided as to the use of internet voting. Those in opposition site [sic.] the opportunity for attacks, viruses, lack of a ballot audit trail, or denials of service.
No.  Experts are not divided.  Find me the 50% of computer security experts who strongly endorse Internet voting.  The reality is the vast majority of computer security experts, and indeed the larger computer science expert community, is opposed to online voting until a number of extremely challenging technical requirements can be demonstrated conclusively to be resolved.  This consensus is so strong that the US Association of Computing Machinery, the largest organisation of computer scientists, has a consensus recommendation against paperless voting tabulators and against internet voting entirely.  (This in a world where it is usually difficult to get scientists to agree on many things.)
An example of a denial of service occurred at an N.D.P convention where electors were prohibited from voting due to a restrictive program put in place by an outside source.
This is awkwardly described, but it is true.  The NDP used online voting and experienced a denial of service attack.  In fact they've had technical problems in 2003[1] and in 2012[2][3][4].  It's also worth noting that they used third-party, for-profit companies for the voting.

[1] CPAC Special - NDP Federal Leadership Convention – January 25, 2003 (Part 3 of 17)
[2] Toronto Star - Internet voting carries risk as show [sic.] by NDP experience - by Michael Geist - March 31, 2012
[3] iPolitics - NDP cyber attack a warning to stay away from Internet voting: expert - by James Munson - April 14, 2012
[4] Huffington Post - NDP Denial of Service Attack

There have also been technical problems in many many other uses of telephone and online voting for political parties in Canada, which doesn't seem to stop any of them from continuing to use these flawed technologies.  Notably, there were reports of hacking in the 2014 Alberta PC leadership election.  "Police may be called in to probe the suspected hacking of the online voting system used to elect Jim Prentice as Alberta Tory party leader and premier-designate, a senior party official said Sunday."[5]

[5] Calgary Herald - Hacking of online voting - by Darcy Henton - September 8, 2014
 
It is perhaps not surprising that Hamilton would cite the NDP 2012 incident, as they cited the exact same incident in their 2012 report Alternative Voting Solutions for Municipal Elections (FCS12046).  In fact, the 2016 report is just a slightly updated version of the 2012 report.

These incidents cited are, however, relatively minor in the grand scheme of things.  What people should be much more concerned about is that Canadian federal government departments have been repeatedly, severely, successfully attacked.  Including departments with sophisticated technical capabilities.
An example of an attack was an internet voting program test conducted by the City of Washington, D.C. that was reprogrammed by University of Michigan students to play the Michigan fight song.
This is a good example, it was work done by J. Alex Halderman and his team of students.  You can see him report on it from 7:11 to 14:02 in the video of his USENIX Enigma 2016 talk Internet Voting: What Could Go wrong? and also read his paper about the attack and the accompanying materials

Attacking the Washington, D.C. Internet Voting System (blog post, testimony, video)
Scott Wolchok, Eric Wustrow, Dawn Isabel, and J. Alex Halderman
Proc. 16th Intl. Conference on Financial Cryptography and Data Security (FC ’12), Bonaire, February 2012

For an even more extensive overview of these kinds of vulnerabilities, read his book chapter Practical Attacks on Real-world E-voting (PDF).

Note that this is one of the very rare times that a jurisdiction has allowed a public hacking challenge.  Every time a public hacking challenge is opened, vulnerabilities are found.  Most importantly, the third-party, for-profit companies that are used in Ontario municipal Internet voting have never permitted a public hacking challenge or indeed any meaningfully extensive independent security audit.
Overall municipalities using internet are finding that although the voting on advance polls has risen significantly, the overall percentage of voters has either remained the same or showed a slight improvement in numbers.
Online voting never substantially increases turnout.  And contrary to the perception that it will increase voting by younger and disadvantaged voters, in an extensive study of Ontario's municipal online voting, Dr. Nichole Goodman finds that "The typical online voter is older, educated and wealthier."[6]

[6] Internet Voting Project - Executive Summary (PDF) - August 2016

It is also important to understand that Dr. Goodman is a social scientist, doing a survey-based analysis of satisfaction with online voting.  She is not a computer scientist and has not done an examination of the security of the voting systems.

Hamilton Pro/Con

Pro and Con taken from their report.

Pro: Possible increase in voter turnout.

There is no substantial increase in voter turnout.  In the only example of national online voting, Estonia, after 9 years of offering online voting their turnout is lower than Canada's in the last election.

Con: Ability for others to influence how an elector is to vote.

This risk, the risk of voter coercion, is a significant one and one that has nothing to do with technology, it has to do with the fact that the casting of the vote can be observed.  I devoted some time to this risk in my presentation on online voting as often overlooked.  I don't see any good way to reduce this risk for online voting.  In case you think it is minor, at any time in history when votes could be easily coerced, they were coerced.

Con: Hacking, viruses or denial of services. (Average age of a hacker is 18-22 and they do it as a challenge.)

