2.4 LOCAL LITERATURE

2.4.1 Electronic Voting Literature Review

Computer scientists who have done work in, or are interested in, electronic voting all seem to agree on two things: * Internet voting does not meet the requirements for public elections * Currently widely-deployed voting systems need improvement

Voting on the Internet using every day PC's offers only weak security, but its main disadvantages are in the areas of anonymity and protection against coercion and/or vote selling. It's such a truly bad idea that there seems to be no credible academic effort to deploy it at all. The Presidential elections of 2000 brought national attention to problems with current American methods of casting and counting votes in public elections. Most people believe that the current system should be changed; there is much disagreement on how such changes should be made.

The MIT/Caltech researchers [1] “see a promising future for electronic voting, despite its problems today” (under a few conditions). They advocate using the methods currently in use which result in the lowest average numbers of “uncounted, unmarked, and spoiled ballots,” like in-precinct optical scanning. Their report even proposes a framework for new voting system with a decentralized, modular design.

Other researchers have done work in electronic voting; while they may not explicitly mention voting from remote poll sites, their work is nonetheless relevant to any effort at designing or implementing a remote poll site voting system. Lorrie Cranor [2] could be classified, like the Caltech/MIT researchers, as a cautious optimist. She acknowledges the problems inherent in each kind of voting apparatus, but doesn't make an over the recommendation on her site for one technology over the rest. Some other academics, whom we did not study in class, like Peter Neumann who moderates the RISKS mailing list, are less optimistic. They agree mostly with the Caltech/MIT committee, but their papers focus on the immensity of the problem one faces when trying to design and implement a truly secure voting system. They often remind us of Ken Thompson's Turing acceptance speech and the fact that we really can't trust any code which we did not create ourselves. (And in reality, we cannot trust even code that we do write ourselves, since we almost always need a development tool chain written by someone else.) Therefore, they tend to be extremely suspicious of proprietary voting machines and their makers who insist that we should “just trust [them].”

Neumann [4] gives a list of suggestions for "generic voting criteria" which suggests that avoting system should be so hard to tamper with and so resistant to failure that no commercial system is likely to ever meet the requirements, and developing a suitable custom system would be extremely difficult and prohibitively expensive.

Rebecca Mercuri [3,7] invented the “Mercuri method” for electronic voting. A critical component of this method is very similar to the Caltech/MIT proposal: a voting machine must produce human-readable hardcopy paper results, which can be verified by the voter before the vote is cast, and manually recounted later if necessary. Her philosophy and Neumann's are very similar; in fact, they've written papers together on the subject.

David Chaum presents a very interesting scheme [5], whereby voters could get receipts for their votes. This receipt would allow them to know if their votes were included in the final tally or not, and to prove that they voted without revealing any information about how they voted. The security of this scheme depends on visual cryptography developed by Naor and Shamir, and on voters randomly choosing one of two pieces of paper. Mercuri and Neumann advocate the use of this technique in electronic voting systems.

Dr. Michael Shamos of CMU provides a sharp counterpoint [6] to Neumann and Mercuri's views. While his “Six Commandments” summary of requirements for a voting system is very similar to others' requirements, he's less afraid of the catastrophic failures and sweeping fraud made possible by imperfections in electronic voting machines actually occurring in a real election. Shamos is also much less impressed with paper ballots than are Neumann and Mercuri. He places a great deal of faith in decentralization to make fraud difficult to commit and easy to detect. Dr. Shamos even likes DRE machines. (We must take into account the fact that this paper was written ten years ago, long before the 2000 elections and before more modern mathematical results like Chaum's; some of Dr. Shamos' opinions may have changed since then. While Dr. Neumann's talk cited here is of similar age, his pessimism with regard to machines has had little reason for change.)

