Tag Archives: ORG

Update on Independent report on Estonia’s e-voting

On Saturday 10th May we (the Independent Team) informed key stakeholders in Estonia that we would be reporting our findings the coming Monday. We contacted the Estonian Elections Committee, other officials and agencies as well as media. We did this impartially and openly to avoid being seen to favour any one political party or media source.

Late on Sunday 11th May we launched our website summarising the findings and supporting them with photos and videos.

On Monday 12th May we held a press conference – to which there had been an open invitation – to present our findings and answer questions from anyone who wanted to. That day a first response to our work was posted by the Estonian Electronic Voting Committee’s Facebook page, to which we responded.

On Tuesday 13th May we met privately with members of the Estonian Electronic Voting Committee (which is part of the overall Elections Committee).  There we talked through our findings and shared technical details of issues and vulnerabilities that will not be published until the current elections are over. We also assured them that we would not publish any demonstration code until after the election, and would not interact with the live voting system if they chose to proceed with using it for the European Parliamentary elections. They confirmed they would proceed with using their system. I was particularly surprised when the Electronic Voting Committee members said they could think of no circumstances in which they wouldn’t proceed with using their system.

The same day the Elections Committee published a lengthy response to The Guardian’s reporting of our findings. We responded in full here.

Since Monday we have had significant interest from a range of people in Estonia’s tech industry who we have met or corresponded with. We have also seen local and international media reporting on our findings.

Sadly, despite repeated requests, we have not been able to meet with representatives of the Estonian government nor the key Parliamentary committees with oversight on these issues. The Estonian Prime Minister and President have used the media (and social media) to dismiss our work and suggest we are working to favour one political party over another in Estonia. That simply isn’t true, such a response would appear to be a case of trying to shoot the messenger rather than hear some uncomfortable truths.

On Saturday 17th May we published the detailed technical analysis report to expand on and support the findings we had published a week earlier. The paper has also been submitted to an academic conference.

I have been pleased to see such widespread discussion of our findings. However some have sought to shut down the debate by seeking to query our independence and integrity. These claims have no truth and team members have a strong record of examining the security of e-voting systems around the world without any fear or favour for political parties of any type.

Some have suggested that Estonia is uniquely able to deliver secure online voting because of their universal ID smartcards and cyberwar protections. They would argue that no other country than Estonia has the infrastructure to use online voting. Whilst I agree that Estonia has a highly developed online infrastructure, which is incredibly exciting for e-government applications, even that isn’t enough for the uniquely difficult problem of online voting.

The debate is for Estonian citizens to have now with input from the EU and NATO where they have obligations as a member-state. If I was an Estonian I would be voting on paper but happily making use of their online services for tax, health and more.

Estonia and the risks of internet voting

Originally posted on the Open Rights Group Blog.

In my capacity as an ORG Advisory Council member I’ve been working with an independent team of election observers researching the Internet voting systems used by Estonia. Why should anyone in the UK be interested in this?

Two reasons: Firstly Estonia is regularly held up as a model of e-government and e-voting that many countries, including the UK, wish to emulate. Secondly, after years of e-voting being off the UK agenda (thanks in part to ORG’s previous work in this area), the chair of the Electoral Commission recently put the idea of e-voting for British elections back in play.

Before our or any other government leaps to copy the Estonian model, our team wanted to better understand the strengths and weaknesses of the Estonian system. So several of us monitored the internet voting in operation for Estonia’s October 2013 municipal elections as official observers accredited the Estonian National Election Committee. Subsequently the team used the openly published source code and procedures for the Estonian system to build a replica in a lab environment at the University of Michigan. This enabled detailed analysis and research to be undertaken on the replica of the real system.

Despite being built on their impressive national ID smartcard infrastructure, we were able to find very significant flaws in the Estonian internet voting system, which they call “I-voting”. There were several serious problems identified:

Obsolete threat model

The Estonian system uses a security architecture that may have been adequate when the system was introduced a decade ago, but it is now dangerously out of date. Since the time the system was designed, state-level cyberattacks have become a very real threat. Recent attacks by China against U.S. companies, by the U.S. against Iran, and by the U.K. against European telecoms demonstrate the proliferation and sophistication of state-level attackers. Estonia itself suffered massive denial-of-service attacks in 2007 attributed to Russia.