Hacking is definitely a serious consideration.  Most significant is the fact that online voting involves casting votes from a personal computer or smartphone.  Many millions of personal computers and smartphones are already known to be compromised by various types of malicious software.  The second part is kind of funny in its misunderstanding of hackers.  Anyone can be a hacker.  By far the two most serious threats are criminal gangs, who conduct very sophisticated attacks, most recently involving ransomware[7], and countries with professional hacking teams ("nation-state attackers") who have the time, money and expertise to compromise almost any system[8].  Comparing the basement script kiddie hacker to a nation-state team of attackers is like comparing a BB gun to a bunch of missile launchers.

[7] CSO - A single ransomware network has pulled in $121 million - by Maria Korolov - September 14, 2016
[8] Information Week - Dark Reading - Nation-State Cyberthreats: Why They Hack - by Mike Walls - January 8, 2015

The threat of nation-state attackers is in fact so significant that the US has raised the possibility of classifying election technology as critical infrastructure [9], and the US Department of Homeland Security recommends against online voting, stating “We believe that online voting, especially online voting in large scale, introduces great risk into the election system by threatening voters’ expectations of confidentiality, accountability and security of their votes and provides an avenue for malicious actors to manipulate the voting results."[10]

[9] New York Times - U.S. Seeks to Protect Voting System From Cyberattacks - by Julie Hirschfeld Davis - August 3, 2016
[10] Washington Post - More than 30 states offer online voting, but experts warn it isn’t secure - by Sari Horwitz - May 17, 2016

In light of the above, I support the City of Hamilton staff recommendation, which is silent about Internet voting (i.e. does not recommend the use of Internet voting for the 2018 election).

Also note that the City of Toronto did a security analysis of Ontario municipal Internet voting options (PDF) and the report concluded that none of the systems met the security requirements (even for the limited amount of security analysis they were able to conduct on the third-party, closed-source, for-profit commercial systems).  Kudos to Toronto for hiring computer scientists to conduct an expert study.

In addition, Quebec has had a moratorium on electronic voting since a debacle with their machines in 2006, BC's Independent Panel recommended against Internet voting and when Australia did an extensive Parliamentary investigation with 20 hearings and over 200 submissions, they concluded that electronic voting would catastrophically compromise election integrity.

For vote tabulators (vote counting machines), they are acceptable if they are mark-sense paper ballot scanners.  Ideally with extensive auditing including random testing on election day, by pulling machines out of service to test them (unfortunately almost no jurisdiction actually does this). If the majority of votes is cast instead on touch screen, this is unacceptable.

Previously:
August 22, 2016  City of Kitchener 2012 report on Internet Voting
June 23, 2016  City of Mississauga report on Internet Voting

Labels: , , ,

[permanent link] posted by rakerman : 9:43 am (0) comments /

Monday, September 12, 2016

Ottawa - Sept 15, 2016 - Electoral Reform consult with Minister Monsef

The Federal electoral reform community dialogue tour with the  Honourable Maryam Monsef, Minister of Democratic Institutions will be doing its Ottawa / Gatineau / National Capital Region (NCR) event on Thursday September 15, 2016 at 7pm in Gatineau.

7pm-9pm
Crowne Plaza Gatineau
Salon des Nations
2 Montcalm Street
Gatineau, Quebec (sector Hull)

The discussion will include online voting, for which I have written an online voting backgrounder as the consultation itself does not provide any detailed information.

This Ministerial consultation is a separate process from the Special Committee on Electoral Reform (ERRE) consultations, and associated MP consultations, and possible citizen consultations, which are also taking place across the country at the same time.

In theory you're supposed to know that the committee hashtag is #ERRE, whereas the Ministerial consultations have the hashtag #EngagedInER and tweet from @CdnDemocracy, but in practice I'm guessing many people are not aware of the distinction.  Plus which people are also using the hashtag #electoralreform.

In brief, the Ministerial consultations provide feedback to the Minister directly, while the Special Committee (ERRE) consultations feed into a report with recommendations that the Minister will consider (the Minister is of course free to decide not to accept certain committee recommendations).

Labels: , , , , , , , , ,

[permanent link] posted by rakerman : 6:34 pm (0) comments /

Sunday, September 11, 2016

Electoral reform consultations discussing electronic voting in addition to online voting

I'm going to assume that this is just an unfortunate misunderstanding about terminology and mandate.

Online voting means voting over the Internet.  You cast your vote from your home computer or smartphone.

Electronic voting means voting on a voting machine (a voting computer) at a polling place.

Electronic vote counting means vote tabulators of various sorts, most commonly optical mark-sense readers that count votes by scanning marked paper ballots.

Recommendations for Consultation

0. Discontinue discussion of electronic voting

However, if discussion of electronic voting is going to continue:
  1. The mandate for the Electoral Reform committee should be amended, adding after the words "online voting" the following: ", and electronic voting.
    But it is probably too late to do that.
  2. There should be clear definitions of electronic voting and online voting in the Host a Canadian federal electoral reform dialogue in your community materials and those definitions should also be provided to the committee.
  3. The focus of the electoral reform dialogue should be placed on online voting to respect the original committee mandate.
  4. The Library of Parliament Background Paper 2016-06 on Electoral Systems should have a section on electronic voting added.
  5. The Electoral Reform committee online survey should have questions about electronic voting added, and the consequences of currently-completed surveys only having questions about online voting will have to be considered.
  6. In future, more care must be taken with terminology used and alignment between committee activities and consultation materials.

