E-Voting and Forensics: Prying Open the Black Box Sean Peisert - - PowerPoint PPT Presentation

▶
e voting and forensics prying open the black box
SMART_READER_LITE
LIVE PREVIEW

E-Voting and Forensics: Prying Open the Black Box Sean Peisert - - PowerPoint PPT Presentation

May 28, 2023 186 likes •552 views

E-Voting and Forensics: Prying Open the Black Box Sean Peisert Matt Bishop Candice Hoke Mark Graff David Jefferson given at EVT/WOTE09 Montreal, Canada August 10, 2009 Monday, August 10, 2009 Key Questions That We Address

slide-1
SLIDE 1

E-Voting and Forensics: Prying Open the Black Box

Sean Peisert Matt Bishop Candice Hoke Mark Graff David Jefferson given at EVT/WOTE’09 Montreal, Canada August 10, 2009

Monday, August 10, 2009

slide-2
SLIDE 2

Key Questions That We Address

  • What questions can a forensic examination

answer?

  • When should election administrators consider

an election forensic examination?

  • How should they prepare for an examination?
  • Who should be included on the forensic team?
  • What sort of legal, contractual, and practical

provisions may be needed?

2

Monday, August 10, 2009

slide-3
SLIDE 3

Key Questions We Do Not Answer

  • Study the merits of e-voting, or specific

types of e-voting systems.

  • Analyze or discuss proposed voting

systems.

  • Analyze specific auditing techniques.

3

Monday, August 10, 2009

slide-4
SLIDE 4

Some Causes of Problems in Voting

  • Malicious attacks can occur.
  • Many problems are caused by accident and are

not malicious.

  • Someone trips over a power cord.
  • The polling place floods due to rainstorms.
  • Basic Problem: what happens when something

goes wrong with an election?

4

Monday, August 10, 2009

slide-5
SLIDE 5

Questions Driving Election Forensics

5

  • Why don’t vote totals always reconcile?
  • Why does a system keep failing?
  • Are totals accurate and complete?
  • Can election officials certify the results?
  • Will the public accept the results?
  • Should candidates demand a recount?

Monday, August 10, 2009

slide-6
SLIDE 6

Issues With Election Forensics

6

  • No generally/broadly accepted logging/

auditing standards.

  • No generally/broadly accepted machine

standards.

  • No concrete legal guidance from court

precedents.

  • In forensic auditing, accountability and

traceability are key. But votes cannot be tied to individual voters.

Monday, August 10, 2009

slide-7
SLIDE 7

Privacy and Security Must Be Balanced

(Peisert, Bishop, & Yasinsac HICSS’09)

  • Election officials need to be able to count ballots
  • Forensic analysts need to be able to determine if

and how a machine failed.

  • Cannot allow a voter to indicate to an auditor who

they are (vote selling)

  • Cannot allow an auditor to determine who a voter

is (voter coercion)

  • This leads to a direct conflict.

7

Monday, August 10, 2009

slide-8
SLIDE 8

What About VVPATs?

  • VVPATs are not audit trails (Yasinsac & Bishop, HICSS’08)
  • If a VVPAT shows an undervote:
  • could be malfunction
  • could be voter choice
  • If a VVPAT shows an over-vote:
  • probably malfunction, but where?
  • If a VVPAT shows an equal balance:
  • implies that any problem did not involve dropping or

adding votes (but could simply be mis-recording votes)

8

Monday, August 10, 2009

slide-9
SLIDE 9

Questions a Forensic Examination Can Answer

  • How many votes did the problem affect?
  • How accurate are the canvass totals?
  • If the totals are wrong, can the investigation recover the

data needed to correct the problem?

  • Is the voting equipment functioning according to

documentation?

  • Were any procedural guidelines violated?
  • Which jurisdictions does the problem affect?
  • ...and others...

9

Monday, August 10, 2009

slide-10
SLIDE 10

Requirements

  • Accuracy
  • Availability
  • Secrecy
  • Anonymity

10

Monday, August 10, 2009

slide-11
SLIDE 11

Laocoön: A Model of Forensic Logging

  • Our approach: what data do

we need to record in order to be able to analyze certain events?

