How might you hack this voting protocol?

Question

There is a society with about the same technological development as we have today, but they are more civically-minded and more astute when it comes to security issues. They are also democratic and want to ensure their democratic process is secure.

Here's how they vote.

• Voters arrive at a public space in their local area. They present their credentials to an administrator and, if that checks out, reach into a bucket of barcoded tokens and take one at random. Each token activates a voting machine for a single use.

• The list of who has and has not voted is made public at the end and leftover activation tokens are counted in public view.

• The machines are in hooded boothes in the same room. Outside each booth is a prominent display counter which increments each time someone casts a ballot.

• Inside the booth, the voter feeds the activation token to the machine. They enter their preference(s) and the machine prints a paper slip which contains this information.

• The confirmation slip stays within the machine but is visible through a plastic window. It remains in place so the voter can choose to confirm or shred it in case of a mistake.

• If confirmed, the slip falls face-down onto a stack of previous voters' slips. The container is transparent.

• When some number, say 500, of votes have been entered, the box is sealed and the totals are electronically broadcast. An attendant takes the transparent box of slips out into the room and shakes it vigorously to disorder the slips. The full box is left in public view and an empty box is set into the machine for further use.

• When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.

The people in this society have a high degree of confidence in the security of their elections. How might they be caught out?

This system has at least one vulnerability that I can see: the administrators could forge credentials to allow fictitious people to vote, but the population also anticipated this and volunteers run footage of voters through facial recognition software to red-flag similar faces for closer inspection. They know this isn't perfect, but it raises the bar somewhat. Also, the government as a whole is not expected to be so hostile (although individuals within it may be).

How else might an imaginative adversary subvert the voting process?

EDIT Thanks everyone for your insight. I'm not going to nominate a "correct" answer since it's such an open question, but have an upvote :-)

Answer 1

In modern democracies, voter fraud is no problem. Actual tampering with the voting process is done by more complex mechanisms that can be done openly. It is all about discouraging people to vote who would vote in a majority against your interest or allowing people to vote who will vote for you. Refer for example to Last Week Tonight on the system in the US for inspiration.

You can:

• prohibit, that certain groups of people vote at all: elders, certain types of criminals, poor, you can have age restrictions, restrictions based on income, gender, you name it!
• influence which types of immigrants can vote - This goes both ways, e. g. certain cities in Europe allow EU-citizens to vote for majors if they live in the city, even if they are not citizens of this country
• have strict ID-Laws that require IDs certain groups might or might not have, e.g. drivers license or fishing license.
• make it difficult/easy to vote depending on location. If the people living in rural areas don't vote in your interest, then make it harder for small villages to set up a place to vote.

The best part about these kinds of tampering is, that there is no risk of a scandal, where everything might get revealed to the public. You can always act as if your actions are a way of protecting the democracy! Isn't that lovely?

Answer 2

Purge the electorate

Start with the registered voter lists. Find some way of purging the people most likely to support the wrong person. As an example, write letters to the illiterate and elderly telling them to reregister online to confirm their address or they'll be removed from the lists.

Gerrymandering

Moving the electoral boundaries to favour your desired outcome.

In the process of setting electoral districts, gerrymandering is a practice intended to establish a political advantage for a particular party or group by manipulating district boundaries. The resulting district is known as a gerrymander (/ˈdʒɛriˌmændər/); however, that word can also refer to the process. The term gerrymandering has negative connotations.

In addition to its use achieving desired electoral results for a particular party, gerrymandering may be used to help or hinder a particular demographic, such as a political, ethnic, racial, linguistic, religious, or class group, such as in U.S. federal voting district boundaries that produce a majority of constituents representative of African-American or other racial minorities, known as "majority-minority districts". Gerrymandering can also be used to protect incumbents. Wikipedia

Placement of polling stations

Now that you have very few poor, elderly, or vulnerable people on your electoral roll, you don't need to place polling stations where they can access them. Only placing them on the far side of town where all these people would have trouble accessing them will be fine.

---

At this point I've already pretty much won the election and I haven't needed to find a weakness in your polling system yet. Unfortunately all these methods are par for the course even in our "free" "modern" western democracies.

Gerrymandering is a favourite in the US, in the UK the Labour party has just run a massive soviet style purge of, ironically, the communists on their voting lists.

