Are ATMs also a hard problem from a security standpoint? Because we have relied on them to exchange currency around the world, 24 hours a day, 7 days a week, for decades. And they are basically identical in function to a voting machine, except of course for having more functionality.
ATMs are actually a pretty fruitful point of comparison since people have a good idea of how ATMs work in their heads already. Some differences in the threat model come to mind:
- ATMs and their backend systems invest heavily into making complete transaction records, voting systems must be anonymous.
- ATM transactions can be undone.
- ATM operators can better afford to take a reactive approach, monitoring fraud levels and first taking a liability hit, until they can fixing the systems or must do a temporary network shutdown to stop the losses.
- ATMs get by with fewer controls for insider fraud due to above controls
- ATMs don't worry about nation state level adversaries
- Amount of damage from ATM compromise is clearly bounded, unlike legislation/election
You're missing the most crucial point: ATMs provide instant tangible demonstrable feedback to the user that it has done exactly what it said it would do. The machine spits out money, and the money is not only the result of the interaction, but also the perfect witness.
With voting machines, so far, there has been absolutely no provable feedback whatsoever that allows you to assure your vote has been counted. Even worse, there is no system that allows you to verify no votes have been counted that did not exist. I'm not saying these problems can't be solved with cryptography, all I'm saying is that so far, they haven't been solved/implemented yet.
How so? How do you know if your vote was really counted? How do you know someone didn't slip in a bunch of votes while you weren't looking? How do you know numbers aren't doctored as they're aggregated?
Well then you don't, and another requirement is that the voting stations may be accessed by the public from start till end. In that case each individual can verify for themselves that ballot boxes are empty at the start. That no one tampers with the ballot boxes during the day, and at night when the boxes are opened and the votes are being tallied.
With optical scanning at least, ballot stubs are linked directly to the signature book (once the stubs are separated from the ballot, matching the ballot back to the stub is extremely difficult if at all possible--perhaps by looking at fiber patterns at the perforation).
At the end of the election day each site's poll workers manually count the number of signatures, the number of stubs, the number of ballots within the scanner's tub, the number of soiled or defaced ballots, the number of provisional ballots etc and numbers reported by the scanner. (whenever actual ballots are handled, at least one Democrat and Republican poll worker must be present). Tracking the number of ballots read in this situation doesn't concern me much. We also sign and post the end of day tapes printed by the scanner on the doors for the public to see.
The biggest questions left really is whether the optical scanner actually reports the tally correctly. The board of elections also rescans all the ballots centrally with different machines in the weeks after the election before it is certified. I don't know the procedures for evaluating the scanners, but in theory the scanner can't tell the difference between real ballots and control ballots so some sort of randomized batch testing where the real ballots are run with control batches should be pretty straightforward.
It's also true with the electronic voting booths that you can match the number of tallied votes at the end of the day against the number of signatures on the books. But I don't think there's any mechanism I'm aware of for performing an actual recount. (Yes, you can re-sum the individual machine totals, but that doesn't go back to raw responses).
I personally don't trust the purely electronic voting at all yet because there's no way I know of to verify or test the accuracy of the machine. I recently moved to a different State and don't do election work anymore. Here we vote using some bullshit touchscreen using some PCMCIA card that the poll worker hands me and that I stick into the computer. Not even a paper receipt is printed. WTF. No, thanks. I think I'll just vote absentee.
You can have a system with multiple levels of verification. For example in Canada, each party is allowed to appoint an on-site representative for each ballot box to observe the voting process, the count (and ensure it matches the number of voters and ballot stubs) and the paperwork (a copy of which is sealed in the ballot box which can be unsealed in the event of a judicial recount).
Trusting election officials doesn't have to be a passive process like it would be in an electronic voting system.
1. Voting machines are subject to the fairly unique design objective that, ideally, votes have to be verifiable while still preventing voters from proving who they voted for in order to avoid vote-buying. An ATM can just give you a receipt showing a record of the transaction. But a voting machine can't do anything so straightforward.