Sources:
[1] "A Preliminary Assessment of the Reliability of Existing Voting Equipment," The
Caltech-MIT Voting Technology Project, March 30, 2001 (revised).
Available at http://www.vote.caltech.edu/Reports/index.html)
[2] “Lorrie Cranor's Voting Papers,” Lorrie Faith Cranor. http://lorrie.cranor.org/pubs/voting.html [3] "A Better Ballot Box?" Rebecca Mercuri, IEEE Spectrum, Volume 39, Number 10,
October 2002.
[4] “Security Criteria for Electronic Voting,” Peter Neumann, presented at the 16th
National Computer Security Conference Baltimore, Maryland, September 20-23, 1993.
Available at http://www.csl.sri.com/users/neumann/ncs93.html
[5] “Secret-Ballot Receipts and Transparent Integrity,” David Chaum, draft.
Available at http://www.vreceipt.com/article.pdf
[6] “Electronic Voting - Evaluating the Threat,” Michael Ian Shamos, CFP '93.
Available at http://www.cpsr.org/conferences/cfp93/shamos.html\
[7] “Electronic Voting,” Rebecca Mercuri. http://www.notablesoftware.com/evote.html

2.4.2 E-Voting in UAE FNC Elections: A Case Study

The amount of reported work on the subject of e-voting is considerably significant. The literature of electronic voting states that the field needs significant improvement (Alexander, 2001; Besselaar and Oostveen, 2003; Cranor, 2000; IPI, 2001; Hargrove, 2004; Liptrott, 2006; Manjoo, 2003a; Manjoo, 2003b; Millar, 2002; O'Donnell, 2002; Oostveen and Besselaar, 2006; Shamos, 1993; Xenakis and Macintosh, 2006). Advocates of e-voting point out that electronic voting can reduce election costs and increase civic participation by making the voting process more convenient. Critics maintain that without a paper trail, recounts are more difficult and may open the door for electronic ballot manipulation, and that even poorly-written programming code, could affect election results. Many researchers have produced different studies and approaches to address these concerns. A sample outline of such research is provided in Table 3. A report worthy of note around e-voting was produced by an MIT Universality Team in the United States.Information and Knowledge Management www.iiste.org ISSN 2224-5758 (Paper) ISSN 2224-896X (Online) Vol 2, No.6, 201227. The Caltech/MIT Voting Technology Project that was established in December in 2000, following the controversial election recount of the 2000 residential vote in Florida, assessed the magnitude of the problems surrounding voting systems, their root causes and how technology can reduce them (Caltech-MIT, 2001). The report provided a set of recommendations on the various issues related to voting and proposed a framework for a new voting system with a decentralised, modular architecture in which vote generation is performed separately from vote casting. The report emphasised the importance of developing a permanent audit trail. It also stressed the fact that the vote generation machine can be proprietary, whereas the vote casting machine must be open-source and thoroughly verified and certified for correctness and security. The National Institute of Standards and Technology draft report, issued in 2006, proposed vote verification through a parallel process of electronic and ballot count (NIST, 2006). It indicated that voting systems should allow election officials to recount ballots independently from a voting machine's software. The recommendations endorse "optical-scan" systems in which voters mark paper ballots that are read by a computer, and electronic systems that print a paper summary of each ballot, which voters review and elections officials save for recounts.

NIST indicated in its report that the lack of a paper trail for each vote "is one of the main reasons behind continued questions about voting system security and that it diminished public confidence in elections."

The California Internet Voting Report [CIVTF, 2000] suggested an innovative strategy to enable remote internet voting to improve participation in the elections process, i.e. providing voters with the ability to cast their ballots at any time from any place via the Internet. On the contrary, experts argue that the internet isn’t ready yet for "prime time" national federal elections over the internet, given the current state of insecurity of hosts and the vulnerability of the Internet to manipulation and denial-of-service attacks (Hisamitsu and Takeda, 2007; Kosmopoulos, 2004; Rubin, 2002; Schneier, 2004). They also identify security issues in social engineering and in using specialised devices and other factors that could undermine the sanctity of an Internet-based election process, and that the current infrastructure is inadequate for remote Internet voting (ibid).

Another report produced by the National Institute of Standards and Technology (NIST) in 2008 concluded that widely-deployed security technologies and procedures could mitigate many of the risks associated with electronic ballot delivery, but that the risks associated with casting ballots over the Internet were more serious and challenging to overcome (NIST, 2008).Another recent NIST report (2011) concluded that Internet voting systems cannot currently be audited with a comparable level of confidence in the audit results as those for polling place systems. Other researchers point out that building secure online voting systems is far from being possible and that a small configuration or implementation error would undermine the entire voting process (Wolchok et al., 2012).

