Processing Votes by Mail

In his tweets (see my previous post), President Trump wrote “go to your Polling Place to see whether your Mail In Vote has been Tabulated (Counted). … If it has not been Counted, VOTE”

This reflects a common misunderstanding of the way vote by mail ballots are handled. There is a distinction between processing vote by mail ballots and counting the votes on them.

Processing a vote by mail ballot has two basic parts:

1. The voter signature on the envelope is validated, and that the voter has voted is recorded. This can start 29 days before the election ([1], §15101(a)).
2. The envelopes are opened, the ballots are removed and prepared to be counted, for example by being scanned. The ballots are not actually counted at this time. ([1], §15101(b)(1)).

Then, the votes are counted. These counts cannot be released until 8 p.m. on Election Day. ([1], §15101(b)(1), §15101(c)).

So when you go to a polling station, your vote will not have been counted yet, because it can't be counted until the polls close.

Reference

1. California Elections Code Division 15, Chapter 2. Vote by Mail Ballot Processing (2020). URL: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=ELEC&division=15.&title=&part=&chapter=2.&article=.

Don't Vote Twice

President Trump has been railing against voting by mail, claiming it is very easy to commit voter fraud with it. But he supports absentee voting, saying it is much safer. This is very confusing, as there is absolutely no difference in the way ballots from, voting by mail and voting absentee are handled. Indeed, in California, the Election Code used to say “The absentee ballot shall be available to any registered voter” ([1], §3003), and “After marking the ballot, the absentee voter shall … return the ballot by mail” ([1], §3017(a)) or in other ways. Now the Election Code says “The vote by mail ballot shall be available to any registered voter” ([2], §3003), and “After marking the ballot, the vote by mail voter shall … return the ballot by mail” ([2], §3017(a)). Note that the word “absentee” was simply replaced by the words “vote by mail.”

On Wednesday, September 2, President Trump suggested people who vote by mail should go to the polls on Election Day and see if their mailed-in ballot has been counted; if not, he said they should vote again to ensure their vote is counted [3,4]. He repeated this in a series of tweets (see below).

There is a huge problem President Trump didn’t mention — it is illegal in every state in the United States of America to vote twice. And this will be detected.

Here’s why. A “voting location” is a location under control of election officials, where you can cast a ballot. Every voting location has a list of voters who can vote at that voting location. This information is kept in a poll book. So, let’s say you voted by mail. There will be a notation in the poll book that you requested a vote-by-mail ballot. You will be told this; and if you insist on voting anyway, you will be given a provisional ballot. This is used when it is unclear whether a voter can vote, or can vote at that voting location. The ballot is a regular ballot, but it is put into an envelope, which in turn is put into another envelope, and the name of the voter and the reason why they voted provisionally are written directly on the outer envelope. The envelope is then put into the ballot box.

When the votes are counted, the provisional ballots are counted separately. Before a provisional ballot is counted, election judges look at the name and reason, and determine if the vote should be counted. If the voter has already voted by mail, and the ballot received, the judges will disallow the provisional ballot. Otherwise, the provisional ballot will be counted, and when the mail-in ballot arrives, it will not be.

Now, if you did as President Trump suggests, the election officials will know you tried to vote twice, once by mail and once in person because your name will be on the envelope in which you returned the vote by mail ballot and on the envelope of the provisional ballot . You can expect this being reported to the local prosecutors, who take this sort of thing very seriously (see [5], the Ohio cases of McMillan and Richardson, for example).

Rather than risk arrest, if you are concerned enough about your ballot being delivered on time by the Postal Service to do as President Trump suggests, just don’t mail your ballot. Instead, if your jurisdiction allows, take it to the voting location and, rather than voting there, hand it to a poll worker. Most jurisdictions have other locations where you can safely drop off ballots, such as drop boxes or the elections office. It's just as effective as voting in person, and has the side benefit of being perfectly legal.

One other note. Many of us (including me) have been testing voting systems for 20 years or more. We never do any kind of testing during an election because of the risk of corrupting votes and committing an illegal act. So President Trump’s statement that this is a good way to test election security is advice that no professional tester would ever follow.

References

1. California Elections Code Chapter 1. Absentee Application and Voting Procedures. (2005). URL: https://law.justia.com/codes/california/2005/elec/3000-3024.html.
2. California Elections Code Division 3. Vote by Mail Voting, New Resident, and New Citizen Voting (2020). URL: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=ELEC&division=3.&title=&part=&chapter=1.&article=.
3. M. Haberman and S. Saul, “Trump Encourages People in North Carolina to Vote Twice, Which Is Illegal,” The New York Times (Sep. 2, 2020); URL: https://www.nytimes.com/2020/09/02/us/politics/trump-people-vote-twice.html.
4. J. Oliphant, “Trump Encourages Supporters to Try to Vote Twice, Sparking Uproar,” U.S. News and World Report (Sep. 3, 2020); URL: https://www.usnews.com/news/top-news/articles/2020-09-03/trump-says-north-carolina-voters-should-vote-twice-once-by-mail-once-in-person.
5. “A Sampling of Election Fraud Cases from Across the Country,” The Heritage Foundation, Washington, DC, USA. URL: https://www.whitehouse.gov/sites/whitehouse.gov/files/docs/pacei-voterfraudcases.pdf.

Computer Security: Art and Science, Second Edition

The second edition of my book “Computer Security: Art and Science” is scheduled to be published on November 30 (this Thursday!).

My web page for the book is http://nob.cs.ucdavis.edu/book/book-aands2/index.html.

The publisher’s is https://www.informit.com/store/computer-security-art-and-science-9780321712332.

What a long, interesting trip it’s been (to paraphrase the Grateful Dead) …

Special! Black Friday Sale!

The publisher has a pre-order special. Until November 26, you can get 35% off on 1, and 55% off for 2 or more using code BF2018 at http://informit.com/blackfriday.

About Those Post-Election Audits ...

After the election, efforts to recount votes in Michigan and Pennsylvania were denied on the grounds there is no evidence that the electronic voting systems were hacked, the basis of the request. Independent of this, in light of evidence uncovered by the U.S. intelligence agencies involving Russia’s hacking of election-related systems, questions about the integrity of the election have been raised.

To my mind, the concern about attackers compromising election systems is important but not entirely on the mark. Questioning the integrity of the election does not require suspicion of attackers compromising the electronic voting systems. The poor quality of the software on these voting systems is sufficient to raise concerns. We have multiple analyses showing this. I don’t understand why the lawsuits did not emphasize this.

A claim that electronic voting system software is so poor that the results of the election could be incorrect requires some substantiation. Here are three specific, documented problems that could cause the results of an election to be compromised. I was on the teams that found these.

1. Failure to install security updates. These updates fix vulnerabilities that attackers can exploit to take over the computer. They may delete or alter information. Clearly this can alter the results of an election.In 2004, Maryland commissioned a study of the Diebold AccuVote-TS systems it would be using in the next election. The study, conducted by RABA Technologies, “identified fifteen additional Microsoft patches that have not been installed on the servers. In addition, the servers lack additional measures (all considered best practice) for defense such as the use of firewall antivirus programs as well as the application of least privilege, i.e. turning off the services that are unused or not needed.” [1, p. 21]. The team used one of these unpatched vulnerabilities to gain complete control of the vote-counting system in under 30 minutes.
2. Failure to check for integer overflow. When computers count, they cannot handle numbers that are too big. As a simple example, consider a type of computer called a “16 bit system”. Such a computer can represent the numbers 0 to 65,535 inclusive, but no others. If you add 1 to 65,535, the result will “wrap around” to be 0. Checking for this is crucial in an electronic voting system to avoid errors. In 2006, the California Voting Systems Technology Assessment Advisory Board analyzed the Diebold AccuVote Optical Scanner (version 1.96.6). The analysis team found that “the AV-OS source code has numerous places where it manipulates vote counters as 16-bit values without first checking them for overflow, so that if more than 65,535 votes are cast, then the vote counters will wrap around and start counting up from 0 again” [2, p. 18]. The source code did not accept more than 65,535 ballots, but if the vote counter started at any non-zero number (for example, 1), overflow could occur.
   Similarly, the report on the analysis of the ES&S iVotronic electronic voting system (version 8.0.1.2) says the “software also contained array out-of-bounds errors, integer overflow vulnerabilities, and other security holes” [3, p. 57].
3. Incorrect handling of error conditions. A mark of good programming is that, when something goes wrong, the program logs the error and takes action to minimize the impact of the error. The occurrence of the error should be clearly identified and not create problems beyond those immediately resulting from the failure.

In the analysis of the ES&S iVotronic electronic voting system (version 8.0.1.2), a team of forensic analysts identified a problem of this type. These systems have two types of Personal Electronic Ballots, a Voter PEB and a Supervisor PEB. When a voter is to vote, a Voter PEB is inserted into the iVotronic to set it up for that voter. The PEB is then removed and the voter votes. If the iVotronic has a particular configuration, the software then queries the PEB to get its serial number — and, as the PEB has been removed, the software records the serial number as 0, rather than that off the PEB actually used. As a result, the voter’s votes are recorded correctly, but the PEB’s serial number is recorded incorrectly as 0. The log shows a successful vote with a PEB having serial number 0, which is not possible and raises the question of whether the voter’s votes were recorded correctly. But the problem is not recording votes; the problem is simply recording a serial number. [3, §6.2.1.2]

All of these relate to security because the analyses were done in the context of examining the security of the systems. All arise from poor programming.

