| 5 min read
Table of contents
Near the end of this year, there will be a new presidential election in
the US. From the Democratic side, Biden seems to be leading according
to some early
ratings,
competing with Trump on the Republican side seeking reelection. This
election process may occur amid the
COVID-19 pandemic
that is currently affecting us. Thus, considering that we aim to
maintain safe distances to prevent contagion, questions arise on how to
carry out the voting processes. Could it be somewhat more convenient and
more secure to perform such processes over the Internet?
A few days ago, the researchers Michael A. Specter, of MIT, and Alex
Halderman, of the University of Michigan, published an
article
that reports how an online election could be affected by undetected
attackers. These authors made the first review explicitly focused on
Democracy Live’s
OmniBallot platform
used in different states on certain voting activities. Using reverse
engineering to analyze platform security,
Specter and Halderman found that OmniBallot is vulnerable to specific
attacks that can mean alteration of votes or theft of personal data.
They also gave some recommendations to take into account for the next
elections.
OmniBallot
Current health risks have led some states to consider the Internet as a
means of running the coming elections. Generally, the Internet has been
used to allow specific vulnerable populations or those not present in
the country to participate in elections. Tools such as OmniBallot have
been used for these purposes. OmniBallot is a web-based platform that
can serve for three modes of operations: blank ballot delivery, ballot
marking, and online voting. Now, reportedly, it is going to be used
for online voting for the first time in Delaware, West Virginia, and
New Jersey with larger groups of voters. This is the riskiest mode in
relation to cyberattacks.
Let’s clarify each OmniBallot’s mode of operation:
-
Online blank ballot delivery: The voter downloads her corresponding blank ballot, and it is printed, manually marked, and physically returned to the election authorities.
-
Online ballot marking: The voter marks her ballot on the website and then downloads it to print it and return it physically. Some jurisdictions give the option to return it via fax or email.
-
Online ballot return (online voting): The voter marks her ballot and transmits it to the authorities over the Internet through a service of Democracy Live. Among the
OmniBallotcustomers and in comparison with the two previous modes, this is the least used.
Following ethical and legal principles, Specter and Halderman limited
their analysis to the publicly available parts of OmniBallot,
specifically the Delaware version. Therefore, as a general description
of the OmniBallot architecture, they proposed the following:
- The web app runs in the browser and uses HTTPS to load files and call REST-like APIs from several domains. When voting online or marking a ballot, the app sends the voter’s identity and ballot selections to Democracy Live services running in Amazon’s cloud. The app runs JavaScript loaded from Amazon, Google, and Cloudflare, making all three companies (as well as Democracy Live itself) potential points of compromise for the election.
After having a clear understanding of the platform’s architecture and
client-server interactions, the authors analyzed the risks created when
OmniBallot is used in each of the three modes mentioned above. Before
we talk about that, let’s state the possible attackers or adversaries:
First, adversaries may have access to the voter’s device. These
attackers could be system administrators, abusive partners, or remote
attackers that control certain malware, and could modify HTTP or
inject JavaScript to alter the behavior of the web browser. In second
place are the attackers with access to the server infrastructure of
OmniBallot. These adversaries could be, for example, internal staff
from Democracy Live or Amazon, and external attackers ready to access
and affect the systems involved. In third place are the adversaries with
control of third-party code. This involves attackers who may have access
to third-party software and services which OmniBallot integrates, such
as Google Analytics, AngularJS, reCAPTCHA, and Fingerprint JS. Also,
customers load some libraries from Amazon, Cloudflare, and Google, where
there could also be malicious subjects willing to modify the
OmniBallot platform.
So, what could these attackers end up doing in the different ways
OmniBallot works?
OmniBallot risks
-
Online blank ballot delivery: We can start with the fact that the attacker could manipulate the ballot design, for example, swapping or removing candidates. In a more difficult to detect manipulation, for instance, an attacker could even change bar codes to alter the records when tabulated by a scanner. On the other hand, there may be attacks not directed at the ballot itself but at the ballot return instructions. The attacker could make the ballot be sent to an inappropriate place, after knowing the voter’s site that is among the data verified by OmniBallot at the start. Additionally, the attacker could mail a different ballot (following their preferences) to the appropriate place employing the voter’s data.
-
Online ballot marking: Here, the attacker could know the voter’s selection before the ballot’s generation, and from this, modify that particular ballot to suppress the vote for a specific candidate. Attacks may also involve reordering the candidates and swapping the barcodes linked to each of them. In these online marking cases, the attacker could also simply alter the voter’s marking and select a different candidate. And while some might notice the change, many others would not detect the errors on their ballots and return them as they are.
-
Online ballot return:
OmniBallotdoes not use the "end-to-end verifiability (E2E-V)" approach for a secure remote voting protocol. Computer scientists have been working on it for several decades, and to some extent, it is the most recommended approach. It "allows each voter to independently check that their vote is correctly recorded and included in the election result."OmniBallotuses a protocol in which no one can verify that what the voters gave as a selection is the same as what the officials received. Hence the possibility of the attacker changing the votes without being noticed.
Finally, a risk associated with all modes of operation is the collection and storage of privacy-sensitive data, including names, addresses, and dates.
Recommendations and conclusion
Apparently, Democracy Live’s security controls are limited. Following
the authors' recommendations, OmniBallot’s online ballot return should
be eliminated, and the physical ballot return should be improved on
accessibility and efficiency. Also, online marking should be offered
only to voters who have this mode as necessary to join the elections.
Moreover, officials should carry out risk-limiting audits
(RLAs) to test at
least in part the accuracy of the computers' work. Additionally,
Democracy Live could reduce risks eliminating unnecessary reliance on
third parties that may constitute multiple routes of attack. And as a
final tip related to some legal protections, OmniBallot should have a
posted privacy policy informing voters of the limitations on the use of
their data by Democracy Live and third parties. The fact is that such
data should only be used for the election process.
The public security review of OmniBallot by security experts is
something of high value when its use —due to a positive record in much
smaller procedures— is under consideration for the next presidential
election. In the end, they warn us that with such high risks of election
outcomes being altered without detection, and without sufficient tools
to mitigate those risks, it is best that OmniBallot’s (or any similar
voting platform’s) online ballot return doesn’t become the default
voting process.
Table of contents
Share
Recommended blog posts
You might be interested in the following related posts.