Reference is made to the pilot project of an online voting in Washington, D.C. and how researchers at University of Michigan were able to break through the security functions and gained complete control of the election server in less than 48 hours. Researchers argue that fundamental advances still need to be made in security before e-voting will truly be safe (Cramer et al., 1996; Ikonomopoulos et al., 2002; Schoenmakers, 1999; Wolchok et al.,
2012).

Researchers indicated that operationally, no commercial system is likely to ever meet all requirements, and that developing a suitable custom system would be extremely difficult and prohibitively expensive (Neumann, 1993). Others indicated that any catastrophic failures and sweeping fraud made possible by imperfections in electronic voting machines are also likely to occur in a real election (Shamos, 1993). Shamos (1993) refers to the fact that the real source of election problems is the result of human limitations. He describes that the chief source of the issue is the willingness of unsuccessful politicians to embrace any conceivable reason for their loss, except that the voters didn't want them. His reflective recommendation proposes that government efforts expended in meeting threats to the election process should be rationally related both to the probability of the threat and the seriousness of its effects.

Other researchers argue that the progress of e-voting relies on the advancement of standards and technical solutions, which should take into account discussions on general requirements, threat perceptions and the economic, political and sociological implications surrounding the use of electronic voting systems (Alexander, 2001; Cranor, 2000; Hillman, 2007; Hoffman, 2004; Jones, 2001; Shamos, 1993; UK POST, 2001; Volkamer, 2009). Rubin (2002) argues that technologists should take on a role to educate the policymakers about the issues surrounding an e-voting system and enable them to develop more effective strategies.

Another part of the literature deals with public trust and confidence. It argues that, if the public perceives elections to be unfair, the foundation of the government is weakened. Whether electronic voting systems are fair may not even matter; it is the public perception that is crucial (Bonsor and Strickland, 2011).
On a different standpoint, the International Institute for Democracy and Electoral Assistance published a policy report that identified some essential considerations for e-voting systems to gain public trust and confidence (IDEA, 2011). It introduced a pyramid of trust that consists of three levels: credible electoral process, socio-political context, and operational and technical context. See also Figure 2. Information and Knowledge Management www.iiste.org ISSN 2224-5758 (Paper) ISSN 2224-896X (Online) Vol 2, No.6, 201228

The top level represents the ultimate goal of the electoral reform and the introduction of the e-voting system, and is a factor that is dependent on the two levels shown below. Public trust is seen to be determined by the socio-political context in which e-voting is introduced. Some factors in this context can be directly addressed by a comprehensive e-voting implementation strategy, while others, such as a general lack of trust in the Election Management Body (EMB), or fundamental political or technical opposition, will be more difficult to change. A negative socio-political context has the potential to create serious risks, even if the technical and operational foundations of the e-voting solution are sound.
Chiang (2009) developed a technology acceptance model that constitutes four trust variables, namely ease of use, perceived usefulness, attitude of usage, and security. The research results showed the effect of 'ease of use' on voters’ attitude towards using the e-voting system required 'perceived usefulness' as a medium. Then, the effect exhibited positive and significant influences among ease of use, perceived usefulness and attitude towards using the e-voting system. Security of the e-voting system has a positive and significant effect on attitude and trust in the e-voting system. The study concluded that the security of the e-voting system plays an important role in establishing user trust. Overall, the literature identified key elements that e-voting systems need to heed. These are listed in Table 4.

Though debate on the issue of e-voting has been and will continue to be passionate, most critics recognise that a move towards an electronic voting system is an inevitable step in the evolution of the voting process (2007).Governments seem to be motivated to adopt e-voting systems, despite the issues and concerns reported in the literature, as the next section will present.

