You Go to Elections with the Voting System You Have:Stop-Gap Mitigations for Deployed Voting Systems

J. Alex Halderman
Princeton University

Hovav Shacham
University of California, San Diego

Eric Rescorla
RTFM, Inc.

David Wagner
University of California, Berkeley

Abstract

In light of the systemic vulnerabilities uncovered by recent reviews of deployed e-voting systems, the surest way to secure the voting process would be to scrap the existing systems and design new ones. Unfortunately, engineering new systems will take years, and many jurisdictions are unlikely to be able to afford new equipment in the near future. In this paper we ask how jurisdictions can make the best use of the equipment they already own until they can replace it. Starting from current practice, we propose defenses that involve new but realistic procedures, modest changes to existing software, and no changes to existing hardware. Our techniques achieve greatly improved protection against outsider attacks: they provide containment of viral spread, improve the integrity of vote tabulation, and offer some detection of individual compromised devices. They do not provide security against insiders with access to election management systems, which appears to require significantly greater changes to the existing systems.

-snip-

While the procedures that we recommend in Sections 2–4 can help slow the spread of malicious software among the components of a voting system, they cannot prevent all such attacks. For instance, they cannot defend against insider fraud, nor do they provide any way for observers to independently verify election results. Further safeguards are necessary: following every election, a post-election audit should be carried out to ensure that the totals from the tabulation phase agree with the voter-verifiable paper ballot records created during the voting process, and to ensure that election observers can verify that this is the case.

While conducting a thorough audit may be time consuming, it provides a higher level of confidence in the integrity of the result than any other mechanism we have been able to identify.

http://www.cs.berkeley.edu/~daw/papers/stopgap-evt08.pdf

"While conducting a thorough audit may be time consuming, it provides a higher level of confidence in the integrity of the result than any other mechanism we have been able to identify."

Except hand-counted paper ballots!

Why is this simple solution not allowed? It is like the 1980's when every speech from every person high-profile enough to be invited to give a speech began: "Of course, we must Globalize."

I hope someday to understand how these meta-messages that pre-select what is "on the table" in all discussions, everywhere get decided, dispersed and adopted so un-erringly.

Right now, I don't.

In that case, the best you can do is hand count enough ballots to see who won. It's true that for some elections, that would be all the ballots. But not for all elections.