The point is that, without a thorough analysis of the current software, we must assume the software has many problems with robustness. Thus it is not necessary to claim that an attack may have occurred to assert the results are suspect; the evidence from the software that has been analyzed gives one ample reason to assert the results are suspect.

The RABA report and the VSTAAB reports sum this situation up:

“True security can only come via established security models, trust models, and software engineering processes that follow these models; we feel that a pervasive code rewrite would be necessary to instantiate the level of best practice security necessary to eliminate the risks we have outlined in the previous sections.” [1, p. 23]

“This is a good example of the need for defensive programming. If code had been written to check for wrap-around immediately before every arithmetic operation on any vote counter, Hursti’s technique of loading the vote counter with a large number just less than 65536 would not have worked.” [2, p. 18]

So, what can (and should) be done? That depends on the requirements of an election. In the United States, everyone agrees on at least three of these:

1. Accuracy: the final tallies should reflect the votes that the voters intended to cast.
2. Anonymity of the ballot: No one should be able to link a ballot to an individual.
3. Secrecy of the ballot: No one should be able to prove to another how he or she voted.

If we are to use computers to record, tally, and report the votes, we need software that is robust, reliable, easy for voters to cast their votes on, and easy for the operators to operate. Note that the casting of votes may not involve a computer. The voter may mark a paper ballot, and then the ballot scanned. The scanning, and resulting electronic representation of the ballot, would then be used by computers.

A fourth requirement that is rarely stated explicitly, but is implicit, is that of transparency. This requirement basically says that the process of the election must be public, and that a voter can observe the entire election process, except for watching an individual voter marking his or her votes. An implication of this is credibility — the election must not only meet its requirements, but it must also be seen to meet the requirements. And here’s the rub.

When we say “transparency”, transparent to whom? Voters? Election officials? The vendors of electronic voting equipment? Computer scientists? Politicians? The public at large? The answer to this question will control many facets of the election process that affect its credibility. The reason is the use of computers.

Contrast how voting occurs on paper with that on an electronic voting machine (sometimes called a “Direct Recording Electronic”, or DRE, machine). The observer, standing in the polling station, can watch the voter being handed a ballot, going into a voting booth, coming out of the booth with the ballot in hand, and then inserting it into the ballot box. The observer knows that the voter’s votes were recorded on the ballot, and the ballot is in the box that will be carried to Election Central (if she has any doubt, she can follow the ballot box to Election Central). With a DRE, the observer can watch the voter being given the access code to use the DRE, the voter going to that DRE, and the voter leaving the DRE. But she cannot see the ballot being put into a transport mechanism that will be taken to Election Central. She can certainly see the flash cards or the voting system being taken to Election Central; but she cannot tell whether the ballot records what the voter thinks it records, or even if the ballot is there. She must trust the software. This is why robust, well-written software is so critical to the election process. A similar consideration applies to the counting of the ballots at Election Central.

Paper trails that show the votes cast (called “Voter-Verified Paper Trails” or VVPATs) are not sufficient for two reasons. First, VVPATs are not used for counting. They are used to validate results of the voting systems when required. This occurs during the canvass or when a recount is conducted. Thus, the VVPATs and the electronic results are rarely compared. Second, there is evidence that most voters do not review the VVPAT before they cast their vote, so there is no way to know whether the votes recorded on the VVPAT are the votes that the voter intended to cast. So while VVPATs help if voters check them, they still do not add transparency because they are not used to do the initial counting.

If the target of the transparency trusts the electronic voting equipment, then the above process is transparent. If one does not, then the entire system must be available to those for whom the transparency is intended. It certainly is for the vendors; but what about others? In the past, it has also been made available for analysis to specific individuals when the state mandated that those individuals have access (usually because of some problem, or for testing). But this access required that a non-disclosure agreement, or something similar, be signed. The electronic voting equipment was not available to others, like voters.

So, if the election process is to be transparent to voters, all of the electronic voting equipment used in that process must be accessible to voters. The voters can then inspect the hardware, software, and all other components to assure themselves (to whatever degree of assurance they desire) that the requirements are met.

This includes the software that runs the equipment. It does not matter who creates the software so long as it is “open source”, i.e. available to anyone who wants to see it. But that is not enough. It is possible to corrupt hardware, or ancillary components such as scanners or keyboards, and the voters must be able to assure themselves that this will not happen (again, to whatever degree of assurance they require), so that too must be open source, and the manner in which everything is assembled to create the systems used in the election process be public and precise enough so others can verify it. Note voters may need to work with specialists to make this determination. The point is, they can do so, and choose the specialists they trust rather than rely on specialists selected by others.

By the way, the term “open source”, as used in the technical community, has many meanings. All uses require that the source code be available to anyone who wants it. The differences lie in the way that software can be used. For example, must changes to open source software be open source? Under a license called the GPL, yes; under a license called the BSD license, no. This distinction is irrelevant for transparency, and hence for our purposes. What matters is the software used during the election process can be examined by disinterested parties.

Elections are the cornerstone of our republic. All aspects of the process by which they are conducted should be open to those most affected by it, the voters. Currently, it is not, as the software involved in elections is closed source, and the details of the electronic voting systems (and the systems themselves) are not available for public scrutiny. I hope in the future this changes, so that questions about the voting systems raised in the last 4 presidential elections can be settled and, ideally, avoided.

Acknowledgement.Thanks to Candice Hoke for pointing out that the legal cases involved attacks on the electronic voting systems, and not that they might produce incorrect results due to other problems.

References.

1. RABA Innovative Solution Cell, “Trusted Agent Report Diebold AccuVote-TS Voting System”, RABA Technologies LLC, Columbia, MD 21045 (Jan. 2004). Available at http://nob.cs.ucdavis.edu/~bishop/notes/2004-RABA/index.html
2. D. Wagner, D. Jefferson, M. Bishop, C. Karlof, and N. Sastry, “Security Analysis of the Diebold AccuBasic Interpreter”, Technical Report, Voting Systems Technology Assessment Advisory Board, Office of the Secretary of State of California, Sacramento, CA 95814 (Feb. 2006). Available at http://nob.cs.ucdavis.edu/~bishop/notes/2006-inter/index.html
3. A. Yasinsac, D. Wagner, M. Bishop, T. Baker, B. de Medeiros, G. Tyson, M. Shamos, and M. Burmester, “Software Review and Security Analysis of the ES&S iVotronic 8.0.1.2 Voting Machine Firmware”, Security and Assurance in Information Technology Laboratory, Florida State University, Tallahassee, FL (Feb. 2007). Available at http://nob.cs.ucdavis.edu/~bishop/notes/2007-fsusait-1/index.html

Some Thoughts on the Recent Election

To all who are upset at the results of the Presidential election, remember this, from Lord of the Rings by JRR Tolkien:

“I wish it need not have happened in my time,” said Frodo.

“So do I,” said Gandalf, “and so do all who live to see such times. But that is not for them to decide. All we have to decide is what to do with the time that is given us.”

And to those upset with the failure of California’s Proposition 62 (to eliminate the death penalty in the state), more from Lord of the Rings about Gollum:

“No, and I don’t want to,” said Frodo. “I can’t understand you. Do you mean to say that you, and the Elves, have let him live on after all those horrible deeds? Now at any rate he is as bad as an Orc, and just an enemy. He deserves death.”

“Deserves it! I daresay he does. Many that live deserve death. And some that die deserve life. Can you give it to them? Then do not be too eager to deal out death in judgement. For even the very wise cannot see all ends.”

Peace.

Oh, Those Presidential Debates!

I didn’t see either the first presidential debate, but I did see the second and third. I also saw several of the debates for the primaries.

I’d love to see the debates restructured so all candidates sat in soundproof booths that are clear so the audience can see them. They would be wired for sound so the candidates could hear one another and the moderator. Each booth would have a microphone. The microphones would be off unless the candidates was supposed to be speaking, for example to answer a question from a moderator or the audience. So if one candidates were answering, the others could not interrupt.

I think that would make the debates much saner — one candidate could not talk over the other or snipe at them until their turn.

And at least it would make the debates easier to follow!

Customers as Shareholders

Here’s an idea for improving customer service.

The goal of American, and other, companies is to keep their stockholders happy. Paying executives large bonuses, automating as many aspects of their work as possible, and outsourcing functions are all attempts to increase the revenue that stockholders receive. Customer service is simply one of these functions. As long as the customers come, it does not matter how poor customer service is. When customers cease to come, then the company will try to improve its customer service.

This is particularly pernicious when few vendors supply a needed service. Consider air travel. Currently, three airlines — American, Delta, and United — dominate the U.S. airline market All treat the customers as revenue generators, not human beings. The width of seats has shrunk to the point where some people cannot fly coach for medical reasons; the pricing structure of tickets is incomprehensible; and the customer bears the brunt of any problems. Witness United’s and Delta’s recent computer breakdowns. The result: customers could rebook without charge (the airlines emphasized the latter). Now, if a customer misses a meeting because the flight is delayed, the airline does not provide any compensation. Rather one-sided — and the customer can rarely move his business to another airline, because all of the airlines operate the same way. The customer produces money. Complaints? Doesn’t affect their shareholders, so they won’t do anything.