Source: http://www.emiratesid.gov.ae/userfiles/EVoting_UAE_%20A%20Case%20Study.pdf 2.4.3 Electronic Voting - A Survey

Prashanth P. Bungale and Swaroop Sridhar
Department of Computer Science
The Johns Hopkins University

As the world watched the electoral drama unfold in Florida at the end of 2000, people started wondering, “Wouldn’t all our problems be solved if they just used Internet Voting?”. People all over the world soon started taking a hard look at their voting equipment and procedures, and trying to figure out how to improve them [1]. There is a strong inclination towards moving to Remote Internet Voting – at least among the politicians – in order to enhance voter convenience, increase voter confidence and voter turnout. However, as will be seen later in this paper, there are serious technological and social aspects that make Remote Internet Voting infeasible in the visible future. Therefore, many technologists have suggested that remote poll-site electronic voting, where the voter can vote at any poll-site (not only his home county poll-site), seems to be the best step forward as it provides better voter convenience, but at the same time, does not compromise security. This paper presents a survey of the state of the art in Electronic Voting, including the various works done in Internet Voting (and the arguments against its use), as well as in electronic poll-site voting.

Electronic voting refers to the use of computers or computerized voting equipment to cast ballots in an election. Sometimes, this term is used more specifically to refer to voting that takes place over the Internet. Electronic systems can be used to register voters, tally ballots, and record votes [2].

The Caltech/MIT Voting Technology Project [3] came into being in order to develop a new voting technology in order to prevent a recurrence of the problems that threatened the 2000 U. S. Presidential Elections. The report assesses the magnitude of the problems, their root causes and how technology can reduce them. They address a wide range of “What is” issues including voting procedures, voting equipment, voter registration, polling places, absentee and early voting, ballot security, cost and public finance of elections, etc. They then propose a novel “What could be” framework for voting technology (that moves away from monolithic voting structures), and propose that a process for innovation be setup. The framework is “A Modular Voting Architecture (“Frogs”)” [4,5,6] in which vote generation is performed separately from vote casting, and the “Frog” forms a permanent audit trail, the importance of which cannot be over-stressed. Here, the vote generation machine can be proprietary whereas the vote casting machine must be open-source and thoroughly verified and certified for correctness and security.
Finally, the report provides a set of short-term and long-term recommendations on the various issues related to voting.

In “Electronic Voting” [7], Rivest addresses some issues like the “secure platform problem” and the (im)possibility of giving a receipt to the voter. He also provides some personal opinions on a host of issues including the striking dissimilarity between e-commerce and e-voting, thedangers of adversaries performing automated, wide-scale attacks while voting from home, the need for extreme simplicity of voting equipment, the importance of audit-trails, support for disabled voters, security problems of absentee ballots, etc.

The NSF Internet Voting Report [8] addresses the feasibility of different forms of Internet voting from both the technical and social science perspectives, and defines a research agenda to pursue if Internet voting is to be viable in the future. It groups Internet voting systems into three general categories as follows:
• Poll-site Internet voting: It offers the promise of greater convenience and efficiency in that voters could cast their ballots from any poll site, and the tallying process would be both fast and certain. More importantly, since election officials would control both the voting platform and the physical environment, managing the security risks of such systems is feasible.
• Kiosk voting: Voting machines would be located away from traditional polling places, in such convenient locations as malls, libraries, or schools. The voting platforms would still be under the control of election officials, and the physical environment could be modified as needed and monitored (e.g., by election officials, volunteers, or even cameras) to address security and privacy concerns, and prevent coercion or other forms of intervention.
• Remote Internet voting: It seeks to maximize the convenience and access of the voters by enabling them to cast ballots from virtually any location that is Internet accessible. While this concept is attractive and offers significant benefits, it also poses substantial security risks and other concerns relative to civic culture. Current and near-term technologies are inadequate to address these risks.

The report presents some findings on the feasibility of each of these categories and provides research recommendations for the long-term future. It then identifies criteria for election systems. Finally, it addresses the technological issues (including voting system vulnerabilities, reliability, testing, certification and standards, specifications of source code, platform compatibility, secrecy and non-coercibility, etc.) and social science issues (such as voter participation, voter access, the election process, voter information, deliberative and representative democracy, community and character of elections, distribution of roles, legal concerns, voter registration, etc.)

