July 1, 2022

What the Assessments Say About the Swiss E-voting System

(Part 4 of a 5-part series starting here)

In 2021 the Swiss government commissioned several in-depth technical studies of the Swiss Post E-voting system, by independent experts from academia and private consulting firms.  They sought to assess, does the protocol as documented guarantee the security called for by Swiss law (the “ordinance on electronic voting”, OEV)?  Does the system as implemented in software correctly correspond to the protocol as documented?  Are the networks and systems, on which the system is deployed, adequately secure?

Before the reports even answer those questions, they point out: “the engineers who build the system need to do a better job of documenting how the software, line by line, corresponds to the protocol it’s supposed to be implementing.”  That is, this kind of assessment can’t work on an impenetrable black-box system; the Swiss Post developers have made good progress in “showing their work” so that it can be assessed, but they need to keep improving.

And this is a very complex protocol, and system, because it’s attempting to solve a very difficult problem:  conduct an election securely even though some of the servers and most of the client computers may be under the control of an adversary.   The server-side solution is to split the trust among several servers using a cryptographic consensus protocol.  The client-side solution is what I described in the previous post: even if the client computer is hacked, it’s not supposed to be able to succeed in cheating because there are certain secrets that it can’t see, printed on the paper and only visible to the voter.

Now, does the voting protocol work in principle?  The experts on cryptographic voting protocols say, “The Swiss Post e-voting system protocol documentation, code and security proofs show continuing improvement. The clarity of the protocol and documentation is much improved on earlier versions [which] has exposed many issues that were already present but not visible in the earlier versions of the system; this is progress. … There are, at present, significant gaps in the protocol specification, verification specification, and proofs. … [S]everal of the issues that we found require structural changes …. ”

And, is the system architecture secure?  The expert on system security says, “the SwissPost E-voting system [has] been evolving … for well over a decade. … The current generation of the system under audit takes many important and valuable measures for security and transparency that are to this author’s knowledge unprecedented or nearly-unprecedented among governmental E-voting programs worldwide. At a technical level, these measures include individual and universal verifiability mechanisms, trust-splitting of critical functions across four control components, the incorporation of an independent auditor role in the E-voting process, and the adoption of a reproducible build process for the E-voting software.  [I see] ample evidence overall of both a system and a development process represent[ing] an exemplar that other governments worldwide should examine closely, learn from, and adopt similar state-of-the-art practices where appropriate.”

But on the other hand, he says, “the current system under audit is still far from the ideal system that … perhaps any expert well-versed in this technology domain – would in principle like to see. Some issues [include] the current system’s reliance on a trusted and fully-centralized printing authority, and its exclusion of coercion or vote-buying as a risk to be taken seriously and potentially mitigated.  [And] Explicit documentation of the architecture’s security principles and assumptions, and how the concrete system embodies them, is still incomplete or unclear in many respects … The architecture’s trust-splitting across four control components strengthens vote privacy, but does not currently strengthen either end-to-end election integrity or availability … The architecture critically relies on an independent auditor for universal verifiability, but the measures taken to ensure the auditor’s independence appear incomplete … While the system’s abstract cryptographic protocol is well-specified and rigorously formalized, the security of the lower-level message-based interactions between the critical devices – especially the interactions involving offline devices – do not yet appear to be fully specified or analyzed.”

In conclusion,  the cryptographic-protocol experts recommend, “We encourage the stakeholders in Swiss e-voting to allow adequate time for the system to thoroughly reviewed before restarting the use of e-voting,”  while the system-security expert concludes, “as imperfect as the current system might be when judged against a nonexistent ideal, the current system generally appears to achieve its stated goals, under the corresponding assumptions and the specific threat model around which it was designed.”

In the next part of this series:  Threats that the experts didn’t think of.

How the Swiss Post E-voting system addresses client-side vulnerabilities

(Part 3 of a 5-part series starting here)

In Part 1, I described how Switzerland decided to assess the security and accuracy of its e-voting system.  Swiss Post is the “vendor” developing the system, the Swiss cantons are the “customer” deploying it in their elections, and the Swiss Parliament and Federal Chancellery are the “regulators,”  deciding whether it’s secure enough for the cantons to use.