Answer 3

Liberal democracy

Voters arrive at a public space in their local area. They present their credentials to an administrator and, if that checks out, reach into a bucket of barcoded tokens and take one at random. Each token activates a voting machine for a single use.

• public space - limited amount of people are able to implement that publicity - buy them
• buy voter
• buy threaten administrator
• barcoded tokens and take one at random. - weakens system, not strengthen it, you can't predict it, you can’t validate results in fraud investigations because of it. You can give false sense of randomness - see card tricks.
• compromise voting machine, like it is done with cache machines today (reading cards and pincodes, backdoors for agencies etc.)

The list of who has and has not voted is made public at the end and leftover activation tokens are counted in public view.

• is made public - no one can validate that information, it adds nothing to security
• public view - limited amount of peoples can utilize that public view - buy them.
• buy those who counts - see card tricks, casino token tricks - pure magic

The machines are in hooded boothes in the same room. Outside each booth is a prominent display counter which increments each time someone casts a ballot.

• as usual, limited amount of people can use that information, just because surface area available around that place. It is more limited space of places where you might have connection by observing consequences between who enters and changing number

When some number, say 500, of votes have been entered, the box is sealed and the totals are electronically broadcast. An attendant takes the transparent box of slips out into the room and shakes it vigorously to disorder the slips. The full box is left in public view and an empty box is set into the machine for further use.

• replace box, like dat
• shakes it vigorously - adds nothing to security, adds some to anonymity and makes more difficult to investigate in case of fraud.
• public view - limited amount of peoples can utilize it, no one can validate the boxes, that they are the boxes, but not other boxes. Max distance you can do it is 1m, if they have way to validate, more information they have more information they have to falsify this validation process. More people tries to validate, easier it is to exchange boxes. Seal is not a problem - see false money, it might be good enough that without instrumental control you have no way to tell difference.

When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.

• buy container chooser
• buy who counts
• limited space
• confirmation slips are anonymous - no one can confirm that it was his voice and everything is right
• count should be exact. compromise voting machine by shaking it and disrupting process, in regions where you less likely to get what you wish
• count should be exact. compromise result buy buying who counts, let him take few tokens (card tricks, money stealing - lost the link there criminal not very well in english in handcuffs(?) shows to police(I guess) and steals banknote in process of counting them, by folding it, and you see no clue he does it. If some one saw - feel free to remove description and put link here)

The people in this society have a high degree of confidence in the security of their elections.

Yhea, totally false sense of security, which actually makes things easier to do, as they probably will not try to see everything and sniff for any possible problem.

There are big history of exploiting different machines in casinos, cash machines, different security systems in hardware in software in society. Most high level trick are done because of fine details, most people have no idea about. Different tricks in psychology when it comes to humans, etc. They have detail or combination of details they exploit - so even your description is not enough, but sure exact implementation of your system will have different possibilities.

Who or what counts tokens which are not open by coin toss request - sure it can be exploited.
Which system shows results - sure it can be exploited, at least at some degree, but you may not need much 0.5% 1% might be enough. Who conducts decision, Who rise suspicion of possible falsifications, Who investigates ....

You use word everyone - who are those everyone, are they everyone everyone - so we talking about small group of peoples - just rising hands is enough in such cases, to make decisions.

Main problem those who vote have no ways to validate results. If they knew decisions of their relatives and friends and possible some random person - and could check if their voices are counted in the way they claim - it could way much reduce possibility of fraud, at least percentage wise, and those who suspect fraud could verify and validate information up probability of their desire.

So if they are so concern with their voting results - they should make their choose available to anyone who interested in knowing that information - which decisions or selection they have maid. (And it is done so in US senate as example - votes are not anonymous)

Public view, public access - obstruct that access for any valid reason, and cheer your supporters - this will change outcome percentage wise, because some opponents may leave if they are not totally dedicated to wait for unknown for 1-2-3-4-6 hours. See dat.
Make sure your supporters are observers, favorable outcome will be less suspicious for them, and if they decide by voting is_or_isn't, more likely to get desired results in suspicious cases. (You do not have to have all observers to be yours)

Every system have flaws, no exception, even this one. And more valuable are combo's of details to exploit. Weakest part of any system is humans.

P.S.
By accident, hit that video The art of misdirection | Apollo Robbins, it highlights kinda interesting inside in public attention, which is intensifly used by OP. Highly recommend to watch, just for fun.

