letters to the editor

DOI:10.1145/1461928.1461931

Seven Principles for Secure E-Voting

E-VOTING CAN BE as secure and confidential as paper-based voting, as discussed in the “Point/Counterpoint” “The U.S. Should Ban Paperless Electronic Voting Machines” by David L. Dill and Daniel Castro (Oct. 2008). However, to work properly, such systems must first incorporate seven design principles:

Proven security. All protocols and techniques must be mathematically proven secure. One-time-pad-based methods qualify, while popular cryptographic methods (such as AES, DES, RSA, and SHA) do not; historically, every cipher not proven secure has been broken;

Trustworthy design responsibility. Government security agencies (such as the U.S. National Security Agency and the German Bundesamt für Sicherheit in der Informationstechnik) should be responsible for creating secure voting systems, though this work must be inspected and audited by experts selected and approved by all major parties taking part in elections. Private companies have shown they are unable to secure critical systems, including government ciphers and nuclear launch codes, so should not be entrusted to secure elections;

Published source code. The source code of all election software must be published and made publicly accessible;

Vote verification. All voters must be able to verify their votes as part of a complete nationwide tally of votes, as well as of individual voting-district-based tallies;

Voter accessibility. A full list of voters must be available to all citizens, allowing them to verify its accuracy; date and place of birth might be necessary parts of voter records to assure detection of duplicate entries;

Ensure anonymization. Techniques like onion routing must be used to ensure anonymization; and

Expert oversight. The government’s responsibility in the election system (including defense against denial-of-

service attacks) must be handled by a team of experts selected and approved by all major parties taking part in elections.

Simple, mathematically secure methods for e-voting are conceivable, and voters’ confidence can be increased by allowing them to verify their votes in the nationwide tally, as well as review the full list of voters. As with any cryptographic method, the system must still rely on a chain of mutual trust, which will always be necessary. The chain of trust inherent in practical cryptography cannot be ignored in e-voting. Moreover, boot-from-CD voting software like Linux Live CDs, one-time pads, and onion routing would support more direct democracy. The economics of e-voting allow for much cheaper voting, thereby allowing more elections on a larger number of specific policy decisions.

Frank Gerlach,

Baden-Württemberg, Germany

Dill Responds:

Rather than critiquing Gerlach’s complex yet vague proposal, I return to the question addressed in the debate. Suppose, for the sake of argument, that an elaborated version of that scheme allowed its operator to change votes without detection. The current and proposed standards and certification processes would be completely ineffective at protecting voters from such a system. A certification system that would be able to assure the security of paperless voting systems will not exist for many years, maybe never. On the other hand, it is possible to write testable requirements for secure voter-verified paper-ballot systems. That’s one reason they should be mandated.

David L. Dill, Stanford, CA

Castro Responds:

Many of Gerlach’s suggestions can (and often are) used in today’s e-voting systems and elections. Security, accountability, usability, and cost will all continue to be important factors in evaluating these systems. However, I disagree with the

premise that in essence “nationalizing” the voting-machine industry is a good solution. The quality of an engineer’s final product is not dependent on whether or not the engineer works for private industry or for government. Competition can ensure that innovation continues and better voting system standards protect the electorate from unnecessary risk.

Daniel Castro, Washington, D.C.

Send IT Employees to Teach

Reading “Crossroads for Canadian CS Enrollment” by Jacob Slonim et al. (Oct. 2008), I thought of something not discussed directly in the article: Why not have industry employees contribute directly to the education process? Many of the causes the authors attributed to the decline of CS enrollment can be, at least partially, addressed by increasing the participation of IT employees in high school and university education. A general proposal would involve companies in the technology community initiating employee-teach-ing programs that give employees the option of serving as high school teachers or as visiting university professors for some period of time, say, two to five years. They could use their practical knowledge and industry ties to:

Share industry trends and create curricula for high schools and university CS departments that more closely align with the demands of industry;

Teach university courses on industrial topics or new technologies not traditionally addressed by CS departments;

Provide the kind of computing knowledge high school faculty often lack;

Serve as a visible representative of computing in the educational setting, as well as a role model for students; and

Create a direct line of communication between industrial and educational organizations.

This program should coincide with other industrial initiatives (such as donating equipment to schools and giv-

8 COMMUNICATIONS OF THE ACM | FEBRUARY 2009 | VOL. 52 | NO. 2