Recommendations for Individuals

If you're concerned about Canada using electronic voting machines or online voting in national elections, please participate in the consultation (deadline October 7, 2016) and make your opinion heard.

Background

The terms of reference for the Special Committee on Electoral Reform very clearly say only online voting.  There is no mention of electronic voting.

Here's Vote 79



and Vote 80


That's the mandate discussed in Parliament.

The town hall material and discussion has proceeded to talk about electronic voting. Without an adequate backgrounder. Without even a definition. So we may get reporting back about some jumbled up mix of voting machines and online voting, while the committee itself has only discussed online voting.

And electronic voting is a VERY DIFFERENT DISCUSSION than just online voting, with very different considerations.

I will now have to write a separate briefing about electronic voting machine risks.

Anyway, here's some of the town hall materials in order to demonstrate that electronic voting is being discussed.

Potential Canadian federal electoral reform event dialogue topics and questions


So it is clear that the terminology electronic voting and online voting are not being used interchangeably, they are mentioned separately; this is not just confusing one term for the other.

Electronic voting and online voting both link to this text below about "introducing new technologies at the polls", which again has no Parliamentary mandate that I can see, other than a chain of assumptions about how using voting machines could lead to using online voting.  There is no definition of either electronic voting or online voting provided.

Changing Canada’s federal electoral system


In addition, the only thing that is even close to a briefing, the Library of Parliament Background Paper 2016-06-E on Electoral Systems, which is already weak on online voting, has no section about electronic voting at all (presumably because it's not in the committee mandate).

And the committee survey also doesn't ask any questions about electronic voting.

Some of the dialogue guidance even focuses on electronic voting alone, without mentioning online voting.

Sample Canadian federal electoral reform event agenda and facilitator guide


And there are at the time of this writing five variations of the Canadian Democracy tweet below, asking about electronic voting; I assume at least one tweet per town hall meeting.

"Electronic and Online voting?  Good idea? Bad idea? #EngagedinER" - @CdnDemocracy - 10:56 PM - 9 Sep 2016
So to sum up:

Labels: , , , , ,

[permanent link] posted by rakerman : 8:07 am (0) comments /

Briefing note on online voting in Canada

Make It Short

The Canadian government has already been cyberattacked by nation-states, computer security experts warn that online voting is not secure, national security experts warn that online voting is not secure, and online voting won't increase turnout.

Here's the evidence:
As further quick background I recommend:

I Want To Know More

Labels: , , , , ,

[permanent link] posted by rakerman : 7:39 am (0) comments /

Monday, September 05, 2016

Online Voting video playlist

Here is a playlist of YouTube videos about online voting / Internet voting / electronic voting.

https://www.youtube.com/playlist?list=PLhvSKQLn9Dm4bMS_AhDJWEuQu0YVto1wo

I have previously featured some of these videos as "Internet voting videos of the week". See label links to video for more info.

Labels: , ,

[permanent link] posted by rakerman : 10:46 am (0) comments /

Wednesday, August 31, 2016

Narrated presentation - Questions to ask about Internet Voting

You can also download the PowerPoint slides (from Google Drive). The PowerPoint includes clickable links and slide notes.
To download the slides, click the download link (the downward-pointing arrow) in the upper right of the Google Drive screen.

UPDATE 2016-09-09: Transcript is now available (auto-transcript from YouTube with corrections by me). To see the transcript during the YouTube video, click on CC (Closed Captioning). [Text below in progress]

Slide 1: This presentation is "Questions to ask about Internet voting". It's authored and narrated by me, Richard Akerman and it's actually questions that for the most part you could ask about any kind of voting system.

Slide 2: Before I get started with the presentation, I want to first acknowledge that this image and some of the approach in the presentation has been inspired by a presentation that Andrew Appel did and I provided a link to his presentation in the annex at the end of these slides. Getting into the presentation, one of the things I wanted to raise is that voting hasn't always taken place the way it does right now. In fact as you can see in this image of an election in the United States in 1846 elections didn't used to be private at all - they used to be quite rowdy public affairs and in fact so much is going on in this picture that you may kind of struggle to see where the voting is taking place. It's actually this gentleman in the red in the upper-right who is casting his vote by speaking it out loud or probably (given the number of people milling around) by shouting it out loud. So no secret ballot at all; everybody can hear him cast his vote. We hope that these gentlemen sitting on the porch are recording his vote correctly, although as you can see no one really seems to be paying much attention to what they're doing. And in addition to the fact that the vote is not private, it's possible even that the candidates are these gentleman in the black top hats right next to the voter. So the voter's vote can be heard, it can be seen, and that means that voters can be rewarded or punished depending how they have voted and you can see in the lower left a voter potentially being rewarded with some drink for how he voted.

