Wednesday, April 14, 2010

Israeli RFID-based voting system shown to be insecure

While I am opposed to the type of electronic voting that has been implemented in Maryland and in much of the US, I can understand the motivations of those who support these systems. Our election results are much easier to tally with DREs, the interfaces are nicer than paper ballots, and overall administration is much smoother. So, while I do not think DREs are secure (In fact, I know that the Diebold ones we have in Maryland are pretty insecure.), I have no trouble understanding why some people want them.

In Israel the situation is different. When Israelis vote, the process is as simple as can be. Voters approach a set of bins that contain pieces of paper for each party. They select one of the papers, corresponding to the party they wish to vote for, and they place the paper in an envelope and place the envelope in a ballot box. That's it. The papers are counted, and the party with the most votes wins. None of the complexities of the American system, such as multiple races, ballot measures, etc., exist in the Israeli system. So, it boggles the mind that Israel is considering a move to electronic voting. They simply don't need it.

Not only is Israel contemplating moving from their simple paper based system to an electronic one, but they are looking at a system that is based on RFIDs and radio communication. Talk about shooting a flea with a canon. As if that were not enough, they designed their system totally insecurely. Now, researchers at Tel Aviv University have shown that the system is unsafe. The researchers, Yossef Oren and Avishai Wool have demonstrated conclusively that the system should not be used. From their abstract:

We show how a low-budget adversary armed with a relay device can read out all votes already cast into the ballot box, suppress the votes of one or several voters, rewrite votes at will and even completely disqualify all votes in a single voting station. Our attacks are easy to mount, very difficult to detect, and compromise both the confidentiality and the integrity of the election system.

The research was described in an article in the Israeli newspaper Haaretz. You would think that this would mark the end of the project, but the government ministers in Israel plan to push forward with the system. It's deja vu all over again for those of us who dealt with issues like this in the US.