This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/australia-news/2015/mar/23/nsw-election-result-could-be-challenged-over-ivote-security-flaw

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
NSW election result could be challenged over iVote security flaw NSW election result could be challenged over iVote security flaw
(35 minutes later)
The result of the NSW election this Saturday is likely to be challenged after a security flaw was identified that could potentially have compromised 66,000 electronic votes.The result of the NSW election this Saturday is likely to be challenged after a security flaw was identified that could potentially have compromised 66,000 electronic votes.
A number of parties, including the Greens, the National party and the Outdoor Recreation party have told Guardian Australia they would consider all of their options after the “major vulnerability” was revealed in the iVote system, an internet voting program being trialled for the first time this year.A number of parties, including the Greens, the National party and the Outdoor Recreation party have told Guardian Australia they would consider all of their options after the “major vulnerability” was revealed in the iVote system, an internet voting program being trialled for the first time this year.
But a senior NSW Electoral Commission official said fears of vote tampering were overblown and the work of “well-funded, well-managed, anti-internet voting lobby groups”.But a senior NSW Electoral Commission official said fears of vote tampering were overblown and the work of “well-funded, well-managed, anti-internet voting lobby groups”.
While the iVote website itself is secure, Melbourne University security specialist Vanessa Teague discovered on Friday that it loaded javascript from a third-party website that was “vulnerable to an attack called the FREAK attack”.While the iVote website itself is secure, Melbourne University security specialist Vanessa Teague discovered on Friday that it loaded javascript from a third-party website that was “vulnerable to an attack called the FREAK attack”.
“The implication is that an attacker who controls some point through which the user’s traffic is passing could substitute that code for a code of the attackers’ choice,” she said.“The implication is that an attacker who controls some point through which the user’s traffic is passing could substitute that code for a code of the attackers’ choice,” she said.
In layman’s terms, a hacker could intercept a vote for party A and turn it into a vote for party B without alerting the voter or the NSW Electoral Commission.In layman’s terms, a hacker could intercept a vote for party A and turn it into a vote for party B without alerting the voter or the NSW Electoral Commission.
The vulnerability was discovered on a practice site set up by the commission. The source code for the actual system hasn’t been made available, but Teague said it was “identical”.The vulnerability was discovered on a practice site set up by the commission. The source code for the actual system hasn’t been made available, but Teague said it was “identical”.
Teague and her colleague, University of Michigan computer science professor Alex Halderman, alerted the commission, and the vulnerable code was deleted from the system by 2pm on Saturday.Teague and her colleague, University of Michigan computer science professor Alex Halderman, alerted the commission, and the vulnerable code was deleted from the system by 2pm on Saturday.
“But during the time before they closed off the hole, about 66,000 votes were cast, and now all of those are going to have be somewhat in question because of the nature of the vulnerability,” Halderman said.“But during the time before they closed off the hole, about 66,000 votes were cast, and now all of those are going to have be somewhat in question because of the nature of the vulnerability,” Halderman said.
It was impossible to know if there were other flaws without seeing iVote’s source code and verification system, he said. “It’s a secret how it works. There could well be other vulnerabilities of similar severity and we don’t know.”It was impossible to know if there were other flaws without seeing iVote’s source code and verification system, he said. “It’s a secret how it works. There could well be other vulnerabilities of similar severity and we don’t know.”
Internet voting has been trialled in a handful of American states, and in Norway, Estonia and parts of Switzerland. But Halderman said this was the first time “a major vulnerability was discovered in the middle of an ongoing poll”.Internet voting has been trialled in a handful of American states, and in Norway, Estonia and parts of Switzerland. But Halderman said this was the first time “a major vulnerability was discovered in the middle of an ongoing poll”.
Greens campaign director Chris Harris said it was important that people had confidence in the outcome of the election.Greens campaign director Chris Harris said it was important that people had confidence in the outcome of the election.
“People need to know their votes are secure and accurately recorded,” said Harris.“People need to know their votes are secure and accurately recorded,” said Harris.
“At this stage it is circumstantial evidence but we reserve the right to challenge the result if there is some doubt about validity of the election, as would all other parties and as happened in the most recent WA election.“At this stage it is circumstantial evidence but we reserve the right to challenge the result if there is some doubt about validity of the election, as would all other parties and as happened in the most recent WA election.
“I would be very surprised if anyone who missed out by a couple of hundred votes and could see proven problem would not seek to challenge.”“I would be very surprised if anyone who missed out by a couple of hundred votes and could see proven problem would not seek to challenge.”