Slide 3: The key point there is that voting is a system that has been designed. We had a system where the vote was not private. We saw the consequences and a new system, a paper ballot system was designed to address some of the risks that have been identified and it's key that when you have a designed system you look at risks and you look at the entire system and so

Slide 4: the first item that I'd like to examine is: Does the design limit voter coercion? What coercion means is that you can either force someone to vote a particular way or you can reward someone for voting a particular way. And when we look at

Slide 5: risk, I want to really emphasize the concept that there are levels of risk: Very high-risk, medium-risk, low-risk. We're always aiming in system design to try to have low risk and sometimes there are steps that we can take to mitigate, to reduce the risk from high to low. Sometimes we will see people claiming that the risk is in fact zero. In Internet voting or in technological systems often people claim that because they have encryption or because they have blockchain or because they have some particular security measures, in fact they have perfect security, they have zero risk and while that is possible sometimes in mathematical systems - kind of pure abstract systems - voting systems operate in the real world, the physical world with imperfect computers, imperfect computer code, and imperfect people and so in the real world there is never zero risk so always be very very cautious when people are claiming that for some reason their system has actually mitigated the risk down to zero.

Slide 6: I want to look at this question: Does the design limit voter coercion? and use the approach of risk analysis and look at the Canadian paper voting system. In this system voting takes place in a public area, with observers, but marking the ballot takes place in private, alone and once the ballot is cast it's detached from the identity of the voter - you can't tell how an individual voter voted and in fact an individual voter can't prove that they voted a particular way. When we look at these properties of the system, because the voting takes place in a public area you can see the voter come into the voting place, you can see they receive one vote [one ballot], you can see that the ballot they've received they are taking into the voting place [polling booth] and marking, but you cannot see (because the vote takes place in private) how they have marked it. Because everyone is receiving identical paper ballots, as long as they mark them in a non-unique way (as they're required to) by marking an ex it's difficult - not impossible - but it's very difficult to tell which ballot was cast by which voter and in such a situation the risk of coercion is very low because the ability to prove that an individual voter voted a particular way is very low. And if you think about the outcome that you want when you try to coerce someone's vote: you're either paying them to vote a particular way or you're threatening them with consequences if they don't vote a particular way - in both cases you want some proof that they actually did cast that vote that you have asked for and in this system it's designed that that clear proof of how one individual person voted is not available.

Previously:
June 2, 2016  Presentation - Questions to ask about Internet Voting

Labels: , , , ,

[permanent link] posted by rakerman : 4:26 pm (0) comments /

Tuesday, August 23, 2016

Online voting and computer security expertise

There are people trained in computer science, computer security and/or voting technology who can bring evidence and experience to any analysis of online voting.  Canadians first but otherwise no particular order.

Barbara Simons

Ph.D. in computer science from the University of California, Berkeley

Barbara Simons is a computer scientist and past president of the Association for Computing Machinery (ACM). She is founder and former Chair of USACM, the ACM U.S. Public Policy Committee. Her main areas of research are compiler optimization and scheduling theory. Together with Douglas W. Jones, Simons co-authored a book on electronic voting entitled Broken Ballots.

Key documents:
Key videos:
Websites:
Twitter: not an active personal Twitter user, however there are tweets from book account @BrokenBallots

Konstantin Beznosov

Ph.D. in Computer Science from Florida International University

Dr. Beznosov served on the BC Independent Panel on Internet Voting

Konstantin (Kosta) Beznosov is an Associate Professor at the Department of Electrical and Computer Engineering, University of British Columbia (UBC), Vancouver, where he founded and directs the Laboratory for Education and Research in Secure Systems Engineering (LERSSE).  His primary research interests are distributed systems security, usable  security, secure software engineering, and access control.

Key documents: British Columbia Independent Panel on Internet Voting - Recommendations Report (PDF)

Websites:
Twitter: not an active Twitter user

Valerie King

Ph.D. in Computer Science and a J.D., both from the University of California at Berkeley

Dr. King served on the BC Independent Panel on Internet Voting

Valerie King is Professor of Computer Science at the University of Victoria and has been a faculty member there since 1992.  She received an A.B. degree in Mathematics from Princeton University and a Ph.D. in Computer Science and a J.D., both from the University of California at Berkeley.  She was a post-doctoral fellow at the University of Toronto and Princeton University, a Research Scientist at NECI, Compaq SRC and HP Labs, a Visiting Researcher at Microsoft Research SVC, and a Visiting Professor at the University of Copenhagen and Hebrew University.