Estonia’s system places extreme trust in election servers and voters’ computers — all easy targets for a foreign power. The report demonstrates multiple ways that today’s state-level attackers could exploit the Estonian system to change votes, compromise the secret ballot, disrupt elections, or cast doubt on the fairness of results.

Abundant lapses in operational security and procedures

Observation of the way the I-voting system was operated by election staff highlighted a lack of adequate procedures for both daily operations and handling anomalies. This creates opportunities for attacks and errors to occur and makes it difficult for auditors to determine whether correct actions were taken.

Close inspection of videos published by election officials reveals numerous lapses in the most basic security practices. They appear to show the workers downloading essential software over unsecured Internet connections, typing secret passwords and PINs in full view of the camera, and preparing election software for distribution to the public on insecure personal computers, among other examples. These actions indicate a dangerously inadequate level of professionalism in security administration that leaves the whole system open to attack and manipulation.

Serious vulnerabilities demonstrated

The authors reproduced the e-voting system in their laboratory using the published source code and client software. They then attempted to attack it, playing the role of a foreign power (or a well resourced candidate willing to pay a criminal organization to ensure they win). The team found that the Estonian I-voting system is vulnerable to a range of attacks that could undetectably alter election results. They constructed detailed demonstration attacks for two such examples:

Server-side attacks: Malware that rigs the vote count

The e-voting system places complete trust in the server that counts the votes at the end of the election process. Votes are decrypted and counted entirely within the unobservable “black box” of the counting server. This creates an opportunity for an attacker who compromises this server to modify the results of the vote counting.

The researchers demonstrated that they can infect the counting server with vote-stealing malware. In this attack, a state-level attacker or a dishonest election official inserts a stealthy form of infectious code onto a computer used in the pre-election setup process. The infection spreads via software DVDs used to install the operating systems on all the election servers. This code ensures that the basic checks used to ensure the integrity of the software would still appear to pass, despite the software having been modified. The attack’s modifications would replace the results of the vote decryption process with the attacker’s preferred set of votes, thus silently changing the results of the election to their preferred outcome.

Client-side attacks: A bot that overwrites your vote

Client-side attacks have been proposed in the past, but the team found that constructing fully functional client-side attacks is alarmingly straightforward. Although Estonia uses many security safeguards — including encrypted web sites, security chips in national ID cards, and smartphone-based vote confirmation — all of these checks can be bypassed by a realistic attacker.

A voter’s home or work computer is attacked by infecting it with malware, as millions of computers are every year. This malicious software could be delivered by pre-existing infections (botnets) or by compromising the voting client before it is downloaded by voters by exploiting operational security lapses. The attacker’s  software would be able to observe a citizen voting then could silently steal the PIN codes required to use the voter’s ID card. The next time the citizen inserts the ID card — say, to access their bank account — the malware can use the stolen PINs to cast a replacement vote for the attacker’s preferred candidate. This attack could be replicated across tens of thousands of computers. Preparation could being well in advance of the election starting by using a replica of the I-voting system, as the team did for their tests.

Insufficient transparency to establish trust in election outcomes

Despite positive gestures towards transparency — such as releasing portions of the software as open source and posting many hours of videos documenting the configuration and tabulation steps — Estonia’s system fails to provide compelling proof that election outcomes are correct. Critical steps occur off camera, and potentially vulnerable portions of the software are not available for public inspection. (Though making source code openly available is not sufficient to protect the software from flaws and attacks.) Many potential vulnerabilities and forms of attack would be impossible to detect based on the information provided to the public. So while the researchers applaud attempts at transparency, ultimately too much of how the I-voting system operates is invisible for it to be able to convince skeptical voters or candidates in the outcomes.

To illustrate this point, the team filmed themselves carrying out exactly the same procedural steps that real election officials show innearly 24 hours of videos from the 2013 elections. However, due to the presence of malware injected by the team before the recordings started, their count produces a dishonest result.

Recommendation: E-voting should be withdrawn

After studying other e-voting systems around the world, the team was particularly alarmed by the Estonian I-voting system. It has serious design weaknesses that are exacerbated by weak operational management. It has been built on assumptions which are outdated and do not reflect the contemporary reality of state-level attacks and sophisticated cybercrime. These problems stem from fundamental architectural problems that cannot be resolved with quick fixes or interim steps.