National party director Ben Franklin said while he had not examined the security issue closely, if there were breaches, the party would take it very seriously.National party director Ben Franklin said while he had not examined the security issue closely, if there were breaches, the party would take it very seriously.
Franklin said the Nationals supported the iVote system because it “is a terrific concept for rural people that are in far-flung areas”.Franklin said the Nationals supported the iVote system because it “is a terrific concept for rural people that are in far-flung areas”.
“We have faith and trust in the NSW Electoral Commission and the commissioner,” he said. “But if we have concerns about any part of electoral process we would consider all options.”“We have faith and trust in the NSW Electoral Commission and the commissioner,” he said. “But if we have concerns about any part of electoral process we would consider all options.”
Peter Whelan of the Outdoor Recreation party, which was found to have been left off the electronic version of the upper house ballot paper last week, said the latest security issue compounded the problem for the party.Peter Whelan of the Outdoor Recreation party, which was found to have been left off the electronic version of the upper house ballot paper last week, said the latest security issue compounded the problem for the party.
The Outdoor Recreation party, which is number two on the upper house ballot paper, is aligned with senator David Leyonhjelm’s Liberal Democrat party.The Outdoor Recreation party, which is number two on the upper house ballot paper, is aligned with senator David Leyonhjelm’s Liberal Democrat party.
“We have been thinking, regardless of what happens we will probably challenge it,” said Whelan.“We have been thinking, regardless of what happens we will probably challenge it,” said Whelan.
“Once I had been alerted that our box was missed, I reserved the right to challenge in the court of disputed returns.”“Once I had been alerted that our box was missed, I reserved the right to challenge in the court of disputed returns.”
While Whelan said he had not seen the details of the electronic voting security breach, he was “afraid of another WA Senate rerun”.While Whelan said he had not seen the details of the electronic voting security breach, he was “afraid of another WA Senate rerun”.
The chief information officer at the NSW Electoral Commission, Ian Brightwell, acknowledged the error, but said the risk of fraud was always present in any voting system, whether online or paper-based.The chief information officer at the NSW Electoral Commission, Ian Brightwell, acknowledged the error, but said the risk of fraud was always present in any voting system, whether online or paper-based.
“Is it possible that one person’s vote could be manipulated? That is a chance. Is it possible that one person’s ballot paper could be lost? That is a chance,” he said.“Is it possible that one person’s vote could be manipulated? That is a chance. Is it possible that one person’s ballot paper could be lost? That is a chance,” he said.
“We acknowledged in our risk assessment that there’s always been the potential for the voting client to be corrupted and votes to be tampered with, we can’t do anything about that.”“We acknowledged in our risk assessment that there’s always been the potential for the voting client to be corrupted and votes to be tampered with, we can’t do anything about that.”
But he said the risk that any of the 66,000 votes cast before Saturday had been tampered with was “not materially great”.But he said the risk that any of the 66,000 votes cast before Saturday had been tampered with was “not materially great”.
A small number of people were expected to use a phone service to verify their votes, which would reveal whether any widespread fraud had taken place, he said.A small number of people were expected to use a phone service to verify their votes, which would reveal whether any widespread fraud had taken place, he said.
“Things happen ... This is not perfect. We’re not suggesting it’s theoretically impossible to break this system.“Things happen ... This is not perfect. We’re not suggesting it’s theoretically impossible to break this system.
“But the general public are willing to accept a level of risk, and there will never be a cryptographically perfect internet voting system,” he said.“But the general public are willing to accept a level of risk, and there will never be a cryptographically perfect internet voting system,” he said.
Brightwell said fears over the system’s integrity were being fanned by “well-funded, well-managed anti-internet voting lobby groups”.Brightwell said fears over the system’s integrity were being fanned by “well-funded, well-managed anti-internet voting lobby groups”.
He was confident the system would survive any challenge in the court of dispute returns. “We’re fully aware we’re going to have people contest, and when they contest they’ll look around the countryside and see what problems they can find. And this may well be part of it.”He was confident the system would survive any challenge in the court of dispute returns. “We’re fully aware we’re going to have people contest, and when they contest they’ll look around the countryside and see what problems they can find. And this may well be part of it.”
The bar for a successful challenge in NSW is high, with candidates needing to satisfy the court “the result of the election was likely to be affected” by the illegal conduct.