Key documents: British Columbia Independent Panel on Internet Voting - Recommendations Report (PDF)

Website:

Jeremy Clark

Ph.D. in computer science from the University of Waterloo

Assistant professor at the Concordia Institute for Information Systems Engineering

Key document: City of Toronto RFP #3405-13-3197 - Internet Voting for Persons with Disabilities - Security Assessment of Vendor Proposals (PDF)

Website: http://users.encs.concordia.ca/~clark/
Twitter: @pulpspy

Aleksander Essex

Ph.D. in computer science from the University of Waterloo

Assistant professor of software engineering in the Department of Electrical and Computer Engineering at Western University

Key document: City of Toronto RFP #3405-13-3197 - Internet Voting for Persons with Disabilities - Security Assessment of Vendor Proposals (PDF)

Websites: Twitter: @aleksessex

J. Alex Halderman

Ph.D. in Computer Science, Princeton University

Dr. Halderman has extensive expertise in examining Internet voting systems, including Estonia's system

J. Alex Halderman is an assistant professor of Computer Science and Engineering at the University of Michigan, where his research spans applied computer security and tech-centric public policy. Halderman has studied topics ranging from web security, data privacy, digital-rights management, and cybercrime to technological aspects of intellectual-property law and government regulation. He is known for helping to introduce the ”cold-boot attack,” which breaks encryption by literally freezing a computer's memory, and for exposing Sony’s rootkit digital-rights management and other harmful copy-protection technologies. A noted expert on electronic voting security, Halderman demonstrated the first voting-machine virus and helped lead California’s ”top-to-bottom” electronic-voting review. He has uncovered vulnerabilities in numerous deployed voting systems. He holds a Ph.D. from Princeton University.

Key quotes:
Key documents:
Key videos:
Websites:
Twitter: not an active Twitter user

David Dill

Ph.D. in Computer Science, Carnegie-Mellon University

David Dill is Professor of Computer Science at Stanford University.  He was named a Fellow of the Institute of Electrical and Electronics Engineers (IEEE) in 2001 for his contributions to verification of circuits and systems, and a Fellow of the ACM in 2005 for contributions to system verification and for leadership in the development of verifiable voting systems. In 2008, he received the first "Computer-Aided Verification" award, with Rajeev Alur, for fundamental contributions to the theory of real-time systems verification. In 2013, he was elected to the National Academy of Engineering and the American Academy of Arts and Sciences.

He has been on the faculty at Stanford since 1987. He has an S.B. in Electrical Engineering and Computer Science from Massachusetts Institute of Technology (1979), and an M.S and Ph.D. from Carnegie-Mellon University (1982 and 1987).

Prof. Dill has been working actively on policy issues in voting technology since 2003. He is the author of the "Resolution on Electronic Voting", which calls for a voter-verifiable audit trail on all voting equipment, and which has been endorsed by thousands of people, including many of the top computer scientists in the U.S. He has testified on electronic voting before the U.S. Senate and the Commission on Federal Election Reform, co-chaired by Jimmy Carter and James Baker III. He is the founder of the Verified Voting Foundation and VerifiedVoting.org and is on the board of those organizations. In 2004, he received the Electronic Frontier Foundation's "Pioneer Award" for "for spearheading and nurturing the popular movement for integrity and transparency in modern elections."

Key quotes:
Key documents:
Websites:

Avi Rubin

Ph.D., Computer Science and Engineering, University of Michigan

Avi Rubin is Professor of Computer Science at Johns Hopkins University and Technical Director of the JHU Information Security Institute. His primary research area is Computer Security, and his latest research focuses on security for healthcare IT systems. He is Director of the Health and Medical Security (HMS) Lab at Johns Hopkins. He also founded Harbor Labs, a company that provides security consulting, professional training, and technical expertise and testimony in high tech litigation.

He is a frequent speaker on Information Security. Some highlights include TED talks in October, 2011 and September, 2015 about hacking devices, a TED Youth talk, testimony in Congressional hearings, and a high level security briefing at the Pentagon to the Assistant Secretary of the Army and a group of generals.  Authored a book on electronic voting entitled Brave New Ballot: The Battle to Safeguard Democracy in the Age of Electronic Voting.

Key quotes:
Key documents:
Websites:
Twitter: @avirubin

David Jefferson

Ph.D. in Computer Science from Carnegie-Mellon University

David Jefferson is computer scientist in the Center for Applied Scientific Computing, where he works on parallel entity-based simulation. He is interested in scalable parallel "middleware" supporting high-performance computing applications, including scalable operating system and communication software, discrete simulation engines, Java platforms, load balancing, checkpointing, performance instrumentation.

David has served (and continues to serve) on a number of government panels at the state and federal levels, advising on election security issues, especially with regard to electronic and Internet voting. He also sits on the board of directors of the California Voter Foundation.

Key quotes:
Website:
Twitter: not an active Twitter user

Ron Rivest

Ph.D. in Computer Science from Stanford University

Ron Rivest is a cryptographer and an Institute Professor at MIT. He is a member of MIT's Department of Electrical Engineering and Computer Science (EECS) and a member of MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL). He was a member of the Election Assistance Commission's Technical Guidelines Development Committee, tasked with assisting the EAC in drafting the Voluntary Voting System Guidelines.

Rivest is one of the inventors of the RSA algorithm (along with Adi Shamir and Len Adleman). He is the inventor of the symmetric key encryption algorithms RC2, RC4, RC5, and co-inventor of RC6. The "RC" stands for "Rivest Cipher", or alternatively, "Ron's Code".