  • Attack graphs of goals.
  • Goals can be attacker goals

(i.e., “targets”) or defender goals (i.e., “security policies”)

  • Predicates represented by pre-

conditions & post-conditions

  • f events to accomplish goals.
  • Method of translating those

conditions into logging requirements.

11

a b c d start of attack unknown intermediate steps end goals

  • f intruder

Monday, August 10, 2009

slide-12
SLIDE 12

Laocoön & E-Voting

  • Many violations of security policy on e-

voting are easy to define precisely (e.g., changing or discarding cast votes)

  • Machines have (theoretically or ideally)

limited modes of operation.

12

Monday, August 10, 2009

slide-13
SLIDE 13

Applying the Model to E-Voting: Start with E-Voting Requirements

  • Laws and requirements

become security policies

  • Security policies define

attack graphs

  • Attack graphs start with

ultimate “goals”

  • Attack graphs are

translated into detailed specifications and implementations to guide logging

13

a b c d start of attack unknown intermediate steps end goals

  • f intruder

logging points

Monday, August 10, 2009

slide-14
SLIDE 14

Law to Policy

14

  • California Constitution, Article 2 (“Voting, initiative and

referendum, and recall”)

  • Law: Sec. 7. Voting shall be secret.
  • Manual Voting Policy: the person who opens envelopes

containing absentee ballots and removes the ballots is different than the person who tallies the ballots.

  • E-Voting Policy: information must not “leak” outside

the system through any method other than the prescribed ballot.

Monday, August 10, 2009

slide-15
SLIDE 15

Policy to Goals

  • Examine the ballots for signs of unique identifiers.
  • Examine the setup of the e-voting machines to see if

network cables, wireless devices, or physical sight lines could cause votes to be observed.

  • Interview poll workers to determine the locations
  • f people during voting.

15

Monday, August 10, 2009

slide-16
SLIDE 16

Example: Laocoön & Over-Voting

  • Over-voting occurs when more candidates are selected

than allowed in a given race.

  • At some point, the value of a bit changes.
  • What are the paths to that event?
  • Start with the entry to the system (e.g., touchscreen,

supervisor screen, HW manipulation).

  • End at the data.
  • This places bounds on the intermediate steps.
  • Monitor those paths.

16

Monday, August 10, 2009

slide-17
SLIDE 17

Laocoön & Over-Voting

17

Memory Card #1 Memory Card #2 Memory Card #3 Touchscreen Supervisor Screen Hardware Access

Intermediate Steps

Open Box Magnetic Manipulation Swap Mem Cards "write" syscall Introduce HW via USB

Monday, August 10, 2009

slide-18
SLIDE 18

Procedural Elements

  • What about methods of bypassing the

logging system?

  • How tamperproof are logs?
  • What about denial-of-service?
  • What about human error?
  • What about DREs vs. optical scanners?

18

Monday, August 10, 2009

slide-19
SLIDE 19

Basic Concept

  • Repeated crashes, freezes, or auto-reboots

may indicate a failure of the system.

  • This describes a goal state of the fault graph.
  • The model states that data to describe the

system and failure should be recorded.

19

Monday, August 10, 2009

slide-20
SLIDE 20

What Data to Preserve

  • Laocoön prescribes the need to begin with the

endpoint of the attack/fault graph and work backwards to understand prior indications. Thus:

  • Rule P1: Record indications of any failure, what

happened, when it happened, and any error indicators.

20

Monday, August 10, 2009

slide-21
SLIDE 21

Laocoön and Data Preservation

21

  • System-level events
  • Commands capable of performing such actions
  • Human events
  • Who was using the machine?
  • Who had access to the machine?

Monday, August 10, 2009

slide-22
SLIDE 22

Laocoön and Data Preservation

22

Memory Card #1 Memory Card #2 Memory Card #3 Touchscreen Supervisor Screen Hardware Access

Intermediate Steps

Open Box Magnetic Manipulation Swap Mem Cards "write" syscall Introduce HW via USB

Monday, August 10, 2009

slide-23
SLIDE 23

What Data to Preserve

  • Laocoön also prescribes the need to start at the

beginning of the fault graph. So:

  • Rule P2: Record information about entry points into the

system, including the locations from which people accessed the system.

