Hello everyone, it's a while I don't write here, but tasks have been making themselves heard, as my sense of right telling me to warn as many people as possible of a fact:

Electronic voting is a horrible idea.

But let's break it down.

Why should E-Voting be a bad idea? It saves everyone a lot of money...

Why ordinary voting is better than E-Voting

In history, voting via paper has always ben a solid thing for a simple reason: attacks against it do not scale well.

Ordinary voting is base on (not) trusting people, if someone does something wrong they will immediately get caught by other members in the system, so even if it's possible to bribe, menace or anyway force someone to "tweak" the results, as soon as you start trying to tamper with regional or national votes, you need to pay/force a lot more people, which becomes a lot harder.

It's also possible to force voters to vote in a certain way, but the scaling issue is back again; furthermore you can't leave any sign on the voting form (used to prove that the "forced" vote was made) since this would make the vote void immediately, to keep voting anonymous.

E-Voting: The voting machines

Tablets, or any voting machine of the kind, has a software inside: who can guarantee us that said software is legit?

The software could be open source and verified too, but who can guarantee us that said software is really inserted in the machines?

Checksum? Crypto? Nice, now we move the problem from "trusting the software" to "trusting the person who tells us the software can be trusted".

Plus as "common mortals", we can't just go and verify the checksums of the software inside a voting machine.

Who can tell us nobody can just stick a USB thumbrive to modify the internal software anyway? Those machines could be even get their software and configuration from an USB drive, so if we get to modify the content of that drive...

This isn't that far from reality either, considering around 50% of the world's computers is infected with something.

A receipt printed by the machine to give to the officials, to put it in the ballot box? At this point the pencil costed less.

Seal the machine and transport it to the counting spot? At this point the box was better.

Send the votes via the Internet?

E-Voting: Internet transmission

Internet is not a safe place, we can invent all the Cyphers possible but there will always be an attack that can put us between a rock and a hard place; just think of Man In The Middle attacks.

Again, this isn't too far from reality, considering that in every election/voting there are thousands of billions of euros on stake (in terms of national economy), and that money can be a good reason for corporations or rogue states to be interested in "tweaking" the results of elections or votes.

Sending the number of votes is already a dangerous thing, if we decided to send every single vote to a central server (which has never been seen or verified) that counts the votes for us, we have essentially a black box when votes go in and a number comes out. (Who tells us it's the right number anyway?)

Same would be for a machine used to count the paper votes, it's still a black box where votes go in and a mysterious number comes out, and that number might not reflect the will of the people.

To prevent MITM attacks on the Internet we use certificates, and again we're moving the problem to trust whoever has the keys to sign certificates, while the "central server" method has the same issues we've seen with the single ballot machine.

E-Voting: scaling the attacks

If in ordinary voting one person could just make some minor damage, in E-Voting one person (let alone a group of people) can change millions of votes with the same effort used to change one. In this case it's said that the attacks "scale well", since with minimal extra effort you obtain a much bigger result.

E-Voting: Conclusion

As we've seen, there are many issues in implementing Electronic Voting, and I'm sure that there are more that I didn't mention here, but I hope I gave enough information to make you doubt the reliability of E-Voting. And I talked only of issues that are not related with the quality of the software involved, and that is generally really low.

Now I want to leave you with a provocation: is it really worth saving some millions thanks to E-voting but at the same time have so many doubts about the safety of the vote system itself?

I don't think so, but I would like to hear your opinion on my facebook page

Have a good one and see you in the next post!

Penaz.

Impromptu Cospirationist.