Rivest is a member of the National Academy of Engineering, the National Academy of Sciences, and is a Fellow of the Association for Computing Machinery, the International Association for Cryptologic Research, and the American Academy of Arts and Sciences. Together with Adi Shamir and Len Adleman, he has been awarded the 2000 IEEE Koji Kobayashi Computers and Communications Award and the Secure Computing Lifetime Achievement Award. He also shared with them the Turing Award.

Key quotes:
Key documents:
Websites:
Twitter: not active on Twitter

Andrew Appel

PhD in computer science from Carnegie Mellon University

Andrew W. Appel is Eugene Higgins Professor of Computer Science at Princeton University, where he has been on the faculty since 1986. He served as Department Chair from 2009-2015. His research is in software verification, computer security, programming languages and compilers, and technology policy. He received his A.B. summa cum laude in physics from Princeton in 1981, and his PhD in computer science from Carnegie Mellon University in 1985. He has been Editor in Chief of ACM Transactions on Programming Languages and Systems and is a Fellow of the ACM (Association for Computing Machinery). He has worked on fast N-body algorithms (1980s), Standard ML of New Jersey (1990s), Foundational Proof-Carrying Code (2000s), and the Verified Software Toolchain (2010s).

Key documents:
Key videos:
Websites:

Bruce Schneier

Master's in Computer Science from American University in Washington, DC

Bruce Schneier is an internationally renowned security technologist, called a "security guru" by The Economist. He is the author of 13 books--including Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World--as well as hundreds of articles, essays, and academic papers. His influential newsletter "Crypto-Gram" and his blog "Schneier on Security" are read by over 250,000 people. He has testified before Congress, is a frequent guest on television and radio, has served on several government committees, and is regularly quoted in the press. Schneier is a fellow at the Berkman Klein Center for Internet & Society at Harvard University, a Lecturer in Public Policy at the Harvard Kennedy School, a board member of the Electronic Frontier Foundation, an Advisory Board Member of the Electronic Privacy Information Center, and the Chief Technology Officer at Resilient, an IBM Company.

Key quotes:
Key documents:
Websites:
Twitter: the automatic (non-interactive) account @schneierblog tweets links to new blog entries on his website

Vanessa Teague

Ph.D. in computer science (cryptography and game theory) from Stanford University

Her main research interest is in electronic voting, with a focus on cryptographic schemes for end-to-end verifiable elections and a special interest in complex voting schemes such as STV. She was a major contributor to the Victorian Electoral Commission's end-to-end verifiable electronic voting project, the first of its kind to run at a state level anywhere in the world, joint work with Chris Culnane, Peter Ryan and Steve Schneider. She discovered, with Alex Halderman, serious security vulnerabilities in the NSW iVote Internet voting system.

She has been invited to appear before several Australian parliamentary inquiries into elections at the state and federal level, to answer questions on electronic voting.

She is on the advisory board of Verifiedvoting.org and has been co-chair of the USENIX Electronic Voting Technologies Workshop and the International conference on E-voting and identity.

Key quotes:
Key documents:
Website:

Joe Kiniry

Ph.D. in Computer Science from the California Institute of Technology

Dr. Kiniry is the CEO and Chief Scientist of Free & Fair, a Galois spin-out focusing on high-assurance elections technologies and services.  He is also the Research Lead at Galois of several programs: Rigorous Software Engineering, Verifiable Elections, High-assurance Cryptography, and Audits-for-Good.

Prior to joining Galois in 2014, Dr. Kiniry was a Full Professor at the Technical University of Denmark (DTU). There, he was the Head of DTU’s Software Engineering section. Dr. Kiniry also held a guest appointment at the IT University of Copenhagen. Over the past decade, he has held permanent positions at four universities in Denmark, Ireland, and The Netherlands.

Dr. Kiniry has around fifteen years experience in the design, development, support, and auditing of supervised and internet/remote electronic voting systems while he was a professor at various universities in Europe. He co-led the DemTech research group at the IT University of Copenhagen and has served as an adviser to the Dutch, Irish, and Danish governments in matters relating to electronic voting.  He now advises the U.S. government on these matters via his participation in the EAC-NIST VVSG public working groups.

Key quotes:
Twitter: @kiniry

Jeremy Epstein

Master's in Computer Sciences from Purdue University

Jeremy Epstein joined DARPA as a program manager in February 2016. His technical research interests span cybersecurity, with particular interest in systems security. He was previously the lead for the National Science Foundation's cybersecurity research program.

Jeremy Epstein is a senior computer scientist with SRI International in Arlington, Virginia. At SRI, he has been principal investigator on the NSF-funded ACCURATE research program (www.accurate-voting.org) and supported the Department of Homeland Security Science & Technology cybersecurity research program. He is also a member of the US Election Assistance Commission's Voting Security Risk Assessment (VSRA) team. Prior to joining SRI, Jeremy spent almost nine years as head of product security for Software AG, a global business software company.

Key quotes:
Key documents:
Websites:

Labels: , , ,

[permanent link] posted by rakerman : 7:56 am (2) comments /

Monday, August 22, 2016

City of Kitchener 2012 Report on Internet Voting

The City of Kitchener did a report in 2012, titled FCS-12-191 Alternative Voting - Internet Voting (link will open a page viewer).

