E-voting 101: touch-screen machines and optical scanners
There are many different types of electronic voting machines available from a whole host of large and small vendors, but this article will focus primarily on one type: the direct-recording electronic (DRE) voting machine. Nonetheless, optical scanners are vulnerable to many of the same exploits that I'll describe for the DRE; the only difference is that optical scanners leave a reliable paper audit trail that could be used to tell if an election has been tampered with, but such audits must actually be carried out to have any impact.
DREs and optical scanners are far and away the two most popular types of voting machines in use today. The following statistics break down by popularity the types of voting machines used in 2006:
Voting equipment reported for the 2006 elections
|Type of voting equipment||Counties||Registered voters*|
* Registered voter counts are from the November 2004 general elections
Source: Election Data Systems
Just to orient ourselves to the basics of electronic voting, let's take a brief look at how votes are cast and counted using each type of machine.
Optical scan machines
In order to cast a vote using an optical scan machine, a voter follows the three steps shown in Figure 1.
Figure 1: Electronic voting using an optical scanner
The three steps depicted in Figure 1 are as follows:
- After receiving a paper ballot from poll workers, the voter marks her choices on the ballot by filling in bubbles with a pen. (An optical scan ballot looks and functions much like the multiple choice bubble sheets used in standardized tests.)
- The marked ballot is then fed into the optical scan voting machine, where the voter's choices are translated in the 1s and 0s of computer language and stored, along with the rest of the votes cast on that machine, in the machine's internal memory. (I've depicted the internal storage as a SanDisk Flash PCMCIA card of the type commonly used in the Diebold DRE described below, but other storage formats are possible.)
- At the end of the election, when all of the votes have been cast and are stored in the optical scan machines, the contents of the machines' internal storage devices are then transmitted to the county Board of Elections (BOE) for tallying and archiving. The marked paper ballots are also archived, in case a manual audit is demanded.
There are some variations in the process listed above (e.g., all of the votes in a single precinct can be tallied before being sent off to the BOE), but in general it describes overall movement of votes in the voting process.
Direct-recording electronic (DRE) machines
The steps involved in voting with DREs are similar to those described for optical scan machines, but there are some critical differences. Figure 2 illustrates what we might call the "life-cycle of a vote" in the DRE-based voting process.
Figure 2: Electronic voting using a DRE
The steps depicted in Figure 2 are as follows:
- The voter loads his ballot onto the DRE's screen by inserting into the machine the special smart card that he was issued by a poll worker. When the ballot screen appears, the voter marks his selections by touching the appropriate boxes on the screen.
- The votes are read from the screen by the machine's vote recording software and recorded directly onto the DRE's internal storage, where they're stored along with the other votes that were cast on that machine.
- At the end of the election, when all of the votes have been cast and are stored in the DREs, the contents of the machines' internal storage devices are then transmitted to the county Board of Elections (BOE) for tallying and archiving.
Note that the voter's choices are only recorded in one place: the internal storage of the DRE. Unlike the optical scan machines, the DRE system provides no permanent, nonelectronic paper record of the voter's intended choices that can be verified by the voter and then archived for possible use in an audit.
Now, the three-step process described above is vulnerable at multiple points in each stage. Here are just a few examples to illustrate what I'm talking about:
- Step 1: The machine could be tainted with vote-stealing software, or the voter could taint the machine with vote-stealing software by gaining access to it.
- Step 2: If the machine is tainted, then it can incorrectly record the vote. Or, if the voter has managed to make a supervisor card for himself, he can vote multiple times, delete votes, or disable the machine entirely.
- Step 3: If the centralized machine that does the vote tallying is tainted, then not only can it skew the election results, but it can also infect any DRE that connects directly to it, or it can taint any storage card that's plugged into it.
You might think that the supervisor smartcard cloning, viruses, and unauthorized accesses that I've described above are purely hypothetical. If the DRE in question is the popular Diebold AccuVote TS, then they're not at all hypothetical. All of the attacks that I just summarized, and many more, have been implemented by multiple teams of security researchers. Just for kicks, take a break from reading and go watch this little demonstration video.
But before we talk in more detail about the AccuVote, let's take a step back and get a big-picture look at the kinds of new opportunities that the would-be election thief has at her disposal, thanks to DREs.
Bad apples and barrel sizes, or how to do a lot with a little
If we want to steal an election, then ideally we want as few warm bodies in on the scam as possible. All of the old-school election manipulation tricks, like voter intimidation, vote-buying, turn-out suppression, and so on, require legions of volunteers who know exactly what's going on; but in the new era of electronic vote tampering, an election thief can do a whole lot more with a whole lot less.
Election security experts break down voting fraud types into two main categories, based on how many bad apples it takes to swing an election: retail fraud and wholesale fraud. Retail fraud is the kind of election fraud that's most familiar to us, because it has been around for the longest time. In general, retail fraud involves multiple bad apples at the precinct level, carrying out any number of bad acts involving multiple voters and voting machines. Some examples of retail fraud are ballot stuffing, restricting polling place access by means of intimidation, vandalizing individual machines to make them unusable, counterfeiting ballots, and so on.
Wholesale fraud is relatively new, and it involves a single bad apple who can affect an election's outcome at the precinct, county, and state levels. (Actually, by this definition, wholesale fraud is as old as the poll tax. But let's stick to wholesale fraud involving electronic voting machines for now.) So with wholesale fraud, one bad apple can affect different barrels of various sizes, depending where in the election process she's placed.
The table below breaks down the newer types of fraud that electronic voting machines have made available to election thieves:
Wholesale and retail fraud
|Detectable||• Altering the vote tabulation process
• Altering the record of tabulated results
|• Multiple voting
• Deleting votes
• Disabling a machine
• Invalidating all the votes on a machine
|Undetectable||• Altering the vote tabulation process
• Altering the vote recording process
• Altering the record of votes
|• Altering the vote recording process
• Altering the record of votes
In this table, "detectable" denotes instances of tampering and fraud where we could potentially know that something went wrong with the vote, even if we're not sure what has happened or how. Undetectable fraud denotes fraud that's absolutely impossible to detect after the fact (short of a whistleblower coming forth), and that's functionally impossible to detect before the fact due to time and resource constraints on pre-election machine testing.
The scariest part of Table 2's list of e-voting fraud types is the box where the "Undetectable" row and the "Wholesale" column intersect. Undetectable wholesale fraud is the ultimate apocalyptic scenario for security analysts, and for democracy—it's the briefcase nuke in downtown Manhattan, or the human-transmissible bird flu strain in the international terminal of LAX.
Because undetectable wholesale election fraud is the holy grail of anyone who wants to steal an election, I'll spend the rest of this article discussing it in some detail. Along the way, you'll also see that most of the attacks I'll cover can also be carried out on the retail level, as well.