Electing a University President using Open-Audit Voting: Analysis of real-world use of Helios (extended abstract)

In March 2009, the Université catholique de Louvain elected its President using a custom deployment of the Helios web-based openaudit voting system. Out of 25,000 potential voters, 5000 registered, and almost 4000 voted in each round of the election. The precision of the voting system turned out to be crucial: in the first round, the leader came short of winning the election by only 2 votes. In this work, we document the new version of Helios used in this election, the specifics of the UCL deployment, and the lessons learned in this deployment. We offer suggestions on running future open-audit elections. We note at least one interesting conclusion: while it is often assumed that open-audit voting will lead to more complaints and potentially a denial-of-service attack on the auditing process, we found that, instead, complaints are likely to be more easily handled in open-audit elections because evidence and counter-evidence can be presented. 1 Background and Introduction Over the last 25 years, cryptographers have developed election protocols that promise a radical paradigm shift: election results can be verified entirely by public observers, all the while preserving voter secrecy. These protocols are said to provide two properties: ballot casting assurance [3], where each voter gains personal assurance that their vote was correctly captured, and universal verifiability, where any observer can verify that all captured votes were properly tallied. Some have used the term “open-audit elections” to indicate that anyone, even a public observer with no special role in the election, can act as auditor. Unfortunately, though some important test elections have been held in recent years, notably using the Scantegrity [7] and Prêt-à-Voter [8] systems, none have had significant stakes yet. As a result, public awareness of open-audit elections ? The full version of this paper appeared in the proceedings of EVT/WOTE’09 http://www.usenix.org/event/evtwote09/. remains unfortunately low. Even voting experts who recognize that open-audit elections are “the way we’ll all vote in the future” seem to envision a very distant future, not one we should consider for practical purposes yet. The UCL Opportunity. In 2008, the Université catholique de Louvain (UCL) in Louvain-la-Neuve, Belgium, decided to open up its University President selection process to all members of the University, including faculty, students, and staff, via a secret-ballot election conducted through the Internet. With 25,000 eligible voters participating in an election without precedent, there was both a challenge and an opportunity. The challenge lay in providing a trustworthy result of an election with such high stakes. The opportunity to try something new was motivated by two important factors: (i) the UCL’s cryptography department was consulted and given the opportunity to run the election, and (ii) the absence of precedent combined with a general distrust of typical computer-based voting made a novel, publicly verifiable approach particularly appealing. Helios. Helios [2], one of the first web-based open-audit voting system, was released in 2008. Given the simplicity and universality of the web, Helios was immediately a clear candidate for the UCL election. However, Helios was not ready for immediate deployment at UCL, because: – Helios 1.0 was based on mixnets, which could not be used in an election in which votes receive different weights according to the voter’s category, while election results per category need to remain unknown. – Helios 1.0 required Google App Engine to run, which, though not a problem in theory, posed a number of problems for integration with a European University given European privacy laws. – Helios 1.0 verifiability was implemented as a proof-of-concept, and was not scalable to rapid tallying of tens of thousands of votes, nor designed to help solving potential voter complaints. – Helios 1.0 only implemented single-key decryption, meaning that one party would have to be trusted not to decrypt individual votes. Low-coercion Elections. In a secret-ballot election, the coercion threat must be considered: if an adversary can force a voter to cast a vote a certain way, or even to randomize her vote, the election can be bought. Remote voting is, by nature, vulnerable to coercion, since an adversary can simply watch a voter’s every move or, in many practical cases, simply purchase from the voter her authentication credentials and vote entirely in her place. Some solutions to the problem have been proposed [16], but all require at least one truly private interaction between the voter and the election authority. A number of elections can be considered “low-coercion,” a term introduced by the Helios paper [2]. In these elections, ballot secrecy is important, because people might be peer-pressured into voting one way or another, but actual coercion is an unlikely concern because voters often have an effectively private space at home, or because the stakes are not quite high enough to warrant bribes or threats. A University President election is precisely the kind of election that is likely low-coercion: most voters do not physically reside with other voters, and even if peer pressure is applied, money or bribes are usually out of scope. This provides an opportunity to achieve most of the important properties of open-audit voting without the full complexity of a National election. Voting over the Internet. Many voting security experts believe that voting over the Internet is the most troubling of all proposed voting system evolutions [15]. Even if one sets aside the risk of coercion (as UCL did, given the low-coercion setting), there remains the problem of the end user’s computer and the relatively widespread compromise of consumer operating systems, e.g. the numerous and well documented botnets [1]. Helios 2.0, like its predecessor, does little to specifically counter the threat of client-side operating-system or web-browser compromise; a specifically targeted virus could surreptitiously change a user’s vote and mask all of the verifications performed via the same computer to cover its tracks. In this deployment, UCL believed that the likelihood of such an advanced attack against the UCL election was extremely unlikely. UCL also made available a set of secured client machines for voters who wished to use an official voting machine. It should be noted, however, that UCL and the authors do not endorse the use of Helios 2.0 for large, high-stakes, governmental elections where the threat of a targeted virus would be far more realistic. Organization. In Section 2, we detail Helios 2.0, a series of upgrades to Helios developed specifically to fulfill the needs of a large open-audit election like UCL. In Section 3, we consider the organizational aspects and specific customizations needed for the UCL 2009 Election and, in Section 4, we discuss the statistics of the election and make recommendations for improving open-audit elections at UCL and other universities in the future.