While we believe e-government has many promising uses, the Estonian I-voting system carries grave risks — elections could be stolen, disrupted, or cast into disrepute. In light of these problems, our urgent recommendation is that to maintain the integrity of the Estonian electoral process, use of the Estonian I-voting system should be immediately discontinued.

Our work shows that despite a decade of experience and advanced e-government infrastructure Estonia are unable to provide a secure e-voting system. So we believe other countries including the UK should learn from this that voting is a uniquely challenging system to provide online whilst maintaining the fundamental requirements of fair elections: secrecy of the vote, security and accuracy. The significant costs of attempting to build such a system would be better directed at other forms of e-government which can provide greater and more reliable benefits for citizens without risking the sanctity of elections.

Read and watch more about this work at https://estoniaevoting.org

 

 

Press Release: Independent Team finds serious vulnerabilities in Estonian Internet Voting System

Ahead of European Parliamentary elections an International team of independent experts identifies major risks in the security of Estonia’s Internet voting system and recommends its immediate withdrawalEstonia’s Internet voting system has such serious security vulnerabilities that an international team of independent experts recommends that it should be immediately discontinued.The team members, including Jason Kitcat from the UK’s Open Rights Group, were officially accredited to observe the Estonian Internet voting system during the October 2013 municipal elections. These observations — and subsequent security analysis and laboratory testing — revealed a series of alarming problems.  Operational security is lax and inconsistent, transparency measures are insufficient to prove an honest count, and the software design is highly vulnerable to attack from foreign powers.

Estonia is the only country in the world that relies on Internet voting in a significant way for national elections. The system is currently used for Estonia’s national parliamentary elections, municipal elections and is planned to be used for the May 2014 European Parliamentary elections. In recent polls, 20-25% of voters cast their ballots online.

Independent security researcher Harri Hursti, who observed operations in the election data center during October 2013, said there were numerous security lapses. “We didn’t see a polished, fully documented procedural approach of maintaining the back-end systems for these online elections,” said Hursti. Videos published by election officials show the officials downloading essential software over unsecured Internet connections, typing secret passwords and PINs in full view of the camera, and preparing the election software for distribution to the public on insecure personal computers.  “These computers could have easily been compromised by criminals or foreign hackers, undermining the security of the whole system” Hursti said.

Assistant Professor J. Alex Halderman from the University of Michigan, pointed to fundamental weaknesses in the I-voting system’s design.  “Estonia’s Internet voting system blindly trusts the election servers and the voters’ computers”, Halderman said.  “Either of these would be an attractive target for state-level attackers.”  Recent reports about state-sponsored hacking of American companies by China and European telecoms by the NSA demonstrate that these dangers are a reality, Halderman explained.

To experimentally confirm these risks, Halderman and his Ph.D. students recreated the Estonian “I-voting system” in their laboratory based on the published software used in 2013.  They successfully simulated multiple modes of attacks that could be carried out by a foreign power. “Although the Estonian system contains a number of security safeguards, these are insufficient to protect against the attacks we tried,” said Halderman.

In one attack, malware on the voter’s computer silently steals votes, despite the systems’ use of secure national ID cards and smartphone verification.  A second kind of attack smuggles vote-stealing software into the tabulation server that produces the final official count.  The team produced videos in which they carry out exactly the same configuration steps as election officials — but with the system under attack by a simulated state-level adversary.  Everything appears normal, but the final count produces a dishonest result.

“There is no doubt that the Estonian I-voting system is vulnerable to state-level attackers, and it could also be compromised by dishonest election officials,” said Halderman.  These attackers could change votes, compromise the secret ballot, disrupt voting, or cast doubt on the legitimacy of the election process.

The team recently arrived at these results and were so alarmed that they decided to urgently make their findings public ahead of the upcoming European elections, explained Jason Kitcat from the Open Rights Group.  “I was shocked at what we found,” explained Kitcat.  “We never thought we’d see as many problems and vulnerabilities as we did. We feel duty-bound to make the public aware of those problems.”

While some of the problems can be corrected in the short term through changes to the system, others stem from fundamental weaknesses that cannot be fixed.  With the growing risk of state-level cyberattacks, the team unanimously recommends discontinuing Internet voting until there are fundamental advances in computer security.

“With today’s security technology, no country in the world is able to provide a secure Internet voting system,” said Hursti.  “I would recommend that Estonia return to a paper ballot only system.”

