Thoughts On Appropriate Technologies for Voting Ronald L. Rivest - - PowerPoint PPT Presentation
Thoughts On Appropriate Technologies for Voting Ronald L. Rivest Viterbi Professor of EECS MIT, Cambridge, MA Princeton CITP E-voting Workshop 2012-11-01 1 Is Voting Keeping Up with Technology? We live in an age of marvelous
Viterbi Professor of EECS MIT, Cambridge, MA
1
◮ We live in an age of marvelous technology:
2
◮ We live in an age of marvelous technology:
◮ Many technology wishes come true—
2
◮ We live in an age of marvelous technology:
◮ Many technology wishes come true—
◮ Is voting being “left behind”?
2
◮ We live in an age of marvelous technology:
◮ Many technology wishes come true—
◮ Is voting being “left behind”? ◮ Why are many of us voting on paper ballots?
2
◮ We live in an age of marvelous technology:
◮ Many technology wishes come true—
◮ Is voting being “left behind”? ◮ Why are many of us voting on paper ballots? ◮ Why not voting, say, over the Internet?
2
◮ Voting tech has often followed other tech innovations:
3
◮ Voting tech has often followed other tech innovations:
◮ Technology introduces design options.
3
◮ Voting tech has often followed other tech innovations:
◮ Technology introduces design options. ◮ You don’t have to take them.
3
◮ Voting tech has often followed other tech innovations:
◮ Technology introduces design options. ◮ You don’t have to take them. ◮ Sometimes low tech is better! (esp. for security)
3
◮ Voting tech has often followed other tech innovations:
◮ Technology introduces design options. ◮ You don’t have to take them. ◮ Sometimes low tech is better! (esp. for security) ◮ My students prefer chalk/blackboard to powerpoint.
3
◮ Voting tech has often followed other tech innovations:
◮ Technology introduces design options. ◮ You don’t have to take them. ◮ Sometimes low tech is better! (esp. for security) ◮ My students prefer chalk/blackboard to powerpoint. ◮ When hiking, it may be better to carry a map than to
3
◮ Voting tech has often followed other tech innovations:
◮ Technology introduces design options. ◮ You don’t have to take them. ◮ Sometimes low tech is better! (esp. for security) ◮ My students prefer chalk/blackboard to powerpoint. ◮ When hiking, it may be better to carry a map than to
◮ Manual car window may be safer than power window.
3
4
5
◮ VS is not a “trusted party,” but must justify its
5
◮ VS is not a “trusted party,” but must justify its
◮ VS must produce credible evidence that the stated
5
◮ VS is not a “trusted party,” but must justify its
◮ VS must produce credible evidence that the stated
◮ Key question to ask about any VS: “What
5
◮ VS is not a “trusted party,” but must justify its
◮ VS must produce credible evidence that the stated
◮ Key question to ask about any VS: “What
◮ VS should include a (risk-limiting) audit to ensure
5
6
◮ Different than banking or other
6
◮ Different than banking or other
◮ Voters should not be coerced or bribed (they must
6
◮ Different than banking or other
◮ Voters should not be coerced or bribed (they must
◮ No one should know how a voter voted, even if the
6
◮ Different than banking or other
◮ Voters should not be coerced or bribed (they must
◮ No one should know how a voter voted, even if the
◮ Separation of voter identification from ballot
6
◮ Different than banking or other
◮ Voters should not be coerced or bribed (they must
◮ No one should know how a voter voted, even if the
◮ Separation of voter identification from ballot
◮ VBM (vote-by-mail) and unsupervised remote
6
7
◮ Myth = We can build infallible machines that
7
◮ Myth = We can build infallible machines that
◮ Even when attacked!
7
◮ Myth = We can build infallible machines that
◮ Even when attacked! ◮ Ideal machine is equivalent to its specification.
7
◮ Myth = We can build infallible machines that
◮ Even when attacked! ◮ Ideal machine is equivalent to its specification. ◮ Real machine is what you get.
7
◮ Myth = We can build infallible machines that
◮ Even when attacked! ◮ Ideal machine is equivalent to its specification. ◮ Real machine is what you get. ◮ Rarely are these the same.
