If voting in person isn’t secure and voting online isn’t secure, what’s the answer?
Confidence in the outcome of an election increasingly depends on the integrity of the voting systems themselves, cryptographer Matt Blaze told Black Hat 2020 attendees today.
Never has there been a more critical time to debate computer-aided voting, particularly as the world’s attention shifts to the upcoming 2020 US Presidential Election.
With the Covid-19 outbreak making social distancing measures necessary worldwide, how can governments protect the health of voters while maintaining the integrity of their elections?
Blaze, a cryptography expert and chair of computer science and law at Georgetown University, Washington DC, posed this question during the keynote speech at the opening of the virtual Black Hat security conference.
“This is a very different talk than one I would have given four, five months ago,” he told attendees.
“How secure is voting? When we add computers to it, in principle, you know, in theory, this is a pretty simple problem.”
“But, as either Yogi Berra or John Von Neumann, famously said – in theory, theory and practice are the same thing. But in practice, they’re different.”
Blaze points to a ballooning attack surface, including county-level election management software, voting machine software, removable media such as USB sticks, and human targets.
Read more of the latest election security news
“It’s very broad, everything from denial of service to altering or forging precinct counts, compromising the tally or deleting a record, and the possibility of viral propagation – where the compromising one component of the system can end up compromising every other component in the county,” he said.
“And unfortunately, these attacks are not merely theoretical. When computer scientists have been asked to look at voting systems, invariably, what they discover is that there are practical ways to do all of these things.
“In fact, every current voting system that’s been examined is terrible in some way and probably exploitable,” said Blaze.
Emergency vote
In the US, the unprecedented pandemic has forced election security experts to prepare for the worst-case scenario, as the opportunity to vote in person is not, as of yet, guaranteed.
Absentee ballots are currently accepted if the voter can prove they are not able to vote in person. In some states, mail-in votes are allowed without explanation.
But for the majority of voters who attend the ballots in person, is there another option?
Some might point to the possibility of e-voting, a long-idealized system that would allow citizens to cast their ballot via a home computer or mobile device – and one that is yet proven to be wholly secure.
RELATED Control-Alt-Delete? Swiss gov’t puts the brakes on e-voting
One of the major concerns surrounding online voting is the risk of interference. Nation-state adversaries are one threat cited by Blaze.
“They may be satisfied with simply disrupting the overall process and casting doubt on the legitimacy of the outcome, or making it difficult for people to vote or to know who won,” he said.
So, if voting in person isn’t secure and voting online isn’t secure, what is the answer?
“If you ask the internet, they are pretty unanimous that there are either two solutions to this problem. One is that you shouldn’t use software – let’s go back to hand counting paper ballots.
“The other is that you should use more software – that is, everyone should vote on the block chain. And unfortunately, once you start digging in, neither of those ‘simple’ solutions are as viable as they might sound.”
Matt Blaze raised some key questions surrounding election security during his Black Hat 2020 keynote
2020 vision
“So, where do we go from here?” Blaze mused. “Should we be optimistic or pessimistic for November?
“I think the answer is yes to both. There’s reason to be optimistic and reason to be pessimistic. Let's start with the pessimism.
“There’s a lot of uncertainty about how many voters who would otherwise vote in person will need mail-in ballots, and we’re likely not to know until it’s too late to change course.
“That means we need to prepare for a very wide range of scenarios that may not come to fruition. We may need to print lots of ballots we don’t end up using and also provide for lots of in-person voting that might not be used under pandemic conditions.
Read more of the latest news from Black Hat 2020
“It’s likely that most jurisdictions are going to not have the funding to do this themselves.”
He added: “So our expertise in this community is central to many of the problems that we have here. And I think the optimistic note is that we can do this, but we need to engage now.
“Let me end with a kind of call to arms that this community is precisely the one who can help, who among others is going to be needed by your local elected officials – call them, find out what their plans are.
“Find out how you can help… do they need IT expertise? Find out and engage with them. I think we can do this, but we have to want to, and we have to all take responsibility for this.”
The Daily Swig will be back with more Black Hat 2020 coverage all week.
READ MORE Election security: Democracy Live’s online voting system ‘open to manipulation’