Internet voting has inherent vulnerabilities that need to be addressed by any e-voting solution:

  • The server:  bugs in the server that receives e-ballots and counts them; vulnerabilities in the server that allow hackers to penetrate and alter the vote-counting software; the possibility that insiders can use their access to subvert the vote counts.
  • The client:  bugs in the voter’s voting-app or browser app; vulnerabilities in the voter’s browser or operating system or hypervisor or BIOS that allow hackers to subvert the app so that it changes the ballot, after the voter sees it but before it is encrypted and transmitted.
  • The communications network: possibility that attackers can change votes in transit, or cause ballots to be lost, or to commit denial-of-service attacks.
  • Authentication of voters:  association of a physical human being with a set of digital credentials.

Of these, the communications network is probably the easiest to address with known technology (end-to-end encryption/authentication).  Authentication of voters can be very difficult or less difficult depending on societal infrastructure.  (Since Switzerland has no universal digital ID card, they address this issue by mailing a sheet of paper to each voter before each election, with an authorization key.)  The server and insider threats can (perhaps) be addressed by splitting the server’s responsibilities among independent machines managed by independent trusted people, and using cryptographic protocols that prove consensus – and this is definitely an important part of the Swiss Post solution.

But it’s that other part, insecurities in the client, that the Swiss Post system tries to address in a more solid and responsible way than almost any other e-voting system deployed in other countries in public elections.  A few other countries (and U.S. states, and Australian states) have deployed e-voting – typically in a limited way, only for citizens living abroad – and every one of them that I know of can be hacked on the client side.  If the hacker installs a modified browser on your laptop computer, or hacks the operating system of your phone, then the voting app can be made to display to you the candidate choices that you indicated, but then encrypt, authenticate, and transmit a different set of votes.   And if the e-voting system has some feature that lets you “check” whether your votes were recorded correctly at the server, then the hack can subvert that feature too, to reassure you.

And the Swiss method of securing the client is:  Send a sheet of paper through the mail.   Before each election, the election administrator sends to each e-voter a personalized paper.  At the top is a numeric key, randomly chosen for that voter alone.  At the beginning of the voting session, the voter types the key into the voting app.

(at the top of the paper sheet is this box)

The voter then selects candidates in the app, and the app uses the voter’s key to encrypt/authenticate the vote selections, and transmit them to a server.

If we stopped here, it would be insecure:  the app could cheat, and encrypt a ballot with candidates that the voter didn’t choose.

The next step is that the servers return “result codes.”  These are calculated based on the private key, known to the server but not to the voter or the client-side app, associated with the start-voting-key that the voter typed in.  The voting app displays these result codes.

Then the voter looks up the result codes on the sheet of paper, and checks that they correspond to the candidates that were chosen.

If the system is working correctly, then the voting app (even if hacked) can’t know what the result codes are supposed to be.  The (hacked) app can’t display the right result codes unless it gets them from the server, and it can’t get them from the server unless it has encrypted the right candidates in the first place.  And it can’t see what result codes are written on the paper, unless the voter’s computer has some sort of camera attached to it ¯\_(ツ)_/¯.  Do computers have cameras? Really?  And why would the camera ever be aimed at the paper sheet during the process of entering the start-voting-key?

If the Swiss Post e-voting system might possibly be secure, it’s only because of the out-of-band communication channel that is completely out of reach of the voter’s computer.  That is: a sheet of paper sent through the mail, to the voter.

So the Swiss Post e-voting system isn’t exactly paperless.  It is not a “pure” internet voting system.  Scientists do not know how to make an adequately secure internet voting system without paper.  (And by the way, the thoughtless use of paper doesn’t help:  for example, when you upload or e-mail a PDF file to an election administrator who then prints it out onto paper before feeding it through the optical-scan voting machine.  That’s not a “paper trail”, because the voter can’t see it, and it doesn’t make the system secure.)

