The School of Computing and Technology
Eastern Mediterranean University
Spring Semester Academic Year 2013 – 2014
ITEC 317
ONLINE VOTING
PRESENTED BY
AKINSANYA BLESSING
128593
TABLE OF CONTENT
I.
What is online voting?
II. What are the electronic systems?
III. Advantages Of Online Voting
IV.
Disadvantages of online voting
V.
Security threats of online voting
What Is Online Voting?
Online voting is a form of electronic voting and involves casting a ballot through
the internet. Normally this involves logging on to a website through any computer
with access to the internet, including your home PC. Votes are not stored in the
machine used to cast the vote, but on a central vote server that tallies votes at the
end of polling. However, online voting can also be conducted using voting kiosks.
These kiosks contain computers installed in public places for the purpose of online
voting, but are not supervised by electoral officials. Computers can also be
installed in the polling station to allow Online voting.
Online voting was first used for binding political elections in 2000 in the
U.S. in a pilot across several states targeting overseas voters. Since then, 13 more
countries have used Online voting. Two countires use Online voting nationwide
(Estonia and the United Arab Emirates); five use Online voting in some parts of
the country or for certain members of the electorate (Australia, Canada, France,
Mexico and Switzerland); two have ongoing pilots (India and Norway); three have
piloted Online voting and decided not to continue its use (Finland, the UK and the
U.S.); and two adopted Online voting, but decided to discontinue it (Netherlands
and Spain).
Countries that use Online voting tend to target specific categories of voters – for
example, expatriate voters, military personnel posted overseas, absent voters or
voters with disabilities.
Despite the Online playing an increasing role in the lives of people around
the world, there has been significant caution about the adoption of Online voting.
Some have argued that we trust the Online for banking transactions and to make
online purchases, so we should trust it to cast ballots. However, these online
transactions have a level of transparency, which means you can check they are
accurate. The need for ballot secrecy means transparency and auditability in Online
voting is difficult to implement.
This is illustrative of the biggest lesson we can learn about Online voting:
this system has much to offer, but it brings significant challenges that need to be
properly addressed if it is to positively impact the electoral process. The
auditability of the system is one of these challenges, and this inherent lack of
transparency has implications for the trust placed in the system.
PROPERTIES OF A SECURED ONLINE VOTING PROCESS
1. PRIVACY: there is no association between voter’s identification and a
marked ballot.
2. ELIGIBILITY: Only eligible voters are permitted to cast their ballots.
3. UNIQUENESS: No voter can cast his ballot more than once.
4. RECEIPT- FREENESS: A voter does not gain any information (a receipt)
which can be used to prove to a coercer that he or she voted in a certain way.
5. FAIRNESS: No partial result is available before the final result comes out.
6. VERIFIABILITY: Voters can verify that their ballots are counted correctly.
There are two types of verifiability; individual verifiability and universal
verifiability.
7. EFFICIENCY: The computations can be performed within a reasonable
amount of time.
What are the electronic systems?
In this section, theory related to existing voting systems is explained.
 Polling Place Internet Voting :Voting is done at any valid polling place by
using a computer under the physical control of election officials to cast a
ballot over the internet.
 Remote Kiosk Internet Voting is voting done at certain locations by using a
computer under the physical control of election officials to cast a ballot over
the interenet.
 Precint Internet voting: Voting that is identical to polling place internet
voting except that the voter can only vote at his or her own voting place.
 Remote Internet is voting by using a computer that is not under the physical
control of election officials.The ballot is cast over an internet connection
Online voting system by Cellphone/Smartphone
In the twenty first century, public acceptance of online voting has been promoted
by popular Television media shows such as Star Search (1980 to 1990s) and
various other variety shows. Most recently, American idol has shown a large
audience base. "There are multiple ways for you to vote for your next American
Idol: (1) Toll-free Number Voting; (2) AT&T Text Voting (SMS); (3) Online Voting
at www.AmericanIdol.com; and (4) the American Idol App Voting.The most
interesting fact is that smartphone and wireless devices provides an economic
solution to the expensive Paper ballot/mail in ballot system. In addition, most votes
are translated into an electronic format with both government identification of
identity, economic identification of identity and in addition geographical
verification of location.
