Presented at
Kiwicon 9: Cyberwar Is Hell (2015),
Dec. 11, 2015, noon
(30 minutes).
In the world's largest-ever deployment of online voting, the iVote Internet voting system was trusted for the return of 280,000 ballots in the 2015 state election in New South Wales. During the election, we performed an independent security analysis of parts of the live iVote system and uncovered severe vulnerabilities that could be leveraged to manipulate votes, violate ballot privacy, and subvert the verification mechanism. These vulnerabilities do not seem to have been detected by the election authorities before we disclosed them, despite a pre-election security review and despite the system having run in a live state election for five days. One vulnerability, the result of including analytics software from an insecure external server, exposed some votes to complete compromise of privacy and integrity. At least one parliamentary seat was decided by a margin much smaller than the number of votes taken while the system was vulnerable. We also found fundamental protocol flaws, including vote verification that was itself susceptible to manipulation. This incident underscores the difficulty of conducting secure elections online and carries lessons for voters, election officials, and the e-voting research community.
Presenters:
-
Vanessa Teague
Vanessa Teague is a Senior Lecturer in the Department of Computing and Information Systems at at The University of Melbourne. She did her Bachelor's Degree at The University of Melbourne and her Ph.D. in cryptography and game theory at Stanford University. Her main research interest is in electronic voting, with a focus on cryptographic schemes for end-to-end verifiable elections and a special interest in complex voting schemes such as STV. She was a major contributor to the Victorian Electoral Commission's end-to-end verifiable electronic voting project, the first of its kind to run at a state level anywhere in the world, joint work with Chris Culnane, Peter Ryan and Steve Schneider. She recently discovered, with Alex Halderman, serious security vulnerabilities in the NSW iVote Internet voting system. She is on the advisory board of Verified Voting and has been co-chair of the USENIX Electronic Voting Technologies Workshop and the International conference on E-voting and identity. She also spends a lot of time explaining to parliamentarians and electoral officials that requirements for transparency, privacy and verifiability apply to computerised voting too.
Links:
Similar Presentations: