Glass Box Voting

I just voted on a Diebold AccuVote-TS (I will call them Diebold machines as long as they have Diebold branding all over them). Everything went very smoothly - I was greeted by friendly and knowledgeable elections workers, the touchscreen was calibrated, my vote was presented to me for review, I mashed on the “Cast Vote” button on the screen, and then… poof. Nothing. I had no tangible evidence that my vote was recorded according to my wishes.

VVPAT is voter verified paper audit trail. It means a piece of paper records your vote choice in parallel with the electronic record. Many experts recommend mandatory VVPAT in conjunction with audits that reconcile the paper with the electronic counts for a statistically meaningful sample of available data. I don’t know about the Maryland audit procedures, but since there’s no VVPAT, there’s nothing to audit.

In an earlier post I discuss security requirements for a voting system. Let’s just review how well they were met today.

Ballot Secrecy

This requirement is probably met adequately. I was given a smartcard to insert into the machine to initiate my voting system. It is possible that the device that put the voting token credentials on the smartcard may have recorded my identity, but it’s doubtful. Violating ballot secrecy permits vote buying and intimidation, but there are easier ways to manipulate an election than these “social engineering” approaches.

Vote Integrity

Who knows. Feldman, Halderman and Felten’s 2006 article on the Accuvote-TS states:

Analysis of the machine, in light of real election procedures, shows that it is vulnerable to extremely serious attacks. For example, an attacker who gets physical access to a machine or its removable memory card for as little as one minute could install malicious code; malicious code on a machine could steal votes undetectably, modifying all records, logs, and counters to be consistent with the fraudulent vote count it creates. An attacker could also create malicious code that spreads automatically and silently from machine to machine during normal election activities—a voting-machine virus. We have constructed working demonstrations of these attacks in our lab. Mitigating these threats will require changes to the voting machine’s hardware and software and the adoption of more rigorous election procedures.

Ed Felten has demonstrated that it is possible to access the memory card with a minibar key, by the way.

An attack that can modifies software can be applied anytime in the voting process. An attack that modifies logs can be applied any time after voting begins. How strong is the chain of custody from the point in which the machines were known to be in a secure state? How do I know that somebody with a minibar key and a malicious memory card hasn’t had sixty seconds of private time with the machine I voted on?

Mutual Suspicion

With no independent voter verification (such as VVPAT), I am required to trust the manufacturer and the elections administrators. I do not impute ill motives to any party, but the integrity of the voting process must not be contingent on trusting them.

[updated]

Of course why would anyone ever suspect the chain of custody.

This entry was posted on Tuesday, February 12th, 2008 at 11:26 am and is filed under Diebold, VVPAT, electronic voting, voting experiences. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.