The California Internet Voting Report [9] suggests a strategy of evolutionary rather than revolutionary change towards achieving the goal of providing voters with the opportunity to cast their ballots at any time from any place via the Internet. The report defines four distinct Internet voting models – Internet voting at voter’s polling place, Internet voting at any polling place, Remote Internet voting from County computers or kiosks, Remote Internet voting from any Internet connection – and the corresponding technical and design requirements that must be met when implementing any of the stages. It addresses the advantages, implementation and security issues of each of the four stages. They believe that additional technical innovations are necessary before remote Internet voting can be widely implemented as a useful tool to improve participation in the elections process and that current technology however would allow for the implementation of new voting systems that would allow voters to cast a ballot over the Internet from a computer at any one of a number of county-controlled polling places in a county. Finally, the report presents the findings and recommendations of the task force on policy issues. The Appendix A [10] of this report contains a technical analysis of the communication and security issues inherent in Internet voting, along with recommended privacy and security requirements for any Internet voting systems. It also deals with potential Internet-based voter registration systems and, briefly, with Internet petition-signing systems as well.

An extensive survey of e-voting technology has been provided in “e-Voting Security Study” [11]. It provides a survey of recent academic and commercial projects in the area, in addition to the area’s prominent academics’ personal views and testimonies regarding the issues. It identifies threats, potential sources of attack and possible methods of attack in such voting systems. It also identifies security objectives and requirements of an electronic voting system.

The foundation of much of the academic work in the area of remote voting is a paper by Fujioka, Okamoto and Ohta (FOO) [12]. It gives a mathematical framework for a secure election that involves an administrator, and a counter and the voter connected by an anonymous channel.
Practically focused projects build on the blind voting protocol proposed in this paper. Sensus [13] uses blind signatures to ensure that only registered voters can vote and that each registered voter votes exactly once, while at the same time maintaining voter’s privacy. It allows voters to verify independently that their votes were counted correctly and anonymously challenge the results, should their votes be miscounted. Another project called E-VOX [14] at MIT implements a simplified, user-friendly version of the FOO framework using Java, Netscape and JDBC (Java Database Connectivity). This system is still involved in teaching and research and was used for an Undergraduates Association election at MIT in 1999. “Multiple Administrators for Electronic Voting” [15] improves this further by distributing the authority among multiple administrators to prevent vote forging.

“An untraceable, universally verifiable voting scheme” [16] presents a remote voting scheme that applies the technique of blinded signature to a voter's ballot so that it is impossible for anyone to trace the ballot back to the voter. They achieve the desired properties of privacy, universal verifiability, convenience and untraceability, but at the expense of receipt-freeness. The E-Poll (Electronic Polling System for Remote Voting Operations) project [17] investigates broadband mobile communications based on the UMTS standard for providing the E-Poll network with the required bandwidth and security. This makes it possible to use E-Poll kiosks anywhere, within a private, reliable and protected network. The voter-recognition system is based on an innovative smart card with an embedded biometric fingerprint reader, which performs voter recognition with absolute security. An ergonomic kiosk facilitates use by disabled people. The FREE e-democracy project [18] is dedicated to creating the GNU.FREE Internet Voting system and also advocating Free Software, which is non-partisan and non-commercial in origin. [19] presents a system for secure electronic voting which does not rely on persistent network connections between polling places and the vote-tallying server. They build the system on a disconnected (or, more accurately, an intermittently connected) environment, which behaves well in the absence of network connectivity.

“Security Criteria for Electronic Voting” [20] considers some basic criteria for confidentiality, integrity, availability, reliability, and assurance for computer systems involved in electronic voting. After an assessment of the realizability of those criteria, it concludes that, operationally, many of the criteria are inherently unsatisfiable with any meaningful assurance.

