Course investigates vote tampering

By Jaclyn Youngblood     11/6/08 6:00pm

If you give a Rice student electronic voting machine source code, he may want to tamper with it. He may if he is taking COMP527: Computer Systems Security with Associate Professor of Computer Science Dan Wallach.The course focuses on computer systems security in a broad sense, surveying topics such as cryptography, the encryption of data for security purposes; operating system design; and web security and distributed systems security, Wallach said.

Class member and Jones College senior Christopher Warrington said the relationship between security, secrecy and information integrity is also explored.

Electronic voting machine security is specifically targeted with the first project of the course, Hack-A-Vote. The project sets up a hypothetical world in which the student is an employee of the imaginary Hack-A-Vote Corporation. Students are expected to manipulate the outcome of an election by hacking the votes in an undetected fashion.

---

---

The project consists of two phases. Students first hack the provided source code, which is a set of programming statements understandable by the computer processor. After the code has been changed, it is audited by two other groups in the class.

"It is easy to add malicious code [to benign source code]," Warrington said.

He said the difficulty lies in how hard it is to detect the changes.

Wallach said certain changes might be easier to spot than others.

"When you add changes, they are more likely to be found," Wallach said. "If you just delete parts of the code, that is less likely to be detected."

The source code the class uses was written by a former student of Wallach's, David Price (Jones '03). Wallach said he leaves the directions vague so that students will be creative. Students in previous years have implemented hacks that enabled the voter to cast multiple votes, enabled the machine to ignore votes altogether and substituted the students' own votes for the documented votes.

The project has recently caught the attention of several media sources. Rice News and Media Relations played a role in getting the word out about the Hack-A-Vote project, Wallach said. MSNBC, Yahoo! and the Houston Chronicle have written articles about the Hack-A-Vote project and its translation to national elections.

Despite this publicity, Wallach thinks the press in general has given less attention to the issue of electronic voting security than in the past. He said poorly-calibrated touch screen electronic voting machines can result in the machine thinking the voter has touched a different area than he actually has, which can lead to vote flipping, where a vote for one party is counted as a vote for a different party. Human factors like errors in calibration, coupled with bad engineering design and even malicious intent, can increase the likelihood of error in electronic voting machines, Wallach said.

Wallach said electronic voting machine security will be easier to analyze after the election is over.

"Depending on what goes wrong and what goes right, things could move very quickly," he said.

---