In the digital age, the idea of leveraging technology to enhance electoral processes is increasingly appealing. However, the concept of digital elections carries with it a plethora of security concerns and controversial opinions. In this blog post, we propose a hypothetical architecture for a digital election system designed to maximize security, maintain voter anonymity, and ensure the integrity of the voting process. This system architecture utilizes kiosks with embedded systems, operates entirely within a Virtual Private Network (VPN), and is protected by robust firewall configurations and other security measures. In our example we will use Slovakia in Central Europe, lets deep dive!

Overview of Slovakia’s Electronic ID System

Issuance of eIDs

In Slovakia, electronic IDs are issued to all citizens with the primary purpose of facilitating secure electronic interactions with public administration services. The process of issuing an eID is managed by the government and begins with the citizen applying for an eID at a local authority office, which is similar to applying for a traditional ID card. The electronic component of the eID includes a chip that stores digital certificates and other secure elements that authenticate the holder’s identity. This certificates are protected with PIN codes which were setup by citizen itself during issuing process.

Features of the eID

Each eID is equipped with a microchip that carries encrypted digital certificates. These certificates serve multiple functions:

• Identity Verification: The primary certificate is used to confirm the identity of the eID holder, ensuring that the person presenting the card is indeed the legitimate owner.
• Digital Signatures: Another key feature is the ability to sign documents digitally, giving them the same legal standing as a handwritten signature.
• Access to Services: The eID can be used to access a wide range of government services, from tax submissions to health care and voting, ensuring that all interactions are secure and that the identity of the user is verified. Each citizen has access to portal slovensko.sk where can do lot of things with eID card.

Application in Digital Elections

Given the robust framework Slovakia has in place for issuing and using eIDs, integrating this technology into a digital election system offers several advantages:

• Secure Voter Authentication: The eID can be used at voting kiosks to authenticate the identity of voters securely and efficiently. This process ensures that each vote is cast by a legitimate voter without the need to reveal the voter’s identity in the election system.
• Anonymity in Voting: Once a voter is authenticated using their eID, the system can generate a temporary, anonymous ID for the actual voting session. This ensures that the vote remains confidential and that the voter’s choices are not connected to their identity.
  • Initial Input Generation: When a voter logs into the system using their authentication method (like an eID), the system gathers non-identifying data to create an initial input. This data can include a randomly generated number (nonce), the current timestamp, and perhaps session-specific data.
  • Hash Function Application: This initial input is then passed through a cryptographic hash function. Because of the properties of the hash function, the output (the hash value) will be a fixed-length, seemingly random string of characters that cannot be traced back to the voter’s identity.
  • Incorporation of Time Element: To further enhance security and ensure the token’s uniqueness for each session, the current time and date can be concatenated with the initial input before hashing. This practice ensures that even if the same voter were to authenticate multiple times, each session would generate a different token.
  • Token Use in Voting Session: The resulting hash value (the token) is then used as the voter’s identifier during the voting session. This token is what the voting system uses to record votes instead of any identifiable information about the voter. Once the session ends, the token can be discarded, thereby leaving no link between the voter and their vote.
  • Session Tokens: Upon successful login, the system issues a session token that is valid for the duration of the voting period. This token is unique and linked to the voter’s session. If the voter attempts to log in again, the system checks for active tokens associated with their credentials. If an active token exists, the system will deny a second login attempt.

• Reduced Potential for Fraud: The security features embedded in the eID, including biometric data and PIN verification, minimize the risk of voter impersonation and other types of electoral fraud.

System Overview

Our proposed digital election system is designed around several core principles of security, anonymity, and reliability. Here’s an overview of the system architecture:

1. Voting Kiosks with Embedded Systems: Secure, standalone machines placed in controlled locations.
2. Encrypted VPN Environment: All kiosks connect to a central server through a fully encrypted Virtual Private Network.
3. Advanced Firewall Protection: High-level firewalls manage and monitor all incoming and outgoing network traffic.
4. Two-Factor Authentication (2FA): Ensures that the voter is who they claim to be, while maintaining their anonymity in the vote record.
5. End-to-End Encryption (E2EE): From the kiosk to the central server, all data is encrypted, ensuring that votes are transmitted securely.

Voter Authentication and Anonymity

The integration of eID for voter authentication is the first critical step in securing digital elections. When voters arrive at designated voting kiosks:

• Authentication: Voters insert their eID into a reader, verifying their identity through the digital certificate and a personal identification number (PIN).
• Anonymity Assurance: Post-authentication, the system generates a one-time token using a hash function combined with a time-based element. This token, devoid of any personal information, represents the voter during the session, ensuring complete anonymity.

Secure Voting Kiosks

Voting kiosks equipped with embedded systems are the primary interface for voters. These kiosks:

• Secure Hardware: Use tamper-resistant hardware designed to operate solely for voting, minimizing vulnerabilities. No ports visible for citizens. Input is just Smartcard reader.
• Dedicated Software: Run on secure, minimalistic operating systems with all non-essential functionalities stripped out to further enhance security. We have lot of choices from variety of Linux distributions or hardened Windows system.

