Scribd
Upload
13 views

Lecture 1 - Voting As A Security Problem

Uploaded by

Tony
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
13 views

Lecture 1 - Voting As A Security Problem

Uploaded by

Tony
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 23

Securing Digital Democracy

Lecture 1 | Voting as a Security Problem

J. Alex Halderman
University of Michigan
1.1 Welcome Securing Digital Democracy

Welcome!
1.1 Welcome Securing Digital Democracy
1.1 Welcome Securing Digital Democracy
1.1 Welcome Securing Digital Democracy
1.1 Welcome Securing Digital Democracy

Deny entry to India


and notify originator
1.1 Welcome Securing Digital Democracy

Goals for the Course


Understand how your vote is counted.
You should have confidence in the results…or not?
Learn to apply the security mindset to reason about
attacks and defenses, in elections and beyond.
Critically examine the role of technology in elections,
including results of recent research.
Find out what you can do to make elections fair and accurate.
1.1 Welcome Securing Digital Democracy

Syllabus
1. Voting as a Security Problem
2. How We Got Here
3. Computers at the Polls
4. Problems with DREs
5. Security Procedures
6. E-Voting around the World
7. Human Factors
8. Internet Voting
9. Using Technology Wisely
10. E-Voting and Public Policy
1.2 The Security Mindset Securing Digital Democracy

The Security Mindset


1.2 The Security Mindset Securing Digital Democracy

The Adversary
Computer security studies how
systems behave in the presence
of an adversary .

“The adversary”
a.k.a. “the attacker”
a.k.a. “the bad guy”
1.2 The Security Mindset Securing Digital Democracy

Know your enemy.

Thinking like an Attacker


Understand techniques for
circumventing security.

Look for ways security can


break, not reasons why it won’t.

Image by Wikipedia user 663highland, licensed under a Sun Tzu


Creative Commons Attribution 2.5 Generic license. author of
http://en.wikipedia.org/wiki/File:Enchoen27n3200.jpg The Art of War
1.2 The Security Mindset Securing Digital Democracy

Thinking Like an Attacker


• Look for weakest links – easiest to attack
• Identify assumptions that security depends
on – are they false?
• Think outside the box: Practice thinking like an attacker:
not constrained by For every system you interact with,
system designer’s think about what it means for it to
worldview be secure, and image how it could
be exploited by an attacker.
1.2 The Security Mindset Securing Digital Democracy

Practice Thinking Like an Attacker


In your college math course,
Prof. Rote is giving the final exam:

Write the first 100 digits of pi:


3.________________________

Available in advance.
Closed book, closed notes.

How would you cheat?


1.2 The Security Mindset Securing Digital Democracy

Thinking as a Defender
Security policy
– What are we trying to protect?
– What properties are we trying to enforce?
Threat model
– Who are the attackers? Capabilities? Motivations?
– What kind of attack are we trying to prevent?
Risk assessment
– What are the weaknesses of the system? Challenge is to think
– What will successful attacks cost us? rationally and
– How likely?
rigorously about risk.
Countermeasures
– Costs vs. benefits?
Rational paranoia.
– Technical vs. nontechnical?
1.3 Security Requirements for Voting Securing Digital Democracy

What Security Requirements


do election systems need to enforce?
1.3 Security Requirements for Voting Securing Digital Democracy

Integrity Security Requirements

 Integrity
The outcome matches voter intent.

Votes are cast as intended.


Votes are counted as cast.
1.3 Security Requirements for Voting Securing Digital Democracy

Ballot Secrecy Security Requirements

 Integrity
Weak form:
 Ballot Secrecy
Nobody can figure out how you voted…
Strong form:
…even if you try to prove it to them.
1.3 Security Requirements for Voting Securing Digital Democracy

Voter Authentication Security Requirements

 Integrity
Only authorized voters can cast votes,
 Ballot Secrecy
and
 Voter Authentication
each voter can only vote up to the
permitted number of times.
1.3 Security Requirements for Voting Securing Digital Democracy

Enfranchisement Security Requirements

 Integrity
All authorized voters have the
opportunity to vote.  Ballot Secrecy
 Voter Authentication
 Enfranchisement
1.3 Security Requirements for Voting Securing Digital Democracy

Availability Security Requirements

 Integrity
The election system is able to accept all
votes on schedule and produce results in  Ballot Secrecy
a timely manner.  Voter Authentication
 Enfranchisement
 Availability
1.3 Security Requirements for Voting Securing Digital Democracy

Integrity Ballot Secrecy

Voter
Enfranchisement
Authentication
1.3 Security Requirements for Voting Securing Digital Democracy

Security Requirements Other Important


Properties
 Integrity
 Ballot Secrecy  Cost Effectiveness

 Voter Authentication  Accessibility

 Enfranchisement  Convenience

 Availability  Intelligibility
Securing Digital Democracy
Lecture 1 | Voting as a Security Problem

J. Alex Halderman
University of Michigan

You might also like