In the next part of this series, I’ll analyze what problems remain in the Swiss Post system: some problems raised in the reports commissioned by the Chancellery, and some things that they haven’t thought of.

Next part: What the Assessments Say About the Swiss E-voting System

How NOT to Assess an E-voting System

by Vanessa Teague, an Australian computer scientist, cryptographer, and security/privacy expert.

(Part 2 of a 5-part series starting here)

Australian elections are known for the secret ballot and a long history of being peaceful, transparent and well run. So it may surprise you to learn that the Australian state of New South Wales (NSW) is home to one of the world’s largest Internet voting projects, second only to Moscow’s by absolute number. In the 2021 New South Wales local government elections, 652,983 votes were received from the Internet, including more than one third of votes for the Sydney city council.

The system suffered substantial downtime throughout polling day and the day before. There is no way to tell how many voters were disenfranchised. Electoral Commission estimates give a total of about 20,000 people who registered to use iVote but did not receive a voting credential in time to vote. About half of these probably voted on paper; the rest were disenfranchised. In many councils, the number of disenfranchised people was enough to change the election outcome. As a consequence, the Supreme Court of New South Wales voided the results in three local councils, though the results are highly uncertain in many other councils too. 

iVote has had serious reliability issues and security concerns since its inception. The protocol does not provide any genuine verification, either for the voter to check that their vote reflects their intentions, or for election observers to verify that the complete set of votes has been properly included and decrypted. In 2015, Alex Halderman and I showed that it was vulnerable to an Internet-based attacker who could take over the voting session and substitute a different vote. In 2017, a different set of colleagues found that a version of the vote could be decrypted directly by the server. In 2019, when Thomas Haines, Sarah Jamie Lewis, Olivier Pereira and I found serious cryptographic errors in the Swiss Internet voting system, the NSW Electoral Commission announced that iVote had the same problems

Unlike Switzerland, NSW attempted no serious reassessment of either the regulations or the system design. Even when their appointed auditing team raised concerns about hardcoded passwords, a possible opportunity to delete votes without detection, and inadequate procedures for ensuring that the executed code matched the audited code, the NSW Electoral Commission simply ran iVote again in 2021. No regulations were altered, and they continued to threaten jail time for sharing the source code, though the sharing of source code in Switzerland had led to the identification and correction of serious problems in NSW.

We don’t have demographic or political data, either about who tried to use iVote or who was most impacted by its downtime. We do know, from NSW Electoral Commission reports, that about half of the voters affected by iVote’s downtime went to a polling place and voted on paper. This is extremely unlikely to be a random half—most probably, it was the well-off, healthy voters without caring responsibilities, long working hours on a Saturday, or physical or mobility challenges. The people actually excluded from the franchise by iVote’s downtime were people who were not easily able to suddenly make alternative arrangements, who probably included the more disadvantaged people often used as a justification for running Internet voting. There would have been some who were not able to vote on paper under any circumstances (such as those with physical disabilities) and those who suddenly found themselves under covid isolation orders despite intending to vote in a polling place. These people had no other voting option in NSW (the voters with disabilities should have been offered a verifiable voting option, but they weren’t). However, some of those disenfranchised by iVote’s downtime were people who would have had ample opportunity to apply for a mail-in vote, if they had known in advance that iVote would fail. Unreliable voting systems are most damaging to the voting rights of the people dependent upon them.

The main long-term consequence of iVote’s downtime is that NSW elections will become much more secure and trustworthy because they will stop using iVote.

Internet voting is not part of Australia’s proud history of innovative electoral progress. It is more accurately seen as part of a pattern of public-sector disregard for electronic security and privacy, which includes driver’s licenses, health data, and covid-tracing records. Serious, evidence-based security concerns were repeatedly ignored.

By the time the reruns & possible lawsuits are settled, it will be much more expensive than running the election properly the first time.

Undetectable fraud remains the primary concern. The worst thing about this election was not that ten thousand or more people were disenfranchised, but that 652,983 votes were included in the tally without the slightest evidence that they accurately reflected the voting intentions of eligible voters.

(Next part: How the Swiss Post E-voting system addresses client-side vulnerabilities)