Week 11: Election security, internet voting, and evidence-based elections

In plain words

Week 11 of the My Vote Forward seminar asks how an election can prove its result is correct, and why security experts warn against voting online. Students read the National Academies’ 2018 report Securing the Vote, two papers on risk-limiting audits and evidence-based elections, independent security analyses of internet voting in Estonia, Washington, D.C., and West Virginia, a paper on blockchain voting, and a paper defining how a remote election could resist coercion.

A paper ballot that a voter checks can be recounted and audited. A vote sent over the internet cannot be checked the same way, and researchers have broken or found serious weaknesses in each internet voting system they studied in this week’s readings. This week explains what the evidence shows and what remains unsolved.

Defined terms

• Voter-verified paper record: a paper record of the vote that the voter can check before it is cast. See voter-verified paper record.
• Risk-limiting audit: a statistical audit that examines paper ballots until there is strong evidence that the reported outcome is correct, or escalates to a full hand count. See risk-limiting audit.
• Risk limit: the largest chance that the audit will fail to correct a wrong outcome.
• Software independence: a property of a voting system in which an undetected change in software cannot cause an undetectable change in the outcome.
• End-to-end verifiable voting: systems that let voters check their vote was recorded as intended and let anyone check that recorded votes were counted correctly. See end-to-end verifiable voting.
• Coercion resistance: in Juels, Catalano, and Jakobsson’s definition, the property that an adversary cannot determine whether a coerced voter complied.
• Threat model: a statement of which attackers and attacks a system is designed to withstand. See threat model.

Learning objectives

By the end of week 11, a participant should be able to:

1. State the National Academies’ recommendations on paper ballots and internet return of marked ballots.
2. Explain what a risk-limiting audit checks and what its risk limit means.
3. Describe Stark and Wagner’s evidence-based elections framework.
4. Summarize the findings of the Estonia, Washington, D.C., and Voatz security analyses, with their dates and scope.
5. Explain Park and coauthors’ argument against internet and blockchain voting.
6. Define coercion resistance and explain why it is hard to achieve remotely.
7. Explain why the strongest arguments for remote voting, especially access, still face these problems.

Core readings

1. National Academies of Sciences, Engineering, and Medicine, Securing the Vote: Protecting American Democracy (National Academies Press, 2018), summary and recommendations.⁠¹
2. Mark Lindeman and Philip B. Stark, “A Gentle Introduction to Risk-limiting Audits,” IEEE Security and Privacy, 2012.⁠²
3. Philip B. Stark and David Wagner, “Evidence-Based Elections,” IEEE Security and Privacy 10(5), 2012, pp. 33 to 41.⁠³
4. Drew Springall, Travis Finkenauer, Zakir Durumeric, Jason Kitcat, Harri Hursti, Margaret MacAlpine, and J. Alex Halderman, “Security Analysis of the Estonian Internet Voting System,” ACM Conference on Computer and Communications Security, 2014, pp. 703 to 715.⁠⁴
5. Scott Wolchok, Eric Wustrow, Dawn Isabel, and J. Alex Halderman, “Attacking the Washington, D.C. Internet Voting System,” Financial Cryptography and Data Security, 2012, pp. 114 to 128.⁠⁵
6. Michael A. Specter, James Koppel, and Daniel Weitzner, “The Ballot is Busted Before the Blockchain: A Security Analysis of Voatz, the First Internet Voting Application Used in U.S. Federal Elections,” USENIX Security Symposium, 2020.⁠⁶
7. Sunoo Park, Michael Specter, Neha Narula, and Ronald L. Rivest, “Going from Bad to Worse: From Internet Voting to Blockchain Voting,” Journal of Cybersecurity 7(1), 2021.⁠⁷
8. Ari Juels, Dario Catalano, and Markus Jakobsson, “Coercion-Resistant Electronic Elections,” ACM Workshop on Privacy in the Electronic Society, 2005, pp. 61 to 70.⁠⁸

Lecture notes

Why security belongs in a seminar on democracy

Election security is the subject of week 11 because the course has reached the point where design proposals must face adversaries. Weeks 1 to 10 asked how preferences are expressed, measured, and weighed. Week 11 asks what happens when someone tries to change them, read them, or fake them. The answer matters for the My Vote Forward framework, which describes requirements for a private vote without claiming to have built one. The site’s chapters on security, hardware, and audits and verification apply this week’s material to the framework.

The core idea of the week is a shift from trusting equipment to producing evidence. A voting system should not ask the public to trust that its software is correct. It should produce evidence, checkable by others, that the reported result reflects how people voted.