Improving customer service requires an incentive. The bottom line is keeping stockholders happy, and this usually (but not always) involves profits. If profits fall, the money stockholders make falls, and they will become discontent — and possibly change company management, or dump their stock, causing the price of the stock to drop, thereby hurting the company’s financial position. If profits fall, companies will try to find the cause and correct it. So, tie customer service to stockholder satisfaction. The belief that improving customer service improves revenue, and therefore stockholder satisfaction, simply is not working, especially when the company is a monopoly or near-monopoly. This suggests making the tie more direct.

Here’s the idea: make the customer a shareholder. For example, when I fly on (say) Delta, I receive a share of Delta’s voting stock. If I fly often, I get more stock; indeed, this could be handled like a “frequent flier” (loyalty) program. Now, I have a direct voice in the overall management of the company because I can vote my stock at a shareholder’s meeting. Further, I can band together with others of like mind to make our stock be a larger block and hence increase the strength of our voices.

Now as a shareholder, the company will want to keep me happy; and it can do so not just by revenue, but also by making my flights more comfortable. And to do so it will have to reverse the trend of poor customer service.

Certification, Software, and People

I recently sat through an excellent talk in which the speaker reported on a Gartner meeting in which the software industry captains said their biggest problem was finding people who know how to write secure, robust code. He then said that academia had to start producing these programmers.

In the Q&A period, I pointed out that people who practice “secure coding” (really, low assurance programming, as opposed to no assurance programming!) and forms of much higher assurance programming require more enterprise resources and time to develop, implement, test, and document their software than most employers are currently providing their programmers. My question was how to persuade corporate managers and executives to understand and be willing to provide (and pay for) the additional resources, and allow the additional time, to enable the developers to produce high-quality software.

The speaker’s reaction was interesting. He agreed that this was a problem, but one that could be solved by requiring software to be certified. He said that now if a programmer refuses to deliver software until he or she could ensure it was robust (secure), they would probably be fired for not meeting deadlines. But if software industry practices were modified to require software certification, and gave the programmer the duty to certify the software met some standard, the programmer could (and presumably would) refuse to sign the certification. Then the managers could not fire the programmer without giving up the signature. The company could not market the software without the certification. He drew an analogy with lawyers and the legal profession. Lawyers are certified, and the profession disciplined miscreants. He thought that the same should be done for software developers and programmers.

Let’s split his answer into two parts. The first part is that software products should be certified before being marketed; the second, that software engineers and those involved in the development of software should also be certified. Both are more complex than they seem.

First, consider the idea of certifying something as secure. What exactly does “secure” mean here? The definition of “secure” requires a security policy against which the software’s security can be defined and, ideally, measured. But security is not just a property of the software. It is a property of the software, the environment, and the installation, operation, and maintenance. If any of these cause the software not to satisfy the security policy, then the software is not secure. So any certification will need to specify not only the security policy, but also the environment and other aspects of where and how it is to be used. And even then, there will be problems.

A good example is the certification process that was used in the United States for electronic voting machines. There, both software and hardware had to be certified to meet specific requirements, usually from a set of standards promulgated by the U. S. Election Assistance Commission. But the original standards did not take into account the processes and environments in which the machines were to be used. As a consequence, the certifications would have been inadequate even if the testing labs had thoroughly tested both the hardware and software — and, unfortunately, the quality of at least one lab was so poor it was closed.

Neglecting the processes and environment leads us to another problem — who does (or should do) the assessment for the certification? Presumably, a set of independent laboratories vaguely similar to the Underwriters Laboratories for electrical elements would be authorized to do this. Unless theses labs co-operate, however, the scenario that developed with electronic voting systems may arise. In that scenario, the vendor paid for the evaluation by the lab. If the system failed the testing, the vendor would be told how it failed and could then fix it and resubmit it for certification. But then the vendor could request a different lab to recertify it; the vendor need not return to the original lab. Thus a vendor could seek a lab that gave more frequent favorable reviews, and concentrate its certification requests there. This would give the labs financial and business incentives to find systems meet the requirements, in order to improve their chances of gaining repeat business from the vendor. Various approaches can ameliorate this situation, but ultimately laws and regulations would control the methods chosen, and their effectiveness depends on what they say and how they are enforced. The result could well be like the electronic voting system certifications — a certification system that is far from robust.

Next, let’s look at the recommendation to certify programmers and software developers. To what standard or standards should these individuals be held? Should those standards be a function of what they are developing (such as an operating system, a mobile phone app, or a text editor)? A function of what tools they use to build it (such as a particular development environment such as Eclipse)? A function of the environment to which the system is to be deployed? Or some combination of these factors? For example, would the certification be general (for virtually any system or set of tools, or for both) or specific (for writing programs in the programming language XYZZY for the PLUGH operating system, using the Magic Source Code Scanner)? If a program or system fails in the field, is the programmer liable? And if a programmer is certified to work in a specific environment, with specific operational and maintenance requirements, how would one ensure those requirements and environment were maintained? How will those requirements be changed, and how will programmers ensure their certification continues to meet those changed requirements?

Complicating this is the fact that programmers rarely work alone; they usually are employed by a company, and work in teams. In particular, companies will not want to increase the cost of the systems they deliver, nor the time to delivery, because customers will not be willing to pay more, or wait longer, for the systems they want. So if liability is tied to the programmer(s), the company has no financial incentive to give the programmer(s) the resources and time they need to develop the secure systems. The only consequence to the company would be that programmers and developers would likely migrate to companies that provided the needed resources and support. However, if the software had to be certified before it could be marketed, then the company would have an incentive — it would need to have programmers who could certify the software, and presumably those programmers themselves would need to be certified.

Given that programmers work for a company and work in teams, how would one determine the programmer(s) responsible for the software, so necessary discipline could be applied? Particularly in these days of global outsourcing, when much of the hardware and software upon which we depend is created overseas, how would the U.S. ensure that those programmers or the companies that employ them (over whom the U.S. has no jurisdiction) meet certification standards? How would legacy software, which was written before certification of developers and software were instituted, be dealt with?

Certifying developers and giving them the responsibility of certifying software also ignores the question of why the developers are held responsible for what are, essentially, marketing decisions over which the company executives have control. As anyone who has worked in the software industry knows, plans for software development, including timetables and testing protocols, are often not under the control of the developers. The practice has long been to move quickly to market, and then patch software problems as they arise, rather than invest from the start in secure and robust coding practices.

All these questions and complications would need to be resolved before a credible certification system is put into place. Otherwise, the mess we are in with respect to software will only get worse. I would love to hear someone discuss these problems in more depth, and ideally come up with a way to resolve them.

And once that happens, then I am optimistic that certification will indeed improve the quality of software and systems!

Acknowledgements: Thanks to Holly Bishop and S. Candice Hoke for their valuable comments.

Two Thoughts on Government-Required “Back Doors”

I finally finished reading the report about giving the government access to communications [1]. It parallels an earlier report [2] discussing the same thing, but the revelations of Snowdon and he F.B.I. director’s reaction warranted a reiteration, and a stronger one. It is an excellent report, one I encourage everyone to read.

I have a suggestion for strengthening the report, and a comment about the government’s reaction to it.

First, the suggestion. The report makes the point that Sir Arthur Conan Doyle made so many years ago (“What one man can invent another can discover” [3]), but much more prosaically. It says that attackers who want to compromise the communication will find and exploit the backdoor added at government insistence. This is quite correct, and a strong argument against adding such backdoors.

But let’s take it a step further. Suppose an attacker has begun reading messages between two medical institutions (for example). She realizes that the F.B.I. will undoubtedly be interested in what she is doing, and wants to find out how much they know. As the law requires all communications equipment to have backdoors built in, and she has found the backdoor (in order to monitor the electronic medical records in the messages going between the two medical institutions). She exploits that knowledge and monitors the F.B.I.’s communications. She finds out she is indeed being tracked, and now can see how far the F.B.I. has gone in discovering what she is doing and who she is.

Lest this seem fanciful, it has happened. In “The Athens Affair” [4], Prevelakis and Spinellis write “the hackers broke into a telephone network and subverted its built-in wiretapping features for their own purposes.” The lawful (under Greek law) wiretapping capability enabled the attackers to tap the cell phones of the Greek prime minister, the defense and foreign affairs ministers, and — note this — law enforcement officials.

The obvious solution is to give government agencies communications equipment that does not have backdoors while requiring everyone else to use equipment with backdoors. But this raises two immediate problems.

First, if such equipment is manufactured, it will become available to others not authorized to have it — through pilferage if nothing else, or from equipment made abroad. Foreign manufacturers are highly unlikely to go along with the backdoor requirement — and if they do, how does the U.S. government know that only they can use the backdoor? Much of our software and hardware is manufactured abroad, using components manufactured in places like China. What is to stop a foreign government from requiring the vendor to add a backdoor to the backdoor to allow them in? This is called the supply chain problem, and is essentially a type of the insider problem, one of the most difficult problems in computer and information security.