Because the City of Kitchener website provides a page viewer and a button to generate a PDF download, I've made a copy of the PDF, you can view and download it from Google Drive (click the down-pointing arrow in the upper right of that screen to download).

The report is particularly good is in the area of turnout.  It concludes
there is no clear indication that [internet voting] increases voter turnout. There is data that shows internet voting does not increase voter turnout amongst younger voters. 
The conclusion is supported by tables in the Results and Outcomes section showing data from Markham, Peterborough, and Burlington, with a particularly detailed breakdown for Markham.  See the image extracted from the document below:


Let me re-emphasize the last sentence in the above extract:

There is clear evidence that, regardless of geography internet voting does not attract younger voters.

I believe it is the Markham evidence that underlies the Canadian Internet Voting Project's (@ivotingproject) October 31, 2015 tweet stating "Young ontario voters (aged 18-24) more likely to use paper ballots than internet voting"
The Kitchener report however unfortunately comes to an incorrect conclusion about security "Security issues are a real threat but most studies conclude that the risk is small to medium." The reality is most studies conclude the risk is large.

The staff report's Executive Summary recommended against adopting Internet voting and indeed Kitchener rejected Internet voting for 2014.

Executive Summary (extract)

Staff is of the opinion that [internet voting] should not be introduced in 2014 based on several factors outlined in greater detail in this report such as:
Previously
June 23, 2016  City of Mississauga report on Internet Voting

Labels: , , , , , ,

[permanent link] posted by rakerman : 6:02 pm (0) comments /

Friday, August 19, 2016

Get Informed about Online Voting Before You Answer the #ERRE Survey

The background information provided by the Special Committee on Electoral Reform is wildly inadequate in the context of online voting.  It provides only four short paragraphs.  There is no direct citation of computer scientists or computer security experts in the background paper.  I had considered this a problem, but not an insurmountable one, but now that background paper is the only information provided to inform citizens completing the committee's online survey.


The background paper does not draw upon sufficient evidence, and its "on the one hand, on the other hand" conclusion is weak.  See my previous blog post Online voting section of Background Paper 2016-06-E on Electoral Systems.

Before you complete the online voting section of the Electoral Reform survey, I encourage you to review the evidence provided below.

Make It Short

The Canadian government has already been cyberattacked by nation-states, computer security experts warn that online voting is not secure, national security experts warn that online voting is not secure, and online voting won't increase turnout.

Here's the evidence: As further quick background I recommend:

I Want To Know More

Beyond that, there are 12 years worth of material in this blog itself

http://blog.papervotecanada.ca/

and 6 years worth of material in my Twitter

http://twitter.com/papervote

I'm happy to respond to specific requests for particular evidence related to Internet voting. 

Take the Survey

Now that you've had a chance to get a proper briefing with relevant evidence, I encourage you to complete the online survey (deadline unknown; presumably before deadline October 7, 2016) or use any of the other methods to contribute to the Special Committee on Electoral Reform.

Labels: , , , , ,

[permanent link] posted by rakerman : 12:25 pm (0) comments /

Canadian government departments have been hacked before

Intrusions into computer systems by sophisticated attackers ("hacks") have already happened multiple times for multiple Canadian government departments. Some of these attacks have been attributed to other nation-states. This means the risk of attack to online voting is far from theoretical.

Quote from the CIO of Canada, July 29, 2014:

Government of Canada computer networks, like those of other governments and the private sector, are under increasing threat of cyber-attack.

Labels: ,

[permanent link] posted by rakerman : 11:16 am (0) comments /

Secret Ballot privacy report in the news

Verified Voting, the Electronic Privacy Information Center, and Common Cause have released a report: The Secret Ballot at Risk

http://secretballotatrisk.org/

It describes how US voters often have to waive (sign away) their right to a secret ballot in order to vote online.

It's being widely reported in the media, including:

Labels: , , ,

[permanent link] posted by rakerman : 7:05 am (0) comments /

Wednesday, August 17, 2016

Internet voting video of the week - J. Alex Halderman for Slashdot 2012

The video can't be embedded, but you can watch it at

https://it.slashdot.org/story/12/03/10/2351259/prof-j-alex-halderman-tells-us-why-internet-based-voting-is-a-bad-idea-video

Find out more about J. Alex Halderman at https://jhalderm.com/

Labels: , ,

[permanent link] posted by rakerman : 4:11 pm (0) comments /

Saturday, August 06, 2016

Australia concludes electronic voting would catastrophically compromise election integrity

In my understanding, Australia does a review of election processes and possible improvements after every election.

