This is susceptible to many traditional forms of fraud, but you don't want fraud, you want Hack. Ok, I'll give you some security advice. Because that what (white hat) hackers do.
Voters arrive at a public space in their local area.
Make fake IDs, the check system could be relaying on a backend database. There is no need to hack the database if you can make a counterfeit ID of another - but valid - person.
As per hacking the database, it got to be stored somewhere. If it is working on a local copy, it is harder – it would be an inside job. On the other hand, if the database is remote, there has to be a connection. Intercept the signal, stablish a man-in-the-middle attack, and provide fake ID info.
Although the ID hacking could fool the machines, but the guards would recognize you enter one too many times.
Security advice: Do not query the remote database with the ID, query with a hash of the ID. This makes it harder to know for which request to fake the response. And the answer needs a digital signature. This means that the attackers need to steal the private key of the database server to fake the response. An all that done over a ciphered connection because why not?
The machines are in hooded boothes in the same room. Outside each booth is a prominent display counter which increments each time someone casts a ballot.
About hacking the counter… from the voting machine there must be a signal (wired or wireless) going out to the counter. The minimum viable implementation of the signal would be a pulse each time a vote happens.
If the connection is wired, it would require sabotage of the voting station – doing it on site could be viable, but problematic, as the next person to enter the booth won’t count. Instead it would be safer to repair it… then again; you would have to be too fast and too silent. Yet, insider job makes it easier.
If the developers are paranoid, the signal works backwards, it counts when the pulse is interrupted. In this case hacking can be done by inducing a current that mask the interruption caused by the machine when your vote.
If the connection is wireless… oh, if the connection is wireless, it would be harder to cut and plug, because it could be an antenna buried deep in the machine. But you can fake the signal! This gives the chance for another kind of attack: DoS. Send a fake signal all over the voting area, all the counters go up by one, the organizers notice something is going on, and they close the voting session – to chase you, if they can spot you.
If the developers are paranoid they make the wireless signal could be some authentication code. It is a matter of matching the pattern, that is: intercept prior signals and decipher how to send the code.
Security advice: Make the connection wired, and shield the cable. The protection of the cable must be: 1) strong enough to shield any signal that may disturb the connection. 2) Compact enough to avoid using it to hide some device. 3) Evident enough, so that when broken, everybody notices.
Inside the booth, the voter feeds the activation token to the machine. They enter their preference(s) and the machine prints a paper slip which contains this information.
The confirmation slip stays within the machine but is visible through a plastic window. It remains in place so the voter can choose to confirm or shred it in case of a mistake.
Hmm… shred it in case of a mistake. How does that work? If I shred it, did the vote count? Does the machine shred it on command? Why did it print it if I didn’t confirm?
If confirmed, the slip falls face-down onto a stack of previous voters' slips. The container is transparent.
Can the attacker bribe the person watching over that?
Security advice: get rid of the paper thing. Instead make the two steps counter. Once the person enters the booth it allows for the counter to increment by one... once the person votes, the counter do actually increment by one. If the person tries some mockery to try to vote again, the counter can't register the vote because the person didn't enter again (so no more increments have been allowed). And if the person leaves to enter again, guards notice.
When some number, say 500, of votes have been entered, the box is sealed and the totals are electronically broadcast. An attendant takes the transparent box of slips out into the room and shakes it vigorously to disorder the slips. The full box is left in public view and an empty box is set into the machine for further use.
Oh, you don’t send votes in real time. Muahahahaha!
Fake the signal; people believe the 500 votes have been reached, the votes in the fake signal counted.
If they notice that the 500 votes have been reached, they could close the box, and nobody else can vote. Of course they would notice discrepancy between the counter and the fact that the signal was sent. If the counter is wired, that is, because if it is wireless we hack it remotely too.
Let's say the attacker can't buy people to enter each booth and install a wireless receiver connected to the counter cable (If the attacker can do that, the attacker can do traditional fraud). Instead the attacker needs to use the cables as receivers. That requires a very power transmitter... one that would give away its location once the attacker used it.
Security advice: Shield those cables, oh, I said that already. Ern…
Security advice: Wire the vote reporting via the counter. So the counter is no longer dumb, but a smart device (if the counter doesn’t go up, the vote isn’t sent). Now, the votes need to be ciphered. The voting machine generates a private and public key pair at the start of the vote session. Then it uses its private key and the public key of the server that open the votes for counting. The private key of the server that open the vote would be needed to decipher. In other to count votes, the public key of the machine is extracted; this allows verifying that the votes come from that machine. Any vote that can't be deciphered is an invalid vote. Any vote that can't be verified to come from the private key of the voting machine it claims to come from is an invalid vote. A robust protocol must be in place to ensure that the votes were received correctly.
When voting is over, in public view, attendants visit each container in turn and toss a handful of coins (say, 5) and if all of them come up heads then the box is opened and the count checked manually. This all happens in the same room, in front of everyone. The confirmation slips are anonymous and the count should be exact. At least one container in each room must be checked, so this process is repeated until the coin toss chooses at least one.
This is not good. If there is a problem what do you do? Do you consider all the votes of the machine invalid? That means that tampering with the vote once defeats 499 potentially valid votes. That sounds like a good avenue to attack.
Security advice: Remember that about a robust protocol? Here it is: store it in two hard disks (mirror copy) and ship the hard disks. This means that "intercepting the signal" is attacking the truck that carries the hard disks, it also means that Anonymous won't be launching any DoS attack to the server that open the votes for counting, because it won’t be open to the internet.