Second, if it is possible to make exceptions, various people and organizations will lobby for those exemptions. As an example, an obvious exception would be for the U.S. financial industry (banks, brokerage houses, the Federal Reserve, and so forth), which would be reluctant to use equipment with backdoors built in, as confidentiality and integrity are absolutely critical to their clients trusting them. Once exceptions are made, the number of exceptions will grow, as will the groups to whom those exceptions are applied. And the folks the government will want to monitor most will be the ones most likely to use those organizations granted exceptions. Terrorists, for example, will move money around the financial system.

So by adding backdoors, the government renders itself as vulnerable as everyone else, thus defeating its purpose. Angela Rojas’ comment seems appropriate, as it summarizes the dilemma very succinctly: “But, darling, the spies were spying on the spies who were spying on the spies!”

The report should have made this point explicitly.

My comment about the government’s reaction to the report refers to Mr. Comey’s testimony that technologists are smart enough to find a way to put in a backdoor that only law enforcement can use:

Technical people will say it’s too hard. My reaction to that is: Really? Too hard? Too hard for the people we have in this country to figure something out? I’m not that pessimistic. [5,6]

But Mr. Comey is not a technologist, so how would he know? In fact, there are some problems that can be proved unsolvable. Perhaps the question he should be asking is whether our law enforcement agents are smart enough to be able to solve crimes without these backdoors. Certainly they have done so in the past. Mr. Comey’s comment bothers me, because as a top U.S. government official, he should have more faith in U.S. security agencies and law enforcement personnel — and if he does not, his focus should be on strengthening those agencies, and hiring and training people, rather than weakening everything else.

Note: I am one of the signers of the letter [7] that Mr. Comey refers to in his speech on cybersecurity to the Third Annual Cybersecurity Law Institute, from which the above quote comes.

References

1. H. Abelson, R. Anderson, S. Bellovin, J. Benaloh, M. Blaze, W. Diffie, J. Gilmore, M. Green, S. Landau, P. Neumann, R. Rivest, J Schiller, B. Schneier, M. Specter, and D. Weitzner, “Keys Under Doormats: Mandating Insecurity by Requiring Government Access to All Data and Communications,” Technical Report MIT-CSAIL-TR-2015-026, Massachusetts Institute of Technology, Cambridge, MA, USA (July 2015).    url: http://hdl.handle.net/1721.1/97690
2. B. Adida, C. Anderson, A. Antón, M. Blaze, R. Dingledine, E. Felten, M. Green, J. Halderman, D. Jefferson, C. Jennings, S. Landau, N. Mitter, P. Neumann, E. Rescorla, F. Schneider, B. Schneier, H. Shacham, M. Sherr, D. Wagner, and P. Zimmermann, CALEA II: Risks of Wiretap Modifications to Endpoints, Center for Democracy and Technology (May 2013).    url: https://www.cdt.org/files/pdfs/CALEAII-techreport.pdf
3. Sir Arthur Conan Doyle, “The Adventure of the Dancing Men,” The Return of Sherlock Holmes, Dover Publications, Mineola, NY, USA (2010). isbn: 978-0486478739
4. V. Prevelakis and D. Spinellis, “The Athens Affair,” IEEE Spectrum 44(6) pp. 26–33 (July 2007).    doi: 10.1109/MSPEC.2007.376605
5. J. Comey, Comments at the Third Annual Cybersecurity Law Institute, Georgetown University Law Center, Washington DC, USA (May 2015).    url: https://www.justsecurity.org/23120/transcript-comey-authors-encryption-letter-uninformed-fair-minded/
6. J. Comey, “FBI Director James Comey Cybersecurity Challenges,” video of [5] (quoted comment at 18:03–18:13).     url: http://www.c-span.org/video/?326168-1/fbi-director-james-comey-cybersecurity-challenges
7. Letter to President Obama (May 19, 2015).    url: https://static.newamerica.org/attachments/3138--113/Encryption_Letter_to_Obama_final_051915.pdf
   

The Fourth Amendment to the Constitution and California Senate Bill SB-828

The 4th Amendment to the United States Constitution says:

“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

California Senate Bill SB-828, “The 4th Amendment Protection Act”, proposes to ban any California government institution, political subdivision, or employee of the state acting in an official capacity from supporting any federal agency that “claims the power … to collect electronic data or metadata of any person” in a way that violates the 4th Amendment.

Like any law, this bill has good points and bad points. Section 7599.5(d) bars the use of any such information in a “criminal investigation or prosecution”, even if the information was obtained by a corporation. That currently is not banned, and adding something like that into the law is a good idea — a very good idea.

Unfortunately, the rest of the bill misses the point, and that far outweighs the good part. The bill should be defeated. Here’s why.

First, the authors of the bill object to the gathering and use of “electronic data or metadata” in violation of the 4th Amendment. But there is no objection to non-electronic data or metadata. Why not? It seems to me the threat is not just electronic; it also includes physical data and metadata such as notations in a paper log, or stopping and searching cars without cause. However, the bill doesn’t object to that.

Along those lines, the bill objects to “material support, participation, or assistance” to any federal agency that claims the above-mentioned power. But if a California county, city, or other agency claims the power, the bill is silent about providing material support, participation, and assistance to that agency. This seems hypocritical at best — it’s disallowed if the feds do it, but it’s fine if the state does.

The bill also is aimed at the wrong people — it targets Californians rather than federal agencies (and, presumably, their employees acting on behalf of the agencies). It’s rather like targeting the homeowner because the burglar was able to break into the house and steal things; the target should be the burglar, who committed the crime, and not the homeowner, who may have “materially assisted” the burglar by not properly locking up the house before running to the store. A better approach would be to make the federal agencies involved accountable in some way, or have the agents of that agency arrested for violating the rights of the citizens of California.

Also, the bill is speculative. It focuses on “any federal agency that claims the power to authorize …”. The problem, of course, is that the 4th Amendment is in the Constitution, and therefore any agency “claiming the power” is claiming it is above the law. So if the federal agency does not “claim the power”, do the restrictions in the bill apply? This is important, because I know of no group that claims the power to violate the law with impunity.

If the goal is to disallow the state, its subdivisions, agencies, or its employees from aiding federal agencies in violations of the 4th Amendment, why not just say so directly? It seems to me that language like “to aid a federal agency in the collection of electronic data or metadata …” would achieve this end.

Next, what is “material support, participation, or assistance”? Does supplying power or water to California buildings containing offices of such agencies qualify? How about providing medical transport for injured employees? If the bill said “material support, participation, or assistance to aid a federal agency in the collection of electronic data or metadata …”, then the restriction is clear: if the agency is collecting the electronic data or metadata in violation of the 4th Amendment, they can’t get help doing so from the California government. But the bill doesn’t say that.

Section 7599.5(b) begins: “[u]tilize any assets or public funds, in whole or in part, to engage in any activity that aids a federal agency, federal agent, or corporation while providing services to the federal government …” If I make a telephone call to a federal agency to request a proposed public standard, does my use of a state telephone mean I violate the act? Is that an “activity” that aids them in some unknown way? The vagueness here is frightening.

Similar remarks apply to Section 7599.5(c), which deals with providing services. How generally is the term “services” defined, and exactly when is the provision of services banned? It seems to me that basic life and medical services fall into this category.

And ultimately, the bill does not say who decides whether a “federal agency … claims the power, by virtue of any federal law, rule, regulation, or order, to collect electronic data or metadata of any person” in a way that violates the 4th Amendment. Must the agency announce it? Does a judge decide? The California state legislature? This is critical, because interpretations of what “violates” the 4th Amendment differ. For example, if an agency obtains a warrant, does a search, and later a federal judge tosses the warrant out as violating the 4th Amendment rights of the subject of the search, does that mean those California employees who provided “material support, participation, or assistance in any form”, or used “assets or public funds”, or provided “services” to that federal agency go to jail for violating the law?

I admire and laud the spirit of the bill — violations of people’s right “to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures” need to be stopped. But this bill isn’t the way to do it.

Save the Davis Flora!

The campaign against Measure P has reached the heights of absurdity. The advocates of the new water rates are saying that homeowners need to stop watering their lawns; indeed, they advocate killing the grass and many types of trees if they require too much water. As someone said, “[p]eople at some point have to accept that their world is changing.”

This criminally neglectful treatment of flora has to stop. Trees, grass, and flowers didn't cause the lack of water that Davis apparently suffers from. People did. Yet we are to punish the innocent flora for the sins of humans? This is outrageous!

Let’s start taking responsibility for our actions. If people caused the need to conserve water, let people bear the brunt of conservation. Continue to feed the flora with water so they can survive, nay thrive, and be happy as they convert carbon dioxide to the pure oxygen that we all breathe. Let humans take the hit. Stop taking showers and baths — those send lots of water down the drain. Stop washing clothes; the pollutants in your soaps mean the water you use cannot be recycled, and so is wasted. Stop washing your cars and drive with dirty windows — that will save even more water. Drink fruit juice instead of the Davis water — apparently it’s better for you, given the claimed impurities of the Davis water, and it leaves the water for the plants, who will happily absorb it.