ADVANTAGES OF ONLINE VOTING
Despite the challenges discussed, Online voting has a lot to offer. With increasing
levels of access to the Online, the most obvious benefit is the ease of access to the
voting process.No longer would people have to trudge down to schools, church or
community to vote now ould bad weather conditions hinder people from
voting.They can vote in the comfort of their homes, offices or visit a nearby
internet café. This is especially important in the context of declining turnout in
elections in many democracies around the world. By decreasing barriers to
participation, it is hoped Online voting can slow or reverse this decline. Voters
who are overseas, military personnel, emergency service personnel who work on
Election Day can vote from anywhere and be assured that their vote would be
counted. voters with disabilities can especially benefit from the increased access,
they can vote from their own homes without the stress of moving around. It might
also pull the hardest to reach group, those between the ages of 18 and 25 into the
political process. They have a tremendous amount of experience in surfing the net
and like the idea of new technologies. Online voting can also eliminate significant
logistical challenges associated with paper-based elections. The removal of these
logistical challenges can reduce the costs of holding elections, although new costs
will also arise.
DISADVANTAGES OF ELECTRONIC VOTING
(i)
Inequality problem: For those with low salary and cannot afford to
access the internet then it is a very big problem for them to vote. This is
known as digital divide.
(ii)
Vulnerable to security: Security issue is the main drawback of the
electronic voting system. The attack might be from the webpage, network
or even the extent of server’s database.
(iii)
Virus: Virus can be sent to destroy data from the server. Sever can be
easily protected from this virus by using some specific operating system.
(iv)
Hacking: Hackers are a big problem on the Online today.
(v)
Educational Ignorance: Some aged adults can not make use of the
computer or internet.
Security Threats of Online Voting
As all information systems, an online voting system is normally vulnerable to
computer attack. Although online voting system may improve our voting system
but the disadvantage or the threats of a security attack is really causing a setback
which is overweighing the advantages or benefits of using electronic voting. The
security problems are usually from the voter’s personal computers because that is
the weakest link and most voters don’t keep their personal computer well. Almost
everybody has experienced some kind of virus infection to their personal computer
which can be a link to destroy data used for election. I have listed some security
threats to talk about in this section.
a) Malicious payload: malicious payload is a security threat that affects the
personal computers of the voters. It is a software or configuration designed
to harm and it could be a virus, worm, Trojan horse, or a remote control
program which may be the biggest threat in voting. If malicious program is
installed on the system of the voters, it could change the vote secretly. The
owner of the system might be unaware of even having a malicious program
installed because this program might be difficult to detect because most of
the time, it run on a stealth mode. With today’s hardware and software
architectures, a malicious payload on a voting client can actually change the
voter's vote, without the voter or anyone else noticing, regardless of the kind
of encryption or voter authentication in place. For Example, Backorifice
2000 (BO2K) is packaged and distributed as a legitimate network
administration toolkit. In fact, it is very useful as a tool for enhancing
security. BO2K contains a remote control server that when installed on a
machine, enables a remote administrator (or attacker) to view and control
every aspect of that machine, as though the person were actually sitting at
the console. The open source nature of BO2K means that an attacker can
modify the code and recompile such that the program can evade detection
by security defense software (virus and intrusion detection) that look for
known signatures of programs. A signature is a pattern that identifies a
particular known malicious program. The current state of the art in widely
deployed systems for detecting malicious code does not go much beyond
comparing a program against a list of attack signatures. In fact, most
personal computers in peoples’ houses have no detection software on them.
BO2K is said to run in stealth mode because it was carefully designed to be
very difficult to detect. The program does not appear in the Task Menu of
running processes, and it was designed so that even an experienced
administrator would have a difficult time discovering that it was on a
computer. The program is difficult to detect even while it is running.
There can be no expectation that an average Online user participating in an
online election from home could have any hope of detecting the existence of
BO2K on his computer. At the same time, this program enables an attacker to
watch every aspect of the voting procedure, intercept any action of the user with
the potential of modifying it without the user’s knowledge, and to further install
any other program of the attackers desire, even ones written by the attacker, on the
voting user’s machine. The package also monitors every keystroke typed on the
machine and has an option to remotely lock the keyboard and mouse. It is difficult,
and most likely impossible, to conceive of a web application (or any other) that
could prevent an attacker who installs BO2K on a user’s machine from being able
to view and/or change a user’s vote.