7
◮ Myth = We can build infallible machines that
◮ Even when attacked! ◮ Ideal machine is equivalent to its specification. ◮ Real machine is what you get. ◮ Rarely are these the same. ◮ Even good commercial software has several
7
◮ Myth = We can build infallible machines that
◮ Even when attacked! ◮ Ideal machine is equivalent to its specification. ◮ Real machine is what you get. ◮ Rarely are these the same. ◮ Even good commercial software has several
◮ Even worse, deployed implementation may have
7
◮ Myth = We can build infallible machines that
◮ Even when attacked! ◮ Ideal machine is equivalent to its specification. ◮ Real machine is what you get. ◮ Rarely are these the same. ◮ Even good commercial software has several
◮ Even worse, deployed implementation may have
◮ Properties of system derive from properties of
7
8
◮ Automation / personification duality: Tasks once
8
◮ Automation / personification duality: Tasks once
◮ Just like a person, complex technologies can act
8
◮ Automation / personification duality: Tasks once
◮ Just like a person, complex technologies can act
◮ Think of buying a voting system as you would
8
◮ Automation / personification duality: Tasks once
◮ Just like a person, complex technologies can act
◮ Think of buying a voting system as you would
◮ Think of these workers as high-school students
8
◮ Automation / personification duality: Tasks once
◮ Just like a person, complex technologies can act
◮ Think of buying a voting system as you would
◮ Think of these workers as high-school students
◮ Imagine a voting machine, or the internet, as a
8
9
◮ An insider (election official or piece of technology)
9
◮ An insider (election official or piece of technology)
◮ Mental state of “temp worker” is at best weak or
9
◮ An insider (election official or piece of technology)
◮ Mental state of “temp worker” is at best weak or
◮ Note difference between “job listing for the person
9
◮ An insider (election official or piece of technology)
◮ Mental state of “temp worker” is at best weak or
◮ Note difference between “job listing for the person
◮ Misbehavior by an insider should be detectable
9
◮ An insider (election official or piece of technology)
◮ Mental state of “temp worker” is at best weak or
◮ Note difference between “job listing for the person
◮ Misbehavior by an insider should be detectable
◮ Helps to distinguish “wholesale” from “retail” fraud.
9
10
◮ Low-tech approach to constraining complex
10
◮ Low-tech approach to constraining complex
◮ Paper is human readable/writable, machine
10
◮ Low-tech approach to constraining complex
◮ Paper is human readable/writable, machine
◮ A writing is a commitment–can’t be easily
10
◮ Low-tech approach to constraining complex
◮ Paper is human readable/writable, machine
◮ A writing is a commitment–can’t be easily
◮ VVPAT creates evidence—a set of facts—that
10
◮ Low-tech approach to constraining complex
◮ Paper is human readable/writable, machine
◮ A writing is a commitment–can’t be easily
◮ VVPAT creates evidence—a set of facts—that
◮ Audit is like yank on dog leash...
10
11
◮ A voter proxy votes in your place.
11
◮ A voter proxy votes in your place. ◮ A voting witness watches you vote.
11
◮ A voter proxy votes in your place. ◮ A voting witness watches you vote. ◮ Proxy: You tell touch-screen voting machine (guy
11
◮ A voter proxy votes in your place. ◮ A voting witness watches you vote. ◮ Proxy: You tell touch-screen voting machine (guy
◮ Witness: You show scanner (elf) paper ballot you
11
◮ A voter proxy votes in your place. ◮ A voting witness watches you vote. ◮ Proxy: You tell touch-screen voting machine (guy
◮ Witness: You show scanner (elf) paper ballot you
◮ In first case, guy is creating the evidence of your
11
12
◮ Why vote over the Internet? Why?
12
◮ Why vote over the Internet? Why?
12
◮ Why vote over the Internet? Why?
12
◮ Why vote over the Internet? Why?
12
◮ Why vote over the Internet? Why?
12
◮ Why vote over the Internet? Why?
◮ Would you connect your toaster to a high-tension
12
◮ Why vote over the Internet? Why?