Let’s take responsibility for the problems we create, and deal with them ourselves, without starving the poor plants upon whom our lives depend!

On Features, Bugs, and Trapdoors

John Stewart of Cisco posted a very interesting blog entry discussing the differences among features, bugs, and backdoors. He categorizes them by intent (features and backdoors are intentional, whereas bugs are not) and transparency (features are disclosed to customers “at the start”, bugs are disclosed after being identified, and backdoors are not disclosed). This raises an interesting point about third parties.

Suppose a company builds a product using supplies obtained from a third party (the “supplier”). That supplier inserts something into the software (or hardware) allowing them access to the computer on which it is used. This is a backdoor to that supplier. But how would we classify it, using John’s categories?

In this case, the company and their customer are in effect both “customers” of the supplier. But the company is an intermediary, which makes it both customer and company in the sense that John is talking about. So, the supplier might disclose a feature of its product to the company, which may not disclose that feature to the customer (perhaps it is not something that the customer needs to know, or the company thinks it unimportant). What is it — a feature, bug, or backdoor?

In this case, I think you need to have two answers: one for the supplier to company relationship (in which the company plays the role of customer) and one for the company to customer relationship. Unfortunately, the ultimate customer must rely on the company to protect him or her. And the company must rely on the supplier to protect it, and its customers.

What makes this really tricky is when the “third party” is neither the supplier nor the company and does not disclose the change to anyone. If someone else (the “interceptor”) changes the product on its way to the company (or from the company on the way to the customer), then the change is completely unintentional on the supplier’s or company’s part, but quite intentional on the third party’s part. So, which is it — a feature, bug, or backdoor?

This is most likely not an academic question, as some government agencies have been accused of doing this. The current accusation making headlines is that the U.S. National Security Agency can do this).

Probably the simplest way to handle this is to look at these terms from the point of view of the customer. In this case, the interceptor’s addition is not a feature (as it is not transparent to the end customer), nor is it a bug (as some entity made the change quite intentionally). So it is a backdoor. But this analysis is unfair to the supplier and the company, as they did nothing intentionally. So again, to them too, it is a backdoor, and they are as much victims as the customer.

1982 E-Voting Systems in Science Fiction

I was reading a science fiction book, “The Stainless Steel Rat for President”, by Harry Harrison [1], and came across a passage that I found interesting and, given that the book was written in 1982, surprising.

An opposition candidate has discovered that there was fraud in an election, which was conducted on computers. He quotes from the planet’s constitution [2]:

Due to the nature of electronic voting and due to the necessity of assuring that the voting is always recorded with utmost accuracy and due to the invisibility of the votes once they have been recorded in the voting machine, ...

I found that a remarkably perceptive, and also a very succinct, statement of a key problem with computerized voting systems. To me, that this statement was made in a book that appeared in 1982, makes it even more remarkable.

By the way, the passage goes on to say that if it is proven beyond doubt that the record of votes in a single voting machine is altered, then the election is null and void, and a new one must be conducted using paper and ballot boxes, and no subsequent election can use the computerized voting machines until the newly-elected President has them investigated.

References

1. Harry Harrison, The Stainless Steel Rat for President, Bantam Books, New York, NY, USA (1982).
   
2. ibid., p. 166
   

Jeffrey Hunker: A Personal Memory

My friend and colleague, Jeffrey Hunker, passed away Friday. This was unexpected, and stunning.

Jeffrey in a dark shirt at NSPW 2009, in Oxford, England.
What follows is not an obituary; others can write about the minutiae of his life, and of his many accomplishments, better than I. These are simply some of my memories.

I met Jeffrey some time in the 1990s, at (I believe) a workshop on incident response. Alan Paller, a mutual friend, introduced us. At the time, Jeffrey was the director of the Critical Infrastructure Assurance Office (the CIAO), and if memory serves me correctly also on the National Security Council. (I may be off on the dates — he was on the NSC, but it may have been after the meeting.)

Jeffrey struck me as very friendly and willing to discuss various aspects of security. He gave a good talk at the workshop.

We reconnected in the mid-2000s, at a meeting for the Institute for Information Infrastructure Protection (I3P); he was the representative for Carnegie-Mellon, and I for UC Davis. Our interests complemented each others’. Jeffrey knew quite a bit about technology, and far more about politics, how governments worked and interacted with one another, and about national security — topics I was very interested in. I knew a lot about the technology he was interested in, and I was learning about the other aspects he was an expert in. So we became friends, and colleagues.

Jeffrey was very good-natured, and seemed to be constantly amused at life. He was a joy to work with; he was very perceptive, and could get to the heart of an issue very quickly. He also asked questions that caused us to look at something in a new way. Talking to him was usually exciting, and I looked forward to it.

Our work on attribution sprang from a workshop on the Global Environment for Network Innovation (GENI) project, held in Davis. He was one of the attendees, and joined several others to come to my house for a small get-together; then we all went to dinner. He was charming to my wife Holly, and she immediately liked him.

That workshop also produced the only time I ever saw him irritated with me. He, another friend and colleague, and I were discussing attribution, and we decided to meet at 8am, before the workshop workday, to consider some ideas. Well, I overslept, and our friend was also late — and Jeffrey had been up since 6am working on the ideas. He quickly forgave us, though.

The work wound up in a paper on what attribution requirements the future Internet might require. His political expertise combined with our technical expertise to develop what I thought were interesting (and somewhat unexpected) results. We chose a rather impish title for the paper: “The Sisterhood of the Traveling Packets”. It was great fun to see him handle the questions about the title at the workshop — he ended up suggesting that the questioners ask any parent of a teenage girl!

Since then, Jeffrey and I worked together on topics ranging from attribution to the insider problem. Indeed, when he passed away, we had just completed a short write-up on whether the Internet could be controlled, and we were sending it around to see if we could get funding to explore that issue in more depth.

Jeffrey could take a complex political and governance issue and explain it in very simple terms. His book, Creeping Failure: How We Broke the Internet and What We Can Do to Fix It, did a nice job of explaining how we wound up with the Internet we have today, and how the problems arose and were magnified during its growth. His comparison of this to the evolution of cities was quite enlightening, and one I’d never heard of before.

He also enjoyed talking about books and history. I remember when we were at a workshop in New Hampshire. I was telling him about a book I was reading (The Illuminatus! Trilogy), and he seemed to enjoy the idea behind the book; I recommended it very highly. The same happened a couple of years later, when we were talking about counterfactual history. I told him about another book, Pastwatch: The Redemption of Christopher Columbus, which is an alternate history of Columbus' voyage. I hope he did read them; he would have enjoyed them very much.

I remember him being the general chair of the Workshop on Governance of Technology, Information, and Policies (GTIP) held in 2009. There were problems with the organization of the workshop, through no fault of anyone in particular. What they were are not relevant, but what is relevant is how Jeffrey adapted to the problems and out of them moulded a very successful workshop. His vision and skill in working with people, and his determination, made the workshop successful.

I spoke with Jeffrey on the Wednesday before he died; he told me he had been in the hospital for some time, which was why he was so hard to get hold of, but he thought he was getting better. But he wasn’t sure, and was still very, very tired. So we talked a bit, made plans to finish up a project we were working on, and agreed to talk on Thursday. I called at the prearranged time, and he told me he needed to rest, so could we talk on Friday? Of course, I said; and called him then. He didn’t answer. He never will.

There is an expression we use when we talk about people who are very, very good deep inside; we say they have a good soul. He had a good soul. My life was much richer for knowing Jeffrey — both professionally and, more importantly, personally. I will miss him very much.

A Thought on the Proposed Built-In Wiretap Capability

The paper CALEA II: Risks of Wiretap Modifications to Endpoints raises very good points about the dangers of requiring vendors to build a wiretap capability into communications technology. I wanted to add a thought.

Let’s say that this capability is built in. As the above paper noted, an attacker can exploit the wiretap capability (which is, of course, simply a known, built-in vulnerability) to monitor the conversation. This may, or may not, alarm law enforcement authorities who are pushing for adding this capability. What should alarm them is that their conversations can also be monitored — that is, the attackers can keep tabs on the law enforcement authorities who are trying to catch the attackers! In other words, the tool intended for catching criminals can also be used to monitor the attempts to catch them.

Saying that vendors can build the vulnerability in such a way that only authorized eavesdroppers (read: law enforcement authorities) can use it underestimates the resourcefulness of attackers, and overestimates the capacity of humans both to design procedures that are flawless, and to carry out those procedures. Quoting from another report [1]:

Finally, no security should ever rely solely on secrecy of defensive mechanisms and countermeasures. While not publishing details of security mechanisms is perfectly acceptable as one security mechanism, it is perhaps the one most easily breached, especially in this age of widespread information dissemination. Worse, it provides a false sense of security. Dumpster diving, corporate espionage, outright bribery, and other techniques can discover secrets that companies and organizations wish to keep hidden; indeed, in many cases, organizations are unaware of their own leaking of information. A perhaps classic example occurred when lawyers for the DVD Copyright Control Association sued to prevent the release of code that would decipher any DVD movie file. They filed a declaration containing the source code of the algorithm. One day later, they asked the court to seal the declaration from public view — but the declaration had been posted to several Internet web sites, including one that had over 21,000 downloads of the declaration! [2] More recently, Fox News reported that information posing “a direct threat to U.S. troops … was posted carelessly to file servers by government agencies and contractors, accessible to anyone online” [3], and thefts of credit card numbers and identities are reported weekly and growing in number.