(a) Delivery mechanism
The previous section gave an example of what an attacker could do to
disrupt an election if the attacker could install code of his choosing on peoples’
computers. This section deals with how this installation could happen.The first,
and most obvious mechanism is physical installation. Most people do not keep
their computers in a carefully controlled, locked environment. Imagine
someone who develops an application to attack the voting system, prepares a
floppy disk with the code on it, and then installs it on as many machines as
possible. This could be accomplished by breaking into houses, by accessing
machines in someone’s house when visiting, by installing the program on
public machines in the library, etc. at some point leading up to an election.
Then, malicious code can be delivered that can trigger any action at a later
date, enable future access (as in the case of BO2K), or disrupt normal
operation at any time. Considering that many of the attack programs that we
are seeing these days run in stealth mode, malicious code could be installed
such that average computer users cannot detect its presence.
While the physical delivery of malicious code is a serious problem, it is
nowhere near as effective as remote automated delivery. In most of the cases,
the attacks spread wider and faster than their creators ever imagined. One thing
that all of these attacks have in common is that they install some code on the
PCs that are infected. Any one of these e-mail viruses could deliver the attack
code described in the previous section.
The computers in most peoples’ houses are running operating systems with
tens of thousands of lines of code. These systems are known to be full of
operational bugs as well as security flaws. On top of these platforms, users are
typically running many applications with security problems. These security
flaws can be exploited remotely to install malicious code on them.
Perhaps the most likely candidate for delivering a widespread attack against an
election is an ActiveX control, downloaded automatically and unknowingly from
a Web server, which installs a Trojan horse (hidden program) that later interferes
with voting. Several documented attacks against Windows systems operated
exactly this way. In fact, any application that users are lured into downloading
can do the same. This includes browser plug-ins, screen savers, calendars, and
any other program that is obtained over the Online. Another danger is that the
application itself may be clean, but the installer might install a dynamically
linked library (DLL) or other malicious module, or overwrite operating system
modules. The number of ways is legion, and most users are not aware of the
dangers when they add software to their computers. As long as there are people
out there who download and install software over the Online onto today’s
personal computers running today’s operating systems, it will be easy for
attackers to deliver code that changes their votes, to peoples’ computers.
All of This is in sharp contrast to holding an election that allows people to cast
their votes from a computer full of insecure software that is under the direct control
of several dozen software and hardware vendors and run by users who download
programs from the Online, over a network that is known to be vulnerable to total
shutdown at any moment.
(b) Denial of service attack: Denial of service attacks are carried out by
automatically sending a flood of messages to a web site, a server, over a
channel or similar, to make it crash or decrease quality because it can’t
handle all the generated traffic. By using the distributed denial of service,
attackers can cause routers to crash or election server to be flooded. This can
be a significant threat to the Online voting if for instance the voting occurs on
a single day.
(c) Spoof sites: spoof sites are malicious web sites that are created to look like
legitimate web site, and in a voting scenario we understand that this could be
really bad, as the site could be used to launch phishing attacks to collect
voters credentials like a pin or a password needed to cast a vote. There are
several ways that an attacker could spoof a legitimate voting site. One way
could be to send email messages to users telling the users to click on a link
which would then bring up a fake voting site were the adversary could collect
the user’s credentials, steal the vote, and then use it differently. An attacker
could also set up a connection to the legitimate server and then feed the user
a fake web page, acting like the man in the middle, transferring and
controlling all the traffic between the user and the web server. By transferring
all the information between user and server, the user’s vote can be altered
before further sent to the server .
Given the above discussion, should countries move towards the adoption of
Online voting?
There are many challenges to be dealt with in implementing Online voting, but
also many benefits that could be achieved. There is no right or wrong answer as to
whether a country should adopt Online voting. The advantages and disadvantages
will need to be carefully weighed up, electoral stakeholders will need to be
consulted and the specific electoral environment assessed to determine whether
Online voting is appropriate and feasible. It is also very important for countries
which wish to adopt Online voting to conduct pilot projects to ensure that their
expectations of Online voting and their anticipated benefits can be achieved, and
the challenges can be properly dealt with.