In [21], Rubin identifies the new risks brought about by introducing the state-of-the-art technology into the election process, which may not be worth taking. The major security risks identified include those at the voting platform – including malicious payload (attack programs, remote administration and monitoring toolkits, etc.) and delivery mechanism (worms, viruses and bugs, active content downloaded automatically, etc.) – and the communications infrastructure – including (distributed) denial of service attack, DNS server attack, etc. He also identifies security issues in social engineering and in using specialized devices. Discussions on requirements, threat perceptions and socio-political issues regarding electronic voting can be found in [22, 23, 24, 25, 26].

Sources: “Voting After Florida: No Easy Answers,” Lorrie Faith Cranor, December 2000, http://lorrie.cranor.org/.
“Electronic Voting,” Encyclopedia of Computers and Computer History, prepared by Lorrie Faith Cranor and edited by Raul Rojas, published by Fitzroy Dearborn, 2001.
“Voting – What is, What Could be,” Caltech/MIT Voting Technology Project (VTP) Report, July 2001.
“A Modular Voting Architecture (“Frogs”),” Shuki Bruck, David Jefferson, and Ronald L. Rivest, August 2001.
“Comments of Professor Ronald L. Rivest”, Caltech/MIT VTP Press Conference, July 16, 2001, http://theory.lcs.mit.edu/~rivest/publications.html.
“Testimony given before the U.S. House Committee on Administration”, Ronald L. Rivest, May 24, 2001, http://theory.lcs.mit.edu/~rivest/publications.html.
“Electronic Voting,” Ronald L. Rivest, Technical Report, Laboratory for Computer Science, Massachusetts Institute of Technology.
“Report of the National Workshop on Internet Voting: Issues and Research Agendas,” Internet Policy Institute, Sponsored by the National Science Foundation, Conducted in cooperation with the University of Maryland and hosted by the Freedom Forum, March 2001.
“A Report on the Feasibility of Internet Voting,” California Internet Voting Task Force, January 2000.
“Appendix A: Technical Committee Recommendations,” California Internet Voting Task Force, January 2000. “e-Voting Security Study,” E-Democracy Consultation, U. K. Cabinet Office, http://www.edemocracy.gov.uk/library/papers/study.pdf.
“A Practical Secret Voting Scheme for Large Scale Elections,” A. Fujioka, T. Okamoto, and K. Ohta, Advances in Cyptology - AUSCRYPT ‘92.
“Sensus: A Security-Conscious Electronic Polling System for the Internet,” Lorrie F. Cranor and Ron K. Cytron, Proceedings of the Hawai`i International Conference on System Sciences, January 7-10, 1997, Wailea, Hawai`i, USA.
“Secure Electronic Voting Over the World Wide Web,” Master’s Thesis, Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, May 1999.
“Multiple Administrators for Electronic Voting,” Bachelor’s Thesis, Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, May 1999.
“An Untraceable, Universally Verifiable Voting Scheme,” Professor Philip Klein, Seminar in Cryptology, December 12, 1995. http://www.e-poll-project.net/ http://www.free-project.org/
“Secure Voting Using Disconnected, Distributed Polling Devices,” David Clausen, Daryl Puryear and Adrian Rodriguez, Department of Computer Science, Stanford University.
“Security Criteria for Electronic Voting,” Peter G. Neumann, 16th National Computer Security Conference, Baltimore, Maryland, September 20-23, 1993.
“Security Considerations for Remote Electronic Voting,” Aviel D. Rubin, Communications of the ACM, Vol. 45, No. 12, December 2002.
“Ten Things I Want People to Know About Voting Technology,” Kim Alexander, President and Founder, California Voter Foundation, Presented to the Democracy Online Project’s National Task Force, National Press Club, Washington, D. C., January 18, 2001.
“Electronic Voting – Evaluating the Threat,” Michael Ian Shamos, International Conference on Computers, Freedom, and Privacy, Burlingame, California, 1993.
“Internet Voting: Will it Spur or Corrupt Democracy?,” Lance J. Hoffman, Technical Report, Computer Science Department, The George Washington University, Washington, D. C.
“Online Voting,” postnote – a publication of the U. K. Parliamentary Office of Science and Technology, May 2001.
“Evaluating Voting Technology,” Douglas W. Jones, Testimony before the United States Civil Rights Commission, Tallahassee, Florida, January 11, 2001.