Maggie MacAlpine, a Post-Election Audit Advisor said, “While Estonia has an excellent e-government system, which they should continue to develop, they should take the Internet voting element of that off-line. Estonia has a well organized paper voting system which they should revert back to.”

The full report and videos explaining the key findings will be published at https://estoniaevoting.org

NOTES FOR EDITORS

For queries contact estoniaevoting@umich.edu or Jason Kitcat at +44 7956 886 508.

The report authors are:

J. Alex Halderman, University of Michigan*
Harri Hursti, Independent Security Researcher*
Jason Kitcat, Open Rights Group*
Maggie MacAlpine, Post-Election Audit Advisor*
Travis Finkenauer, University of Michigan
Drew Springall, University of Michigan

* Authors who acted as election observers for 2013 Estonian local elections

ENDS.

 

Flaws found in Estonian internet voting system – PRESS CONFERENCE by independent team on this Monday 12th May in Tallinn, Estonia

PRESS CONFERENCE 12th May 2014 11:00am — Hotel Metropol, Tallinn

International Team of Independent Election Observers to deliver report on Estonian Internet Voting System

TALLINN, Estonia — An international team of independent experts will deliver their findings on the security of the Estonian E-Voting System this Monday.

This team of renowned experts on computer security and voting systems observed the use of Internet Voting in the 2013 Estonian municipal elections. Ahead of the 2014 European Elections, which plan to use the same internet voting system in Estonia, the International experts will introduce a report in which they explain their observations from 2013 and the results of their security analysis. Their analysis has identified serious flaws in the systems and processes used in Estonian internet voting.

The entire team will be at the press conference and available for interview afterwards to present and discuss their findings.

NOTES FOR EDITORS

For queries contact Jason Kitcat on jason@jasonkitcat.com or +44 7956 886 508

* The Press conference will be in the Hotel Metropol, Roseni 13, 10111 Tallinn, Estonia at 11am on Monday 12th May 2014. The press conference will be in English.

* The report and associated information will be later available from https://estoniaevoting.org

* The team who produced the report and who will be present at the press conference are:
J. Alex Halderman, University of Michigan
Harri Hursti, Independent Security Researcher
Jason Kitcat, Open Rights Group
Maggie MacAlpine, Post-Election Audit Advisor
Travis Finkenauer, University of Michigan
Drew Springall, University of Michigan

ENDS.

Upcoming events in Brighton & Cambridge

Two events coming up soon which will be of interest to digital rights type people:

  • Debating the Digital Economy Act Thur 29th April
    I’ll be one of the contributors at this debate, organised by Wired Sussex here in Brighton.
  • Internet Voting: Threat or Menace Tue 27th April
    Jeremy Epstein from SRI International is over in the UK and will be giving a talk at Cambridge Uni’s Computer Lab Security Seminar series. I did one of these a few years ago and it was highly enjoyable – the audience were engaged and very generous with their interest.

London: We have a non-answer on e-counting

So London Mayor Boris Johnson did answer Andrew Boff’s question on e-counting, or did he? Here’s the background on the question, and the section of Mayor’s question time copied in below (source [PDF]):

Elections
Question No: 3574 / 2009
Andrew Boff

For the 2012 elections would the Mayor prefer a £5million+ electronic count where the bulk of the costs would go to a foreign computer company or a £3.5million manual count where the bulk of the costs would go into Londoner’s pockets?

Answer from the Mayor:

The Authority’s Scheme of Delegation quite properly gives the Chief Executive, in his role as the Greater London Returning Officer, the right to take all the decisions about how GLA elections are delivered. That accords entirely with the practice across the country that politicians contest elections, and do not decide how they should be run.

The answer completely dodges the nub of the question as well as the budget setting powers of the Mayoralty along with the London Assembly. Of course politicians in power get a say in how elections are delivered, why else would a race for e-voting have been begun when Robin Cook had suggested an electronic general election after 2005 was a target?

Boris either doesn’t care, doesn’t understand or doesn’t want to take on his Chief Executive.

The question now becomes, how do we hold the Greater London Authority’s Chief Executive to account about election arrangements if the directly elected Mayor won’t?

Where next for e-counting in London?