Answer 4

This is susceptible to many traditional forms of fraud, but you don't want fraud, you want Hack. Ok, I'll give you some security advice. Because that what (white hat) hackers do.

Voters arrive at a public space in their local area.

Make fake IDs, the check system could be relaying on a backend database. There is no need to hack the database if you can make a counterfeit ID of another - but valid - person.

As per hacking the database, it got to be stored somewhere. If it is working on a local copy, it is harder – it would be an inside job. On the other hand, if the database is remote, there has to be a connection. Intercept the signal, stablish a man-in-the-middle attack, and provide fake ID info.

Although the ID hacking could fool the machines, but the guards would recognize you enter one too many times.

Security advice: Do not query the remote database with the ID, query with a hash of the ID. This makes it harder to know for which request to fake the response. And the answer needs a digital signature. This means that the attackers need to steal the private key of the database server to fake the response. An all that done over a ciphered connection because why not?

The machines are in hooded boothes in the same room. Outside each booth is a prominent display counter which increments each time someone casts a ballot.

About hacking the counter… from the voting machine there must be a signal (wired or wireless) going out to the counter. The minimum viable implementation of the signal would be a pulse each time a vote happens.

If the connection is wired, it would require sabotage of the voting station – doing it on site could be viable, but problematic, as the next person to enter the booth won’t count. Instead it would be safer to repair it… then again; you would have to be too fast and too silent. Yet, insider job makes it easier.

If the developers are paranoid, the signal works backwards, it counts when the pulse is interrupted. In this case hacking can be done by inducing a current that mask the interruption caused by the machine when your vote.

If the connection is wireless… oh, if the connection is wireless, it would be harder to cut and plug, because it could be an antenna buried deep in the machine. But you can fake the signal! This gives the chance for another kind of attack: DoS. Send a fake signal all over the voting area, all the counters go up by one, the organizers notice something is going on, and they close the voting session – to chase you, if they can spot you.

If the developers are paranoid they make the wireless signal could be some authentication code. It is a matter of matching the pattern, that is: intercept prior signals and decipher how to send the code.

Security advice: Make the connection wired, and shield the cable. The protection of the cable must be: 1) strong enough to shield any signal that may disturb the connection. 2) Compact enough to avoid using it to hide some device. 3) Evident enough, so that when broken, everybody notices.

Inside the booth, the voter feeds the activation token to the machine. They enter their preference(s) and the machine prints a paper slip which contains this information.

The confirmation slip stays within the machine but is visible through a plastic window. It remains in place so the voter can choose to confirm or shred it in case of a mistake.

Hmm… shred it in case of a mistake. How does that work? If I shred it, did the vote count? Does the machine shred it on command? Why did it print it if I didn’t confirm?

If confirmed, the slip falls face-down onto a stack of previous voters' slips. The container is transparent.

Can the attacker bribe the person watching over that?

Security advice: get rid of the paper thing. Instead make the two steps counter. Once the person enters the booth it allows for the counter to increment by one... once the person votes, the counter do actually increment by one. If the person tries some mockery to try to vote again, the counter can't register the vote because the person didn't enter again (so no more increments have been allowed). And if the person leaves to enter again, guards notice.

When some number, say 500, of votes have been entered, the box is sealed and the totals are electronically broadcast. An attendant takes the transparent box of slips out into the room and shakes it vigorously to disorder the slips. The full box is left in public view and an empty box is set into the machine for further use.

Oh, you don’t send votes in real time. Muahahahaha!

Fake the signal; people believe the 500 votes have been reached, the votes in the fake signal counted.

If they notice that the 500 votes have been reached, they could close the box, and nobody else can vote. Of course they would notice discrepancy between the counter and the fact that the signal was sent. If the counter is wired, that is, because if it is wireless we hack it remotely too.

Let's say the attacker can't buy people to enter each booth and install a wireless receiver connected to the counter cable (If the attacker can do that, the attacker can do traditional fraud). Instead the attacker needs to use the cables as receivers. That requires a very power transmitter... one that would give away its location once the attacker used it.

