Election security is considered one of the most difficult problems in computer security

Question

Not just electronic voting, but in election security general.

I think it part is because there are many components to it, and it has many components that could be compromised.

What are some of the top 3 reasons why this problem is a particularly challenging problem?

Answer 1

Voting secrecy and inability to verify your vote

A particular concern that's mostly limited to election systems is to ensure the secrecy of ballots even with cooperation of the voter.

It's quite straightforward (though a lot of attention to detail is needed) to design a digital e-voting system that allows you to securely cast a vote, cryptographically verify that your vote has been counted properly in the end, and be able to offer solid proof if your vote has been "stolen" i.e. counted differently. With a bit of trickiness it's possible to combine this with the ability to keep your vote anonymous from others without your cooperation, there are published theoretical methods for that.

However, that is not sufficient for real elections where there's a need (both constitutional and practical) to prevent vote buying and vote coercion. This requires that there is no way for the voter to prove to a third party anything about their vote - any "evidence" that the voter might show to someone else that they voted in a particular way (because either someone is offering them money to show that, or their boss is requiring to show such proof or be fired) must be either impossible or easily forgeable. Current paper-based systems have various measures for this purpose, depending on the particular nuances of the system. For example, the possibility to take a photo of your ballot needs to be adressed by either making it trivial to make a photo of a different ballot than the one that you actually put in the ballot box, or by disallowing any photos of the ballots.

So the problem here is the conflicting (perhaps incompatible - as far as I know there are no good solutions yet) aspects of (a) need to securely verify to the public that all the votes have been counted properly and (b) need to ensure the impossibility of verifying any single vote.

It will be hard to get people to trust an electronic system where they can't verify how exactly their vote was counted, but a system where they can verify it remotely from their home is not acceptable.

If there were no good alternatives, then perhaps people might tolerate some tradeoff like that, but the current paper voting processes in many countries are actually quite effective at filling the security needs, and the best currently suggested e-voting protocols are worse than the existing systems.

Answer 2

The problems with voting from a security perspective are myriad.

Among them are

• Privacy: a democracy requires that nobody knows who voted what. Any security you employ must guarantee this.
• Integrity: there must be no way to manipulate a vote or voter.
• Availability: a voering system must remain available for the compleet voting period. (That is from when the voting slips are made until the last contested votes have been counted and verified)
• Auditable: afterwards it must be possible to validate that each voter voted at most once and the results must be countable after the fact in some way.

Now for a smooth voting experience voting must also be easy, fast, and have as little obstacles as possible.

In short a Voting systems wants everything at once. Since this is not possible without enormous effect and resources we usually try a best effort approach. This effort must still ensure all the things I listed above, some of which are I. Direct conflict with each other.

And just to reiterate: this is not an exhaustive list! Just what I came up with in a few minutes.