On 18th November I hope to find out the future of e-counting in London. Conservative London Assembly Member, Andrew Boff, will be asking London’s Mayor, Boris Johnson the following question:

Elections
Question No: 3574 / 2009
Andrew Boff

For the 2012 elections would the Mayor prefer a £5million+ electronic count where the bulk of the costs would go to a foreign computer company or a £3.5million manual count where the bulk of the costs would go into Londoner’s pockets? (Source [PDF])

This question sums up the view the Open Rights Group and I have been advocating. Does it really make sense to splurge a huge sum of money on e-counting when we know a manual count would be cheaper, let alone easier to verify and more trusted by voters and politicians alike? In these times of restricted public funds wouldn’t the millions for e-counting be better spent on other priorities – I certainly think so.

The back story is that after strong urging from the Electoral Commission and the Open Rights Group, London agreed to conduct a cost-benefit analysis of continuing with e-counting versus using manual counting. When it finally emerged the analysis was obviously biased towards e-counting, trying to minimise the greater cost of e-counting as much as possible.

When a round table was organised to discuss stakeholder views of the analysis, attendees were told that London would proceed with e-counting regardless, rather making the process and that meeting pointless. The Guardian picked up the story. At this point ORG released its own comments on London’s analysis (which I led on drafting) but the Electoral Commission had yet to release theirs.

When the Commission did release their views (something which I was very remiss not to blog on then, sorry loyal readers) we were in for a pleasant surprise. The response was very direct in criticising the weakness of London’s analysis and failings in the UK Government in providing a clearer framework for the use (or not) of such voting technologies. The killer quote:

“However, having studied the cost-benefit assessment, we are concerned that there are potentially a number of gaps that suggest the advantages of e- counting may have been overstated. For example, it was assumed that e- counting was free from human error. Conversely, the assumptions made about the speed and accuracy of manual counting seem overly negative. Also, important safe-guards, such as preparing a manual count as a back-up and the manual checking of a random sample of ballot papers do not appear to have been considered when costing e-counting.

“Therefore, we would suggest that a determination that e-counting is affordable and that the cost is not significantly or disproportionately more than that of manual counting cannot be made without undertaking further analysis of the costs and benefits which takes into account these and other points…”

The Commission also notes the moral hazard in there being only 2 likely suppliers for running an e-counted London election. It also adds a final significant warning:

“We believe that there are considerable risks in undertaking a large scale e-counting exercise in the absence of such a national framework and that the current cost-benefit analysis by GLRO does not sufficiently fill the gap created by this absence.”

It was the strongest public statement I have ever seen from the Commission, and I couldn’t have been more delighted by the firm approach they took. GLA officers are understood to be re-doing some form of analysis following the Commission’s request for more work, meanwhile however procurement also seems to be going ahead. More coverage by Mark Park.

The hope is that Andrew Boff’s question will reveal the current direction and show how committed Boris Johnson is to spending taxpayer funds on election technology.

A bad day for the public interest

What a strange day it has been. I’ve had a very productive time at work whilst lots of other things have been bubbling over:

  • London Elects and the Greater London Returning Officer (the people responsible for the London Mayoral and Assembly elections) had asked for responses to their cost-benefit analysis of manual vs e-counting in 2012. I had just completed ORG’s response earlier this week, which argued that given the £1.5m saving from going manual, there seemed to be no good reason for e-counting. Today was a ’round table’ to also explore issues covered in the analysis. However rather than being the consultation event we expected, ORG’s Executive Director was told that the decision to e-count the 2012 London election had already been taken. Not even a pretence of keeping an open mind! No proper debate or consideration has taken place, just a firm commitment to press ahead with e-counting regardless of costs or consequences.
  • Meanwhile in Brighton & Hove I submitted a formal request to Brighton & Hove City Council’s acting Chief Executive that he ‘call-in’ a decision made by the Tory Cabinet earlier this month. This means the decision is suspended and hopefully will be examined by a scrutiny committee. Why? Because the reports for the decision, over pedestrianising parts of East Street,  failed to include comments from any residents in spite of several having provided detailed objections. Council decisions cannot be based on consultations which have failed to include residents views. This just makes people (more) cynical about consultations and prevents decisions being taken on the balanced information.
  • Finally some Freedom of Information requests I put in some time ago have come to fruition, somewhat explaining why such huge rent rises are being demanded from seafront businesses. The reason? A big fat commission-based fee for the consultant leading the rent reviews for the Council. More details in “Huge consultant fees encourage seafront rent hikes“.