Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/6/2019
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Microsoft Debuts ElectionGuard to Secure Voting Processes

The new software development kit - free and open source - will be available to election officials and technology suppliers this summer.

Microsoft today debuted ElectionGuard, a free, open source software development kit (SDK) aiming to protect political voting processes as the spotlight on election security grows harsher.

CEO Satya Nadella announced ElectionGuard during his keynote at the Build developer conference, this week in Seattle. The SDK, built in partnership with security company Galois, is designed to make the election process more secure by providing verification throughout elections and letting third parties securely validate results, among other capabilities.

ElectionGuard isn't a voting machine, and it's not intended to replace paper ballots or support Internet voting. It's built to secure current systems that rely on modern voting technology and serve as a platform for new systems to protect against tampering. Microsoft's goal here is to give officials a means to handle and organize votes while letting individuals verify their votes. People can verify their votes were correctly recorded and that recorded votes were properly counted.

Verification happens in two ways: Each voter gets a tracker with a code that can be used to follow an encrypted version of his or her vote throughout the election. Voters also can see their selections on a Web portal provided by authorities; however, once a vote is cast, neither the tracker nor portal data can be used to reveal the vote. After the election, these codes can be used to confirm votes were not changed and were included in the total count.

The tool includes an open specification, or "road map," as Microsoft puts it, which lets voters and candidates run verifiers to confirm the recorded votes have been accurately counted. It relies on homomorphic encryption, which lets mathematical procedures be done to encrypted data. This lets individually encrypted votes be combined to form an encrypted vote count, which can be decrypted to view a full tally that protects voter privacy. Someone who runs an open election verifier can confirm encrypted votes were aggregated and the encrypted tabulation has been decrypted to get the final count.

[Hear Microsoft's Shawn Anderson, executive security adviser, present Crash Course: Principles of Endpoint Defense, at Interop 2019 next month]

"This process allows anyone to verify the correct counting of votes by inspecting the public election record, while keeping voting records secure," writes Tom Burt, corporate vice president of customer security and trust, in a blog post on the news. "The use of homomorphic encryption to enable verification is separate from and in addition to the process of paper ballots counted as an official election tally."

If a vote needs to be audited, ElectionGuard lets officials compare random ballot records with corresponding paper ballots to confirm a match. By comparing paper with digital records, fewer ballots would be necessary to ascertain confidence in an election, Burt explains.

ElectionGuard will be available this summer to election officials and technology suppliers so they can incorporate it into voting systems. Microsoft also has teamed up with election tech suppliers to explore integration of ElectionGuard into voting systems. It reports it has existing partnerships with suppliers responsible for more than half of the voting machines in the US.

This tool is part of Microsoft's Defending Democracy Program, through which it works with governments, nongovernment organizations, academics, and businesses to protect election campaigns, develop technology to protect processes, and defend against disinformation.

Microsoft isn't the only tech company strengthening its focus on election security. Late last summer, jurisdictions across the US registered for free website and user-account protection services offered by vendors including Google and Microsoft. Back in 2017, Google and sister company Jigsaw teamed up to offer digital protection – password alerts andmultifactor authentication – to election candidates and their campaigns.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Windows 10 Migration: Getting It Right
Kevin Alexandra, Principal Solutions Engineer at BeyondTrust,  5/15/2019
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/14/2019
When Older Windows Systems Won't Die
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Who replaced the "Scroll Lock" key with a "Screen Lock" key?
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12173
PUBLISHED: 2019-05-18
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
CVE-2019-12172
PUBLISHED: 2019-05-17
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
CVE-2019-12168
PUBLISHED: 2019-05-17
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.
CVE-2019-12170
PUBLISHED: 2019-05-17
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...
CVE-2019-11644
PUBLISHED: 2019-05-17
In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premi...