◮ Would you connect your toaster to a high-tension
◮ Would you invest your pension in credit default
12
◮ Why vote over the Internet? Why?
◮ Would you connect your toaster to a high-tension
◮ Would you invest your pension in credit default
◮ Vendors who claim to have solved internet
12
◮ Why vote over the Internet? Why?
◮ Would you connect your toaster to a high-tension
◮ Would you invest your pension in credit default
◮ Vendors who claim to have solved internet
◮ Internet is useful in elections, but fails as an
12
13
◮ Good for privacy and for commitments.
13
◮ Good for privacy and for commitments. ◮ With “end-to-end” (E2E) voting systems, voters
13
◮ Good for privacy and for commitments. ◮ With “end-to-end” (E2E) voting systems, voters
◮ Voters can verify encryption, without getting
13
◮ Good for privacy and for commitments. ◮ With “end-to-end” (E2E) voting systems, voters
◮ Voters can verify encryption, without getting
◮ Bulletin board enables “verifiable chain of custody.”
13
◮ Good for privacy and for commitments. ◮ With “end-to-end” (E2E) voting systems, voters
◮ Voters can verify encryption, without getting
◮ Bulletin board enables “verifiable chain of custody.” ◮ Authorities can produce tally without violating
13
◮ Good for privacy and for commitments. ◮ With “end-to-end” (E2E) voting systems, voters
◮ Voters can verify encryption, without getting
◮ Bulletin board enables “verifiable chain of custody.” ◮ Authorities can produce tally without violating
◮ Anyone can verify tally of encrypted ballots.
13
◮ Good for privacy and for commitments. ◮ With “end-to-end” (E2E) voting systems, voters
◮ Voters can verify encryption, without getting
◮ Bulletin board enables “verifiable chain of custody.” ◮ Authorities can produce tally without violating
◮ Anyone can verify tally of encrypted ballots. ◮ Scantegrity nicely integrates both paper ballots
13
◮ Good for privacy and for commitments. ◮ With “end-to-end” (E2E) voting systems, voters
◮ Voters can verify encryption, without getting
◮ Bulletin board enables “verifiable chain of custody.” ◮ Authorities can produce tally without violating
◮ Anyone can verify tally of encrypted ballots. ◮ Scantegrity nicely integrates both paper ballots
◮ Helios embodies similar ideas for remote voting
13
14
◮ non-fattening pizza
14
◮ non-fattening pizza ◮ totally safe cigarette
14
◮ non-fattening pizza ◮ totally safe cigarette ◮ getting fit with 5 minutes exercise/day
14
◮ non-fattening pizza ◮ totally safe cigarette ◮ getting fit with 5 minutes exercise/day ◮ automobile that runs on water
14
◮ non-fattening pizza ◮ totally safe cigarette ◮ getting fit with 5 minutes exercise/day ◮ automobile that runs on water ◮ secure internet voting
14
15
◮ Security vs. Usability vs. Cost vs. Complexity vs.
15
◮ Security vs. Usability vs. Cost vs. Complexity vs.
◮ Conflicting requirements drive up complexity.
15
◮ Security vs. Usability vs. Cost vs. Complexity vs.
◮ Conflicting requirements drive up complexity. ◮ High complexity makes security tough.
15
◮ Security vs. Usability vs. Cost vs. Complexity vs.
◮ Conflicting requirements drive up complexity. ◮ High complexity makes security tough. ◮ Evidence-based elections may reduce need or
15
◮ Security vs. Usability vs. Cost vs. Complexity vs.
◮ Conflicting requirements drive up complexity. ◮ High complexity makes security tough. ◮ Evidence-based elections may reduce need or
◮ Continued research needed to identify interesting
15
◮ Caltech/MIT Voting Technology Project.
◮ Douglas W. Jones and Barbara Simons.
◮ Verified Voting.
◮ Overseas Vote Foundation
◮ Brennan Center for Justice
16
17
17
17
17
17
17
17
◮ Opscan ballots with post-election auditing. ◮ End-to-end voting sytems.
17
18