So, the alternative is to give law enforcement communications tools without these eavesdropping capabilities. Now, there are two sets of communications technology out there: those with built-in wiretaps, and those without built-in wiretaps. How long the market for the latter can be restricted to law enforcement is anyone’s guess, but there is no doubt that those wiretap-free tools will become available to people not engaged in active law enforcement. Restrictions on that type of technology fail quickly.

This point, I think, strengthens what the above paper is saying. Not only does it pose “serious consequences for the economic well-being and national security of the United States” as the paper says, it also hampers the effectiveness of law enforcement.

References

1. M. Bishop, “Overview of Red Team Reports”, Office of the Secretary of State of California, 1500 11th St, Sacramento, CA 95814 (July 2007); available at http://www.sos.ca.gov/voting-systems/oversight/ttbr/red-overview.pdf
   
2. Declan McCullagh, “DVD Lawyers Make Secret Public”, Wired News (Jan. 26, 2000); available at http://www.wired.com/politics/law/news/2000/01/33922
   
3. Associated Press, “Government Agencies Posting Sensitive ‘Need to Know’ Material Online”, Fox News (July 12, 2007); available at http://www.foxnews.com/story/0,2933,289011,00.html
   

Internet Voting? Not Yet -- From an Election Point of View

[[This blog post discusses Internet elections from the point of view of how the election process might work. It’s similar to my blog entry of Monday, April 22, 2013, but presented from a different point of view (and has additional information.]]

The time for Internet voting has not yet arrived. Someday it may be a good idea, but we have many security problems to solve, and we will have to decide whether to change how elections are run.

To see why, let’s look at how Internet voting will work. When you go to vote, you will use your home computer, a work computer, or some other device to connect to an election server. That server will transmit a ballot back to you. You mark the ballot appropriately to cast your votes, and then the computer transmits the completed ballot back to the election server. The election server then processes the ballot, counting the votes.

Now let’s look at each step in this process.

First, you need to get the ballot from the election server. You have to connect to the election server and provide information to ensure you get the right ballot. In order to do this, you will need to supply your voting address and, possibly, prove your identity.

Let’s see what this means. During Election Day, when you open your browser and type in the Election Office’s web site, you get a message saying the web site is unavailable. You’re thrilled so many people are voting, so you go to work. While there, you try to vote again, with the same result. This happens whenever you try to cast your vote throughout the day. That evening, at 7:55pm (just before the polls close), you try to vote from home one last time. Again, the web site is “unavailable”. Oh, well.

What you just read is a description of a “denial of service”" attack. They are actually fairly common, and extremely easy to launch. In fact, recently many banks (such as U.S. Bank, Bank of America, Wells Fargo Bank, CitiBank, and American Express) [1-3] were victims of such attacks. But the banks have an advantage that election offices don't: lots of servers and lots of money. They can hire teams of cybersecurity experts to respond to these attacks, and can reroute traffic to geographically widely distributed servers to mitigate some of the effects of the attack. Even so, the banks all experienced slow-downs that affected customer use of their web sites.

Given that most Election Offices have 1 or 2 people whose job involves cybersecurity (among other functions) and would have a single server to handle Internet voting, not being able to connect to the election server over the Internet is very realistic. And as the above news articles note, these attacks are easy to launch — from anywhere in the world.

In fact, this has happened. During Hurricane Sandy, New Jersey allowed voters to request email ballots by sending an email to county email addresses set up for this purpose. But the email addresses which received the emails were quickly overwhelmed, and email requests for ballots were bouncing [4,5]. And this was not an attack; it was simply voters requesting email ballots — requests that were never received.

Next, let’s look at how you would retrieve a ballot. You give your voting address, and the election server transmits the appropriate ballot. But how do you know you are talking to the correct election server, and not a fake one?

Someone could send you a fake ballot from a bogus election server. Such a ballot could cause the votes you cast through that ballot to be changed before the ballot is transmitted to the election server. This sounds surprising, but remember that PDF files contain programming instructions that tell the computer how to draw the image on the screen. And that same language can tell the program reading the image to count votes differently than displayed; or they can add markings and cover them up when displayed.

So how do you know the votes you enter on your computer are what is sent to the server? Aside from rigging the ballot files, it is very easy to write programs that alter information; indeed, the infamous computer virus does exactly this. And while antivirus programs are very effective in countering viruses that they know about, they do not protect you against new viruses or other nasty programs on your system. There are many ways to introduce these programs, including having you go to a web site that looks like your bank’s (for example). When you get there, the site has you download something to improve service — and presto!, the malefactors have just put a virus on your system.

With smartphones this is even easier, because we all download apps and run them. The protection most smartphones offer is minimal, so writing an app to cast your vote (suitably doctored, of course) is easy. To get you to download it, the perpetrator sends you an email saying that your election official has set up a web site that you can go to for the app — and when you download it, you really download the doctored app. The election official, of course, did not send this letter.

So you need to be sure that, once you have marked the ballot, the marks you make are the ones that the vote counting system and software will count.

Now let’s say you supply your authentication information to validate who you are, so the election server will send you the right ballot. If you are communicating with a bogus election server, it now has all the information it needs to vote for you — it simply discards your ballot, logs in to the real election server as you, and casts its votes.

How can you be sure you are talking to the right election server? Presumably the county will supply that web address. But if the address comes in an email, it would be easy for some group to send you specially crafted email that displayed the right address as a link — but when you click on the link, it takes you to a completely different web site. This technique is called phishing (or, in this context, spearphishing) and is remarkably effective. This is widely believed to be the way attackers recently took over the Associated Press twitter news feed — and they then posted a fake news story about President Obama being injured by explosions at the White House, causing Wall Street to panic [6].

Instead, if the address doesn’t come in an email, the attackers may send an email on the night before the election that looks like it comes from the elections office, but is an attack as described above. This would probably trick a large number of people, who would be grateful that the elections office was providing a more convenient way of getting to the web page rather than forcing the user to type the full web address into the browser.

Okay, let's assume you are now talking to the real election server. Once you have cast your votes, they have to be transmitted to the election server. (If you haven't given the authentication information yet, you will have to do so now.) This means the ballot must be sent through the Internet. How does it get there? This is called “routing”, and the route the ballot takes depends on a lot of factors that change constantly. Unless specific methods are used to transmit the ballot, the ballot could get lost, or altered, or someone along the way could read it.

The method that has to be used is the same one that you use to talk to your bank — basically, it is an encrypted connection. These connections require the server to send something called a “certificate” that is signed by a trusted agency. But what agency, and how will you know that the certificate is valid? If the certificate is too old, your browser will tell you, and may refuse to allow you to proceed. But many institutions don’t keep their certificates up to date (it costs money for that), so when you see a notice saying “certificate expired”, you may be talking to the right election server. You don't know. Worse is the situation where the certificate is valid but from an unknown agency. How much can you trust that the agency really checked that the elections office asked for the certificate? Someone once had a highly reputable agency issue a new certificate for Microsoft — but he had no connection to Microsoft [7]. (The problem was discovered quickly, and no harm appeared to have been done. We may not be so fortunate in a Presidential election.)

Okay, now your vote has arrived at the election server. The election server has a lot to do, and must do it correctly. That you have voted now needs to be recorded, and in a way that does not indicate which ballot you case. Somehow the two must be decoupled. So, when your ballot arrives at the server, your name is marked as having voted, and the ballot must be digitally signed by the election server to ensure it is not changed after it is received. Then the ballot must be counted or moved to a system that will do the counting. Any error in all this will compromise your vote, your privacy, and/or the accuracy of the results.

The election server is connected to the Internet, of course — and the Internet that you use to connect to the election server is the same one that people around the world can use to connect to it. This includes attackers who want to break into the server, see the data that is there, and change it or the programs on the server to corrupt the results of the election. And attackers succeed at breaking into very well-maintained computers at high-security government agencies, and covering their tracks well. U.S. defense contractors, the Pentagon, other government agencies, financial institutions, and many major corporations have had their systems and web servers compromised [8-11]. These organizations have lots of security expertise and lots of money. They can hire teams of cybersecurity experts to detect attacks, analyze them, repair or reinstall corrupted systems, (attempt to) recover corrupted data, and figure out how to prevent the attacks from recurring. Of course, these responses take time to carry out. Election offices simply do not have these financial, human, or technical resources. Nor do they have the time, because during an election people vote for a fixed period of time (usually 14 hours or so). Thus, ensuring that an election server connected to the Internet is secure simply is infeasible.

Finally, the procedures to be followed to maintain the server's security must be well thought out and followed meticulously. This is a critical, and often overlooked, point: security experts know that a “system” is not secure; a “system” is secure when used in a specific way. A good way to think of this is to consider how safe a car is. When the driver obeys the traffic laws, she is (usually) quite safe. But if she runs red lights, she is not. Similarly, if the Internet voting system procedures are poorly done, or do not take into account the bad things that can prevent voting or corrupting the ballots, poor "system" security is the least of the problems.

