The Risks of E-Voting Machines

1. The Risks of E-Voting Machines Dan S. Wallach Department of Computer Science Rice University

2. Clearly, voting machines matter • Failure of machines  failure of democracy • Potentially dire consequences

3. Many potential failure modes • Human-factors issues

4. Many potential failure modes • Mechanical flaws Bush Bush Gore Gore

5. What about e-voting? • Several different forms • Internet voting (used on many college campuses) • Computerized voting machines

6. Obvious benefits • Better human factors • Can check for “overvoting” • Can review for mistakes • Interfaces for blind users • It’s new • No antiquated machinery • Non-traditional election styles • Condorcet voting, approval voting, etc.

7. Obvious flaws • Indication to voter that vote is recorded? • No paper to drop in ballot box • No satisfying thunk from mechanical gears • Last-minute voter’s remorse? • Paper ballot: can tear up, get another one • Mechanical / electronic machines: “done” is done

8. How e-voting works • Inside the polling place (Hart architecture): network Base station Voting machine … Code Memory Code Memory Card

9. Buggy code? • Write bad data to all three memories? network Base station Voting machine … Code Memory Memory Code Memory Memory Card Card

10. But in Brazil… • Electronic voting since 1996 • Paper built-in for newest systems • Type number for your candidate • Screen shows picture • Paper held behind glass – verifiable, but not touchable

11. Threat models vs. real world • To a computer scientist • Add paper: remove code from the TCB • Paper seen by voter  voter-verifiable audit trail • Cost / complexity to defraud election increases • In the “real” world • Accessibility community hates paper • Vendors need standards • And still advocate security through obscurity • Municipalities required to upgrade machines by ‘04 • Security people seen as paranoid

12. Ongoing advocacy • David Dill’s petition • Lots of action happening in California • Vendors slowly changing their tune • “You require it, we’ll build it.” • Some congressional attention in Washington • Strongest detractors are accessibility advocates • Blind voters cannot read paper cards • You never know who will turn out to be clueless • League of Women Voters (national office)