Canada should be so lucky as to have a process as comprehensive as Australia's last review in 2013, where "The Joint Standing Committee on Electoral Matters held 20 hearings and reviewed more than 200 submissions, before deciding Australia should stick to its largely paper based system."[1]

The foreward of this Joint Standing Committee on Electoral Matters (JSCEM) report is worth quoting extensively, as it is clear and compelling.  Any emphasis (bolding) below is mine.
advocates argue that [electronic voting computers and Internet voting] offer faster and potentially more accurate results. With the close of polls the results are known within minutes rather than hours, days and weeks and arguably without the human error that occurs in the long paper ballot count.
Many think it sounds like a good idea for the next federal election.
No matter your view, this is not feasible.
Even the most ardent electronic voting advocates must recognise that in logistical terms it would be impossible for our electoral authorities to roll it out next polling day which is less than two years away – at the latest.
But what about future elections?
I once simply assumed so, but that was before I had really given it a lot of thought.
After hearing from a range of experts, and surveying the international electoral landscapes it is clear to me that Australia is not in a position to introduce any large-scale system of electronic voting in the near future without catastrophically compromising our electoral integrity.
Machine electronic voting at a polling place is vulnerable to hacking to some degree. This can be mitigated by a system that not only records your vote electronically, but also produces a printed ballot for physical counting and later verification. In other words, a lot of expense to still visit the polling booth, queue up and complete your vote on a machine rather than a paper ballot.
For this reason, internet voting seems to be naturally the most attractive to many voters. As an election expert from the USA recently said to me: ‘when it comes to voting, folks would rather be online than in line.’
But the weight of evidence tells us that at present [Internet voting] is highly vulnerable to hacking. While internet voting occurs in Estonia, it does not mean that system cannot be hacked.
With all the internet security architecture available, the academic experts swear they can, and have proved they can, hack such systems.
...
Given we complete so many transactions online, I am often asked why voting should be any different. My answer to that is that voting once every three years to determine our democratic destiny is not an everyday transaction.
Not only do we have the right to a ballot; we have rightly enshrined within our system the right to a secret vote. Voting at a booth in a polling place guarantees this; voting over the internet threatens this.
Internet voting would expose some voters to family and peer pressure by removing the individual isolation of voting at a secluded booth and replacing it with voting in a home, a workplace or a public place. It also potentially opens up a market for votes where disengaged or financially desperate voters could be offered money to vote a certain way, which could be verified in a way not possible at a polling place.
...
Over the course of the twenty hearings to date and in reviewing the 207 submissions received, the Committee has worked collaboratively and in an impartial manner to ensure that the best outcomes have been met.
Technology is moving at a rapid pace. The Committee believes that we should be utilising it to ensure that the systems underpinning how we vote are sound and that persons with disabilities have easy access to the vote. In doing so, we will harness [technology] which enhances our electoral integrity, not that which endangers it.
Hon Tony Smith
MP Chair
I extend my thanks once again to the Honourable Tony Smith for such a clear and compelling summary of the evidence.

[1] ABC - Curious Campaign: Why have voters not had access to electronic voting? - 26 May 2016

Labels: , , , ,

[permanent link] posted by rakerman : 6:14 am (0) comments /

Sunday, July 31, 2016

votingsolutions.txt

Your post advocates a

( ) technical ( ) legislative ( ) vigilante

approach to improving voting. Your idea will not work. Here is why it won't
work. (One or more of the following may apply to your particular idea.)

( ) It will not increase turnout.  Only public interest increases turnout.  Yes, even for the kids today.
( ) It will not save money
( ) It will not be secure
( ) The ballot will not be secret
( ) Any increase in vote counting speed is irrelevant when weighed against the greatly increased risks of hacking
( ) By enabling the voter to verify their vote after it has been cast, you have opened the door to coercion
( ) By issuing user, password, personal info credentials you have made the voter's identity something that can be sold or stolen
( ) Every eligible voter cannot meaningfully understand and inspect it
( ) The requirement to have a printed ballot for verification means you have invented a very expensive pencil

Specifically, your plan fails to account for

( ) The fact that computers can lie; computers will do whatever they're programmed to do
( ) Nation-state attackers
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Coding errors
( ) Malware
( ) Banking has completely different security requirements from voting; when hacked the transaction is reversed at the bank's expense
( ) The online system you think is analogous is not
( ) The need to cast an anonymous vote on a smartphone, the least anonymous device ever invented
( ) The need to cast a secure vote on a system that has components built or coded by other nation-states
( ) The corporation you have outsourced your voting system to is malicious and/or incompetent
( ) The fact the voting machines (computers) will not be patched as new vulnerabilities are discovered
( ) Tendency of users to click on anything received by email
( ) Lack of technical expertise in individuals overseeing and running the election
( ) Power failure
( ) Denial of service
( ) USB keys
( ) Wifi / Bluetooth
( ) Inevitable technology obsolescence
( ) Encrypting the communication over the network doesn't matter when the client and server aren't secure
( ) Blockchain doesn't work the way you think it does, and even if it did, it wouldn't solve the problem you think it does

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Why should we have to trust you and your servers?
( ) Voting for your democratic representatives should require more thought and effort than ordering a pizza
Copyright © 2016 Richard Akerman
Licensed in the Creative Commons CC0 1.0 Universal Public Domain Dedication
Free to reuse and modify without attribution.
[permanent link] posted by rakerman : 4:17 pm (0) comments /
<- Older Posts - Newer Posts ->

This page is powered by Blogger. Isn't yours?