Privacy in the Voting Booth

1. Privacy in the Voting Booth By: Chris Groves

2. Reason for Privacy • Voters worry that their vote may be held against them in the future • People shouldn’t be rewarded or punished for who they voted for • Voters don’t want to feel socially pressured to vote a particular way • Voters shouldn’t feel peer pressure at the voting booth

3. Issues • The system needs to have a physical paper trail incase the results come into question • Trail can be used to keep track of the order of votes • Must be sure that there is no record of the order that people voted ie. Video or paper

4. Non-Technical Measures • The physical paper trail has to have the records randomized before any person is able to physically touch it • No cameras may be permitted in the location or at entrance/exit to prevent any tracing back to database logs (if the person has video to link the time of the vote to the person then that’s a privacy issue)

5. Technical Issues • Recorded data needs to be heavily encrypted in the event that the physical storage medium is lost or stolen • Where do electronic votes get stored? • Local or Remote

6. Local Storage • Must be stored on physical storage • Need to collect all of the results to get the final tallies. • After the election all of the physical media must be collected to be stored securely so that nobody can access them

7. Central Server • Each voting terminal will transfer it’s votes to the central server via the Internet • Central server then maintains the totals • Still need physical paper trail created at the voting terminal

8. Privacy/Security Concerns • System sends messages over the internet and so they can be intercept and read along the way • Both the voting machines and the central server have to be exposed to the internet during the voting period to allow for traffic to be sent

9. IP Addresses • System would use static IP addresses • Server would filter traffic so that only accepts traffic that it knows are from the network of voting machines • Must be kept a closely guarded secret

10. IP Addresses Cont’d • If IP addresses became known traffic could be intercepted between voting machine and central server • Attacker could spoof the IP of a voting machine and send false votes • Would also leave the system open to DoS attacks

11. Trusted Connection • In this case we could use a public key system to ensure traffic is between voting terminal and the server. • Better option is to use a confidential key • All machines are known ahead of time so all can be given the key before hand • Saves the overhead of exchanging keys • Must be kept strictly confidential

12. Encryption • With these precautions packets need to be encrypted because they can be intercepted en route • Must be very high levels of encryption because the government has a great deal of computing power

13. Data to Store • Stored Information should be kept to a bare minimum to minimize possibility of linking vote to voter • For this system 3 parts shall be stored • Date – Needed in the case of a discrepancy and an audit of the results • Candidate • Identifier – Confirms that the vote came from a legitimate source

14. Identifier • Must be unique to each voter but cannot identify the voter from the ID • In Canada everyone has a Social Insurance Number to uniquely identify them. Can use that to generate our identifier • Can keep a database of generated IDs so that only people that have actually showed up to vote have IDs.

15. Generating the ID • We need a one way function • Could use a one way hash function • This would be computationally infeasible to get the voters Social Insurance Number from the ID • Use a hash function on the persons Social Insurance Number

16. Conclusion • For this system to work effectively it’s important that all parts work together • It’s particularly important that the Confidential Key and the list of IP Addresses be kept private • If they are confidential the technologies can ensure that the data is secure and that it can’t be linked back to an individual voter