One-Way Data Transfers

• Technology Overview: One-way data transfer systems, also known as data diodes, allow data to flow in only one direction, further securing data from external attacks.
• Application in Voting: Used between the voting kiosks and the central election systems to ensure that information can only be sent from the kiosk to the server and not the other way around, thus protecting against potential vulnerabilities that could compromise the voting machines.

Network Security and Data Integrity

• VPN and Encryption: All data transmission between the voting kiosks and the central election server occurs over a Virtual Private Network (VPN), employing end-to-end encryption to safeguard voter data and vote integrity.
• Firewalls: Robust firewalls are deployed to monitor and control incoming and outgoing network traffic, ensuring that only authorized data passes through.

Real-Time Monitoring and System Audits

To maintain system integrity and address any anomalies swiftly:

• Real-Time Monitoring: An advanced monitoring system alerts election officials to any irregular activities or multiple login attempts, enabling immediate action.
• Immutable Audit Trails: All voting activities are logged in an immutable format, allowing for transparent post-election audits and verifications.

SQL Database Solution

For the purposes of a digital election system, a relational database like Microsoft SQL Server is an excellent choice due to its robustness, security features, and extensive support for transactional data management.

Database Encryption Setup

1. Transparent Data Encryption (TDE)

• Purpose: TDE encrypts the storage of an entire database by default, preventing unauthorized access from anyone trying to bypass database security to access the data files directly.
• Implementation: In SQL Server, TDE is set up at the database level. It encrypts the database with a symmetric key known as the database encryption key (DEK). The DEK itself is protected by a certificate stored in the master database of your SQL Server. Why we are encrypting?
  • Vote Confidentiality: By encrypting the entire database or specific columns within the database that store votes, you ensure that the contents remain confidential. This encryption prevents unauthorized parties from viewing or manipulating the votes, even if they gain physical or unauthorized logical access to the database. Only individuals with the correct decryption key can access and interpret the data.
  • Data Integrity: Symmetric encryption helps to safeguard data integrity by ensuring that any unauthorized alterations to the encrypted data are easily detectable. When data is encrypted, altering it without the corresponding decryption key becomes impractical. Any tampering with the encrypted data would not only be evident but also would not decrypt correctly, signaling potential foul play.
  • Protection Against Data Breaches: In the event of a data breach where data is exfiltrated, the stolen data would remain encrypted and thus unusable and unintelligible to the attacker. This is particularly important in voting systems where the privacy and secrecy of each vote are paramount. Encryption acts as a last line of defense against data leaks.
  • Non-repudiation: With the proper logging and management of encryption keys, encrypted databases can help provide non-repudiation. It ensures that once the data (in this case, votes) has been entered and encrypted, the source of this data cannot deny the creation or modification of the data. This feature is crucial for auditing and verifying the authenticity of the voting records.
  • Regulatory Compliance: Many regions have strict regulations governing the handling and protection of electronic data, particularly data pertaining to individual privacy. Using symmetric encryption helps ensure that the digital voting system complies with laws and regulations such as GDPR, HIPAA, or other national data protection laws, which often require that personal data be encrypted both at rest and in transit.

2. Column-level Encryption

• Purpose: For highly sensitive data fields such as voter identities or vote choices, column-level encryption allows for the encryption of specific data within a table, providing additional security where needed.
• Implementation: SQL Server supports column-level encryption where you can define encryption directly on a column using a symmetric key. This method is particularly useful when you need to query encrypted data.

SQL Server Security Best Practices

1. Encryption Keys Management:

• Key Storage: Encryption keys should be managed and stored securely using SQL Server’s built-in Key Management functionality or an external key management appliance to ensure keys are protected.
• Access Control: Access to keys should be limited to authorized personnel only, with audits and logging enabled for any access or use of the keys.

2. Network Security:

• Encrypted Connections: Ensure that connections to the SQL Server database are encrypted using SSL/TLS to protect data in transit. This prevents data from being intercepted during transmission between clients and the server.
• Firewall Configuration: Configure firewalls to restrict database access to only authorized network entities.

3. Audit and Compliance:

• SQL Server Audit: Use SQL Server Audit to create server or database-level audits, which can help track and log access and changes to the database. This ensures transparency and helps maintain a record of all operations that impact data.

Implementation Scenario

In the context of a digital election system, the setup might look something like this:

• SQL Server Installation: Deploy SQL Server in a secure data center with restricted access.
• Database Setup: Create a database with TDE enabled to ensure all data stored within is encrypted.
• Sensitive Data Handling: Apply column-level encryption to specific sensitive columns that store identifiable voter information or vote details.
• Regular Backups: Schedule encrypted backups of the database to secure and external storage regularly to ensure data integrity and availability for recovery.