Security advice: Shield those cables, oh, I said that already. Ern…

Security advice: Wire the vote reporting via the counter. So the counter is no longer dumb, but a smart device (if the counter doesn’t go up, the vote isn’t sent). Now, the votes need to be ciphered. The voting machine generates a private and public key pair at the start of the vote session. Then it uses its private key and the public key of the server that open the votes for counting. The private key of the server that open the vote would be needed to decipher. In other to count votes, the public key of the machine is extracted; this allows verifying that the votes come from that machine. Any vote that can't be deciphered is an invalid vote. Any vote that can't be verified to come from the private key of the voting machine it claims to come from is an invalid vote. A robust protocol must be in place to ensure that the votes were received correctly.

When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.

This is not good. If there is a problem what do you do? Do you consider all the votes of the machine invalid? That means that tampering with the vote once defeats 499 potentially valid votes. That sounds like a good avenue to attack.

Security advice: Remember that about a robust protocol? Here it is: store it in two hard disks (mirror copy) and ship the hard disks. This means that "intercepting the signal" is attacking the truck that carries the hard disks, it also means that Anonymous won't be launching any DoS attack to the server that open the votes for counting, because it won’t be open to the internet.

Answer 5

A few things:

If you don't control the voting machines:

• Complain that the machine printed out the wrong output, and submitted the vote when you asked it to shred it. Get a lot of others to say the same. There is (and can be) no proof that this didn't happen.

If you control the voting machines:

• Put the word out (anonymously) that people should follow the plan described above; then, make your machines do that exact thing.

• People high up on the ballot get many more votes. If you control the voting machines, you control the order they are displayed. The fair thing would be to have them randomized, so make them all ordered with your preference at the top, and say they are randomized. You can't tell if a list is randomized, without a large sample.

• Occasionally vote for the wrong person (the one you want), some people will not check their vote, won't shred it as they should.

In all of these cases, make sure to include a clock/calendar in the device, to make sure it doesn't happen in pre- or post-election testing

• You don't mention how the voting boxes are added up, so: add "phantom" vote boxes to the tally.

• Limit the observers in each voting station, then (somehow) juggle things so all observers in a given voting station are on the same team. You can then fix this particular voting station.

Other:

Bribe someone in the company that makes the voting machines to break the software e.g. so 10% of the votes are contrary to the voters selection. In this case, there will be riots. This will not let your preferred person get into power, but will cause chaos. Perhaps combine with a platform to remove the voting machines, so a re-run of the election will benefit you.

Answer 6

The voter registration can be made easy for likely supporters of one side and difficult for likely supporters of the other side. That can be done by individual administrators without a conspiracy. "That ID photo seems out of date. Do you have any other photo ID? Can come back and bring it?" A significant percentage might not come back after all.

There needs to be some provision to cast absentee ballots. That can probably be abused, specially if the voters are elderly and almost (but not quite) senile. "She has good days and bad days. Yesterday she was clear enough to fill the forms and cast her ballot."

Face recognition could be spoofed by multiple voting in multiple precincts, perhaps after a shave and a haircut. How many false positives if you run an entire nation through the matching?

If the election officials can be subverted, why not the volunteer election watchers?

Voters could wait until after the counting and then claim that they had voted a combination that isn't in the box. "There should be a ballot with yes on proposition 1, 3, 4, and 7, no on proposition 2, 5, and 6, Ed for mayor, Jane for the legislature."

Answer 7

Your system has the same faults in it as the Diebold voting machines in Ohio in the US about a decade ago. These machines were a touch screen that counted votes electronically but also presented a receipt in a clear box for the voter to view. They did not have the shred-rejection option that you describe. My last exposure to these machines in Ohio was in 2006. I do not think they have changed, but I cannot confirm it.

When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.

The tallies in your system and the Ohio system are counted electronically. The slips are only counted in the event of a legal election challenge or an error or a spot check.

This opens up two options:

1. I can still focus my attacks on the machines to shift the election the way I want. Make the machine print the receipt with the voter selection but tally it electronically in a different way. This assumes that I can avoid the random check enough to get away with it.
2. Even with the random check I can simply start skewing the electronic results and make them not match the manual check. This would swiftly erode confidence in the system. As a bonus I can make it look like my opponents are the bad guys and not me.

Answer 8

Why bother with attacking the strong parts of the system, when there's a much weaker area?

Simply bribe people to vote in your favor.

If you tell a bunch of people who don't care about the vote that you'll give them 50 dollars if you vote for candidate X, many of them may simply do it just for the money (amount is changeable) - and if you're afraid that they'll just lie about who they voted for, simply require that they do a polygraph test afterwards (and probably pay them more for their trouble but that's up to you.)

