[Politech logo]

Politech is the oldest Internet resource devoted to politics and technology. Launched in 1994 by Declan McCullagh, the mailing list has chronicled the growing intersection of law, culture, technology, and politics. Since 2000, so has the Politech web site.

Report critiques federal government's Internet voting scheme


-------- Original Message --------
Subject:     the new Internet voting scheme
Date:     Wed, 25 Oct 2006 10:26:53 -0700
From:     Barbara Simons <simons@acm.org>
To:     Declan McCullagh 
CC:     info@servesecurityreport.org


Dear Declan,

PLEASE CIRCULATE:

My colleagues David Jefferson, Avi Rubin, David Wagner and I have just
released a short paper about the government's IVAS system that involves
absentee voting using email and fax and ballot distribution over the
Internet. See

http://servesecurityreport.org/ivas.pdf

We wanted to bring this to your attention because we believe this
system poses significant risks, as described in this excerpt from our
article:

In summary, we see three main risks:

1. Tool One exposes soldiers to risks of identity theft.  Sending
personally identifiable information via unencrypted email is considered
poor practice.  No bank would ask their customers to send SSNs over
unencrypted email, yet Tool One does exactly that.  This problem is
exacerbated by potential phishing attacks.

2. Returning voted ballots by email or fax creates an opportunity for
hackers, foreign governments, or other parties to tamper with those
ballots while they are in transit.  FVAP's system does not include any
meaningful protection against the risk of ballot modification.

3. Ballots returned by email or fax may be handled by the DoD in some
cases.  Those overseas voters using the system sign a waiver of their
right to a secret ballot.  However, it is one thing for a voter's
ballot to be sent directly to their local election official; it is
another for a soldier's ballot to be sent to and handled by the DoD –
who is, after all, the soldier's employer.

Regards,
Barbara Simons



Posted by Declan McCullagh on Oct 25, 2006 in category privacy


Get a Politech feed through RSS or Atom [RSS] [Atom]

The Politech general information pages and photographs are copyrighted by Declan McCullagh. Original posts distributed to the mailing list are licensed under a Creative Commons License.
Creative Commons License