  • Voter interface
  • Maintenance bays
  • Include non-voters, such as officials and vendors
  • Visual descriptions of the state of entry points
  • Locations of power cords, weather, etc...

23

Monday, August 10, 2009

slide-24
SLIDE 24

What Data to Preserve

  • Laocoön prescribes the need to record possible paths

from initial states to error states. So:

  • Rule P3: Collect external data relevant to the state of the

voting system

  • VVPATs
  • Audit logs
  • Memory cards
  • Removable peripherals (e.g., USB sticks)
  • Cables indicating network/telephone connections
  • Videotapes
  • People!
  • Chain of custody details

24

Monday, August 10, 2009

slide-25
SLIDE 25

What Data to Preserve

  • Laocoön prescribes the data necessary to analyze an

event, and thus also the data not adhering to that

  • standard. So:
  • Rule P4: Record any signs that the data is incomplete or

may not be trustworthy

  • E.g., if a system is supposed to record all
  • ccurrences of X but does so only intermittently.

25

Monday, August 10, 2009

slide-26
SLIDE 26

Assurance and How to Preserve Data

  • Laocoön prescribes that data should be recoded at

failure points (both temporally and physical proximity).

  • Rule A1: Preserve all artifacts as soon as the problem is

discovered, in the state in which the problem was discovered.

  • Copies of data, clones, backups, memory
  • Precinct devices
  • Freezing evidence
  • Digital photographs
  • Network state

26

Monday, August 10, 2009

slide-27
SLIDE 27

Laocoön and Data Preservation

27

Memory Card #1 Memory Card #2 Memory Card #3 Touchscreen Supervisor Screen Hardware Access

Intermediate Steps

Open Box Magnetic Manipulation Swap Mem Cards "write" syscall Introduce HW via USB

Monday, August 10, 2009

slide-28
SLIDE 28

Assurance and How to Preserve Data

  • A human process is equally important as a Laocoön

attack graph, although sometimes more difficult to

  • implement. Nevertheless:
  • Rule A2: Election officials must have a process documenting

how to handle potential evidence

  • Chain of custody
  • Observations from humans
  • Forensic logs
  • “Two-person rule”
  • Tamper-evidence (crypto hashes, tape)

28

Monday, August 10, 2009

slide-29
SLIDE 29

Assurance and How to Preserve Data

  • Rule A3: Potential evidence should be frozen and secured.
  • Only forensic examiners should have access.
  • Maintain as close as possible to original state.
  • All access must be observable.

29

Monday, August 10, 2009

slide-30
SLIDE 30

Assurance and How to Preserve Data

  • Rule A4: The process for preserving evidence must be public.
  • Rule A5: The methodology and results of the forensic

examination must be public.

  • Transparency is usually preferable.
  • Secrecy creates doubt and inhibits assurance.
  • Confidentiality of examiners’ discussions is important.
  • Vendors have proprietary information.
  • Voters privacy must also be protected.
  • In the California TTBR, video of meetings was

broadcast, but not audio.

30

Monday, August 10, 2009

slide-31
SLIDE 31

Summary

  • Forensic analysis is difficult in general
  • Forensic analysis of e-voting machines is particularly

challenging.

  • Tradeoffs and contradictions
  • Varying laws, technology, and human behavior
  • Voting is as mission critical as designing aircraft and

satellites

  • We need good design and forensic practices
  • We need high assurance in design and analysis

31

Monday, August 10, 2009

slide-32
SLIDE 32

Going Forward

  • Compare election requirements to design and

implementation of voting machines

  • Apply high assurance techniques to e-voting
  • Analyze inherent contradictions in security,

anonymity, and secrecy within elections

32

Monday, August 10, 2009

slide-33
SLIDE 33

In the Paper

  • Providing a facility for investigations
  • Investigation team organization and size
  • Technical qualifications of investigators
  • Non-technical qualifications of investigators
  • Role of the voting machine vendor

33

Monday, August 10, 2009

slide-34
SLIDE 34

In the Paper

  • Legal, Contractual and Practical Issues
  • Appendices
  • Example NDA
  • Partial List of Voting Systems Studies

34

Monday, August 10, 2009

slide-35
SLIDE 35

Thank you

35

Monday, August 10, 2009