Internet Voting: Making Elections Hackable Barbara Simons IBM Research (retired) Board Chair, Verified Voting 1

Principles for This Hearing • Effectiveness and legitimacy • Engagement • Accessibility and inclusiveness • Integrity • Local representation 2

Australia’s Assessment of Internet Voting “Many think it sounds like a good idea for the next federal election. No matter your view, this is not feasible. … “After hearing from a range of experts, and surveying the international electoral landscapes it is clear to me that Australia is not in a position to introduce any large-scale system of electronic voting in the near future without catastrophically compromising our electoral integrity.” -- Hon Tony Smith MP Chair, Joint Standing Committee on Electoral Matters, Nov. 2014, Canberra 3

Yahoo! (500 million accounts worldwide, including Canada) Finance Department (Canada) Treasury Board Secretariat (Canada) Defence Research and Development Canada National Research Council (Canada) Ottawa Hospital Univ. of Calgary Democratic National Committee (US) Office of Personnel Management (US) Pentagon email, US Postal Service IRS White House (US) FBI US State Department Ashley Madison Jeep, Sony Anthem Health Insurance JP Morgan, Charles Schwab Kmart, Target Google, AOL Symantec, Adobe Northrop-Grumman Juniper Networks etc. 4

5

Computer Vulnerabilities put Elections at Risk l What will happen if months after a gov’t is seated it is discovered that the election had been hacked? l Recently discovered Yahoo breach started in 2014 l DNC breach occurred months before discovered l Can replace money stolen from online bank accounts l A lot is stolen by malware – can discuss in Q/A l CANNOT REPLACE STOLEN VOTES 6

The Secret Ballot • When you bank online or buy a book from amazon, they know who you are and what you want to do • When you vote, you do not want anyone else to know your selections • Online voting may threaten the secret ballot • E-voting is a much harder technical challenge than e-commerce See “The Secret Ballot at Risk” http://secretballotatrisk.org/ 7

Toronto Security Analysis • Independent security experts examined 3 major systems: Scytl, Everyone Counts, Dominion • In response to a Toronto RFP • “… no proposal provides adequate protection against the risks inherent in Internet voting … [We recommend] that the City not proceed with Internet voting in the upcoming municipal election.” 8

Quebec Moratorium • Quebec municipalities could use “electronic voting” machines 1995 – 2005 • Electronic ballot boxes: scanner counted paper ballots • Voting terminals: voter made selections on machines by pressing buttons to record choices • Terminal produced results at end of election • Nov. 2005 election had major machine breakdowns • Difficult obtaining repairs • Created moratorium on all electronic voting – still in effect • No Internet voting 9

Recommendations of Independent Panel on Internet Voting to the Legislative Assembly of British Columbia, Canada February, 2014 https://www.verifiedvoting.org/wp-content/uploads/2014/10/CA-BC-2014-recommendations- final-report.pdf 10

BC Panel Conclusions • Non-voters usually don’t vote over the Internet • Used as a tool of convenience for voters who had already decided to vote • Most popular among middle-age voters • Least popular among youth • Reflects traditional voter turnout Do not implement Internet voting for either local or provincial government elections at this time 11

Estonia • Claimed as example of successful Internet voting • May 2014 independent group of international experts performed security evaluation • Estonian system vulnerable to state-level attackers who could compromise the secret ballot, disrupt elections, or cast doubt on the fairness of results • Vulnerable to range of attacks including vote-stealing malware on voters’ machines • Recommended that Internet voting be halted See https://estoniaevoting.org/findings/summary/ 12

Washington, DC Pilot Hack • Internet voting was planned for 2010 midterm election • Two weeks before a pilot test conducted • Anyone from anywhere could attempt to break in – like real life • Within 36 hours a team from Univ. of Penn. had total control. Could: • Change already case and future ballots • Reveal voters’ secret ballots • Install calling card of U. Mich fight song • Discover probes coming from China and Iran – protected the system from the probes • No other vendor has allowed such a test, even though Internet voting is vulnerable to attack by anyone from anywhere 13

Computer Scientists Can - and Want to - Help • No currently available commercial Internet voting system is secure • Creating a secure Internet voting system is extremely hard because of secret ballot • Even more difficult than securing online banking, which is NOT SECURE • The computer science community can provide expertise on how to design and test computerized voting systems, including Internet voting • Need more research – should NOT conduct pilot elections, which can impact election results, until Internet voting can be made secure • https://www.verifiedvoting.org/ 14