Things to think about

Costs

1. System Architecture: The initial setup requires significant investment in hardware for secure voting kiosks, servers, and networking equipment, including specialized devices like data diodes for one-way data transfers and systems capable of maintaining air-gapped security. Software development costs for creating a secure voting platform that integrates with eIDs can also be substantial. We are talking in millions of € – Hardware, licenses, salaries of IT personal.
2. System Maintenance: Ongoing maintenance involves regular updates to security protocols, software patches, and hardware upkeep. Given the critical nature of the system, high-availability solutions and redundancy mechanisms must also be established, which further contribute to operational costs.
3. Certified Engineers: The system demands involvement from engineers certified in cybersecurity and network architecture, particularly those experienced with cryptographic and PKI technologies. The cost of employing such specialists, especially in a high-stakes environment like national elections, can be considerable.

Complexity

• System Architecture and Setup: Building an architecture robust enough to handle national elections securely introduces complexity. This includes integrating multiple technologies—eIDs, VPNs, air-gapped systems, and one-way data transfer technologies.
• Training and Operation: Training personnel to operate and troubleshoot this sophisticated system requires time and resources. Election staff must be familiar with the technical aspects of eIDs and the specific security procedures of digital voting.
• Human Presence: Despite the automation and electronic aspects of the system, human presence remains necessary at voting kiosks to assist voters, manage equipment, and ensure the integrity of the voting process, similar to traditional voting methods.

Benefits

• Faster Vote Counting: One of the most significant benefits of a digital election system is the rapid counting of votes. As soon as the polls close, the system can quickly tabulate votes electronically, significantly speeding up the process compared to manual counting.

Drawbacks

• Increased Complexity: While digital systems can offer enhancements like faster counting, they also add layers of complexity in terms of system management, security, and legal compliance. Each component, from hardware to software, must adhere to strict security standards, requiring continuous evaluation and adaptation to emerging threats.

Final Thoughts

While digital voting systems offer numerous benefits such as efficiency, convenience, and potentially enhanced security, traditional paper-based voting still holds several advantages, particularly in fostering community engagement and social interaction. Here are some reasons why paper voting can be preferable in certain contexts:

1. Community Interaction

Voting at physical polling stations is a communal activity where neighbors meet, reinforcing social bonds. This gathering can turn into a social event, where people catch up, discuss community issues, and reconnect with those they might not see regularly. For many, Election Day is as much a community activity as it is a civic duty.

2. Network Building

In small communities or tight-knit neighborhoods, Election Day provides an opportunity for residents to network. Such interactions can lead to discussions about local developments, school events, or community projects, fostering a sense of belonging and collective responsibility.

3. Creation of Friendships

The communal atmosphere of polling places can help forge new friendships. Voters who meet in line or while waiting to cast their ballots might find common ground or shared interests, leading to new social connections that enrich community life.

4. Tradition and Ritual

For many, the act of going to a polling place, marking a paper ballot, and physically submitting it into a ballot box carries significant symbolic weight. This ritual reinforces the gravity and importance of the voting process, serving as a tangible reminder of one’s participation in democracy.

5. Transparency and Trust

Paper voting is viewed by many as inherently transparent. The physical handling of paper ballots by multiple scrutineers and the public counting process are visible and tangible activities that can build trust in the electoral process. This visibility can reassure voters that their votes are counted as cast without the need for technical expertise to verify the results.

6. Accessibility and Inclusivity

Paper voting does not require voters to have technical knowledge or access to technology, making it more accessible to a wider demographic, including older populations or those in rural areas with less access to technology. This inclusivity ensures that all segments of the population can participate in the electoral process without barriers.

7. Reduced Risk of Technological Failures

Unlike digital systems, paper voting is not susceptible to technical issues such as software bugs, hardware failures, or cyberattacks. This absence of technological dependency makes the paper voting system less prone to disruptions that could undermine the integrity of the election.

Conclusion

At BACKDOORS IT, our mission extends beyond just presenting technological solutions; we believe in providing a comprehensive view of all available options, embracing both the innovative potentials of digital advancements and the enduring values of traditional methods. Our discussions around the implementation of digital election systems using technologies like Slovakia’s electronic ID system or traditional paper voting emphasize this approach.

We understand that each method has its own set of benefits and challenges. Whether it’s the efficiency and advanced security of digital voting systems or the community engagement and transparency of paper ballots, each has distinct advantages and potential drawbacks. Our goal is to lay out these aspects clearly and thoroughly, ensuring that you, our customers, are equipped with all necessary information to make informed decisions that best suit your needs and values.

At BACKDOORS IT, we’re not here to say something is impossible; we’re here to explore every possibility. By examining all aspects and facilitating comprehensive discussions, we empower you to decide the best path forward. We’re committed to supporting you in navigating these choices, ensuring that your decisions are informed by a complete understanding of the implications, both technologically and socially.