Answer 9

I'm going to address the mechanisms you've listed, not the notion of democracy itself as others have done that already.

• Barcodes - Problem is that the voter gets to pick a barcode. They could take two or more barcodes instead of just one. Sure, if anyone is paying attention they might see the counter go up numerous times per voter, but does anyone actually pay that much attention all the time?
• How is the list of who has and has not voted reconciled, and how are the tokens counted? Either factor could be manipulated by an official
• So a slip is printed and needs confirmation. What happens if someone does not confirm the slip - does it get destroyed? Will confirmation be obviously marked on the slip, i.e. what is preventing the unconfirmed slip for being mistaken as a vote?
• If votes are stored in boxes left in public view, are they being watched, are they sealed? If all of the public who were present were intent on violating the system, boxes could go missing or be tampered with easily.
• There is a 1 in 64 chance of a box being counted - is that significant enough? i.e. only 1.5% of votes will actually be double-checked.
• How are data being transmitted electronically? Is it digital, analog, authenticated, encrypted, signed? Is there a chance that a) someone could interfere with or cancel a transmission, b) someone could imitate or duplicate a transmission, c) someone could record the transmission?
• How are data being stored? Is the system secure, how does it store aggregates, can they be tampered, e.g. if a chaining method was used then every transmission is sealed by the next. But if no such methods are used then a malicious admin could modify data.

Answer 10

With the results being electronically broadcast, that could be your solution. If it's a wireless broadcast, sniff it and attempt to break the encryption I assume would be present. Then you can run your own broadcast in the same vein to send false results, as the broadcasts are linked to the tokens and not the people using the tokens.

If it's wired you can do the same, but you can entirely subvert the other votes by putting in a bypass, assuming there is no handshake or you can properly replicate the handshake.

Both these methods would require a physical presence and knowledge of the system, but these would likely not be too hard to get. The hardest part in this is breaking the assumed cryptography, which a foreign state would be able to do, or bribing/otherwise cajoling the system designers into giving you the details.

Answer 11

Step 1: Write the voting machine software so that it records 'Y' for a positive vote. A ballot receipt might look like this:

Mayor:
  Smith:
  Jones: Y
  Green:

Step 2: Figure out how much you need to skew the vote - say you need to skew it 3%. Then every 3 out of 100 votes for a given candidate, you mark their vote with a character very close to 'Y'. Say you choose 'Ƴ'. (Look closely, two different letters.)

Step 3: When displaying tallies, individual boxes count all votes with any response.

Step 4: When calculating the grand winner, the master collecting machine counts all votes with a valid 'Y' response.

Net result: any citizen can examine their voting receipt, and it will look right. Manual audits will match the totals described by the local machines. The master collecting machine will legitimately tally the properly cast votes. And if any of the bad actors get busted, the only fishy thing is the random Y vs Ƴ vote malformer - everything else is plausibly a legit programming error.

Answer 12

If people have no faith in the democratic process, the effectiveness for voting to enact real change, or if they believe that the entire process is a sham, then they are less likely to vote.

If you discourage enough of the right people to prevent them from placing a vote in the first place ("one vote doesn't matter"; "both parties are basically the same"), then you have effectively hacked democracy without interfering with the process of voting in the first place. Congrats.

Answer 13

After the box is sealed, it seems very difficult to have any influence on the outcome of the elections. You can't achieve the falsification by corruption as it would require to corrupt the whole polling station which seems really difficult to achieve.

That's why if I had to falsify these elections, I would work on the voting machines. The falsified machines would register false votes and print a false confirmation slip. However, on the top of this false confirmation slip, the true vote would be displayed with self-disappearing ink.

Knowing the high-level of security around these elections, the machines are probably tested before the election. The falsified machine should be able to be switched by a remote device just before the election.

The production of the machines is probably closely monitored but the amount of corruption/coertion needed is much lower and probably doable.

Answer 14

Another way to be "caught out" for a given value of "caught out":

team up with a friend, make sure they get in the queue ahead of your target, and you get in behind. They take a photo of the box after they vote, and you take a photo before you vote.

Compare these two photos to figure out what your target voted.

OR:

Go in, with some fake voting slips. Open the box, take actual votes out and replace them with the fake ones. Reseal the box. Update the electronic tally. You will need a security seal, fake votes, and admin access to the device.