It's tempting to assume that you can simply have someone get a ballot, fill it in, scan it into a PDF (or somehow get it into electronic form), and email it back to the county Elections Office. But the same problems arise. Change “election server” to “email server” above, and the description of how someone returns the ballot is the same whether a web browser on a home computer sends it to the (election) server, or a mail program sends it to the (email) server. And if the ballot is to be downloaded or emailed to the voter by an election official, you again have all the problems of getting the ballot as before.

The quest for Internet voting is a good one; but before the body politic decides that it should be implemented, the dangers and problems of it must be known, discussed openly, and a conscious decision made that the consequences of those problems are acceptable. A pilot study using a real election does not provide this information for several reasons. First, no reputable computer security expert will ever attack a voting system during an election (it’s a crime), so we cannot test the security of the system and its procedures as actually used. Second, enabling detection of some attacks requires a complete record of what happens — including how you voted. Before this type of recording is done, the body politic must decide that how you voted can become known, and accept the attendant risks of vote selling and voter intimidation. Third, a very sophisticated attack could well be undetectable — so how would we know the votes were compromised? And so forth. (See my blog entry for Wednesday, April 24, 2013 for a more detailed explanation of this.)

Whether these difficulties can ever be overcome is a very deep, complex question requiring research in technology, human behavior, social organization, political considerations, and legal matters. What is absolutely certain is that, until they are overcome, we should not conduct civic elections over the Internet.

As for my credentials: I am a professor of computer science at the University of California at Davis, where I am a co-director of the Computer Security Laboratory. I have been in the field since 1978. I have been studying electronic and Internet voting since 2004, when I participated in the RABA study of electronic voting systems for the State of Maryland [12]. I was also one of the co-leaders of the technical part of the California Secretary of State's Top-to-Bottom Review of voting systems certified for use in the State of California [13]. Currently, the National Science Foundation is funding our research on election processes [14,15]. Our group works with election officials in Yolo and Marin Counties.

Any opinions expressed in this note are those of the author, and not necessarily those of anyone else.


[ 1] "3 More Major US Banks Report Possible Cyber Attacks," NBC News (Sep. 27, 2012); available at http://www.nbcnews.com/technology/technolog/3-more-major-us-banks-report-possible-cyber-attacks-6126050

[ 2] M. Lennon, "Wells Fargo Says DDoS Attack Disrupting Online Banking Website," Security Week (Mar. 26, 2013); available at http://www.securityweek.com/wells-fargo-says-ddos-attack-disrupting-online-banking-website

[ 3] B. Acohido, "Amex Latest U.S. Major Bank to Get Knocked Offline," USA Today (April 2, 2013); available at http://www.usatoday.com/story/tech/2013/03/29/american-express-denial-of-service-hack/2030197/

[ 4] "Christie Administration Announces E-Mail and Fax Voting Available to New Jerseyans Displaced by Hurricane Sandy," State of New Jersey (Nov. 3, 2012); available at http://www.state.nj.us/governor/news/news/552012/approved/20121103d.html

[ 5] B. Sullivan, "New Jersey's Email Voting Suffers Major Glitches, Deadline Extended to Friday," NBC News (Nov. 6, 2012); available at http://usnews.nbcnews.com/_news/2012/11/06/14974588-new-jerseys-email-voting-suffers-major-glitches-deadline-extended-to-friday

[ 6] J. Steinberg, "Twitter, The Associated Press, and Phishing: Why Breaches Still Occur," Forbes (Apr. 26, 2013); available at http://www.forbes.com/sites/josephsteinberg/2013/04/26/twitter-the-associated-press-and-phishing-why-breaches-still-occur/

[ 7] "Unauthentic 'Microsoft Corporation' Certificates," CERT Advisory CA-2001-04, Pittsburgh, PA (Mar. 30, 2001); available at http://www.cert.org/advisories/CA-2001-04.html

[ 8] M. Riley & B. Elgin, "China Cyberspies Outwit U.S. Stealing Military Secrets," Bloomberg (May 1, 2013); available at http://www.bloomberg.com/news/2013-05-01/china-cyberspies-outwit-u-s-stealing-military-secrets.html

[ 9] G. Wyler, "Pentagon Admits 24,000 Files Were Hacked, Declares Cyberspace A Theater Of War," Business Insider (July 14, 2011); available at http://www.businessinsider.com/pentagon-admits-24000-files-were-hacked-declares-cyberspace-a-theater-of-war-2011-7#ixzz2SAYL2pqp

[10] M. Schwartz, "U.S. Labor Dept. Website Hacked, Serves Malware," Information Week (May 1, 2013); available at http://www.informationweek.com/security/attacks/us-labor-dept-website-hacked-serves-malw/240153984

[11] D. Smith, "Bank of America Hacked By Anonymous: Hackers Leak 'Secrets' About Executives, Salaries, And Spy Activities," International Business Times (Feb. 28, 2013); available at http://www.ibtimes.com/bank-america-hacked-anonymous-hackers-leak-secrets-about-executives-salaries-spy-activities-1107947

[12] "Trusted Agent Report Diebold AccuVote-TS Voting System," RABA Innovative Solution Cell, Columbia, MD (Jan. 20, 2004); available at http://nob.cs.ucdavis.edu/~bishop/notes/2004-RABA/2004-RABA.pdf

[13] M. Bishop, "Overview of Red Team Reports," Office of the California Secretary of State (July 2007); available at http://www.sos.ca.gov/voting-systems/oversight/ttbr/red-overview.pdf

[14] "TC:Medium:Collaborative Research: Technological Support for Improving Election Processes," award from the National Science Foundation tot he University opt California at Davis (Sep. 15, 2009); abstract available at http://www.nsf.gov/awardsearch/showAward?AWD_ID=0905503

[15] "EAGER: Collaborative: Process-Based Technology to Support Comparison and Evaluation of the Security of Elections," award from the National Science Foundation tot he University opt California at Davis (Oct. 1, 2012); abstract available at http://www.nsf.gov/awardsearch/showAward?AWD_ID=1258577

Why An Internet Voting Pilot Project Won’t Tell Us What We Need to Know

Why A Pilot Internet Voting Project Won’t Tell Us What We Need to Know

Lots of folks have suggested running some elections using Internet voting as pilots, to see whether Internet voting will work. A pilot will not tell us this.

To see why, ask what makes an election “work”? Counting votes accurately is one thing. Another is recording the votes accurately — that is, each vote cast is counted correctly, and no votes are changed. Further, each person gets one vote, just as in a non-Internet election. The computer or smartphone used to cast the vote, casts the vote without change. And so forth.

Now, how can we tell when it “works”? How do we know the results are correct and have not been altered? This is the heart of the problem.

Let’s say we try an Internet voting pilot project in which people can vote from their home computer or a smartphone. If either contains a computer virus that will change the vote after the user casts it, but before it is transmitted to the vote counting system, how can we tell this? The only way is to record the vote of each voter as the voter casts it, and compare that with the election totals. And we can’t simply store the vote on the computer it is cast on; that could be tampered with. We would have to have an impartial, trusted observer watch each person vote, and record the votes cast on paper or on a separate, trusted system. Aside from being impractical, this means that how someone voted can (and undoubtedly will) become known, allowing vote selling and voter intimidation.

So that’s one problem. We have no way of verifying that the Internet voting system recorded and counted votes correctly — that is, we cannot check its accuracy.

So let’s ask a different question: will the pilot tell us if Internet voting is secure?

The “pilot” is really a test of Internet voting. Unfortunately, a basic principle of testing is that testing can never prove the absence of problems; it can only prove the presence of problems. When you test drive a car, you’re looking for problems that the car may have — perhaps it doesn’t accelerate fast enough, or the brake pedal is too stiff. You don’t buy the car. But if you don’t find any problems, you might well buy it — not realizing that the braking system will fail in a year or so due to a manufacturing defect. Your test drive didn’t show the car had no problems — that is, it didn’t prove the absence of problems. It simply showed you that you didn’t find any problems.

Back to the Internet voting pilot. If security folks analyze the pilot system after the election, they may find evidence of an attack that could have altered ballots or vote totals. This would prove the Internet voting system is not secure. But suppose they find nothing — there still could have been a successful attack, but one in which the attackers “cleaned up” after themselves, leaving nothing behind to be detected. The absence of evidence proves nothing.

There’s another issue. Suppose a company built a safe that they believed no-one could crack. They give a safe to anyone who asks, so that these people can try to crack the safe in the privacy of their home. The company has asked people who succeed to report it, and they will receive a check for $10,000. Now, some people who succeed will report it and get the money. But others who succeed will ask, “If a bank believes this safe to be uncrackable, might not the bank install the safe? And if so, think of how much money I could get by cracking the safe in the bank rather than here at home! I just find banks that use the safe, crack it, and take the money.”

This points out another problem. If someone did figure out how to compromise the Internet voting system, why do it on a pilot? Think of what would happen if that malefactor waited, and then compromised a gubernatorial or presidential election! And in history, a very few votes have made a difference; witness LBJ’s election to the U.S. Senate by 87 votes — an event that, had it not occurred, would have changed the course of American history drastically.