2. Using an ATM is part of an ongoing course of dealings between a customer and a bank, where verification is straightforward (and largely inevitable). This allows the customer to evaluate the performance and integrity of the system over time. Voting, on the other hand, tends to be an isolated event where there is no opportunity to evaluate the voting system over the long-term.
Some of the companies building these horribly insecure voting machines are originally ATM companies, so I do not think we have any reason to think that ATMs are secure. There have also been incidents where ATMs have been hacked.
ATMs are also an easier problem since they do not care about anonymity, part of the cryptography is done on the card, and they do not have to work without a netowrk connection.
There's cryptography in a magnetic strip? That's news to me. And sure, some ATMs have been hacked, but in general there's a financial incentive for companies to keep them more secure than not, because, well... it gives you money.
And anonymity? The card itself just has a very long string of numbers to identify someone; information about the human it belongs to is optional. Whatever human that is currently verifying if you are allowed to vote can deal with giving you a card to cast your vote; it doesn't actually have to have anything other than a unique number.
ATMs only need a network connection to authorize a transaction. All the other aspects of it are offline, and it creates a paper trail, and saves records in memory. They could very easily be reconfigured to display voting options (and instructions!) and record the tallies both in memory and printed, both internally and externally, and OPTIONALLY connect to a remote server to log the transaction - securely, I might add.
AIUI most ATM's will still give you money up to a couple hundred bucks with their network connection down, in case of legitimate "storm took out the phone lines but people need cash to buy candles and blankets" situations. This is not as sketchy as it sounds because the financial clearing system is only eventually consistent anyway.
But obviously this attack surface has been exploited quite a lot by ATM crackers.
I do not think many, if any, ATMs in my country accept cards with only the magnetic strip anymore. It was over 10 years ago my ATM card was replaced by debit card when the banks phased out ATM cards.
And anonymity of votes has more aspects than just protecting against the guy by the machine. You also need to protect against to guy issuing the numbers (which you don't for ATMs, it is ok if the bank knows how much money you withdrew :)) and also the anonymity should make it hard to sell votes which disqualifies some cryptographic solutions suggested by other commentors (those where you get a cryptographic receipt which can use to look up afterwards to see what you voted).
And some voting machines work exactlty like you describe, and they are not regarded as secure.
Maybe, note that XP still lives in the form of POSready partly because ATMs. But banks really put effort into logging transactions (why voting isn't a similar transaction is beyond me though), also I don't think you can find ATMs with unnecessarily exposed ports.
Votes are supposed to be anonymous to prevent retaliation or coercion from strong-arming elections. Logging each vote in a robust way is difficult to impossible to do without breaking the anonymity. If you have a time or sequence number on the vote outside monitoring could match votes to people.
Also ATMs are easier to secure physically because they don't have to be particularly portable. Most units are built into buildings and those that are not are placed once and not moved for years. Compare this to EVMs that have to be moved into place and removed again over a day or two because most voting places are used for that day only then revert to some other purpose.
People who buy ATMs have a strong vested interest in their security, both physical and virtual. If the machines can be broken into or hacked, the people who buy the machines lose real actual cash. If the machines merely malfunction, it upsets their customers, which then costs the machine owners.
Ultimately, you can run the numbers on security to see how much money it's worth, how much it costs, and find the ideal tradeoff.
Voting machines have completely different incentives. The buyers have no vested interest in their security whatsoever. I would actually argue that they have a bit of a vested interest in insecurity, because a successful voting machine hack would probably cost people their jobs if it came to light, and if a machine is so insecure that you can't even detect hacks then this risk goes away. And if the machines malfunction, users often can't even tell. Even if they can tell, their unhappiness typically won't financially impact the people who buy the machines.
And thus we can see why, for example, Diebold builds good ATMs but craptastic voting machines.
Why don't we just use ATMs as voting machines?