The National Academies: paper and no internet return

The National Academies’ 2018 report Securing the Vote is the most authoritative American consensus statement on the subject. Its public summary states that “all local, state, and federal elections should be conducted using human-readable paper ballots by the 2020 presidential election,” and that “ballots that have been marked by voters should not be returned over the Internet or any network connected to it, because no current technology can guarantee their secrecy, security, and verifiability”.⁠¹

Two features of the recommendation deserve attention. It is about marked ballots returned over networks, which is the core of internet voting. And its reason is a triple requirement: secrecy, security, and verifiability together. A system can provide one or two; the report’s judgment was that no current technology provides all three for ballots returned online.

Risk-limiting audits

Paper alone does not prove a result. It must be checked. Mark Lindeman and Philip Stark describe risk-limiting audits as providing “statistical assurance that election outcomes are correct by manually examining portions of the audit trail, paper ballots or voter-verifiable paper records.” If the sample does not “yield sufficiently strong evidence, more ballots are manually inspected, potentially progressing to a full hand tally.” The strength of evidence is set by the risk limit: “the largest chance that the audit will stop short of a full hand tally when the original outcome is in fact wrong, no matter why it is wrong, including ‘random’ errors, voter errors, configuration errors, bugs, equipment failures, or deliberate fraud.” Smaller risk limits require more evidence, and so do smaller margins: “the audit examines more ballots if the margin is 1% than if it is 10%”.⁠²

The phrase “no matter why it is wrong” is the key. A risk-limiting audit does not need to know what went wrong. It checks the outcome against the paper. The site’s cases on Colorado’s risk-limiting audits and the Georgia 2020 hand count audit show audits in practice.

Evidence-based elections

Philip Stark and David Wagner generalize the idea. They argue that “elections should be structured to provide convincing affirmative evidence that the reported outcomes actually reflect how people voted,” through “a combination of software-independent voting systems, compliance audits, and risk-limiting audits.” The result is “a resilient canvass framework: a fault-tolerant approach to conducting elections that gives strong evidence that the reported outcome is correct or reports that the evidence is not convincing.” They draw a policy conclusion: “there should be more regulation of the evidence trail and less regulation of equipment,” and compliance audits and risk-limiting audits “should be required”.⁠³

The compliance audit is easy to overlook and essential. It checks whether the paper trail itself is trustworthy, for example whether chain of custody was maintained, before the risk-limiting audit relies on it. An audit of a compromised paper trail proves nothing.

Estonia: a national system under analysis

Estonia is the most cited example of national internet voting, and the site’s Estonia case gives its history and the government’s own account. Drew Springall and coauthors analyzed it in 2014, when, in their words, “more than 30% of its ballots are cast online.” Using “in-person election observation, code review, and adversarial testing,” and a threat model that “considers the advanced threats faced by a national election system, including dishonest insiders and state-sponsored attacks,” they “find that the I-voting system has serious architectural limitations and procedural gaps that potentially jeopardize the integrity of elections.” In attacks on a reproduction of the system, they demonstrated “how such attackers could target the election servers or voters’ clients to alter election results or undermine the legitimacy of the system”.⁠⁴

Fairness requires two notes. The analysis describes the system as it stood in 2014, and Estonia’s system has changed since; students should consult the case page and Estonian official sources for later changes. And the site’s Estonia case records that Estonia continued to use internet voting and that later versions added verification features. The researchers’ conclusion, that their findings “illustrate the practical obstacles to Internet voting in the modern world,” is a claim about internet voting generally, which the other readings support.

Washington, D.C.: a public test

In 2010, Washington, D.C. developed an internet voting pilot for overseas absentee voters and held a public mock election, inviting anyone to test it. Scott Wolchok and coauthors took part. They report: “Within 48 hours of the system going live, we had gained near-complete control of the election server. We successfully changed every vote and revealed almost every secret ballot. Election officials did not detect our intrusion for nearly two business days, and might have remained unaware for far longer had we not deliberately left a prominent clue”.⁠⁵

The D.C. case is often cited as a failure, and it is equally a success of the testing process: the District invited scrutiny before using the system in a real election, and the weaknesses were found in time. The site’s Washington, D.C. case gives details.

Voatz: mobile voting in a federal election

Michael Specter, James Koppel, and Daniel Weitzner studied Voatz, which their paper’s title calls “the first Internet voting application used in U.S. federal elections.” They note that “in the 2018 midterm elections, West Virginia became the first state in the U.S. to allow select voters to cast their ballot on a mobile phone via a proprietary app called ‘Voatz,’” and that the company claims security through “a permissioned blockchain, biometrics, a mixnet,” and other measures, although “there is no public formal description of Voatz’s security model.” They describe their findings as “a concrete illustration of the common wisdom against Internet voting, and of the importance of transparency to the legitimacy of elections,” and report that, as a result of their work, “West Virginia and one county in Washington has already aborted their use of Voatz in the 2020 primaries”.⁠⁶ The site’s West Virginia case covers the pilot in more detail.