Finally, in a real test, experts (and, possibly, others) would attack the Internet voting system to see if they could change votes or block voters from voting. But no reputable computer security expert will ever attack a voting system during an election (it’s a crime), so we cannot test the security of the system and its procedures as actually used. If it's a “pilot” in a real election, the laws about trying to rig elections apply. So the pilot prevents people from testing the system for security and accuracy. It sounds strange, but it’s quite true.

So, we cannot tell if the Internet voting system counts votes correctly in the pilot; we cannot be sure that the voting system wasn’t broken into; and we can’t legally test the system by attacking it. But these are the purposes of a pilot project. Hence the pilot, done in a real election, is not useful. This is why I think having a pilot election using an Internet voting system is a bad idea: we learn nothing from it, and worse, if the pilot seems to go well as far as we can tell, people will (incorrectly) assume the system is secure and accurate. And that gives a completely false sense of security.

As for my credentials: I am a professor of computer science at the University of California at Davis, where I am a co-director of the Computer Security Laboratory. I have been in the field since 1978. I have been studying electronic and Internet voting since 2004, when I participated in the RABA study of electronic voting systems for the State of Maryland. I was also one of the co-leaders of the technical part of the California Secretary of State’s Top-to-Bottom Review of voting systems certified for use in the State of California. Currently, the National Science Foundation is funding our research on election processes. Our group works with election officials in Yolo and Marin Counties.

Any opinions expressed in this note are those of the author, and not necessarily those of anyone else.

About Internet Voting

California Assembly Bill 19 (Ting, D-San Francisco) [1] proposes to allow Internet voting. The bill has two serious problems.

The first is in Section 4502(b)(2), which describes what the Internet voting system is to be tested for. They must check that no-one can make the system report inaccurate tallies or change votes. But the bill does not require testing to ensure that all parts of the voting system will be available during the voting period.

Let’s see what this means. During Election Day, when you open your browser and type in the Election Office’s web site, you get a message saying the web site is unavailable. You’re thrilled so many people are voting, so you go to work. While there, you try to vote again, with the same result. This happens whenever you try to cast your vote throughout the day. That evening, at 7:55pm (just before the polls close), you try to vote from home one last time. Again, the web site is “unavailable”. Oh, well.

What you just read is a description of a “denial of service” attack. They are actually fairly common, and extremely easy to launch. In fact, recently many banks (such as U.S. Bank, Bank of America, Wells Fargo Bank, CitiBank, and American Express [2,3,4]) were victims of such attacks. But the banks have an advantage that election offices don’t: lots of servers and lots of money. They can hire teams of cybersecurity experts to respond to these attacks, and can reroute traffic to geographically widely distributed servers to mitigate some of the effects of the attack. Even so, the banks all experienced slow-downs that affected customer use of their web sites.

Given that most Election Offices have 1 or 2 people whose job involves cybersecurity (among other functions) and would have a single server to handle Internet voting, the possibility of Internet voting with an inaccessible server is very realistic. And as the above news articles note, these attacks are easy to launch — from anywhere in the world.

In fact, this has happened. During Hurricane Sandy, New Jersey allowed voters to request email ballots by sending an email to county email addresses set up for this purpose [5]. But the email addresses which received the emails were quickly overwhelmed, and email requests for ballots were bouncing [6]. And this was not an attack; it was simply voters requesting email ballots.

Thus, any proposed Internet voting system needs to be able to handle a denial of service attack. But the bill does not require they be tested for this ability.

The second problem is much more basic: what is an “Internet voting system”? The bill defines it in Sec. 4500(2). It includes the election office server, of course, and the Internet. But what else does it include? The system or device you cast your vote on, and that then transmits the vote to the election server.

Let’s assume you are voting on your home computer. How do you know the votes you enter on your computer are what is sent to the server? It is very easy to write programs that alter information; indeed, the infamous computer virus does exactly this. And while antivirus programs are very effective in countering viruses that they know about, they do not protect you against new viruses or other nasty programs on your system. There are many ways to introduce these programs, including having you go to a web site that looks like your bank’s (for example). When you get there, the site has you download something to improve service — and presto!, the malefactors have just put a virus on your system.

With smartphones this is even easier, because we all download apps and run them. The protection most smartphones offer is minimal, so writing an app to cast your vote (suitably doctored, of course) is easy to write. To get you to download it, the perpetrator sends you an email saying that your election official has set up a web site that you can go to for the app — and when you download it, you really download the doctored app. The election official, of course, did not send this letter.

And there are even more problems. The bill doesn’t require the Secretary of State to certify the system, despite what the legislative counsel’s digest says. It simply requires that the report say the system meets “the standards of accuracy, security, integrity, efficacy, and accessibility”; then it is deemed certified (4502(c)). What “the standards” are is nowhere defined. Also, the bill says nothing about certifying the procedures under which the system is to be used.

This last point is critical. Security experts know that a “system” is not secure; a “system” is secure when used in a specific way. A good way to think of this is to consider how safe a car is. When the driver obeys the traffic laws, she is (usually) quite safe. But if she runs red lights, she is not. Similarly, if the Internet voting system procedures are poorly done, or do not take into account the bad things that can prevent voting or corrupting the ballots, poor “system” security is the least of the problems. Yet the bill does not require these be checked.

The quest for Internet voting is a good one; but before the body politic decides that it should be implemented, the dangers and problems of it must be known, discussed openly, and a conscious decision made that the consequences of those problems are acceptable. A pilot study using a real election does not provide this information for several reasons. First, no reputable computer security expert will ever attack a voting system during an election (it’s a crime), so we cannot test the security of the system and its procedures as actually used. Second, enabling detection of some attacks requires a complete record of what happens — including how you voted. Before this type of recording is done, the body politic must decide that how you voted can become known, and accept the attendant risks of vote selling and voter intimidation. Third, a very sophisticated attack could well be undetectable — so how would we know the votes were compromised? And so forth.

I applaud Assemblyman Ting’s desire to increase voter turnout. But this bill isn’t the way to do it.

As for my credentials: I am a professor of computer science at the University of California at Davis, where I am a co-director of the Computer Security Laboratory. I have been in the field since 1978. I have been studying electronic and Internet voting since 2004, when I participated in the RABA study of electronic voting systems for the State of Maryland [7]. I was also one of the co-leaders of the technical part of the California Secretary of State’s Top-to-Bottom Review of voting systems certified for use in the State of California [8]. Currently, the National Science Foundation is funding our research on election processes [9,10]. Our group works with election officials in Yolo and Marin Counties.

Any opinions expressed in this note are those of the author, and not necessarily those of anyone else.

References

[1] “Internet Voting Pilot Program,” Assembly Bill No. 19, California State Assembly (Apr. 16, 2013); available at http://www.leginfo.ca.gov/pub/13-14/bill/asm/ab_0001-0050/ab_19_bill_20130416_amended_asm_v97.htm

[2] “3 More Major US Banks Report Possible Cyber Attacks,” NBC News (Sep. 27, 2012); available at http://www.nbcnews.com/technology/technolog/3-more-major-us-banks-report-possible-cyber-attacks-6126050

[3] M. Lennon, “Wells Fargo Says DDoS Attack Disrupting Online Banking Website,” Security Week (Mar. 26, 2013); available at http://www.securityweek.com/wells-fargo-says-ddos-attack-disrupting-online-banking-website

[4] B. Acohido, “Amex Latest U.S. Major Bank to Get Knocked Offline,” USA Today (April 2, 2013); available at http://www.usatoday.com/story/tech/2013/03/29/american-express-denial-of-service-hack/2030197/

[5] “Christie Administration Announces E-Mail and Fax Voting Available to New Jerseyans Displaced by Hurricane Sandy,” State of New Jersey (Nov. 3, 2012); available at http://www.state.nj.us/governor/news/news/552012/approved/20121103d.html

[6] B. Sullivan, “New Jersey’s Email Voting Suffers Major Glitches, Deadline Extended to Friday,” NBC News (Nov. 6, 2012); available at http://usnews.nbcnews.com/_news/2012/11/06/14974588-new-jerseys-email-voting-suffers-major-glitches-deadline-extended-to-friday

[7] “Trusted Agent Report Diebold AccuVote-TS Voting System,” RABA Innovative Solution Cell, Columbia, MD (Jan. 20, 2004); available at http://nob.cs.ucdavis.edu/~bishop/notes/2004-RABA/2004-RABA.pdf

[8] M. Bishop, “Overview of Red Team Reports,” Office of the California Secretary of State (July 2007); available at http://www.sos.ca.gov/voting-systems/oversight/ttbr/red-overview.pdf

[9] “TC:Medium:Collaborative Research: Technological Support for Improving Election Processes,” award from the National Science Foundation to the University of California at Davis (Sep. 15, 2009); abstract available at http://www.nsf.gov/awardsearch/showAward?AWD_ID=0905503

[10] “EAGER: Collaborative: Process-Based Technology to Support Comparison and Evaluation of the Security of Elections,“ award from the National Science Foundation to the University of California at Davis (Oct. 1, 2012); abstract available at http://www.nsf.gov/awardsearch/showAward?AWD_ID=1258577