Blockchain is not a fix

Sunoo Park, Michael Specter, Neha Narula, and Ronald Rivest examine the claim that “voting on the blockchain” would increase security, and find such claims “wanting and misleading.” They argue that “Internet- and blockchain-based voting would greatly increase the risk of undetectable, nation-scale election failures.” On turnout, they report that “studies have been inconclusive, showing that online voting may have little to no effect on turnout in practice, and it may even increase disenfranchisement.” Their central point is that, “given the current state of computer security,” any turnout gain “would come at the cost of losing meaningful assurance that votes have been counted as they were cast, and not undetectably altered or discarded”.⁠⁷

A blockchain can make records hard to alter after they are written. It does nothing to ensure that a vote was recorded correctly by a voter’s possibly compromised phone, that the voter was not coerced, or that the voter was who they claimed to be. Those are the hard problems.

Coercion: the problem the booth solved

Week 4 showed that the secret ballot was adopted to stop intimidation. Remote voting reopens that problem. Ari Juels, Dario Catalano, and Markus Jakobsson define a strong adversary who can demand “that they vote in a particular manner, abstain from voting, or even disclose their secret keys,” and define a scheme as coercion-resistant “if it is infeasible for the adversary to determine if a coerced voter complies with the demands.” They present a protocol meeting this definition. Its requirements are instructive: it needs “an anonymous channel during the casting of ballots, and an untappable channel during registration (potentially using postal” mail).⁠⁸

The idea, roughly, is that a coerced voter can give the coercer fake credentials that look real, and cast a real vote later. That requires a moment, at registration, when the voter is free from observation, and it requires voters to understand and use the scheme correctly under pressure. Cryptography can shift the problem; it cannot remove the need for a private moment. The site’s chapter on intimidation and the page can a household coerce a remote voter? take up the practical consequences.

The strongest case for remote voting

Fairness requires stating the other side at its strongest. Remote voting could help voters with disabilities, voters overseas and in the military, and voters far from polling places, groups the site discusses in disability access. Mail voting already provides remote access with paper records that can be audited, as the Oregon case shows. Advocates of internet voting argue that its risks should be weighed against the real exclusion of people who cannot vote otherwise. The readings do not dismiss that argument. They argue that current technology cannot provide secrecy, security, and verifiability together for ballots returned online, and that the costs of an undetectable failure would fall on everyone.

Discussion questions

1. The National Academies require secrecy, security, and verifiability together. Which of the three would you be most willing to weaken for access, and what would follow?
2. A risk-limiting audit checks outcomes “no matter why” they are wrong. Why is that property important for public trust?
3. Was the D.C. public test a failure or a success? What would a responsible test of any new voting technology look like?
4. Voatz did not publish a formal security model. Should any system be used in public elections without one?
5. Juels and coauthors require a private moment at registration. Is that realistic for everyone? Who would lack it?
6. How should a jurisdiction weigh access gains for specific groups against system-wide security risks?

Assignment

Threat model exercise (1,500 words). Write a threat model for a hypothetical remote system that collects priorities, not votes, and a second for a hypothetical remote secret ballot. For each, identify assets, adversaries (including insiders, foreign actors, and household coercers), attacks, and the evidence that would show whether an attack succeeded. Explain why the two threat models differ, using at least four readings. Do not test or probe any real system.

Evidence

The National Academies recommendations are quoted from the report’s catalog page. Lindeman and Stark are quoted from their paper. Stark and Wagner, Springall and coauthors, Park and coauthors, and Juels and coauthors are quoted from their abstracts. Wolchok and coauthors are quoted from their paper. Specter, Koppel, and Weitzner are quoted from the USENIX abstract page. All sources were opened on the review date. Later changes to Estonia’s system are summarized from the site’s Estonia case, which carries its own sources.

Competing interpretations

Most election security researchers, represented by this week’s readings, hold that internet return of marked ballots cannot currently meet secrecy, security, and verifiability requirements together, and that paper with audits is the reliable standard. Some governments and vendors have argued that their systems manage risk adequately and that access benefits justify them, and Estonia has used internet voting nationally for years. Accessibility advocates argue that paper-based systems also exclude, and that risks must be weighed against that exclusion. Cryptographers have developed verifiable and coercion-resistant protocols that answer some objections in theory; critics reply that real deployments face device security, usability, and coercion problems those protocols do not remove.

Application to this framework

My Vote Forward states requirements for a private vote and does not claim to have built one. This week’s readings support that restraint: the requirements it names, including secrecy, verifiability, coercion resistance, and evidence independent of the operator, are exactly the ones independent researchers have found internet voting systems fail to meet. The framework’s security chapter should be judged on whether its threat model matches this literature.

Unresolved questions

• Can any remote voting design provide a private moment for coerced voters at scale?
• What evidence standard should apply to priority collection, which does not elect anyone but may still influence decisions?
• How should the access benefits of remote voting for specific groups be measured and weighed against system-wide risk?